[FEATURE] Audit authority, code quality and documentation in procd #1

New issue

Open

opened 2026-09-12 07:57:59 +02:00 by erikinkinen · 0 comments

erikinkinen commented 2026-09-12 07:57:59 +02:00

Owner

Copy link

Problem and motivation

This issue tracks continuous Phase 6 audit closure for procd. Own process materialization, staging, startup, metrics and terminal cleanup under authenticated authority receipts.

An initial inventory is not a security or documentation closure claim. Evidence must follow each changed boundary through final heads, with priority security, reliability, then performance.

Proposed behavior and scope

Staged construction without root capabilities — 15 September 2026

Add kernel-control operation 54, CREATE_STAGED_PROCESS_WITHOUT_ROOT_CAPS, and checked StagedProcessWithoutRootCapsV1 scalar framing. Successful creation returns a live Created process and nonzero generation whose CSpace contains exactly its requested primary endpoint, with no CNode, VSpace or TCB capabilities. Native CSpace/TCB/VSpace objects and the process's VSpace lifetime reference still exist. No child code executes during construction. The endpoint initially retains its ordinary full endpoint rights; operation 53 independently narrows it before bootstrap execution.

Keep the existing creation operation 32 and its producer behavior unchanged. The new selector is independently recognized: an older kernel refuses it, and callers must not fall back to old ignored flags or a child self-report. Admit it only on the existing Process endpoint family, without adding a capability type, endpoint factory or ChildPopulate creation authority.

Use the existing fixed request envelope. arg0 contains the caller-local install-grant destination in its low 32 bits; its upper half is zero. arg1 low/high halves contain child-local primary endpoint and caller-local endpoint-master destinations. arg2 low/high halves contain the child window base and optional caller-local VSpace destination. arg3 contains the 32-bit window length, with a zero upper half. Flag bit 0 means that the VSpace receipt is requested; all other flag bits are zero. When the bit is clear, arg2's upper half must be zero. This explicit presence bit distinguishes an omitted receipt from a real receipt in slot zero. All slot fields retain their full unsigned width; slot zero and otherwise vacant former root positions are ordinary requested slots, subject to native bounds, actual caller-window visibility and occupancy. The checked codec validates framing, not native capacity or authority. The native constructor requires a valid child window containing the primary endpoint.

The caller receives only its actual unique stage-bound install grant, endpoint master and optional MAP-only VSpace receipt. The grant is bound to the returned process/generation and exact child window. Existing capability ceilings, actual object identity and explicit disposal rules remain in force. Temporary native setup bindings must be gone before constructing the final primary endpoint and publishing the grant; otherwise former root positions would remain an unnecessary destination restriction. The TCB's independently held VSpace reference must keep backing alive even without any child or parent VSpace capability.

On failure, destroy the partial child and dispose only successfully created parent receipts. Preserve pre-existing or overlapping destinations and the original failure; uncertain cleanup fail-stops. Never treat a requested slot as evidence that its capability was created. The new contract supplies an initial inventory, not a permanent prohibition on later explicitly authorized installations or a sealed realm. The returned grant remains a real pre-start population authority that its owner must account for and retire.

Required checks include full-width codec/reserved-field cases, omitted versus slot-zero VSpace receipts, zero/former-root/last-slot endpoint destinations, invalid or inaccessible windows, occupied/overlapping outputs, exact parent and child inventories, no residual native objects, mapping/startup backing retention, attenuation through the actual grant and abort/terminal cleanup. Actual CPL3 creation/refusal/disposal must complement host tests. Procd adoption must select this operation only for the mediator role and preserve all ordinary start gates until authenticated grant return, minimum typed startup, retained native/nested guards, readiness, configuration/seal and fair retirement are independently implemented. No runnable realm or guest build is established by this constructor alone.

Native staged endpoint attenuation — 15 September 2026

Add kernel-control operation 53, ATTENUATE_STAGED_ENDPOINT_WITH_GRANT, with a checked ProcessBoundEndpointAttenuationV1 request. This is a new recognized operation; an older kernel must refuse it, and producers must never fall back to an unchecked or post-execution self-report. No syscall number or service endpoint permission is added.

Use the existing fixed KernelControlRequestV1 layout: arg0 low/high halves are the caller's actual install-grant slot and child endpoint destination; arg1 is the exact 32-bit rights mask, with its upper half zero; arg2 low/high halves are expected process and staging generation; arg3 and flags are zero. Both identity components are nonzero. Zero rights means exactly zero, never inheritance. Successful response values are zero.

The native handler must validate the actually held GRANT-bearing install grant, its record, exact expected process/generation, live Created child, grant window, endpoint type ceiling and actual primary endpoint slot. Its rights ceiling must cover the current endpoint rights as well as the requested result; a narrow installer cannot manage a broader existing binding. The new rights must be known, valid for endpoints and a subset of current rights. Update only that existing binding's rights, preserving native object identity, all other bindings and revocation associations. The change allocates no alias and needs no new destination. Repeating the same attenuation may succeed; restoring a removed right must fail. Running, dead, stale, foreign, missing and wrong-type targets must fail without effects.

Admit the operation only on the same Process and ChildPopulate control kinds as exact process-bound installation. Endpoint possession and descriptive IDs alone are insufficient: the actual held scoped grant remains mandatory. The immediate consumer is the future Procd bootstrap transaction, after the actual broad grant returns from Launchd. It will reduce the staged mediator's initial full endpoint to RECV before any private execution, providing independent native proof of that boundary.

Required coverage includes codec/reserved-field rejection, missing and moved grant, wrong process/generation, wrong target/type/window/ceiling, exact attenuation and retry, attempted amplification, post-start refusal, actual CPL3 effect checks and full cleanup. This primitive alone does not admit mediator execution: authenticated grant return, native lifetime and nested revoker custody, minimal root/bootstrap inventory, readiness, configuration/seal and fair retirement remain separate gates. The current ordinary start prohibition stays in force.

Staged mediator handoff contract — 15 September 2026

Reserve Loaderd operation 0x654 (PREPARE_REALM) using the existing exact-executable preparation request/response layout. The operation selects the new Procd lifecycle class 0x448 (REALM_MEDIATOR); role values describe lifecycle policy and confer no capability authority. Launchd explicitly selects this operation after authenticating its executable object. The ordinary operation 0x652 keeps its existing behavior. Responses must echo the selected operation; no fallback is permitted.

Loaderd validates the same sole exact-executable SEND receipt, authenticates the complete image graph, and uses the existing semantic materialization pipeline. The mediator's temporary initial endpoint occupies child-local slot 4, after native root slots 1–3. This slot is an ABI destination, not a realm-count or resource-budget restriction. The child remains staged. Procd retains the actual endpoint master in the existing managed scratch endpoint column; it never exports that master to Loaderd or Launchd. Only the actual move-only install grant travels Procd → Loaderd → Launchd. The derived ordinary stream installer is absent for this class. Reply loss aborts the exact stage and accounts for the retained endpoint, grant and VSpace; cleanup uncertainty remains fail-stop.

Launchd may inspect, abort and stop only its owned lifecycle classes. Root, driver and powerbox routes cannot use the mediator class; generic staged-start, ordinary startup/stream installation and automatic restart reject it. The future separate bootstrap transaction must receive the actual grant back, authenticate the live caller, install a typed receiver/rendezvous inventory using exact process-bound installation, dispose temporary aliases and configure the startup bytes before private execution. No existing start path may bypass that gate.

This staged handoff is the first implementation increment of typed realm bootstrap. Acceptance for this increment requires malformed/foreign operation rejection, exact executable and grant receipts, unstarted materialization, private master retention, no derived stream grant, and rollback coverage across the actual producer paths. It does not establish mediator execution, seal, publication, client I/O, retirement fairness or either complete guest build generation. Those remain required under the existing acceptance criteria. Native VM coverage of the coordinated producer graph is required before claiming runtime acceptance.

Current inventory: 10 Cargo targets (10 bin); manifests: Cargo.toml. Include explicit and automatically discovered targets, supported features and target-specific configurations.

Inventory every startup/runtime grant and authenticated peer, then success, denial, cancellation, failed transfer, restart and teardown. Trace callers and downstream providers so names, numeric identities and retained aliases never become implicit authority.

Planned native terminal-generation contract — 17 September 2026: Introduce operation 55 for exact native process/staging-generation/event-kind/status observations. The request has zero flags and arguments; malformed requests fail before dequeue. Successful responses preserve all four 32-bit fields, captured with the actual native terminal transition and retained after destruction. Empty queues return RETRY with zero values. These records constrain existing authority and confer no process-control capability.

Kernel, shared IPC, Procd and Rootd migrate together. Procd must match the native process/generation pair before cleanup, CPU-time observation, restart or service-event publication. Remove the superseded identity-free native selector after all maintained consumers migrate, with no fallback on unsupported kernels. Preserve queue reservation, ordering, wake and failure semantics. Validate actual exit/kill, generation reuse, empty/malformed input and cleanup failure, then strict component checks and original bounded native VMs on a coherent immutable revision graph.

This is the terminal-observation prerequisite for typed mediator bootstrap. The actual returned install grant already has a generation-checked endpoint-attenuation primitive for the first bootstrap effect. Guard custody, final receiver readiness, sealed publication, two mediators with real client I/O and both full guest builds remain separate mandatory work; this planned contract implements none of those by itself.

Authority, security and reliability

Maintain a finding register with public finding references, exact revisions, invariants, reproduction, owners, regression tests and closure evidence. Publish only non-sensitive status here; suspected vulnerabilities follow SECURITY.md. Each dimension below needs its own result and rationale; an absent daemon or current Rust target is not a blanket exemption.

Acceptance criteria

• Record origin, recipient, object, operations, delegation ceiling, lifetime and aliases for each relevant capability or caller-supplied authority-bearing value.
• Audit ambient discovery/selectors, cwd/PATH/environment, numeric identities, inherited routes and host fallbacks; require explicit authorized intake.
• Account for residual authority after success, error, cancellation, timeout, restart, failed transfer and teardown, including fork/exec where implemented.
• Remove unnecessary endpoints, broad rights, duplicate aliases, provider/admin grants and debug routes.
• Exercise stale generations, replay, pending replies, forged descriptive identity and object/path resolution races at the owned boundary.
• Prove independent cleanup attempts and caller-specific error precedence; quarantine or terminate when retained authority cannot be accounted for.
• Review unsafe/FFI/parser/arithmetic/lifetime/lock/publication invariants and add adversarial coverage where practical.
• Inventory obsolete APIs, wrappers, fallback/dead paths and duplicate validators with their maintained callers.
• Migrate callers and delete deprecated contracts/shims in a coherent signed revision graph; reject retired input versions where relevant.
• Classify each size/count/depth/time bound as ABI, hardware, explicit resource policy or accidental limitation.
• Test beyond removed boundaries and at allocation/ABI limits while preserving exhaustion errors, denial-of-service controls and bounded waits.
• Keep every tracked authored code/test/script/workflow file below 1000 physical lines through thematic refactoring.
• Run the deterministic tracked-source size gate, covering executable fixtures/generators and excluding only genuine non-code data or external payloads.
• Audit production/test feature and symbol separation, including this repository's effect on rootd test orchestration.
• Supply changes affecting rootd semantic surface to the maintained same-toolchain baseline; record a justified component-specific applicability result.
• Check bootstrap ownership and development/release authority parity at this repository's producer/consumer boundary.
• Use maintained integration#3 profiler evidence before optimizing; preserve live access checks, ownership and success criteria.
• Audit build/CI inputs, secret handling, private outputs, symlink containment, deletion, subprocess bounds, warnings and host dependencies.
• meaningful public/private inline documentation, crate/target missing_docs enforcement without blanket allowances or hidden-API escapes, warning-denied private-item rustdoc and an undocumented-public-API negative gate.
• Validation: Run cargo fmt --all -- --check, strict Clippy, unit/doctests and warning-denied builds/rustdoc for every owned crate/target under default and all valid feature, freestanding/host, SMP and profile combinations; test mutually exclusive combinations separately. Add focused VM regressions for runtime behavior and observe the older catalog and unit tests at the exact published heads.
• Documentation: update applicable README/ARCHITECTURE/ROADMAP in meta's canonical format and affected technical-manual TeX/API references; keep README evergreen and shared governance byte-identical to meta.
• Evidence: record exact source/dependency revisions, commands, configurations, real exit status, CI run URLs and results; repeat the audit on final heads and obtain independent review of security closures. No skipped/pending/predecessor result counts as a pass.

Alternatives and tradeoffs

Use cohesive local refactoring or a justified shared extraction only after identifying real common semantics and authority boundaries. Remove superseded paths after preserving maintained coverage. Profile before optimization; document unavoidable ABI/hardware limits and explicit quotas rather than weakening security for speed.

Typed realm bootstrap installation design — 15 September 2026: The next bootstrap producer step requires validating the actual moved install grant against the intended child before any installation. Add Kernel-control operation 52, INSTALL_WITH_GRANT_FOR_PROCESS, using the existing fixed request/reply envelope: flags and arg3 are zero; arg0 packs grant slot in bits 0..31 and source slot in bits 32..63; arg1 packs child destination slot and exact requested rights; arg2 packs nonzero process ID and nonzero staged generation. Both response values remain zero. The operation is admitted only where grant installation is already allowed (process-control and child-population endpoints, with existing bootstrap control policy preserved). The held unique grant remains the authority; the supplied process/generation pair is an additional equality constraint, never a target-selection grant. Revalidate exact native grant binding, GRANT possession, child/staged identity and current staged liveness, slot and type/rights ceilings, actual source binding and empty destination before transfer. Unlike legacy zero-means-inherit installation, this operation always uses the exact supplied rights, including zero. Reject nonzero reserved input and zero identities deterministically; mismatched target identity must produce no installed alias or new revocation lineage. Keep old producer semantics unchanged until explicitly migrated. Share the native installation implementation and split the existing near-1000-line control dispatcher by responsibility. Tests must use actual moved install grants for distinct staged children, wrong/stale generations, occupied destinations, explicit zero rights, invalid fields, denied endpoint policy, preserved source/grant custody and native lifetime/revocation behavior. Connect the new checked operation to typed Procd bootstrap provisioning; a standalone scalar codec or host-only table is not realm runtime acceptance. Complete receiver readiness, setup-authority disposal, fair terminal/provider scheduling, two-realm byte I/O and both full guest builds remain required.

Process-bound installation checkpoint — 15 September 2026: Signed f1105706cc19ed024a6cca79a29abc57c90c6661 connects ordinary launch-description installation to native operation 52 with exact retained process/generation and SEND rights. Kernel rejection preserves pending stream state; staging disposal and exact child rollback remain owned across lost replies. Default/all development/release matrices pass 227/232 tests including auxiliary binaries, strict host/native Clippy, forty freestanding builds with repository linker scripts, private rustdoc, formatting and Markdown. The initial incompatible IRQ-helper IPC type graph was corrected by aligning five original helper commits; initial generic-linker invocations are retained as validation setup failures. Typed realm bootstrap and complete consumer image adoption remain open.

Process-bound native acceptance — 15 September 2026: Signed Kernel 60da5858d7198185efd103f0e91e5ac2e0b63e67 implements control operation 52, checking the actual moved install grant against expected process/generation with exact rights, including zero, under existing endpoint policies. Signed Procd f1105706cc19ed024a6cca79a29abc57c90c6661 uses this operation in its actual ordinary launch-description producer while retaining the narrow SEND receipt, pending state and exact failure cleanup. IPC c453b697b8cdb9cc1c36f1ad89ff868648190025, capability ABI fe8d558253ad01301b99554e20d287c4ea35bb1d and five aligned helper commits preserve original Git/type identity. Integration 58c925c564b69bebce8df6f3e75a9312824e18c4 passes the expanded lifetime CPL3 scenario with thirteen actual control calls, user-side reply checks, two staged children and full added-custody disposal. The corrected lifetime image SHA-256 is 8e6a9e8f68b90cc1ede61300958cec122b82a7c6dfd6318a51e40fefc7ba166e; the unchanged owned-invocation scenario also passes with image SHA-256 b76a380d3cd6b03b0ff61a3b626ace0667679920684ad7356a1c3a36e2224953. Both have clean teardown and empty QEMU stderr. The initial fixture setup-order failure is retained and corrected in Kernel issue #14. All strict default/all development/release matrices pass: IPC 371, shim 20, capability ABI 191, Kernel 648/672 including standalone controls, Procd 227/232 including auxiliary binaries, and Integration 320/321 tests. Existing native-only ignores are unchanged. Procd passes forty native binary builds with repository linker scripts. All 162 Integration helpers pass after updating the exact policy assertion to require the new marker; its initial mismatch remains recorded. Docs b0fcf0f43af2af741d520a0b1373cc346e08863c updates the native wire/ownership contract, operation registry, Procd boundary and three generated shared APIs. All 45 tests and the complete 2,367-page manual pass, with zero final warnings, 431,138 word boxes within page bounds and four reviewed protocol/API pages. Current IPC 339/340, capability ABI 216/217, Kernel 560/561 and 562/563, Procd 266/267, Docs 869/870 and all five helper push/review CIs pass with complete classified logs and no final warnings. Those component cohorts are stopped. Current full Integration 1623/1624 waits at observation 01. Older full Integration 1615/1616 is running at observation 11; 1617/1618, 1619/1620 and 1621/1622 wait at observations 09, 07 and 04. No pending full suite is counted as passed. Typed realm bootstrap, mediator startup/readiness/configuration/seal, complete consumer image adoption, fair terminal/provider retirement, broader native disposal failures and both full EriX-in-EriX build generations remain open. The new inventory covers 76 repositories, 2,950 code files below 1,000 lines and 158 direct missing_docs crate-root gates; complete inline documentation and whole-codebase authority closure remain open. Prior performance measurements retain their original signed source identities; this checkpoint claims no new timing or guest performance result.

Staged mediator source checkpoint — 15 September 2026: Signed Loaderd adefd028c47d0e60bde65ef2ff2d95c8bfae11b6, Launchd 64b563482c9ecab115283fe56c8562d948fbbabd and Procd cdb0fe4d1496073521626ce21f0fa2c95a81bd36 implement separate exact-executable mediator staging. Operation 0x654 is correlated end-to-end; Procd retains the actual endpoint master and moves only the actual install grant. The mediator class cannot use ordinary start, immediate commit, TTY provisioning, powerbox installation or automatic restart. Exact-stage rollback and lost-reply custody remain owned. Shared IPC 5fa5fdb2edbfe963efae1c11f99a3a58d0062509 and capability ABI e5a3e864491479981b9ab37749109dafe52fa330 plus six original helper commits form the coherent dependency graph. Default/all development and release matrices pass: IPC 371 plus shim 20 (one existing native-only host ignore), capability ABI 191, Loaderd 90, Launchd 326 and Procd 233/238 tests. Strict host/native Clippy, warning-denied freestanding builds, private rustdoc, formatting and Markdown checks pass. Procd has forty native binary builds and six new mediator refusal/cleanup regressions. Loaderd exercises both staging classes through the existing complete-graph producer test. The TTY transaction, its test support and lifecycle policy tests are split into files below 1,000 lines. All six aligned helper libraries pass their full matrices. Current shared IPC CI 341/342 and capability ABI 218/219 pass with all eight complete warning-free logs. Older full Integration 1615/1616 now passes all 486 scenarios and subsequent native probes with six complete classified logs; its three deliberate negative diagnostics per integration job are retained. New producer/helper review CI is pending. No Posixd executable or coordinated realm VM acceptance is claimed. Actual grant-return provisioning, authenticated caller ownership, typed startup memory/inventory, readiness, configuration/seal, client I/O, fair retirement, complete consumer image adoption and both full guest build generations remain open. The manual update is being validated separately.

Native bootstrap destination correction — 15 September 2026

The temporary endpoint destination is now child-local slot 4, after the mandatory CSpace, VSpace and TCB roots in slots 1–3. The initial slot-1 contract was incorrect: the actual native constructor returned DENIED before creating a child. The original failure and published source identities are retained in capability ABI bug #3. Capability ABI c7c72ae2a777b2a9f4ae5d7fb8eef86e5fc1fae5 corrects the constant; Kernel b98156427362a468ae78195a3582901e2474fea5 adds an actual constructor regression and six CPL3 creation/cleanup calls. The expanded lifetime VM passes with ordered, unique staging and cleanup markers and empty QEMU stderr. This proves the constructor boundary; coordinated mediator startup, seal, client I/O, retirement and full guest builds remain open. Matching component CI is still being monitored.

Corrected native staging checkpoint — 15 September 2026: Signed source e48a0e9992eacf69b4c0be6c4ce8de6bdf5fdd47 is recorded in the current review. Retain the mediator endpoint master privately, transfer only the install grant and prohibit ordinary start, restart, TTY and powerbox provisioning paths. 233/238 default/all tests, forty native binary builds, strict Clippy and private rustdoc pass. Six mediator authority/cleanup tests cover ordinary-path refusals. CI 270/271 passes with complete warning-free logs. Actual grant-return provisioning, authenticated receiver readiness, configuration/seal, client I/O, fair retirement, whole-codebase authority/documentation closure and both complete guest build generations remain required. No runnable Posixd realm or guest-build acceptance is claimed.

Native terminal generation implementation — 17 September 2026: Signed revision 2983f807cf7517250239872046f24d75bb9900c6 is pushed. Native retirement, signal and stop completion compare the exact original process/generation pair. Stale and already observed generations cannot initiate accounting or cleanup. Four new controls and the complete strict host/native matrix pass, including forty freestanding binary builds. Matching native execution and coordinated consumer rollout remain in progress; runnable realm bootstrap and complete guest builds are not established. Original automatic CI is monitored without retries.

Coordinated terminal observation checkpoint — 17 September 2026: Signed revision 2983f807cf7517250239872046f24d75bb9900c6 is pushed. The generation-bound consumer passes its full strict host/native matrix and original CI 278/279, with all four terminal logs complete and no warnings. The isolated native producer checks also pass; ordinary service-image adoption is separate. Typed mediator bootstrap, ordinary service-image adoption and both complete EriX builds inside EriX remain open.

Planned exact-generation native cleanup — 17 September 2026: Define distinct native terminal-destruction and
staged-abort operations 56 and 57. A checked request carries the nonzero original
process/generation pair in the low/high 32-bit halves of arg0; flags and all other
arguments are zero. Retire selectors 8 and 35 without reinterpreting them or
adding a compatibility fallback. The existing held Process or Root route remains
required; descriptive identities do not grant authority.

Match the exact pair under the same TCB record lock that enters retained cleanup.
Preserve terminal-versus-Created eligibility, partial disposal and retry custody.
An absent or different generation acknowledges absence of only the requested
instance, with zero response values; it cannot mutate a replacement. Migrate
every native caller and carry creation/event generation through deferred retries.
Account for processes created before a service's own managed ledger without
reconstructing historical identity from the current record. Maintain separate
terminal observation, cleanup custody, provider completion and native absence.

Required evidence includes exact wire and reserved-field controls, actual-object
generation/reuse and failed-release controls, consumer cleanup tests, and bounded
CPL3 native coverage. Update all operation inventories, Rootd's measured audit
contracts, canonical documentation and manual/API references. Validate coherent
original commit dependencies, complete strict component matrices and repository
CI checks, then monitor original workflows. Ordinary mediator start, whole-image
admission and both complete builds inside EriX remain separate open gates.

Generation-bound native cleanup checkpoint — 18 September 2026: Signed revision 92e19c3ec60ffd5cb3bc16cde3a2316cd3bb1556 is pushed. Staged rollback and deferred destruction retain the original generation. Pre-service terminal events own exact native cleanup without managed successor or provider effects; intake checks cleanup capacity before dequeue. Complete native framing and correlation precede result interpretation. Nine added controls pass with 247/252 main-binary units, five probe tests and forty native builds across the strict default/all-feature development/release matrix. Native transport and cleanup custody are separate cohesive modules. Ordinary service-image execution remains required. Formatting and Markdown checks pass. Original CI 280 and CI 281 passes; all four terminal logs are complete (332,946 bytes), without warnings. Runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain separate open acceptance requirements.

Returned-grant bootstrap custody design — 18 September 2026: Add distinct Procd PREPARE_REALM_BOOTSTRAP (0x432) on the existing
private Launchd route. The native pending caller must match a retained running
Launchd generation. Its exact 32-byte request carries u32 request ID, opcode,
original process/generation, source and original destination install-grant slots,
then two zero words. The actual sole receipt must be INSTALL_GRANT with exactly
GRANT|MINT. Slots are full-width descriptions; receipt, live inventory and native
matching-grant checks establish custody. Previously guarded, started, stale,
ordinary-role and malformed stages refuse before new effects.

Reserve exact rollback ownership first. Use the real returned grant and native
operation 53 to narrow the Created child's primary endpoint to RECV. Establish
an ancestor SEND branch under Kernel lifetime custody and a distinct nested
explicit revoker before any export. Retain the nested sender privately; dispose
the original master, unguarded sender and ancestor-only bypass aliases. The
returned install grant stays exclusively owned for later typed installation.
No new endpoint factory or expanded Process endpoint policy is implied.

The exact 32-byte capability-free reply echoes request/opcode/result/process/
generation, followed by a u32 custody state and two zero words. State 1 occurs
exactly with OK and confirms only guarded unstarted-stage custody; failure state
0 is not absence proof. Lost reply, rollback, abort, supervisor loss and terminal
cleanup must account for every reused scratch column, actual guard and exact
child identity. Uncertain disposal prevents reuse and ordinary continuation.

Keep ordinary mediator starts denied. Counted final receivers/configuration,
owned fair intake/provider/retirement progress, private execution, authenticated
readiness, initial receiver disposal, seal/publication, real two-realm client I/O
and both complete builds inside EriX remain required. Host models or this guarded
stage acknowledgment cannot substitute for those acceptance gates.

Returned-grant consumer checkpoint — 18 September 2026: Signed revision 4e233515341067f6b6d3503db0acb61da6d54422 is pushed. Actual native caller/grant admission precedes reservation of all five existing scratch columns. Matching-grant attenuation, ancestor lifetime deposit and a private nested sender/revoker remove original masters and bypass sources. Partial failure, failed acknowledgment delivery, exact supervisor loss and terminal retirement exhaust role-owned cleanup and preserve the first uncertainty, preventing ordinary continuation and row reuse. Eleven added controls pass with 258/263 main-binary units, five probe tests and forty native builds. Ordinary mediator execution remains denied. Formatting and Markdown checks pass. Original CI 282 and CI 283 passes; all four terminal logs are complete (336,168 bytes), without warnings. Matching consumer VM execution, runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain separate open acceptance requirements.

Deferred native cleanup scheduling — 18 September 2026: Give retained native destruction one attempt before each ordinary service intake turn, rather than draining only during idle intake. Preserve the original process/generation and first unacknowledged failure; rotate failed owners so independent queued instances receive attempts. Only a complete exact-generation native cleanup acknowledgment removes an owner. Reserve existing deployment-sized queue capacity before native event dequeue. This adds no capability or process selector and changes no native ABI. Continuous-intake, failure, capacity and wrapped-queue controls will validate the scheduling boundary. One native call bounds work count, not elapsed time. Legacy transfer rendezvous, terminal intake and synchronous provider completion remain separate work before complete realm fairness or consumer VM acceptance.

Deferred native cleanup checkpoint — 18 September 2026: Signed 507a98f53462b688d9008931aab09902713ed805 gives each deferred native cleanup owner an independent turn before request intake. Unacknowledged owners rotate with their exact generation and first error retained. Five new controls and four strict matrices pass: 263/268 main units, five probe controls, forty native builds, formatting, strict Clippy and private-item rustdoc. The original Integration layout reader accepts both compiler-produced record layouts; checked page-rounded arenas remain unchanged. Original CI 284 and CI 285 pass from all four complete logs (337,764 bytes), without warnings. Bug 3 records the bounded scheduling correction. Legacy terminal/provider progress, actual consumer VM execution, complete realm fairness and both full guest builds remain open.

Caller-local grant relocation design — 18 September 2026: Add immediate x86_64 syscall 0x54, RELOCATE_LOCAL_GRANT, taking source slot in argument 0 and destination slot in argument 1. Both fit u32, are nonzero and distinct; arguments 2–5 are zero. The return is the exact result in rax with zero auxiliary value. Admission uses the actual current Running native process and nonzero generation, checks both slots against its syscall window, and accepts only an actual held INSTALL_GRANT or REVOCATION_GRANT with its matching native record. Movement uses the existing unique-record rebinding within that same native CSpace; rights, child/generation installation scope and revocation lineage are preserved. No grant is constructed, copied, attenuated or retargeted. Malformed register shape rejects before context lookup; caller/window checks precede source lookup, then type/binding checks precede empty-destination admission. Ordinary validation refusal leaves inventory unchanged. The transition is serialized with process-terminal and reply-authority lifecycle changes. Owned CLAIM already selects receiving destinations before exposing request bytes; this operation lets a producer validate the received grant and then relocate it into an existing per-process custody slot. The operation itself does not validate a bootstrap request, install child authority or acknowledge application retirement. It adds no Process endpoint selector or general CNode route. Literal register, foreign/terminal caller, missing/fake binding, occupied destination, exact-rights/scope and actual CPL3 controls are required, followed by coordinated producer/consumer adoption and the remaining realm VM gates.

Owned receiver request-budget contract — 18 September 2026: Extend register-only REGISTER (0x4C) to take the actual local RECV slot, maximum request payload bytes and maximum request capability count in arguments 0–2; arguments 3–5 remain zero and successful RDX is zero. Both budget values are explicit receiver declarations. Zero/zero admits only empty requests. The byte/slot/receipt receive layout must be addressable and capability capacity must fit native private CSpace storage. The actual Running generation and held generic RECV endpoint remain the registration authority. Exact repeated registration is idempotent only with the same budget; a different budget or owner conflicts without modifying the original registration. Replacement follows the existing actual receiver-binding removal and exact native retirement rules. SUBMIT compares actual payload length and capability count against that exact registration before request allocation, private-space reservation, native transfer or invocation serial acceptance. Oversized requests return ordinary INVALID_ARGUMENT with zero owner ID and unchanged source custody. The packet decoder passes its checked capability iterator directly to native preparation, removing its redundant temporary vector. Accepted invocation, result-budget, delivery, draining and retirement contracts remain explicit. Migrate every producer and fixture to the new signature without a deprecated unbounded fallback. These budgets describe service-owned receiving storage; they add no global CALL-size ceiling, user-pointer retention, foreign selector or capability grant. Literal malformed/zero/exact registration controls, rejected-inventory checks, actual CPL3 calls and existing VM oracles are required. Then connect the owned Procd/Launchd bootstrap path through its held private route, actual claimed caller identity, server-chosen grant receipt and local relocation, retaining each committed/draining owner through exhaustive cleanup. Actual consumer VMs, complete fair realm progress and both full guest builds remain open acceptance requirements.

Owned guarded-bootstrap service contract — 18 September 2026: Migrate PREPARE_REALM_BOOTSTRAP to native owned request/result custody on the already held private Launchd-to-Procd endpoint. Its exact 16-byte body contains request/opcode/process/generation only; remove obsolete source and destination slot descriptions. The canonical capability-free response remains 32 bytes. No legacy bootstrap transport fallback is retained.

Procd registers explicit 16-byte/one-capability request limits, supplies an actually empty local receiving slot, validates the committed receipt type and rights and matches the native claimed origin to the retained Running Launchd generation. It validates the exact staged mediator row and actual grant scope before adopting the grant into that row through caller-local relocation. Existing launch-description staging may be reused only with explicit exclusive ownership and proved completion of its former cleanup; add no broad Process authority or per-realm scratch column. Numeric identity or receipt metadata never replaces actual possession or scope validation.

The running service loop must give native retirement a turn before owned bootstrap and ordinary intake. Retain nonzero delivery/invocation owners, received authority, exact child rollback and first cleanup failure through committed/draining outcomes. Complete every independent local and child retirement action before relinquishing bookkeeping; uncertain cleanup cannot return a service to ordinary work. Authenticate actual native origin and revalidate the original supervisor before effects; do not manufacture legacy pending-caller or source-slot receipts.

Replace Launchd synchronous bootstrap exchange with retained progress driven by its actual runtime orchestration. Success requires a canonical correlated result, actual source-grant absence and complete invocation retirement. Connect this to authenticated staged realm preparation, with no public numeric shortcut into a prepared process. Preserve ordinary start refusal until realm configuration, readiness and sealing are complete.

Acceptance requires adversarial ownership/cancellation/partial-cleanup host controls, strict coordinated builds and real producer/consumer VM execution. Native primitives alone do not establish service adoption, complete fairness or a full guest build. Existing ordinary source/effect/frame and two complete EriX-in-EriX build gates remain unchanged.

Owned bootstrap receiver checkpoint — 18 September 2026: Signed 1e8713ae4c49ab9a3bc927031936585d4a1f76fd connects the Procd service loop to native owned bootstrap intake on the existing private receiver. It admits 16 request bytes and one actual grant, selects and proves empty exclusive ingress, authenticates claimed Launchd origin and validates native child scope before local relocation into the existing row. The obsolete legacy bootstrap handler is removed. Retained delivery and exact-stage custody survive draining; application cleanup precedes native relinquishment, and uncertain cleanup prevents ordinary intake. Ready owned and ordinary admission alternate with native deferred destruction first. Twelve owned-driver and two scheduling controls cover custody, negative cases and retirement. Four strict configurations pass: 273/278 main units, five probe tests, forty warning-free native builds, formatting, Clippy and private-item rustdoc. Original CI 286 and CI 287 pass from all four complete terminal logs (340,704 bytes), without warnings. These host controls and builds do not establish actual consumer VM execution. Actual Launchd runtime orchestration, full provider/terminal fairness, configuration, readiness, seal and both complete guest builds remain open.

Original realm supervisor and producer cancellation contract — 18 September 2026: Extend BEGIN_MATERIALIZATION to an exact 64-byte body. Its existing 56-byte semantic image description is followed by two full-width u32 fields: original supervisor process ID and generation. Both are nonzero only for the realm mediator role; both must be zero for every other role. Reject the obsolete 56-byte shape. Coordinate the shared codec, Loaderd and Procd through one original pinned dependency graph.

On PREPARE_REALM, Loaderd obtains the supervisor pair from the actual native pending caller on its private Launchd receiver. Procd authenticates the actual Loaderd caller on its materialization receiver and matches the forwarded supervisor to its retained Running Launchd generation before any child effect. The pair describes delegated lifecycle responsibility; numbers alone never confer creation, installation or rollback authority. Retain that original owner before materialization and through grant handoff, native submit/claim and guarded staging. Supervisor terminality retires active preparation and every corresponding stage before unrelated provider cleanup. Guard admission must match the original supervisor, never replace it with a later claimant.

Launchd retains child rollback and native invocation ownership separately. Caller RELEASE initiates cancellation and must precede any ordinary abort request that could wait behind Procd delivery retirement. RELEASE is not an application rollback acknowledgment: preserve the exact child obligation until its separate cleanup proof. Procd exhausts independent local and child cleanup before server RELINQUISH. Both parties retain nonzero native IDs and the first cleanup failure through draining; no uncertain state returns to ordinary work.

Actual Launchd runtime preparation and scheduler adoption, deployment-sized ownership storage, adversarial host controls and real producer/consumer VM execution remain required. Guarded staging does not authorize ordinary start or establish configuration, readiness, sealing, complete fairness or either full EriX build inside EriX. Existing source, effect and frame gates remain.

Original supervisor service checkpoint — 18 September 2026: Signed 3210f44b4fee05a7dd4f0ff25c2664629cc76aa2 is pushed. Authenticate the actual private Loaderd caller and original Running Launchd before creation; retain supervision through preparation, grant handoff and owned bootstrap. Match the original owner before adopting stage rollback. Loaderd rollback ends at guard admission. Supervisor retirement exhausts active preparation and independent committed stages even after a cleanup refusal, preserving exact obligations and first errors. Eight new controls preserve earlier coverage. Four strict default/all matrices pass with 281/286 main units and five probe tests; ten production matrices also pass, for fifty native builds in total. Formatting, strict Clippy, private rustdoc and Markdown pass without warnings. Original CI 288 and CI 289 passes with all four terminal logs (343,310 bytes), without warnings. Actual Launchd owned producer/runtime adoption, coordinated consumer VM execution, complete fairness, configuration/readiness/seal and both full guest builds remain open.

Coherent realm image service prerequisites — 18 September 2026: Signed ea41ec37d36058f0027507ed1ecdb34d773b2aaf selects the original shared wire/startup dependency graph. Direct Rust implementation bytes are unchanged. All 14 default, all-feature and separate production development/release configurations pass 286/288/291 unit tests per configuration, strict host/native Clippy and freestanding linking with fatal linker warnings. Formatting, private-item rustdoc and Markdown pass, with zero warnings. Original push/PR CI is under observation. Matching catalog adoption and real consumer VMs remain requirements; complete realm and full in-guest build acceptance remain open.

Original coherent realm source CI acceptance — 18 September 2026: Signed ea41ec37d36058f0027507ed1ecdb34d773b2aaf passes CI 291 and CI 290. All four terminal logs are complete (343,244 bytes), with zero final warnings. This closes the original CI observation recorded above. Coherent catalog publication, actual consumer VMs and full guest-build acceptance remain separate open requirements.

Tracking and rollout

Runtime consumer dependency alignment — 15 September 2026

Signed a6658875dc767210a489389a1b2b8bbfb21a42e1 aligns the existing dependency selections with the original signed runtime graph. This checkpoint changes Cargo selections and the roadmap; this repository's Rust implementation files are unchanged. Formatting, strict Clippy, private rustdoc and canonical documentation checks pass without warnings. Default/all-feature development/release tests pass 239 default / 244 all-feature tests. Independent production configurations also pass strict host/native Clippy and native builds: procd-runtime: 239 development / 239 release tests, procd-runtime-release-image: 239 development / 239 release tests, procd-runtime-logging: 239 development / 239 release tests, procd-runtime-crash-reporting: 241 development / 241 release tests, procd-runtime-interrupt: 241 development / 241 release tests. There are 50 supported native builds in total. Push/review CI 276/277 passes with complete classified logs and no final warnings. The product catalog, product VM acceptance and guest build remain pending. Review: #2.

Coherent runtime source adoption — 15 September 2026

The product runtime catalog still selects the earlier source graph. Adopt the current original signed sources as one coherent graph before claiming product execution of the new kernel invocation, mediator construction and Procd caller-admission contracts. The frozen inventory covers 73 catalog components and 72 tracked Cargo manifests; 54 components need direct pin alignment, with further propagation after dependency commits are published.

Align dependency selections bottom-up, preserve original Git objects, and validate every altered repository under its supported strict configurations before signing and publishing its dependency commit. Full commit selectors remain mandatory. Unrelated work is preserved, and no synthetic replacement object or rewritten published history supplies build evidence. Update the runtime catalog only once all selected Cargo manifests and original metadata agree.

Run actual product images covering authenticated Launchd activity and the relevant lifecycle/authority regressions, adding negative caller controls where needed. Keep complete warning-free build/test/image evidence and monitor existing CI. Significant regressions use the canonical bug report format. Dependency alignment alone does not prove runtime authority closure, mediator execution, performance improvement or either complete guest build generation. Typed grant return and guarded bootstrap remain the next realm implementation boundaries.

Native caller admission checkpoint — 15 September 2026

Signed Procd c583614aa48f3e11a3ccabfeee06340f518de750 now checks the actual pending native caller on Launchd ingress against its retained running Launchd process and stage generation before operation-specific receipt validation or dispatch. Forwarded SEND aliases, request-body identities, other lifecycle roles, reused generations and unavailable identity cannot acquire this dispatch permission. Other receivers retain their policy; rejected delivered transfers still undergo local disposal, and uncertain disposal stops ordinary continuation.

Five new producer controls exercise accepted event dispatch and refusals without consuming the private event. The complete strict host/native development/release matrix passes: 239 default-feature tests, 244 all-feature tests, Clippy, rustdoc, formatting and forty native binary builds, with no warnings. The changed runtime-loop fragment is formatted by the repository formatter; its other code matches the formatted original outside the reviewed admission replacement.

Signed documentation 45d4d04c534f2ebca857ee203265232fd7c32bbe passes 45 tests and a frozen 2,375-page manual with 433,469 in-bounds word boxes and no final warnings. Page 212 was visually reviewed. The receiver inventory also corrects the existing powerbox omission and obsolete loader operation count. Shared API snapshots are unchanged.

Procd CI 274/275 and Docs CI 879/880 pass with complete classified logs and no final warnings. Both component cohorts are complete. Product runtime-image validation still requires a coherent original-commit dependency graph; this checkpoint does not claim a new Procd VM. Actual returned-grant custody, guarded bootstrap, readiness/configuration/seal, mediated client byte I/O, fair retirement and both complete guest build generations remain open.

Native caller admission — 15 September 2026

Before mediator bootstrap shares an existing receiver, Procd will authenticate every Launchd-ingress CALL using the kernel's pending-reply caller identity. The actual process and stage generation must match a retained, started, running Launchd record. A forwarded sender, another lifecycle class, stale generation, absent delivery or unavailable identity must not gain Launchd dispatch permissions. Receiver selection and caller authentication remain separate checks; request-body identity fields cannot authenticate the sender.

The check precedes operation-specific receipt validation and all handlers. Refused transfer-bearing calls retain actual receipt disposal; uncertain disposal still stops ordinary service operation. Other configured receiver policies remain unchanged. There is no new wire operation, capability grant, fallback identity or mediator start permission. Validate accepted dispatch, identity refusals and original transport errors, then run the strict producer matrix and appropriate runtime acceptance.

Actual grant return, guarded bootstrap, readiness/configuration/seal, mediated byte I/O and both complete guest build generations remain required.

Validated mediator constructor adoption — 15 September 2026

Procd selects checked native operation 54 only for mediator staging, without a parent VSpace receipt. The native TCB retains backing; the child initially holds only its primary endpoint. Other roles retain ordinary construction and its existing receipt/drop sequence. A refusal never falls back to operation 32. Scratch absence cleanup, exact stage retirement, private endpoint-master custody, grant-only handoff and all ordinary mediator start gates remain in place.

Signed original revision 3d9fe97bb66ea82442728ef8a10b998d7159a9ba. Procd passes 55 focused materialization controls and 234/239 default/all tests, strict host/native Clippy, rustdoc, formatting and forty freestanding builds across ten binaries. Exact requests, omitted receipt/drop, materialization, refusal without fallback and unchanged ordinary behavior are covered. CI 272/273 passes with complete warning-free logs.

The previously accepted Kernel 6d2ca19c native fixture establishes the constructor object, root-absence and backing contract. This checkpoint adds producer transport controls; it does not claim a new Procd CPL3 VM, runtime-image adoption or runnable realm. Integration source and native VM inputs are unchanged. The manual is signed at Docs 8b30523f3d7e1c300f39e3418a8748dae10ec04f; all 45 tests, final warning-free rendering and CI 877/878 pass.

Runtime-image adoption, authenticated grant return, guarded bootstrap routes, private execution, receiver readiness, configuration/seal, client I/O, fair retirement and both full guest build generations remain open. Whole-codebase semantic authority and private-item documentation audits remain incomplete.

Mediator constructor adoption — 15 September 2026

Procd will select checked native operation 54 only for the mediator lifecycle class, with no parent VSpace receipt. Native TCB custody retains the mapped backing. Ordinary roles retain operation 32 and its existing receipt/drop sequence. Scratch absence cleanup, complete failed-stage retirement, grant-only handoff, retained endpoint master and all ordinary mediator start gates remain required. A refusal of operation 54 must never fall back to operation 32.

Extract the materialization constructor and test transport before adding coverage so each code file remains below 1,000 lines. Verify the exact constructor request, omitted receipt and drop, ordinary behavior, refused construction without fallback, materialization and final cleanup. Existing native construction evidence remains the authority/object proof; producer transport doubles do not establish a running mediator. Shared pins will select signed IPC 7c7712057cc5d16ab16a677a886caeac54814a16 and capability ABI 2d6b12832b3f0d798756a9c7f29a7c52a8b3bc70 through the existing dependency graph.

Authenticated grant return, guarded bootstrap routes, private execution, readiness, configuration/seal, fair retirement and both complete guest build generations remain open.

Construction without child root capabilities — 15 September 2026

Native prerequisite implemented at Kernel 6d2ca19c48d3663db4b3a1eba4e9b7588b351f6f with shared IPC 7c7712057cc5d16ab16a677a886caeac54814a16. Kernel operation 54 admits only actual Process endpoint holders and constructs a Created child with exactly one primary endpoint and no root capabilities. The native TCB retains address-space backing independently. The caller receives a unique install grant, an endpoint master and only an explicitly requested MAP-only VSpace receipt. The checked request distinguishes absence from a genuine slot-zero receipt. Former-root slots are usable; actual caller windows, native capacity, occupancy and child window scope remain enforced. Rollback disposes only successful new receipts and the partial child while preserving pre-existing bindings. Ordinary operation 32 remains unchanged. Initial inventory is not a seal or a permanent ban on later explicit installation. Both isolated native VMs pass; no runnable mediator follows from this prerequisite.

Procd adoption, authenticated grant return, guarded bootstrap authority, private mediator execution, readiness, configuration/seal, client I/O, fair retirement and both complete guest build generations remain open. Ordinary mediator start gates remain closed. Whole-codebase semantic authority and private-item documentation audits remain incomplete.

Staged endpoint attenuation checkpoint — 15 September 2026

Native prerequisite implemented at Kernel d690eda817e56b515a278bdbb5ea6c5aedeb431b with shared IPC 74c75a5db226413c066b6582210a44cb21d968d8. Kernel operation 53 narrows only the actual install grant's matching Created child's primary endpoint. The grant must cover the current rights as well as the requested result. Final identity/state checks and the allocation-free CSpace mutation share the child record lock. Exact zero and repeated reduction preserve object identity, other aliases and revocation associations; restored rights, stale or foreign targets, malformed fields and started children refuse. Both isolated native VMs pass; this does not establish a runnable mediator.

Authenticated grant return, independently minimal bootstrap/root authority, retained native and nested guards, private mediator execution, configuration/seal, client I/O, fair retirement and both complete guest build generations remain open. Ordinary mediator start gates remain closed. Whole-codebase authority and private-item documentation audits remain incomplete.

• Parent work: erix/integration#2 and erix/docs#1.
• Branch: feature/posix-compat; update linked WIP PRs after coherent signed checkpoints using canonical CONTRIBUTING.md messages.
• Baseline revision: c7607afcbe8691a4c10a1e8e811c6542759db72f; refresh component/dependency heads and their own CI evidence as implementation advances.
• Cross-repository dependencies remain full lowercase commit hashes; update the selected graph deliberately. This issue does not authorize merges, release tags or replacement of published images.

Next native validation — 19 September 2026: add an opt-in Exsh guarded-preparation diagnostic using the existing realm ABI. Keep the passing eleven-call admission-only scenario separate. The new diagnostic will reserve a record, transfer exactly one SEND-only copy of its explicitly supplied startup cwd to the BEGIN-reserved receipt slot, select bin/true within that initial root scope, require PREPARE/Guarded and READ/Guarded, then require ABORT/Retired and a stale READ/NOT_FOUND. The packaged native true executable is an unstarted staging fixture; it does not stand in for a running POSIX mediator.

The existing authenticated private Launchd route remains the sole request path. No ordinary start, new endpoint, root capability or implicit namespace is introduced. Launchd must retire its received directory copy after exact resolution; Loaderd must return the original staged child and grant, and Procd must retain the actual returned grant and guarded sender branch before acknowledging Guarded. Abort must retire that exact stage and retained custody. Error telemetry must preserve application refusal codes and stop ordinary output after uncertain receipt disposal. Independent host controls will cover literal operation order, transfer scope/rights, full correlation, missing or malformed acknowledgments, surplus receipts and no continuation after failure. The new actual VM retains the 120-second hard and 45-second progress limits and requires its own unique marker before ordinary shell exit. Full source/effect/frame proof, configured/sealed mediator execution, real client byte I/O, native Rust/LLVM rebuilding and both full EriX builds remain required.

Native guarded preparation — 19 September 2026: signed Integration 78557a6c672ecf426dfe894a01cc4aeec73b5e3c selects signed Exsh ffe50612889dd58a45a40d04593a4aa3a3ffa512 for the separate appliance-disk-image-realm-preparation-positive scenario. The actual VM passes the eleven existing admission calls followed by BEGIN/Reserved, PREPARE/Guarded, READ/Guarded, ABORT/Retired and stale READ/NOT_FOUND. It transfers exactly one SEND-only copy of the explicitly supplied initial cwd to the authenticated reservation and selects bin/true inside that scope. This packaged executable remains an unstarted staging fixture. The existing private Launchd route is reused; no new endpoint, root grant or implicit namespace is introduced.

Exactly one admission marker and one ERIX_EXSH:REALM_PREPARATION:VERIFIED precede ordinary successful initial-shell exit. The original 120-second hard deadline and 45-second progress watchdog remain unchanged; scenario status is zero and build warnings are absent. The separate admission-only scenario is preserved. All 106 actual appliance artifacts and complete logs are retained. Serial SHA256 is 7ef35833c2d88abcd093c8813791e11cea0d34edb2e29b8686df6996e2bc32ff (55,776 bytes); post-VM writable disk SHA256 is 3439d0750ea456ceb8d9fbb063d6af763b4198a85f0270ae8d22c76c6ff99499. Its earlier packaging checksum is retained separately. Independent artifact review verifies all 73 original component revisions, both diagnostic markers in the actual packaged executable, and the signed image's exact 72-byte LCH1 version-3 configuration with four realm records and a 102,400-byte native arena.

All 169 Integration helper commands, seventeen route/scenario controls and four strict 320/321-test Rust configurations pass, including native builds, fmt, strict host/native Clippy and private rustdoc; all 394 host streams are warning-free. The post-validation source delta changes only the two Exsh catalog pins and final documentation status, preserving checked implementation bytes. Exsh passes ten strict 976-test configurations, ten native builds and 355 frame-checker controls without warnings. Eight actual frame observations retain complete workspace mapping but incomplete 97/63/100/100 runtime/all/admission/preparation proof in both policies; the full frame gate remains required.

Original Integration CI 1677 and 1678 are queued. Original Exsh CI 271 and 272 are under observation. Complete typed mediator bootstrap, readiness/configuration/sealing, real client byte I/O, complete source/effect/frame proof, native upstream Rust/LLVM rebuilding and both full EriX build generations remain required. This prerequisite adds no accepted whole checklist item.

Minimum bootstrap design — 19 September 2026: signed Posixd proposal, in PR 5, specifies the next ownership boundary before codec or runtime implementation. Launchd uses its existing endpoint factory and retains the private configuration RECV/GRANT alias; the child receives only its existing control RECV and a guarded configuration SEND. Counted startup records and actual receipts must agree, with all temporary setup/grant disposal acknowledged before the separate private start gate.

Readiness requires actual CLAIM caller identity plus an acknowledged challenge through the retained control endpoint. COLLECT provides no server-origin evidence. Child-read-only startup mappings do not revoke Procd's trusted memory-write authority, and ordinary writable LCS1 startup mappings cannot silently stand in for this new contract. The current staged-only retirement path must gain exact running-child cleanup. A surviving child-termination owner after Procd loss remains a prerequisite: SEND lifetime revocation alone does not destroy that child, and Rootd exits after bootstrap. Resolve and validate this ownership before admitting private execution.

The proposal assigns no new wire layout/opcode and implements no Posixd runtime. Markdown, canonical document headings, governance bytes, local links, original source anchors and whitespace pass. Original Posixd CI 19 and 20 pass from two complete hashed logs (7,212 bytes), without warnings. Rust and new VM checks do not apply to this documentation-only repository. Existing native guarded-preparation acceptance remains separate; full runtime lifecycle, configuration/seal, real client I/O, full frame proof, native upstream toolchain rebuilding and both full EriX build generations remain open. No whole acceptance item is added.

Native child-lifetime prerequisite — 19 September 2026: Kernel design #19 now specifies opt-in custody through existing Process control authority plus the real matching install grant, with actual current supervisor attribution and separate stopping/reclamation obligations. An install grant alone must not confer child termination authority. The shared exit/kill prerequisite is signed, strictly validated and passes both original native lifetime/invocation scenarios at Integration a62d1381f56a01afc692112d9b427205eaeb6a2e. The custody binding, safe reclamation progress point and producer adoption remain unimplemented. No private mediator start gate opens from this refactor.

Verified grant-rights checkpoint — 20 September 2026:

Signed commit 1c80383afe1460f8d250472284225670f893937c requires exact GRANT-only final installer receipts and selects the original shared dependency graph. Four strict 289/294-unit configurations, four native builds with the maintained linker layout, host/native Clippy, formatting and private rustdoc pass without warnings. Original CI 292/293 passes from four complete hashed logs (344,064 bytes), with zero warning candidates. Procd requests MINT only on actual derivation paths. It derives the final GRANT-only receipt into the disposed VSpace receipt slot and drops its delegating source before handoff. Derivation or disposal failure retains original-generation rollback and all remaining local custody.

Both maintained isolated native scenarios pass on their first attempts under the unchanged 60-second scenario limits, with no build warnings and empty QEMU stderr. Lifetime now exercises 27 ordinary CPL3 grant-right controls and requires INSTALL_GRANT_RIGHTS_OK before its existing cleanup assertions. Its 2,025-byte serial stream has SHA256 6c685f1ceaf9080bf0bec628a4fac512bf9049d0fbcfe2b3737666adf414ca3a; owned invocation retains 1,587 bytes. Normal stripping exactly matches both packaged kernels to retained original artifacts. All fifteen selected original source signatures and clean trees verify. These minimal native scenarios establish neither full service-image acceptance nor a guest build.

Full coordinated consumer acceptance remains open under Kernel design 19 and phase completion.

Installer return-slot regression — 21 September 2026:

Both original corrected-catalog runs are now classified: 1695 passes 431/489 VM scenarios and 1696 passes 430/489. All six complete logs are retained and hashed, 32,723,390 bytes, zero warning candidates. Rust, Markdown and full dependency equality pass. Catalog mismatch issue 68 is corrected; this does not establish full consumer acceptance. Each run has 57 initial-shell uncertain-disposition failures and a separately retained release-appliance stall. Run 1696 also retains the ext4 quota timeout under its original 120-second bound, tracked in issue 20.

Procd bug 4 records a concrete producer/consumer mismatch. The final installer was handed off from VSpace scratch slot 1056 while later TTY provisioning requires managed grant slot 1040. The added producer regression fails on the original code. Signed Procd 10d972b652297fd656e9a6ac6dbdf197f362c7ce in WIP PR 2 derives the exact GRANT-only result, disposes its delegating source and uniquely relocates the result back to the empty managed grant slot. Refusals preserve original-stage rollback and remaining custody. Four strict 291/296-unit configurations, four native builds, host/native Clippy, formatting, private rustdoc and policies pass with zero warnings. Corrected full-service VM validation and original CI remain open; bug 4 remains open.

Acceptance remains 15/460 leaves, 3.48% weighted. Full consumer lifecycle, terminal accounting, source/effect/frame proof, Pagerd, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full in-EriX build generations remain required.

Verified managed installer recovery — 21 September 2026:

Signed Integration 648fbd5614d3d0b82223b1c3bb7f1b5a0c81ea7d in WIP PR 12 selects signed Procd ac8a12993bc8cbf134a11e141e459cb63df71123 and Docs PR 4. Both full original catalogs pass all 72/71 manifest checks against 73/70 clean selected checkouts and all 143 verified signatures. Twenty dependency and 46 immutable-source tests, native scenario policies, Markdown and whitespace pass. The unchanged orchestration crate retains its verified four 320/321-unit configurations, four native builds and strict Clippy/rustdoc evidence. Original Integration CI 1697/1698 is running; no complete regression-suite pass is claimed.

Procd bug 4 is corrected. The added producer regression reproduces the original 1056/1040 mismatch. Procd derives exactly GRANT into disposed VSpace scratch, drops its delegating source and uniquely relocates the result into the now-empty managed grant slot before handoff. The downstream TTY checks remain strict. Four 291/296-unit configurations, four native builds, formatting, strict Clippy and private rustdoc pass without warnings; relocation refusal and occupied-destination controls retain original-stage cleanup. Original correction CI 294/295 passes from four complete logs, 344,660 bytes. The subsequent roadmap-only checkpoint keeps every runtime source byte unchanged and original CI 296/297 passes from four complete logs, 344,680 bytes, zero warnings.

The maintained initial-shell start/exit, realm-admission and normal release-appliance VM scenarios all pass on their first corrected attempts with original guest bounds and watchdogs. The release appliance executes the real product-shell command and produces standalone LOOKUPOK output, separate from its echoed input. All three builds are warning-free and QEMU stderr is empty. Serial logs retain 55,702, 55,738 and 364 bytes respectively. Actual images, full artifact sets, scenario oracles and original signatures are retained. These runs execute Procd 10d972b652; the selected later Procd commit changes only its roadmap. All 73 executed component signatures and clean source trees verify. The earlier 431/489 and 430/489 full CI failures remain recorded, including the independent ext4 quota timeout; those runs are not rewritten as passes.

The native-launch manual now explains the managed return destination, exact rights, unique relocation and partial-failure cleanup. All 45 tests, the complete 2,429-page manual, 448,970 word bounds and changed-page visual review pass without final warnings. Original Docs CI 993/994 passes from four complete logs, 774,342 bytes; each final TeX pass is warning-free after normal earlier reference resolution. Existing generated API references are unchanged.

Canonical acceptance remains 15/460 leaves, 3.48% weighted. This is a repaired runtime regression, not completion of a canonical lifecycle leaf. Original-generation terminal accounting, provider/lifetime completion, source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX build generations remain required. Exsh's retained release compiler and frame-proof failures stay open.

Verified native terminal accounting — 21 September 2026: Kernel a9bdf6163813d378e0b4a164bceb839e24fbb6b7 is signed/pushed. Terminal preflight reserves final scalar CPU evidence independently of TCB/CSpace/VSpace reclamation; exact queries preserve final results or explicit errors. Repeat observations belong to the actual original observer until exact acknowledgement, and observer death releases that claim. Independent authorized observers can progress. Selector 55 is retired; checked selectors 59/60 have no destructive fallback.

Four strict 736/760-unit configurations, both standalone controls and thirteen native build/Clippy profiles pass without warnings. Host controls include nonzero final counters after actual reclamation and ID reuse, original observer death, pending-final-charge destruction refusal, malformed requests, wrong callers, immutable errors and lost-acknowledgement reply retry. Original Kernel CI 624/625 and corrected 626/627 all pass from eight complete hashed logs (1,532,848 bytes), zero warnings.

Both maintained lifetime and owned-invocation VMs pass under the unchanged 60-second scenario limits and standard watchdogs, with no build warnings and empty QEMU stderr. Actual guest instructions check repeat observations and CPU queries, exact acknowledgement and absent-acknowledgement retry; executing children require nonzero user and kernel counters after native reclamation. Lifetime retains 2,025 serial bytes (SHA256 921edf5eadfdff61f2d85a63158555666e77e57a1e8aa4254ac30dcd216f8cf9); owned invocation retains 1,587 (SHA256 404bc4ecad5074349d9ba45d1caf5439aebe849d344b726e5dec2ee2b9c4d907). Normal stripping exactly matches both packaged kernels to retained original artifacts; all fifteen selected original signatures and clean checkouts verify.

Kernel regression 21 retains the first VM's final page-census failure. The corrected layout declares and allocates all six request pages and derives the independent census from that declaration. No unchanged retry or deadline relaxation occurred.

Integration fcd7b4a9608f629a12de78c53da5c3615d906b46 is signed/pushed with the verified isolated catalog. Twenty dependency and 46 immutable-source tests, native policies, Markdown and source checks pass. The unchanged orchestration crate, embedded fixture and original dependency closure retain verified four 320/321-unit and native/Clippy/rustdoc configurations. The full service catalogs retain their separately coordinated revisions; original Integration CI remains under observation.

Procd and Rootd consumer adoption, ordinary and mediator metric retention/consumer loss, manual updates, full service/profiler scenarios, complete authority/source/frame audits and full regression acceptance remain open under Kernel design 20. Canonical acceptance remains 3.48% weighted; 15 of 460 items. Native upstream Rust/LLVM/runtime rebuilding and both full EriX guest build generations remain mandatory and unproven.

Committed terminal-accounting consumers — 21 September 2026:

Procd 66934642c4464fc738152a9e60790914ba27dd1c in WIP PR 2 reserves notification/crash/cleanup storage before effects, obtains exact final CPU evidence, commits local status and cleanup obligations, then acknowledges on every actual event polling path. Lost acknowledgement replies preserve the local result without duplicate counters or notifications. Mediators retain only scalar counters and the original authenticated supervisor identity after disposing all capability columns; supervisor death discharges the pending scalar observation and a replacement cannot inherit it. Four strict 299/305-test configurations, native builds, Clippy and private rustdoc pass. Original CI 298/299 passes from four complete hashed logs, 347,245 bytes, zero warnings. Bug 5 remains open for actual service acceptance.

Rootd 64c97b13c450003d9c2b6bd9ed2a627088684b46 in WIP PR 2 acknowledges bootstrap evidence only after exact native destruction and local endpoint absence; both operations remain unavailable after temporary Process custody transfers to Procd. Four strict 430/429-test configurations, native builds, Clippy and private rustdoc pass. Original 1039/1040 exposed bug 7: a stale source-call inventory and its matching semantic operation declarations. The correction explicitly inventories acknowledgement consumers and preserves the same temporary route and eventual Procd owner. All 64 Python controls, production-boundary, semantic baseline, threat model, phase contract and operation-ownership gates pass. Corrected original CI 1041/1042 passes from four complete verified logs, 222,969 bytes, zero warnings. Bug 7 is corrected; failed original runs remain retained without reruns or weaker gates.

Docs e4525848ad4462901c9a6794ef1794cf85ea9e6b updates the native contract, Procd/Rootd consumer custody and original signed IPC API references. Selector 55 is retired in both the detailed contract and summary; 58/59/60 are cross-checked against the shared registry. All 45 documentation tests and generated-reference checks pass. The complete 2,431-page manual builds without warnings; changed prose, selector and API pages pass visual review. Original documentation CI 995/996 and corrected-table 997/998 passes from eight complete logs, 1,549,628 bytes, with zero warnings in the final LaTeX passes. The 37 earlier convergence candidates per manual log are retained and resolved.

The separate Integration orchestration library checkpoint b06dfad00202765491a64552dde29eaca1c24838 passes four strict 320/321-test host/native configurations. Full service catalogs remain on their prior coherent graph while 35 remaining application/service repositories adopt the original shared revisions. Integration 1697/1698 remains running, and 1699/1700 plus 1701/1702 waits at the latest bounded observations. These are pending full regressions, not successful runtime acceptance.

No new canonical acceptance leaf is closed: 15/460 and 3.48% weighted. Ordinary Launchd metric-consumer restart/disposal semantics, coherent service CPU/profiler VMs, complete realm/provider authority and I/O, source/effect/frame proof, Pagerd, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX build generations remain required. The static audit finds 3,162 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 173 direct missing-docs gates and 92 conventional crate roots; this does not establish semantic authority or complete private-documentation closure.

Terminal selector documentation reconciliation — 21 September 2026:

Signed Procd 68748bc65ea3fb798e810d624845dcb298ae1346 removes stale operation 55 prose and documents observation 59 plus exact acknowledgement 60. All runtime inputs are byte-identical to the validated consumer implementation; its four strict 299/305-test configurations remain applicable. Original documentation-checkpoint CI 300/301 passes from four complete hashed logs (347,266 bytes, zero warnings).

Ordinary consumer loss/restart and final reply disposition remain audited acceptance gaps. Failed ordinary metrics transport currently terminates Procd; it is not evidence of continued execution and row reuse. Full service CPU/profiler VM acceptance, complete realm lifecycle and both guest build generations remain open.

Coherent scalar-consumer validation — 21 September 2026: signed Integration 07c883525ee5 selects Procd 59ee30a88534 in both complete catalogs. All 171 maintained helper commands pass without warnings; unchanged orchestration inputs retain four strict matrices. Five actual service VMs pass: shell CPU accounting, exec successor replacement, two-CPU read-only inspection, out-of-session denial and guarded realm preparation. Each preserves 106 hashed evidence files, clean QEMU stderr, warning-free image builds and all original markers under the unchanged 120-second guest limit. The build-plus-scenario times are 119.746880, 38.325332, 35.346729, 35.773237 and 55.339698 seconds respectively; these are not guest performance measurements. Inspection reports increasing job CPU counters with control disabled; numeric CPU utilization remains unproven.

Procd's four strict 308/314-test configurations and original CI 302/303 pass. The manual update passes 45 tests, all 2,431 pages, 450,185 word bounds and changed-page visual review. Original Docs CI 1003/1004 passes from four complete logs (774,710 bytes); retained reference-convergence warnings resolve to zero on final passes. All 3,166 authored code files remain below 1,000 lines.

Original Integration 1701/1702 remains running; 1703–1710 remains queued. Logd 240 remains failed with terminal logs unavailable through HTTP 500; no cause is inferred. No original job was restarted or cancelled. Remaining lifecycle control/event ownership, complete native fault/cleanup acceptance and the measured startup timing failures remain open. No whole acceptance leaf closes: 15/460, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain inside EriX and using it in the required full EriX guest-build generations remain mandatory and unproven.

## Problem and motivation This issue tracks continuous Phase 6 audit closure for `procd`. Own process materialization, staging, startup, metrics and terminal cleanup under authenticated authority receipts. An initial inventory is not a security or documentation closure claim. Evidence must follow each changed boundary through final heads, with priority security, reliability, then performance. ## Proposed behavior and scope ### Staged construction without root capabilities — 15 September 2026 Add kernel-control operation 54, CREATE_STAGED_PROCESS_WITHOUT_ROOT_CAPS, and checked StagedProcessWithoutRootCapsV1 scalar framing. Successful creation returns a live Created process and nonzero generation whose CSpace contains exactly its requested primary endpoint, with no CNode, VSpace or TCB capabilities. Native CSpace/TCB/VSpace objects and the process's VSpace lifetime reference still exist. No child code executes during construction. The endpoint initially retains its ordinary full endpoint rights; operation 53 independently narrows it before bootstrap execution. Keep the existing creation operation 32 and its producer behavior unchanged. The new selector is independently recognized: an older kernel refuses it, and callers must not fall back to old ignored flags or a child self-report. Admit it only on the existing Process endpoint family, without adding a capability type, endpoint factory or ChildPopulate creation authority. Use the existing fixed request envelope. arg0 contains the caller-local install-grant destination in its low 32 bits; its upper half is zero. arg1 low/high halves contain child-local primary endpoint and caller-local endpoint-master destinations. arg2 low/high halves contain the child window base and optional caller-local VSpace destination. arg3 contains the 32-bit window length, with a zero upper half. Flag bit 0 means that the VSpace receipt is requested; all other flag bits are zero. When the bit is clear, arg2's upper half must be zero. This explicit presence bit distinguishes an omitted receipt from a real receipt in slot zero. All slot fields retain their full unsigned width; slot zero and otherwise vacant former root positions are ordinary requested slots, subject to native bounds, actual caller-window visibility and occupancy. The checked codec validates framing, not native capacity or authority. The native constructor requires a valid child window containing the primary endpoint. The caller receives only its actual unique stage-bound install grant, endpoint master and optional MAP-only VSpace receipt. The grant is bound to the returned process/generation and exact child window. Existing capability ceilings, actual object identity and explicit disposal rules remain in force. Temporary native setup bindings must be gone before constructing the final primary endpoint and publishing the grant; otherwise former root positions would remain an unnecessary destination restriction. The TCB's independently held VSpace reference must keep backing alive even without any child or parent VSpace capability. On failure, destroy the partial child and dispose only successfully created parent receipts. Preserve pre-existing or overlapping destinations and the original failure; uncertain cleanup fail-stops. Never treat a requested slot as evidence that its capability was created. The new contract supplies an initial inventory, not a permanent prohibition on later explicitly authorized installations or a sealed realm. The returned grant remains a real pre-start population authority that its owner must account for and retire. Required checks include full-width codec/reserved-field cases, omitted versus slot-zero VSpace receipts, zero/former-root/last-slot endpoint destinations, invalid or inaccessible windows, occupied/overlapping outputs, exact parent and child inventories, no residual native objects, mapping/startup backing retention, attenuation through the actual grant and abort/terminal cleanup. Actual CPL3 creation/refusal/disposal must complement host tests. Procd adoption must select this operation only for the mediator role and preserve all ordinary start gates until authenticated grant return, minimum typed startup, retained native/nested guards, readiness, configuration/seal and fair retirement are independently implemented. No runnable realm or guest build is established by this constructor alone. ### Native staged endpoint attenuation — 15 September 2026 Add kernel-control operation 53, ATTENUATE_STAGED_ENDPOINT_WITH_GRANT, with a checked ProcessBoundEndpointAttenuationV1 request. This is a new recognized operation; an older kernel must refuse it, and producers must never fall back to an unchecked or post-execution self-report. No syscall number or service endpoint permission is added. Use the existing fixed KernelControlRequestV1 layout: arg0 low/high halves are the caller's actual install-grant slot and child endpoint destination; arg1 is the exact 32-bit rights mask, with its upper half zero; arg2 low/high halves are expected process and staging generation; arg3 and flags are zero. Both identity components are nonzero. Zero rights means exactly zero, never inheritance. Successful response values are zero. The native handler must validate the actually held GRANT-bearing install grant, its record, exact expected process/generation, live Created child, grant window, endpoint type ceiling and actual primary endpoint slot. Its rights ceiling must cover the current endpoint rights as well as the requested result; a narrow installer cannot manage a broader existing binding. The new rights must be known, valid for endpoints and a subset of current rights. Update only that existing binding's rights, preserving native object identity, all other bindings and revocation associations. The change allocates no alias and needs no new destination. Repeating the same attenuation may succeed; restoring a removed right must fail. Running, dead, stale, foreign, missing and wrong-type targets must fail without effects. Admit the operation only on the same Process and ChildPopulate control kinds as exact process-bound installation. Endpoint possession and descriptive IDs alone are insufficient: the actual held scoped grant remains mandatory. The immediate consumer is the future Procd bootstrap transaction, after the actual broad grant returns from Launchd. It will reduce the staged mediator's initial full endpoint to RECV before any private execution, providing independent native proof of that boundary. Required coverage includes codec/reserved-field rejection, missing and moved grant, wrong process/generation, wrong target/type/window/ceiling, exact attenuation and retry, attempted amplification, post-start refusal, actual CPL3 effect checks and full cleanup. This primitive alone does not admit mediator execution: authenticated grant return, native lifetime and nested revoker custody, minimal root/bootstrap inventory, readiness, configuration/seal and fair retirement remain separate gates. The current ordinary start prohibition stays in force. ### Staged mediator handoff contract — 15 September 2026 Reserve Loaderd operation `0x654` (PREPARE_REALM) using the existing exact-executable preparation request/response layout. The operation selects the new Procd lifecycle class `0x448` (REALM_MEDIATOR); role values describe lifecycle policy and confer no capability authority. Launchd explicitly selects this operation after authenticating its executable object. The ordinary operation `0x652` keeps its existing behavior. Responses must echo the selected operation; no fallback is permitted. Loaderd validates the same sole exact-executable SEND receipt, authenticates the complete image graph, and uses the existing semantic materialization pipeline. The mediator's temporary initial endpoint occupies child-local slot 4, after native root slots 1–3. This slot is an ABI destination, not a realm-count or resource-budget restriction. The child remains staged. Procd retains the actual endpoint master in the existing managed scratch endpoint column; it never exports that master to Loaderd or Launchd. Only the actual move-only install grant travels Procd → Loaderd → Launchd. The derived ordinary stream installer is absent for this class. Reply loss aborts the exact stage and accounts for the retained endpoint, grant and VSpace; cleanup uncertainty remains fail-stop. Launchd may inspect, abort and stop only its owned lifecycle classes. Root, driver and powerbox routes cannot use the mediator class; generic staged-start, ordinary startup/stream installation and automatic restart reject it. The future separate bootstrap transaction must receive the actual grant back, authenticate the live caller, install a typed receiver/rendezvous inventory using exact process-bound installation, dispose temporary aliases and configure the startup bytes before private execution. No existing start path may bypass that gate. This staged handoff is the first implementation increment of typed realm bootstrap. Acceptance for this increment requires malformed/foreign operation rejection, exact executable and grant receipts, unstarted materialization, private master retention, no derived stream grant, and rollback coverage across the actual producer paths. It does not establish mediator execution, seal, publication, client I/O, retirement fairness or either complete guest build generation. Those remain required under the existing acceptance criteria. Native VM coverage of the coordinated producer graph is required before claiming runtime acceptance. Current inventory: 10 Cargo targets (10 bin); manifests: `Cargo.toml`. Include explicit and automatically discovered targets, supported features and target-specific configurations. Inventory every startup/runtime grant and authenticated peer, then success, denial, cancellation, failed transfer, restart and teardown. Trace callers and downstream providers so names, numeric identities and retained aliases never become implicit authority. Planned native terminal-generation contract — 17 September 2026: Introduce operation 55 for exact native process/staging-generation/event-kind/status observations. The request has zero flags and arguments; malformed requests fail before dequeue. Successful responses preserve all four 32-bit fields, captured with the actual native terminal transition and retained after destruction. Empty queues return RETRY with zero values. These records constrain existing authority and confer no process-control capability. Kernel, shared IPC, Procd and Rootd migrate together. Procd must match the native process/generation pair before cleanup, CPU-time observation, restart or service-event publication. Remove the superseded identity-free native selector after all maintained consumers migrate, with no fallback on unsupported kernels. Preserve queue reservation, ordering, wake and failure semantics. Validate actual exit/kill, generation reuse, empty/malformed input and cleanup failure, then strict component checks and original bounded native VMs on a coherent immutable revision graph. This is the terminal-observation prerequisite for typed mediator bootstrap. The actual returned install grant already has a generation-checked endpoint-attenuation primitive for the first bootstrap effect. Guard custody, final receiver readiness, sealed publication, two mediators with real client I/O and both full guest builds remain separate mandatory work; this planned contract implements none of those by itself. ## Authority, security and reliability Maintain a finding register with public finding references, exact revisions, invariants, reproduction, owners, regression tests and closure evidence. Publish only non-sensitive status here; suspected vulnerabilities follow SECURITY.md. Each dimension below needs its own result and rationale; an absent daemon or current Rust target is not a blanket exemption. ## Acceptance criteria - [ ] Record origin, recipient, object, operations, delegation ceiling, lifetime and aliases for each relevant capability or caller-supplied authority-bearing value. - [ ] Audit ambient discovery/selectors, cwd/PATH/environment, numeric identities, inherited routes and host fallbacks; require explicit authorized intake. - [ ] Account for residual authority after success, error, cancellation, timeout, restart, failed transfer and teardown, including fork/exec where implemented. - [ ] Remove unnecessary endpoints, broad rights, duplicate aliases, provider/admin grants and debug routes. - [ ] Exercise stale generations, replay, pending replies, forged descriptive identity and object/path resolution races at the owned boundary. - [ ] Prove independent cleanup attempts and caller-specific error precedence; quarantine or terminate when retained authority cannot be accounted for. - [ ] Review unsafe/FFI/parser/arithmetic/lifetime/lock/publication invariants and add adversarial coverage where practical. - [ ] Inventory obsolete APIs, wrappers, fallback/dead paths and duplicate validators with their maintained callers. - [ ] Migrate callers and delete deprecated contracts/shims in a coherent signed revision graph; reject retired input versions where relevant. - [ ] Classify each size/count/depth/time bound as ABI, hardware, explicit resource policy or accidental limitation. - [ ] Test beyond removed boundaries and at allocation/ABI limits while preserving exhaustion errors, denial-of-service controls and bounded waits. - [ ] Keep every tracked authored code/test/script/workflow file below 1000 physical lines through thematic refactoring. - [ ] Run the deterministic tracked-source size gate, covering executable fixtures/generators and excluding only genuine non-code data or external payloads. - [ ] Audit production/test feature and symbol separation, including this repository's effect on rootd test orchestration. - [ ] Supply changes affecting rootd semantic surface to the maintained same-toolchain baseline; record a justified component-specific applicability result. - [ ] Check bootstrap ownership and development/release authority parity at this repository's producer/consumer boundary. - [ ] Use maintained [integration#3](https://git.erikinkinen.fi/erix/integration/issues/3) profiler evidence before optimizing; preserve live access checks, ownership and success criteria. - [ ] Audit build/CI inputs, secret handling, private outputs, symlink containment, deletion, subprocess bounds, warnings and host dependencies. - [ ] meaningful public/private inline documentation, crate/target `missing_docs` enforcement without blanket allowances or hidden-API escapes, warning-denied private-item rustdoc and an undocumented-public-API negative gate. - [ ] Validation: Run `cargo fmt --all -- --check`, strict Clippy, unit/doctests and warning-denied builds/rustdoc for every owned crate/target under default and all valid feature, freestanding/host, SMP and profile combinations; test mutually exclusive combinations separately. Add focused VM regressions for runtime behavior and observe the older catalog and unit tests at the exact published heads. - [ ] Documentation: update applicable README/ARCHITECTURE/ROADMAP in meta's canonical format and affected technical-manual TeX/API references; keep README evergreen and shared governance byte-identical to meta. - [ ] Evidence: record exact source/dependency revisions, commands, configurations, real exit status, CI run URLs and results; repeat the audit on final heads and obtain independent review of security closures. No skipped/pending/predecessor result counts as a pass. ## Alternatives and tradeoffs Use cohesive local refactoring or a justified shared extraction only after identifying real common semantics and authority boundaries. Remove superseded paths after preserving maintained coverage. Profile before optimization; document unavoidable ABI/hardware limits and explicit quotas rather than weakening security for speed. Typed realm bootstrap installation design — 15 September 2026: The next bootstrap producer step requires validating the actual moved install grant against the intended child before any installation. Add Kernel-control operation 52, INSTALL_WITH_GRANT_FOR_PROCESS, using the existing fixed request/reply envelope: flags and arg3 are zero; arg0 packs grant slot in bits 0..31 and source slot in bits 32..63; arg1 packs child destination slot and exact requested rights; arg2 packs nonzero process ID and nonzero staged generation. Both response values remain zero. The operation is admitted only where grant installation is already allowed (process-control and child-population endpoints, with existing bootstrap control policy preserved). The held unique grant remains the authority; the supplied process/generation pair is an additional equality constraint, never a target-selection grant. Revalidate exact native grant binding, GRANT possession, child/staged identity and current staged liveness, slot and type/rights ceilings, actual source binding and empty destination before transfer. Unlike legacy zero-means-inherit installation, this operation always uses the exact supplied rights, including zero. Reject nonzero reserved input and zero identities deterministically; mismatched target identity must produce no installed alias or new revocation lineage. Keep old producer semantics unchanged until explicitly migrated. Share the native installation implementation and split the existing near-1000-line control dispatcher by responsibility. Tests must use actual moved install grants for distinct staged children, wrong/stale generations, occupied destinations, explicit zero rights, invalid fields, denied endpoint policy, preserved source/grant custody and native lifetime/revocation behavior. Connect the new checked operation to typed Procd bootstrap provisioning; a standalone scalar codec or host-only table is not realm runtime acceptance. Complete receiver readiness, setup-authority disposal, fair terminal/provider scheduling, two-realm byte I/O and both full guest builds remain required. Process-bound installation checkpoint — 15 September 2026: Signed `f1105706cc19ed024a6cca79a29abc57c90c6661` connects ordinary launch-description installation to native operation 52 with exact retained process/generation and SEND rights. Kernel rejection preserves pending stream state; staging disposal and exact child rollback remain owned across lost replies. Default/all development/release matrices pass 227/232 tests including auxiliary binaries, strict host/native Clippy, forty freestanding builds with repository linker scripts, private rustdoc, formatting and Markdown. The initial incompatible IRQ-helper IPC type graph was corrected by aligning five original helper commits; initial generic-linker invocations are retained as validation setup failures. Typed realm bootstrap and complete consumer image adoption remain open. Process-bound native acceptance — 15 September 2026: Signed Kernel `60da5858d7198185efd103f0e91e5ac2e0b63e67` implements control operation 52, checking the actual moved install grant against expected process/generation with exact rights, including zero, under existing endpoint policies. Signed Procd `f1105706cc19ed024a6cca79a29abc57c90c6661` uses this operation in its actual ordinary launch-description producer while retaining the narrow SEND receipt, pending state and exact failure cleanup. IPC `c453b697b8cdb9cc1c36f1ad89ff868648190025`, capability ABI `fe8d558253ad01301b99554e20d287c4ea35bb1d` and five aligned helper commits preserve original Git/type identity. Integration `58c925c564b69bebce8df6f3e75a9312824e18c4` passes the expanded lifetime CPL3 scenario with thirteen actual control calls, user-side reply checks, two staged children and full added-custody disposal. The corrected lifetime image SHA-256 is `8e6a9e8f68b90cc1ede61300958cec122b82a7c6dfd6318a51e40fefc7ba166e`; the unchanged owned-invocation scenario also passes with image SHA-256 `b76a380d3cd6b03b0ff61a3b626ace0667679920684ad7356a1c3a36e2224953`. Both have clean teardown and empty QEMU stderr. The initial fixture setup-order failure is retained and corrected in Kernel issue #14. All strict default/all development/release matrices pass: IPC 371, shim 20, capability ABI 191, Kernel 648/672 including standalone controls, Procd 227/232 including auxiliary binaries, and Integration 320/321 tests. Existing native-only ignores are unchanged. Procd passes forty native binary builds with repository linker scripts. All 162 Integration helpers pass after updating the exact policy assertion to require the new marker; its initial mismatch remains recorded. Docs `b0fcf0f43af2af741d520a0b1373cc346e08863c` updates the native wire/ownership contract, operation registry, Procd boundary and three generated shared APIs. All 45 tests and the complete 2,367-page manual pass, with zero final warnings, 431,138 word boxes within page bounds and four reviewed protocol/API pages. Current IPC 339/340, capability ABI 216/217, Kernel 560/561 and 562/563, Procd 266/267, Docs 869/870 and all five helper push/review CIs pass with complete classified logs and no final warnings. Those component cohorts are stopped. Current full Integration 1623/1624 waits at observation 01. Older full Integration 1615/1616 is running at observation 11; 1617/1618, 1619/1620 and 1621/1622 wait at observations 09, 07 and 04. No pending full suite is counted as passed. Typed realm bootstrap, mediator startup/readiness/configuration/seal, complete consumer image adoption, fair terminal/provider retirement, broader native disposal failures and both full EriX-in-EriX build generations remain open. The new inventory covers 76 repositories, 2,950 code files below 1,000 lines and 158 direct missing_docs crate-root gates; complete inline documentation and whole-codebase authority closure remain open. Prior performance measurements retain their original signed source identities; this checkpoint claims no new timing or guest performance result. Staged mediator source checkpoint — 15 September 2026: Signed Loaderd `adefd028c47d0e60bde65ef2ff2d95c8bfae11b6`, Launchd `64b563482c9ecab115283fe56c8562d948fbbabd` and Procd `cdb0fe4d1496073521626ce21f0fa2c95a81bd36` implement separate exact-executable mediator staging. Operation 0x654 is correlated end-to-end; Procd retains the actual endpoint master and moves only the actual install grant. The mediator class cannot use ordinary start, immediate commit, TTY provisioning, powerbox installation or automatic restart. Exact-stage rollback and lost-reply custody remain owned. Shared IPC `5fa5fdb2edbfe963efae1c11f99a3a58d0062509` and capability ABI `e5a3e864491479981b9ab37749109dafe52fa330` plus six original helper commits form the coherent dependency graph. Default/all development and release matrices pass: IPC 371 plus shim 20 (one existing native-only host ignore), capability ABI 191, Loaderd 90, Launchd 326 and Procd 233/238 tests. Strict host/native Clippy, warning-denied freestanding builds, private rustdoc, formatting and Markdown checks pass. Procd has forty native binary builds and six new mediator refusal/cleanup regressions. Loaderd exercises both staging classes through the existing complete-graph producer test. The TTY transaction, its test support and lifecycle policy tests are split into files below 1,000 lines. All six aligned helper libraries pass their full matrices. Current shared IPC CI 341/342 and capability ABI 218/219 pass with all eight complete warning-free logs. Older full Integration 1615/1616 now passes all 486 scenarios and subsequent native probes with six complete classified logs; its three deliberate negative diagnostics per integration job are retained. New producer/helper review CI is pending. No Posixd executable or coordinated realm VM acceptance is claimed. Actual grant-return provisioning, authenticated caller ownership, typed startup memory/inventory, readiness, configuration/seal, client I/O, fair retirement, complete consumer image adoption and both full guest build generations remain open. The manual update is being validated separately. ### Native bootstrap destination correction — 15 September 2026 The temporary endpoint destination is now child-local slot 4, after the mandatory CSpace, VSpace and TCB roots in slots 1–3. The initial slot-1 contract was incorrect: the actual native constructor returned DENIED before creating a child. The original failure and published source identities are retained in [capability ABI bug #3](https://git.erikinkinen.fi/erix/lib-capabi/issues/3). Capability ABI `c7c72ae2a777b2a9f4ae5d7fb8eef86e5fc1fae5` corrects the constant; Kernel `b98156427362a468ae78195a3582901e2474fea5` adds an actual constructor regression and six CPL3 creation/cleanup calls. The expanded lifetime VM passes with ordered, unique staging and cleanup markers and empty QEMU stderr. This proves the constructor boundary; coordinated mediator startup, seal, client I/O, retirement and full guest builds remain open. Matching component CI is still being monitored. Corrected native staging checkpoint — 15 September 2026: Signed source `e48a0e9992eacf69b4c0be6c4ce8de6bdf5fdd47` is recorded in [the current review](https://git.erikinkinen.fi/erix/procd/pulls/2). Retain the mediator endpoint master privately, transfer only the install grant and prohibit ordinary start, restart, TTY and powerbox provisioning paths. 233/238 default/all tests, forty native binary builds, strict Clippy and private rustdoc pass. Six mediator authority/cleanup tests cover ordinary-path refusals. CI 270/271 passes with complete warning-free logs. Actual grant-return provisioning, authenticated receiver readiness, configuration/seal, client I/O, fair retirement, whole-codebase authority/documentation closure and both complete guest build generations remain required. No runnable Posixd realm or guest-build acceptance is claimed. Native terminal generation implementation — 17 September 2026: Signed revision `2983f807cf7517250239872046f24d75bb9900c6` is pushed. Native retirement, signal and stop completion compare the exact original process/generation pair. Stale and already observed generations cannot initiate accounting or cleanup. Four new controls and the complete strict host/native matrix pass, including forty freestanding binary builds. Matching native execution and coordinated consumer rollout remain in progress; runnable realm bootstrap and complete guest builds are not established. Original automatic CI is monitored without retries. Coordinated terminal observation checkpoint — 17 September 2026: Signed revision `2983f807cf7517250239872046f24d75bb9900c6` is pushed. The generation-bound consumer passes its full strict host/native matrix and original CI 278/279, with all four terminal logs complete and no warnings. The isolated native producer checks also pass; ordinary service-image adoption is separate. Typed mediator bootstrap, ordinary service-image adoption and both complete EriX builds inside EriX remain open. Planned exact-generation native cleanup — 17 September 2026: Define distinct native terminal-destruction and staged-abort operations 56 and 57. A checked request carries the nonzero original process/generation pair in the low/high 32-bit halves of arg0; flags and all other arguments are zero. Retire selectors 8 and 35 without reinterpreting them or adding a compatibility fallback. The existing held Process or Root route remains required; descriptive identities do not grant authority. Match the exact pair under the same TCB record lock that enters retained cleanup. Preserve terminal-versus-Created eligibility, partial disposal and retry custody. An absent or different generation acknowledges absence of only the requested instance, with zero response values; it cannot mutate a replacement. Migrate every native caller and carry creation/event generation through deferred retries. Account for processes created before a service's own managed ledger without reconstructing historical identity from the current record. Maintain separate terminal observation, cleanup custody, provider completion and native absence. Required evidence includes exact wire and reserved-field controls, actual-object generation/reuse and failed-release controls, consumer cleanup tests, and bounded CPL3 native coverage. Update all operation inventories, Rootd's measured audit contracts, canonical documentation and manual/API references. Validate coherent original commit dependencies, complete strict component matrices and repository CI checks, then monitor original workflows. Ordinary mediator start, whole-image admission and both complete builds inside EriX remain separate open gates. Generation-bound native cleanup checkpoint — 18 September 2026: Signed revision `92e19c3ec60ffd5cb3bc16cde3a2316cd3bb1556` is pushed. Staged rollback and deferred destruction retain the original generation. Pre-service terminal events own exact native cleanup without managed successor or provider effects; intake checks cleanup capacity before dequeue. Complete native framing and correlation precede result interpretation. Nine added controls pass with 247/252 main-binary units, five probe tests and forty native builds across the strict default/all-feature development/release matrix. Native transport and cleanup custody are separate cohesive modules. Ordinary service-image execution remains required. Formatting and Markdown checks pass. Original [CI 280](https://git.erikinkinen.fi/erix/procd/actions/runs/280) and [CI 281](https://git.erikinkinen.fi/erix/procd/actions/runs/281) passes; all four terminal logs are complete (332,946 bytes), without warnings. Runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain separate open acceptance requirements. Returned-grant bootstrap custody design — 18 September 2026: Add distinct Procd PREPARE_REALM_BOOTSTRAP (0x432) on the existing private Launchd route. The native pending caller must match a retained running Launchd generation. Its exact 32-byte request carries u32 request ID, opcode, original process/generation, source and original destination install-grant slots, then two zero words. The actual sole receipt must be INSTALL_GRANT with exactly GRANT|MINT. Slots are full-width descriptions; receipt, live inventory and native matching-grant checks establish custody. Previously guarded, started, stale, ordinary-role and malformed stages refuse before new effects. Reserve exact rollback ownership first. Use the real returned grant and native operation 53 to narrow the Created child's primary endpoint to RECV. Establish an ancestor SEND branch under Kernel lifetime custody and a distinct nested explicit revoker before any export. Retain the nested sender privately; dispose the original master, unguarded sender and ancestor-only bypass aliases. The returned install grant stays exclusively owned for later typed installation. No new endpoint factory or expanded Process endpoint policy is implied. The exact 32-byte capability-free reply echoes request/opcode/result/process/ generation, followed by a u32 custody state and two zero words. State 1 occurs exactly with OK and confirms only guarded unstarted-stage custody; failure state 0 is not absence proof. Lost reply, rollback, abort, supervisor loss and terminal cleanup must account for every reused scratch column, actual guard and exact child identity. Uncertain disposal prevents reuse and ordinary continuation. Keep ordinary mediator starts denied. Counted final receivers/configuration, owned fair intake/provider/retirement progress, private execution, authenticated readiness, initial receiver disposal, seal/publication, real two-realm client I/O and both complete builds inside EriX remain required. Host models or this guarded stage acknowledgment cannot substitute for those acceptance gates. Returned-grant consumer checkpoint — 18 September 2026: Signed revision `4e233515341067f6b6d3503db0acb61da6d54422` is pushed. Actual native caller/grant admission precedes reservation of all five existing scratch columns. Matching-grant attenuation, ancestor lifetime deposit and a private nested sender/revoker remove original masters and bypass sources. Partial failure, failed acknowledgment delivery, exact supervisor loss and terminal retirement exhaust role-owned cleanup and preserve the first uncertainty, preventing ordinary continuation and row reuse. Eleven added controls pass with 258/263 main-binary units, five probe tests and forty native builds. Ordinary mediator execution remains denied. Formatting and Markdown checks pass. Original [CI 282](https://git.erikinkinen.fi/erix/procd/actions/runs/282) and [CI 283](https://git.erikinkinen.fi/erix/procd/actions/runs/283) passes; all four terminal logs are complete (336,168 bytes), without warnings. Matching consumer VM execution, runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain separate open acceptance requirements. Deferred native cleanup scheduling — 18 September 2026: Give retained native destruction one attempt before each ordinary service intake turn, rather than draining only during idle intake. Preserve the original process/generation and first unacknowledged failure; rotate failed owners so independent queued instances receive attempts. Only a complete exact-generation native cleanup acknowledgment removes an owner. Reserve existing deployment-sized queue capacity before native event dequeue. This adds no capability or process selector and changes no native ABI. Continuous-intake, failure, capacity and wrapped-queue controls will validate the scheduling boundary. One native call bounds work count, not elapsed time. Legacy transfer rendezvous, terminal intake and synchronous provider completion remain separate work before complete realm fairness or consumer VM acceptance. Deferred native cleanup checkpoint — 18 September 2026: Signed `507a98f53462b688d9008931aab09902713ed805` gives each deferred native cleanup owner an independent turn before request intake. Unacknowledged owners rotate with their exact generation and first error retained. Five new controls and four strict matrices pass: 263/268 main units, five probe controls, forty native builds, formatting, strict Clippy and private-item rustdoc. The original Integration layout reader accepts both compiler-produced record layouts; checked page-rounded arenas remain unchanged. Original [CI 284](https://git.erikinkinen.fi/erix/procd/actions/runs/284) and [CI 285](https://git.erikinkinen.fi/erix/procd/actions/runs/285) pass from all four complete logs (337,764 bytes), without warnings. [Bug 3](https://git.erikinkinen.fi/erix/procd/issues/3) records the bounded scheduling correction. Legacy terminal/provider progress, actual consumer VM execution, complete realm fairness and both full guest builds remain open. Caller-local grant relocation design — 18 September 2026: Add immediate x86_64 syscall `0x54`, `RELOCATE_LOCAL_GRANT`, taking source slot in argument 0 and destination slot in argument 1. Both fit u32, are nonzero and distinct; arguments 2–5 are zero. The return is the exact result in rax with zero auxiliary value. Admission uses the actual current Running native process and nonzero generation, checks both slots against its syscall window, and accepts only an actual held INSTALL_GRANT or REVOCATION_GRANT with its matching native record. Movement uses the existing unique-record rebinding within that same native CSpace; rights, child/generation installation scope and revocation lineage are preserved. No grant is constructed, copied, attenuated or retargeted. Malformed register shape rejects before context lookup; caller/window checks precede source lookup, then type/binding checks precede empty-destination admission. Ordinary validation refusal leaves inventory unchanged. The transition is serialized with process-terminal and reply-authority lifecycle changes. Owned CLAIM already selects receiving destinations before exposing request bytes; this operation lets a producer validate the received grant and then relocate it into an existing per-process custody slot. The operation itself does not validate a bootstrap request, install child authority or acknowledge application retirement. It adds no Process endpoint selector or general CNode route. Literal register, foreign/terminal caller, missing/fake binding, occupied destination, exact-rights/scope and actual CPL3 controls are required, followed by coordinated producer/consumer adoption and the remaining realm VM gates. Owned receiver request-budget contract — 18 September 2026: Extend register-only REGISTER (0x4C) to take the actual local RECV slot, maximum request payload bytes and maximum request capability count in arguments 0–2; arguments 3–5 remain zero and successful RDX is zero. Both budget values are explicit receiver declarations. Zero/zero admits only empty requests. The byte/slot/receipt receive layout must be addressable and capability capacity must fit native private CSpace storage. The actual Running generation and held generic RECV endpoint remain the registration authority. Exact repeated registration is idempotent only with the same budget; a different budget or owner conflicts without modifying the original registration. Replacement follows the existing actual receiver-binding removal and exact native retirement rules. SUBMIT compares actual payload length and capability count against that exact registration before request allocation, private-space reservation, native transfer or invocation serial acceptance. Oversized requests return ordinary INVALID_ARGUMENT with zero owner ID and unchanged source custody. The packet decoder passes its checked capability iterator directly to native preparation, removing its redundant temporary vector. Accepted invocation, result-budget, delivery, draining and retirement contracts remain explicit. Migrate every producer and fixture to the new signature without a deprecated unbounded fallback. These budgets describe service-owned receiving storage; they add no global CALL-size ceiling, user-pointer retention, foreign selector or capability grant. Literal malformed/zero/exact registration controls, rejected-inventory checks, actual CPL3 calls and existing VM oracles are required. Then connect the owned Procd/Launchd bootstrap path through its held private route, actual claimed caller identity, server-chosen grant receipt and local relocation, retaining each committed/draining owner through exhaustive cleanup. Actual consumer VMs, complete fair realm progress and both full guest builds remain open acceptance requirements. Owned guarded-bootstrap service contract — 18 September 2026: Migrate PREPARE_REALM_BOOTSTRAP to native owned request/result custody on the already held private Launchd-to-Procd endpoint. Its exact 16-byte body contains request/opcode/process/generation only; remove obsolete source and destination slot descriptions. The canonical capability-free response remains 32 bytes. No legacy bootstrap transport fallback is retained. Procd registers explicit 16-byte/one-capability request limits, supplies an actually empty local receiving slot, validates the committed receipt type and rights and matches the native claimed origin to the retained Running Launchd generation. It validates the exact staged mediator row and actual grant scope before adopting the grant into that row through caller-local relocation. Existing launch-description staging may be reused only with explicit exclusive ownership and proved completion of its former cleanup; add no broad Process authority or per-realm scratch column. Numeric identity or receipt metadata never replaces actual possession or scope validation. The running service loop must give native retirement a turn before owned bootstrap and ordinary intake. Retain nonzero delivery/invocation owners, received authority, exact child rollback and first cleanup failure through committed/draining outcomes. Complete every independent local and child retirement action before relinquishing bookkeeping; uncertain cleanup cannot return a service to ordinary work. Authenticate actual native origin and revalidate the original supervisor before effects; do not manufacture legacy pending-caller or source-slot receipts. Replace Launchd synchronous bootstrap exchange with retained progress driven by its actual runtime orchestration. Success requires a canonical correlated result, actual source-grant absence and complete invocation retirement. Connect this to authenticated staged realm preparation, with no public numeric shortcut into a prepared process. Preserve ordinary start refusal until realm configuration, readiness and sealing are complete. Acceptance requires adversarial ownership/cancellation/partial-cleanup host controls, strict coordinated builds and real producer/consumer VM execution. Native primitives alone do not establish service adoption, complete fairness or a full guest build. Existing ordinary source/effect/frame and two complete EriX-in-EriX build gates remain unchanged. Owned bootstrap receiver checkpoint — 18 September 2026: Signed `1e8713ae4c49ab9a3bc927031936585d4a1f76fd` connects the Procd service loop to native owned bootstrap intake on the existing private receiver. It admits 16 request bytes and one actual grant, selects and proves empty exclusive ingress, authenticates claimed Launchd origin and validates native child scope before local relocation into the existing row. The obsolete legacy bootstrap handler is removed. Retained delivery and exact-stage custody survive draining; application cleanup precedes native relinquishment, and uncertain cleanup prevents ordinary intake. Ready owned and ordinary admission alternate with native deferred destruction first. Twelve owned-driver and two scheduling controls cover custody, negative cases and retirement. Four strict configurations pass: 273/278 main units, five probe tests, forty warning-free native builds, formatting, Clippy and private-item rustdoc. Original [CI 286](https://git.erikinkinen.fi/erix/procd/actions/runs/286) and [CI 287](https://git.erikinkinen.fi/erix/procd/actions/runs/287) pass from all four complete terminal logs (340,704 bytes), without warnings. These host controls and builds do not establish actual consumer VM execution. Actual Launchd runtime orchestration, full provider/terminal fairness, configuration, readiness, seal and both complete guest builds remain open. Original realm supervisor and producer cancellation contract — 18 September 2026: Extend BEGIN_MATERIALIZATION to an exact 64-byte body. Its existing 56-byte semantic image description is followed by two full-width u32 fields: original supervisor process ID and generation. Both are nonzero only for the realm mediator role; both must be zero for every other role. Reject the obsolete 56-byte shape. Coordinate the shared codec, Loaderd and Procd through one original pinned dependency graph. On PREPARE_REALM, Loaderd obtains the supervisor pair from the actual native pending caller on its private Launchd receiver. Procd authenticates the actual Loaderd caller on its materialization receiver and matches the forwarded supervisor to its retained Running Launchd generation before any child effect. The pair describes delegated lifecycle responsibility; numbers alone never confer creation, installation or rollback authority. Retain that original owner before materialization and through grant handoff, native submit/claim and guarded staging. Supervisor terminality retires active preparation and every corresponding stage before unrelated provider cleanup. Guard admission must match the original supervisor, never replace it with a later claimant. Launchd retains child rollback and native invocation ownership separately. Caller RELEASE initiates cancellation and must precede any ordinary abort request that could wait behind Procd delivery retirement. RELEASE is not an application rollback acknowledgment: preserve the exact child obligation until its separate cleanup proof. Procd exhausts independent local and child cleanup before server RELINQUISH. Both parties retain nonzero native IDs and the first cleanup failure through draining; no uncertain state returns to ordinary work. Actual Launchd runtime preparation and scheduler adoption, deployment-sized ownership storage, adversarial host controls and real producer/consumer VM execution remain required. Guarded staging does not authorize ordinary start or establish configuration, readiness, sealing, complete fairness or either full EriX build inside EriX. Existing source, effect and frame gates remain. Original supervisor service checkpoint — 18 September 2026: Signed `3210f44b4fee05a7dd4f0ff25c2664629cc76aa2` is pushed. Authenticate the actual private Loaderd caller and original Running Launchd before creation; retain supervision through preparation, grant handoff and owned bootstrap. Match the original owner before adopting stage rollback. Loaderd rollback ends at guard admission. Supervisor retirement exhausts active preparation and independent committed stages even after a cleanup refusal, preserving exact obligations and first errors. Eight new controls preserve earlier coverage. Four strict default/all matrices pass with 281/286 main units and five probe tests; ten production matrices also pass, for fifty native builds in total. Formatting, strict Clippy, private rustdoc and Markdown pass without warnings. Original [CI 288](https://git.erikinkinen.fi/erix/procd/actions/runs/288) and [CI 289](https://git.erikinkinen.fi/erix/procd/actions/runs/289) passes with all four terminal logs (343,310 bytes), without warnings. Actual Launchd owned producer/runtime adoption, coordinated consumer VM execution, complete fairness, configuration/readiness/seal and both full guest builds remain open. Coherent realm image service prerequisites — 18 September 2026: Signed `ea41ec37d36058f0027507ed1ecdb34d773b2aaf` selects the original shared wire/startup dependency graph. Direct Rust implementation bytes are unchanged. All 14 default, all-feature and separate production development/release configurations pass 286/288/291 unit tests per configuration, strict host/native Clippy and freestanding linking with fatal linker warnings. Formatting, private-item rustdoc and Markdown pass, with zero warnings. Original push/PR CI is under observation. Matching catalog adoption and real consumer VMs remain requirements; complete realm and full in-guest build acceptance remain open. Original coherent realm source CI acceptance — 18 September 2026: Signed `ea41ec37d36058f0027507ed1ecdb34d773b2aaf` passes [CI 291](https://git.erikinkinen.fi/erix/procd/actions/runs/291) and [CI 290](https://git.erikinkinen.fi/erix/procd/actions/runs/290). All four terminal logs are complete (343,244 bytes), with zero final warnings. This closes the original CI observation recorded above. Coherent catalog publication, actual consumer VMs and full guest-build acceptance remain separate open requirements. ## Tracking and rollout ### Runtime consumer dependency alignment — 15 September 2026 Signed `a6658875dc767210a489389a1b2b8bbfb21a42e1` aligns the existing dependency selections with the original signed runtime graph. This checkpoint changes Cargo selections and the roadmap; this repository's Rust implementation files are unchanged. Formatting, strict Clippy, private rustdoc and canonical documentation checks pass without warnings. Default/all-feature development/release tests pass 239 default / 244 all-feature tests. Independent production configurations also pass strict host/native Clippy and native builds: `procd-runtime`: 239 development / 239 release tests, `procd-runtime-release-image`: 239 development / 239 release tests, `procd-runtime-logging`: 239 development / 239 release tests, `procd-runtime-crash-reporting`: 241 development / 241 release tests, `procd-runtime-interrupt`: 241 development / 241 release tests. There are 50 supported native builds in total. Push/review CI 276/277 passes with complete classified logs and no final warnings. The product catalog, product VM acceptance and guest build remain pending. Review: https://git.erikinkinen.fi/erix/procd/pulls/2. ### Coherent runtime source adoption — 15 September 2026 The product runtime catalog still selects the earlier source graph. Adopt the current original signed sources as one coherent graph before claiming product execution of the new kernel invocation, mediator construction and Procd caller-admission contracts. The frozen inventory covers 73 catalog components and 72 tracked Cargo manifests; 54 components need direct pin alignment, with further propagation after dependency commits are published. Align dependency selections bottom-up, preserve original Git objects, and validate every altered repository under its supported strict configurations before signing and publishing its dependency commit. Full commit selectors remain mandatory. Unrelated work is preserved, and no synthetic replacement object or rewritten published history supplies build evidence. Update the runtime catalog only once all selected Cargo manifests and original metadata agree. Run actual product images covering authenticated Launchd activity and the relevant lifecycle/authority regressions, adding negative caller controls where needed. Keep complete warning-free build/test/image evidence and monitor existing CI. Significant regressions use the canonical bug report format. Dependency alignment alone does not prove runtime authority closure, mediator execution, performance improvement or either complete guest build generation. Typed grant return and guarded bootstrap remain the next realm implementation boundaries. ### Native caller admission checkpoint — 15 September 2026 Signed Procd `c583614aa48f3e11a3ccabfeee06340f518de750` now checks the actual pending native caller on Launchd ingress against its retained running Launchd process and stage generation before operation-specific receipt validation or dispatch. Forwarded SEND aliases, request-body identities, other lifecycle roles, reused generations and unavailable identity cannot acquire this dispatch permission. Other receivers retain their policy; rejected delivered transfers still undergo local disposal, and uncertain disposal stops ordinary continuation. Five new producer controls exercise accepted event dispatch and refusals without consuming the private event. The complete strict host/native development/release matrix passes: 239 default-feature tests, 244 all-feature tests, Clippy, rustdoc, formatting and forty native binary builds, with no warnings. The changed runtime-loop fragment is formatted by the repository formatter; its other code matches the formatted original outside the reviewed admission replacement. Signed documentation `45d4d04c534f2ebca857ee203265232fd7c32bbe` passes 45 tests and a frozen 2,375-page manual with 433,469 in-bounds word boxes and no final warnings. Page 212 was visually reviewed. The receiver inventory also corrects the existing powerbox omission and obsolete loader operation count. Shared API snapshots are unchanged. Procd CI 274/275 and Docs CI 879/880 pass with complete classified logs and no final warnings. Both component cohorts are complete. Product runtime-image validation still requires a coherent original-commit dependency graph; this checkpoint does not claim a new Procd VM. Actual returned-grant custody, guarded bootstrap, readiness/configuration/seal, mediated client byte I/O, fair retirement and both complete guest build generations remain open. ### Native caller admission — 15 September 2026 Before mediator bootstrap shares an existing receiver, Procd will authenticate every Launchd-ingress CALL using the kernel's pending-reply caller identity. The actual process and stage generation must match a retained, started, running Launchd record. A forwarded sender, another lifecycle class, stale generation, absent delivery or unavailable identity must not gain Launchd dispatch permissions. Receiver selection and caller authentication remain separate checks; request-body identity fields cannot authenticate the sender. The check precedes operation-specific receipt validation and all handlers. Refused transfer-bearing calls retain actual receipt disposal; uncertain disposal still stops ordinary service operation. Other configured receiver policies remain unchanged. There is no new wire operation, capability grant, fallback identity or mediator start permission. Validate accepted dispatch, identity refusals and original transport errors, then run the strict producer matrix and appropriate runtime acceptance. Actual grant return, guarded bootstrap, readiness/configuration/seal, mediated byte I/O and both complete guest build generations remain required. ### Validated mediator constructor adoption — 15 September 2026 Procd selects checked native operation 54 only for mediator staging, without a parent VSpace receipt. The native TCB retains backing; the child initially holds only its primary endpoint. Other roles retain ordinary construction and its existing receipt/drop sequence. A refusal never falls back to operation 32. Scratch absence cleanup, exact stage retirement, private endpoint-master custody, grant-only handoff and all ordinary mediator start gates remain in place. Signed original revision `3d9fe97bb66ea82442728ef8a10b998d7159a9ba`. Procd passes 55 focused materialization controls and 234/239 default/all tests, strict host/native Clippy, rustdoc, formatting and forty freestanding builds across ten binaries. Exact requests, omitted receipt/drop, materialization, refusal without fallback and unchanged ordinary behavior are covered. CI 272/273 passes with complete warning-free logs. The previously accepted Kernel 6d2ca19c native fixture establishes the constructor object, root-absence and backing contract. This checkpoint adds producer transport controls; it does not claim a new Procd CPL3 VM, runtime-image adoption or runnable realm. Integration source and native VM inputs are unchanged. The manual is signed at Docs `8b30523f3d7e1c300f39e3418a8748dae10ec04f`; all 45 tests, final warning-free rendering and CI 877/878 pass. Runtime-image adoption, authenticated grant return, guarded bootstrap routes, private execution, receiver readiness, configuration/seal, client I/O, fair retirement and both full guest build generations remain open. Whole-codebase semantic authority and private-item documentation audits remain incomplete. ### Mediator constructor adoption — 15 September 2026 Procd will select checked native operation 54 only for the mediator lifecycle class, with no parent VSpace receipt. Native TCB custody retains the mapped backing. Ordinary roles retain operation 32 and its existing receipt/drop sequence. Scratch absence cleanup, complete failed-stage retirement, grant-only handoff, retained endpoint master and all ordinary mediator start gates remain required. A refusal of operation 54 must never fall back to operation 32. Extract the materialization constructor and test transport before adding coverage so each code file remains below 1,000 lines. Verify the exact constructor request, omitted receipt and drop, ordinary behavior, refused construction without fallback, materialization and final cleanup. Existing native construction evidence remains the authority/object proof; producer transport doubles do not establish a running mediator. Shared pins will select signed IPC `7c7712057cc5d16ab16a677a886caeac54814a16` and capability ABI `2d6b12832b3f0d798756a9c7f29a7c52a8b3bc70` through the existing dependency graph. Authenticated grant return, guarded bootstrap routes, private execution, readiness, configuration/seal, fair retirement and both complete guest build generations remain open. ### Construction without child root capabilities — 15 September 2026 Native prerequisite implemented at Kernel `6d2ca19c48d3663db4b3a1eba4e9b7588b351f6f` with shared IPC `7c7712057cc5d16ab16a677a886caeac54814a16`. Kernel operation 54 admits only actual Process endpoint holders and constructs a Created child with exactly one primary endpoint and no root capabilities. The native TCB retains address-space backing independently. The caller receives a unique install grant, an endpoint master and only an explicitly requested MAP-only VSpace receipt. The checked request distinguishes absence from a genuine slot-zero receipt. Former-root slots are usable; actual caller windows, native capacity, occupancy and child window scope remain enforced. Rollback disposes only successful new receipts and the partial child while preserving pre-existing bindings. Ordinary operation 32 remains unchanged. Initial inventory is not a seal or a permanent ban on later explicit installation. Both isolated native VMs pass; no runnable mediator follows from this prerequisite. Procd adoption, authenticated grant return, guarded bootstrap authority, private mediator execution, readiness, configuration/seal, client I/O, fair retirement and both complete guest build generations remain open. Ordinary mediator start gates remain closed. Whole-codebase semantic authority and private-item documentation audits remain incomplete. ### Staged endpoint attenuation checkpoint — 15 September 2026 Native prerequisite implemented at Kernel `d690eda817e56b515a278bdbb5ea6c5aedeb431b` with shared IPC `74c75a5db226413c066b6582210a44cb21d968d8`. Kernel operation 53 narrows only the actual install grant's matching Created child's primary endpoint. The grant must cover the current rights as well as the requested result. Final identity/state checks and the allocation-free CSpace mutation share the child record lock. Exact zero and repeated reduction preserve object identity, other aliases and revocation associations; restored rights, stale or foreign targets, malformed fields and started children refuse. Both isolated native VMs pass; this does not establish a runnable mediator. Authenticated grant return, independently minimal bootstrap/root authority, retained native and nested guards, private mediator execution, configuration/seal, client I/O, fair retirement and both complete guest build generations remain open. Ordinary mediator start gates remain closed. Whole-codebase authority and private-item documentation audits remain incomplete. - Parent work: https://git.erikinkinen.fi/erix/integration/issues/2 and https://git.erikinkinen.fi/erix/docs/issues/1. - Branch: `feature/posix-compat`; update linked WIP PRs after coherent signed checkpoints using canonical CONTRIBUTING.md messages. - Baseline revision: `c7607afcbe8691a4c10a1e8e811c6542759db72f`; refresh component/dependency heads and their own CI evidence as implementation advances. - Cross-repository dependencies remain full lowercase commit hashes; update the selected graph deliberately. This issue does not authorize merges, release tags or replacement of published images. Next native validation — 19 September 2026: add an opt-in Exsh guarded-preparation diagnostic using the existing realm ABI. Keep the passing eleven-call admission-only scenario separate. The new diagnostic will reserve a record, transfer exactly one SEND-only copy of its explicitly supplied startup cwd to the BEGIN-reserved receipt slot, select `bin/true` within that initial root scope, require PREPARE/Guarded and READ/Guarded, then require ABORT/Retired and a stale READ/NOT_FOUND. The packaged native `true` executable is an unstarted staging fixture; it does not stand in for a running POSIX mediator. The existing authenticated private Launchd route remains the sole request path. No ordinary start, new endpoint, root capability or implicit namespace is introduced. Launchd must retire its received directory copy after exact resolution; Loaderd must return the original staged child and grant, and Procd must retain the actual returned grant and guarded sender branch before acknowledging Guarded. Abort must retire that exact stage and retained custody. Error telemetry must preserve application refusal codes and stop ordinary output after uncertain receipt disposal. Independent host controls will cover literal operation order, transfer scope/rights, full correlation, missing or malformed acknowledgments, surplus receipts and no continuation after failure. The new actual VM retains the 120-second hard and 45-second progress limits and requires its own unique marker before ordinary shell exit. Full source/effect/frame proof, configured/sealed mediator execution, real client byte I/O, native Rust/LLVM rebuilding and both full EriX builds remain required. Native guarded preparation — 19 September 2026: signed Integration `78557a6c672ecf426dfe894a01cc4aeec73b5e3c` selects signed Exsh `ffe50612889dd58a45a40d04593a4aa3a3ffa512` for the separate `appliance-disk-image-realm-preparation-positive` scenario. The actual VM passes the eleven existing admission calls followed by BEGIN/Reserved, PREPARE/Guarded, READ/Guarded, ABORT/Retired and stale READ/NOT_FOUND. It transfers exactly one SEND-only copy of the explicitly supplied initial cwd to the authenticated reservation and selects `bin/true` inside that scope. This packaged executable remains an unstarted staging fixture. The existing private Launchd route is reused; no new endpoint, root grant or implicit namespace is introduced. Exactly one admission marker and one `ERIX_EXSH:REALM_PREPARATION:VERIFIED` precede ordinary successful initial-shell exit. The original 120-second hard deadline and 45-second progress watchdog remain unchanged; scenario status is zero and build warnings are absent. The separate admission-only scenario is preserved. All 106 actual appliance artifacts and complete logs are retained. Serial SHA256 is `7ef35833c2d88abcd093c8813791e11cea0d34edb2e29b8686df6996e2bc32ff` (55,776 bytes); post-VM writable disk SHA256 is `3439d0750ea456ceb8d9fbb063d6af763b4198a85f0270ae8d22c76c6ff99499`. Its earlier packaging checksum is retained separately. Independent artifact review verifies all 73 original component revisions, both diagnostic markers in the actual packaged executable, and the signed image's exact 72-byte LCH1 version-3 configuration with four realm records and a 102,400-byte native arena. All 169 Integration helper commands, seventeen route/scenario controls and four strict 320/321-test Rust configurations pass, including native builds, fmt, strict host/native Clippy and private rustdoc; all 394 host streams are warning-free. The post-validation source delta changes only the two Exsh catalog pins and final documentation status, preserving checked implementation bytes. Exsh passes ten strict 976-test configurations, ten native builds and 355 frame-checker controls without warnings. Eight actual frame observations retain complete workspace mapping but incomplete 97/63/100/100 runtime/all/admission/preparation proof in both policies; the full frame gate remains required. Original [Integration CI 1677](https://git.erikinkinen.fi/erix/integration/actions/runs/1677) and [1678](https://git.erikinkinen.fi/erix/integration/actions/runs/1678) are queued. Original [Exsh CI 271](https://git.erikinkinen.fi/erix/exsh/actions/runs/271) and [272](https://git.erikinkinen.fi/erix/exsh/actions/runs/272) are under observation. Complete typed mediator bootstrap, readiness/configuration/sealing, real client byte I/O, complete source/effect/frame proof, native upstream Rust/LLVM rebuilding and both full EriX build generations remain required. This prerequisite adds no accepted whole checklist item. Minimum bootstrap design — 19 September 2026: signed [Posixd proposal](https://git.erikinkinen.fi/erix/posixd/src/commit/3e6292bd3e5c6a3e59dbae54124f8eea52141957/docs/minimum-bootstrap.md), in [PR 5](https://git.erikinkinen.fi/erix/posixd/pulls/5), specifies the next ownership boundary before codec or runtime implementation. Launchd uses its existing endpoint factory and retains the private configuration RECV/GRANT alias; the child receives only its existing control RECV and a guarded configuration SEND. Counted startup records and actual receipts must agree, with all temporary setup/grant disposal acknowledged before the separate private start gate. Readiness requires actual CLAIM caller identity plus an acknowledged challenge through the retained control endpoint. COLLECT provides no server-origin evidence. Child-read-only startup mappings do not revoke Procd's trusted memory-write authority, and ordinary writable LCS1 startup mappings cannot silently stand in for this new contract. The current staged-only retirement path must gain exact running-child cleanup. A surviving child-termination owner after Procd loss remains a prerequisite: SEND lifetime revocation alone does not destroy that child, and Rootd exits after bootstrap. Resolve and validate this ownership before admitting private execution. The proposal assigns no new wire layout/opcode and implements no Posixd runtime. Markdown, canonical document headings, governance bytes, local links, original source anchors and whitespace pass. Original [Posixd CI 19](https://git.erikinkinen.fi/erix/posixd/actions/runs/19) and [20](https://git.erikinkinen.fi/erix/posixd/actions/runs/20) pass from two complete hashed logs (7,212 bytes), without warnings. Rust and new VM checks do not apply to this documentation-only repository. Existing native guarded-preparation acceptance remains separate; full runtime lifecycle, configuration/seal, real client I/O, full frame proof, native upstream toolchain rebuilding and both full EriX build generations remain open. No whole acceptance item is added. Native child-lifetime prerequisite — 19 September 2026: [Kernel design #19](https://git.erikinkinen.fi/erix/kernel/issues/19) now specifies opt-in custody through existing Process control authority plus the real matching install grant, with actual current supervisor attribution and separate stopping/reclamation obligations. An install grant alone must not confer child termination authority. The shared exit/kill prerequisite is signed, strictly validated and passes both original native lifetime/invocation scenarios at Integration `a62d1381f56a01afc692112d9b427205eaeb6a2e`. The custody binding, safe reclamation progress point and producer adoption remain unimplemented. No private mediator start gate opens from this refactor. Verified grant-rights checkpoint — 20 September 2026: Signed commit [1c80383afe1460f8d250472284225670f893937c](https://git.erikinkinen.fi/erix/procd/commit/1c80383afe1460f8d250472284225670f893937c) requires exact GRANT-only final installer receipts and selects the original shared dependency graph. Four strict 289/294-unit configurations, four native builds with the maintained linker layout, host/native Clippy, formatting and private rustdoc pass without warnings. Original CI 292/293 passes from four complete hashed logs (344,064 bytes), with zero warning candidates. Procd requests MINT only on actual derivation paths. It derives the final GRANT-only receipt into the disposed VSpace receipt slot and drops its delegating source before handoff. Derivation or disposal failure retains original-generation rollback and all remaining local custody. Both maintained isolated native scenarios pass on their first attempts under the unchanged 60-second scenario limits, with no build warnings and empty QEMU stderr. Lifetime now exercises 27 ordinary CPL3 grant-right controls and requires INSTALL_GRANT_RIGHTS_OK before its existing cleanup assertions. Its 2,025-byte serial stream has SHA256 `6c685f1ceaf9080bf0bec628a4fac512bf9049d0fbcfe2b3737666adf414ca3a`; owned invocation retains 1,587 bytes. Normal stripping exactly matches both packaged kernels to retained original artifacts. All fifteen selected original source signatures and clean trees verify. These minimal native scenarios establish neither full service-image acceptance nor a guest build. Full coordinated consumer acceptance remains open under [Kernel design 19](https://git.erikinkinen.fi/erix/kernel/issues/19) and [phase completion](https://git.erikinkinen.fi/erix/integration/issues/65). Installer return-slot regression — 21 September 2026: Both original corrected-catalog runs are now classified: [1695](https://git.erikinkinen.fi/erix/integration/actions/runs/1695) passes 431/489 VM scenarios and [1696](https://git.erikinkinen.fi/erix/integration/actions/runs/1696) passes 430/489. All six complete logs are retained and hashed, 32,723,390 bytes, zero warning candidates. Rust, Markdown and full dependency equality pass. Catalog mismatch [issue 68](https://git.erikinkinen.fi/erix/integration/issues/68) is corrected; this does not establish full consumer acceptance. Each run has 57 initial-shell uncertain-disposition failures and a separately retained release-appliance stall. Run 1696 also retains the ext4 quota timeout under its original 120-second bound, tracked in [issue 20](https://git.erikinkinen.fi/erix/integration/issues/20). [Procd bug 4](https://git.erikinkinen.fi/erix/procd/issues/4) records a concrete producer/consumer mismatch. The final installer was handed off from VSpace scratch slot 1056 while later TTY provisioning requires managed grant slot 1040. The added producer regression fails on the original code. Signed Procd [10d972b652297fd656e9a6ac6dbdf197f362c7ce](https://git.erikinkinen.fi/erix/procd/commit/10d972b652297fd656e9a6ac6dbdf197f362c7ce) in [WIP PR 2](https://git.erikinkinen.fi/erix/procd/pulls/2) derives the exact GRANT-only result, disposes its delegating source and uniquely relocates the result back to the empty managed grant slot. Refusals preserve original-stage rollback and remaining custody. Four strict 291/296-unit configurations, four native builds, host/native Clippy, formatting, private rustdoc and policies pass with zero warnings. Corrected full-service VM validation and original CI remain open; bug 4 remains open. Acceptance remains 15/460 leaves, 3.48% weighted. Full consumer lifecycle, terminal accounting, source/effect/frame proof, Pagerd, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full in-EriX build generations remain required. Verified managed installer recovery — 21 September 2026: Signed Integration [648fbd5614d3d0b82223b1c3bb7f1b5a0c81ea7d](https://git.erikinkinen.fi/erix/integration/commit/648fbd5614d3d0b82223b1c3bb7f1b5a0c81ea7d) in [WIP PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12) selects signed Procd [ac8a12993bc8cbf134a11e141e459cb63df71123](https://git.erikinkinen.fi/erix/procd/commit/ac8a12993bc8cbf134a11e141e459cb63df71123) and [Docs PR 4](https://git.erikinkinen.fi/erix/docs/pulls/4). Both full original catalogs pass all 72/71 manifest checks against 73/70 clean selected checkouts and all 143 verified signatures. Twenty dependency and 46 immutable-source tests, native scenario policies, Markdown and whitespace pass. The unchanged orchestration crate retains its verified four 320/321-unit configurations, four native builds and strict Clippy/rustdoc evidence. Original Integration CI 1697/1698 is running; no complete regression-suite pass is claimed. [Procd bug 4](https://git.erikinkinen.fi/erix/procd/issues/4) is corrected. The added producer regression reproduces the original 1056/1040 mismatch. Procd derives exactly GRANT into disposed VSpace scratch, drops its delegating source and uniquely relocates the result into the now-empty managed grant slot before handoff. The downstream TTY checks remain strict. Four 291/296-unit configurations, four native builds, formatting, strict Clippy and private rustdoc pass without warnings; relocation refusal and occupied-destination controls retain original-stage cleanup. Original correction CI 294/295 passes from four complete logs, 344,660 bytes. The subsequent roadmap-only checkpoint keeps every runtime source byte unchanged and original CI 296/297 passes from four complete logs, 344,680 bytes, zero warnings. The maintained initial-shell start/exit, realm-admission and normal release-appliance VM scenarios all pass on their first corrected attempts with original guest bounds and watchdogs. The release appliance executes the real product-shell command and produces standalone LOOKUPOK output, separate from its echoed input. All three builds are warning-free and QEMU stderr is empty. Serial logs retain 55,702, 55,738 and 364 bytes respectively. Actual images, full artifact sets, scenario oracles and original signatures are retained. These runs execute Procd 10d972b652297fd656e9a6ac6dbdf197f362c7ce; the selected later Procd commit changes only its roadmap. All 73 executed component signatures and clean source trees verify. The earlier 431/489 and 430/489 full CI failures remain recorded, including the independent ext4 quota timeout; those runs are not rewritten as passes. The native-launch manual now explains the managed return destination, exact rights, unique relocation and partial-failure cleanup. All 45 tests, the complete 2,429-page manual, 448,970 word bounds and changed-page visual review pass without final warnings. Original Docs CI 993/994 passes from four complete logs, 774,342 bytes; each final TeX pass is warning-free after normal earlier reference resolution. Existing generated API references are unchanged. Canonical acceptance remains 15/460 leaves, 3.48% weighted. This is a repaired runtime regression, not completion of a canonical lifecycle leaf. Original-generation terminal accounting, provider/lifetime completion, source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX build generations remain required. Exsh's retained release compiler and frame-proof failures stay open. Verified native terminal accounting — 21 September 2026: Kernel [a9bdf6163813d378e0b4a164bceb839e24fbb6b7](https://git.erikinkinen.fi/erix/kernel/commit/a9bdf6163813d378e0b4a164bceb839e24fbb6b7) is signed/pushed. Terminal preflight reserves final scalar CPU evidence independently of TCB/CSpace/VSpace reclamation; exact queries preserve final results or explicit errors. Repeat observations belong to the actual original observer until exact acknowledgement, and observer death releases that claim. Independent authorized observers can progress. Selector 55 is retired; checked selectors 59/60 have no destructive fallback. Four strict 736/760-unit configurations, both standalone controls and thirteen native build/Clippy profiles pass without warnings. Host controls include nonzero final counters after actual reclamation and ID reuse, original observer death, pending-final-charge destruction refusal, malformed requests, wrong callers, immutable errors and lost-acknowledgement reply retry. Original Kernel CI 624/625 and corrected 626/627 all pass from eight complete hashed logs (1,532,848 bytes), zero warnings. Both maintained lifetime and owned-invocation VMs pass under the unchanged 60-second scenario limits and standard watchdogs, with no build warnings and empty QEMU stderr. Actual guest instructions check repeat observations and CPU queries, exact acknowledgement and absent-acknowledgement retry; executing children require nonzero user and kernel counters after native reclamation. Lifetime retains 2,025 serial bytes (SHA256 `921edf5eadfdff61f2d85a63158555666e77e57a1e8aa4254ac30dcd216f8cf9`); owned invocation retains 1,587 (SHA256 `404bc4ecad5074349d9ba45d1caf5439aebe849d344b726e5dec2ee2b9c4d907`). Normal stripping exactly matches both packaged kernels to retained original artifacts; all fifteen selected original signatures and clean checkouts verify. [Kernel regression 21](https://git.erikinkinen.fi/erix/kernel/issues/21) retains the first VM's final page-census failure. The corrected layout declares and allocates all six request pages and derives the independent census from that declaration. No unchanged retry or deadline relaxation occurred. Integration [fcd7b4a9608f629a12de78c53da5c3615d906b46](https://git.erikinkinen.fi/erix/integration/commit/fcd7b4a9608f629a12de78c53da5c3615d906b46) is signed/pushed with the verified isolated catalog. Twenty dependency and 46 immutable-source tests, native policies, Markdown and source checks pass. The unchanged orchestration crate, embedded fixture and original dependency closure retain verified four 320/321-unit and native/Clippy/rustdoc configurations. The full service catalogs retain their separately coordinated revisions; original Integration CI remains under observation. Procd and Rootd consumer adoption, ordinary and mediator metric retention/consumer loss, manual updates, full service/profiler scenarios, complete authority/source/frame audits and full regression acceptance remain open under [Kernel design 20](https://git.erikinkinen.fi/erix/kernel/issues/20). Canonical acceptance remains **3.48% weighted; 15 of 460 items**. Native upstream Rust/LLVM/runtime rebuilding and both full EriX guest build generations remain mandatory and unproven. Committed terminal-accounting consumers — 21 September 2026: Procd [66934642c4464fc738152a9e60790914ba27dd1c](https://git.erikinkinen.fi/erix/procd/commit/66934642c4464fc738152a9e60790914ba27dd1c) in [WIP PR 2](https://git.erikinkinen.fi/erix/procd/pulls/2) reserves notification/crash/cleanup storage before effects, obtains exact final CPU evidence, commits local status and cleanup obligations, then acknowledges on every actual event polling path. Lost acknowledgement replies preserve the local result without duplicate counters or notifications. Mediators retain only scalar counters and the original authenticated supervisor identity after disposing all capability columns; supervisor death discharges the pending scalar observation and a replacement cannot inherit it. Four strict 299/305-test configurations, native builds, Clippy and private rustdoc pass. Original CI [298](https://git.erikinkinen.fi/erix/procd/actions/runs/298)/[299](https://git.erikinkinen.fi/erix/procd/actions/runs/299) passes from four complete hashed logs, 347,245 bytes, zero warnings. [Bug 5](https://git.erikinkinen.fi/erix/procd/issues/5) remains open for actual service acceptance. Rootd [64c97b13c450003d9c2b6bd9ed2a627088684b46](https://git.erikinkinen.fi/erix/rootd/commit/64c97b13c450003d9c2b6bd9ed2a627088684b46) in [WIP PR 2](https://git.erikinkinen.fi/erix/rootd/pulls/2) acknowledges bootstrap evidence only after exact native destruction and local endpoint absence; both operations remain unavailable after temporary Process custody transfers to Procd. Four strict 430/429-test configurations, native builds, Clippy and private rustdoc pass. Original 1039/1040 exposed [bug 7](https://git.erikinkinen.fi/erix/rootd/issues/7): a stale source-call inventory and its matching semantic operation declarations. The correction explicitly inventories acknowledgement consumers and preserves the same temporary route and eventual Procd owner. All 64 Python controls, production-boundary, semantic baseline, threat model, phase contract and operation-ownership gates pass. Corrected original CI [1041](https://git.erikinkinen.fi/erix/rootd/actions/runs/1041)/[1042](https://git.erikinkinen.fi/erix/rootd/actions/runs/1042) passes from four complete verified logs, 222,969 bytes, zero warnings. Bug 7 is corrected; failed original runs remain retained without reruns or weaker gates. Docs [e4525848ad4462901c9a6794ef1794cf85ea9e6b](https://git.erikinkinen.fi/erix/docs/commit/e4525848ad4462901c9a6794ef1794cf85ea9e6b) updates the native contract, Procd/Rootd consumer custody and original signed IPC API references. Selector 55 is retired in both the detailed contract and summary; 58/59/60 are cross-checked against the shared registry. All 45 documentation tests and generated-reference checks pass. The complete 2,431-page manual builds without warnings; changed prose, selector and API pages pass visual review. Original documentation CI [995](https://git.erikinkinen.fi/erix/docs/actions/runs/995)/[996](https://git.erikinkinen.fi/erix/docs/actions/runs/996) and corrected-table [997](https://git.erikinkinen.fi/erix/docs/actions/runs/997)/[998](https://git.erikinkinen.fi/erix/docs/actions/runs/998) passes from eight complete logs, 1,549,628 bytes, with zero warnings in the final LaTeX passes. The 37 earlier convergence candidates per manual log are retained and resolved. The separate Integration orchestration library checkpoint [b06dfad00202765491a64552dde29eaca1c24838](https://git.erikinkinen.fi/erix/integration/commit/b06dfad00202765491a64552dde29eaca1c24838) passes four strict 320/321-test host/native configurations. Full service catalogs remain on their prior coherent graph while 35 remaining application/service repositories adopt the original shared revisions. Integration 1697/1698 remains running, and 1699/1700 plus 1701/1702 waits at the latest bounded observations. These are pending full regressions, not successful runtime acceptance. No new canonical acceptance leaf is closed: 15/460 and 3.48% weighted. Ordinary Launchd metric-consumer restart/disposal semantics, coherent service CPU/profiler VMs, complete realm/provider authority and I/O, source/effect/frame proof, Pagerd, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX build generations remain required. The static audit finds 3,162 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 173 direct missing-docs gates and 92 conventional crate roots; this does not establish semantic authority or complete private-documentation closure. Terminal selector documentation reconciliation — 21 September 2026: Signed Procd [68748bc65ea3fb798e810d624845dcb298ae1346](https://git.erikinkinen.fi/erix/procd/commit/68748bc65ea3fb798e810d624845dcb298ae1346) removes stale operation 55 prose and documents observation 59 plus exact acknowledgement 60. All runtime inputs are byte-identical to the validated consumer implementation; its four strict 299/305-test configurations remain applicable. Original documentation-checkpoint CI [300](https://git.erikinkinen.fi/erix/procd/actions/runs/300)/[301](https://git.erikinkinen.fi/erix/procd/actions/runs/301) passes from four complete hashed logs (347,266 bytes, zero warnings). Ordinary consumer loss/restart and final reply disposition remain audited acceptance gaps. Failed ordinary metrics transport currently terminates Procd; it is not evidence of continued execution and row reuse. Full service CPU/profiler VM acceptance, complete realm lifecycle and both guest build generations remain open. Coherent scalar-consumer validation — 21 September 2026: signed [Integration 07c883525ee5](https://git.erikinkinen.fi/erix/integration/commit/07c883525ee5e23378008232760d045f74f60d32) selects [Procd 59ee30a88534](https://git.erikinkinen.fi/erix/procd/commit/59ee30a885346db4db8c8791a23c15694f2a90a8) in both complete catalogs. All 171 maintained helper commands pass without warnings; unchanged orchestration inputs retain four strict matrices. Five actual service VMs pass: shell CPU accounting, exec successor replacement, two-CPU read-only inspection, out-of-session denial and guarded realm preparation. Each preserves 106 hashed evidence files, clean QEMU stderr, warning-free image builds and all original markers under the unchanged 120-second guest limit. The build-plus-scenario times are 119.746880, 38.325332, 35.346729, 35.773237 and 55.339698 seconds respectively; these are not guest performance measurements. Inspection reports increasing job CPU counters with control disabled; numeric CPU utilization remains unproven. Procd's four strict 308/314-test configurations and original CI 302/303 pass. The [manual update](https://git.erikinkinen.fi/erix/docs/commit/2d05169e6974a495eab80b62edf0f23d1ad667da) passes 45 tests, all 2,431 pages, 450,185 word bounds and changed-page visual review. Original Docs CI 1003/1004 passes from four complete logs (774,710 bytes); retained reference-convergence warnings resolve to zero on final passes. All 3,166 authored code files remain below 1,000 lines. Original Integration 1701/1702 remains running; 1703–1710 remains queued. Logd 240 remains failed with terminal logs unavailable through HTTP 500; no cause is inferred. No original job was restarted or cancelled. Remaining lifecycle control/event ownership, complete native fault/cleanup acceptance and the measured startup timing failures remain open. No whole acceptance leaf closes: 15/460, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain inside EriX and using it in the required full EriX guest-build generations remain mandatory and unproven.

erikinkinen added the

phase-6

enhancement

security

docs

refactor

labels 2026-09-12 07:57:59 +02:00

erikinkinen referenced this issue from erix/integration 2026-09-12 08:02:00 +02:00

[FEATURE] Audit and refactor authority, lifecycle and code quality across every repository #2

erikinkinen changed title from [FEATURE] [P02.R65] Audit authority, code quality and documentation in procd to [FEATURE] Audit authority, code quality and documentation in procd 2026-09-12 08:02:39 +02:00

erikinkinen referenced this issue from erix/lib-bootstrap 2026-09-15 10:04:45 +02:00

WIP: Align native mediator construction dependencies #2

erikinkinen referenced this issue from erix/lib-interrupt 2026-09-15 10:07:26 +02:00

WIP: Align native mediator construction dependencies #2

erikinkinen referenced this issue from erix/lib-service 2026-09-15 10:07:28 +02:00

WIP: Align native mediator construction dependencies #2

erikinkinen referenced this issue from erix/lib-time 2026-09-15 10:07:31 +02:00

WIP: Align native mediator construction dependencies #2

erikinkinen referenced this issue from erix/lib-log 2026-09-15 10:07:36 +02:00

WIP: Align native mediator construction dependencies #2

erikinkinen referenced this issue 2026-09-15 10:12:02 +02:00

WIP: Guard mediator construction and Launchd admission #2

erikinkinen referenced this issue from erix/lib-ipc 2026-09-15 12:49:11 +02:00

WIP: Define native authority and staged construction contracts #2

erikinkinen referenced this issue from erix/lib-capabi 2026-09-15 12:49:13 +02:00

WIP: Align capability layouts and staged authority contracts #2

erikinkinen referenced this issue from erix/kernel 2026-09-15 12:49:14 +02:00

WIP: Enforce native lifetime and staged construction authority #3

erikinkinen referenced this issue from erix/docs 2026-09-15 12:49:15 +02:00

WIP: Document native authority and verify workspace and command evidence #4

erikinkinen referenced this issue from erix/integration 2026-09-15 12:54:08 +02:00

WIP: Coordinate native authority, shell workspace and source transport #12

erikinkinen referenced this issue from erix/lib-bootstrap 2026-09-15 14:20:38 +02:00

WIP: Align native mediator construction dependencies #2

erikinkinen referenced this issue from erix/lib-interrupt 2026-09-15 14:20:39 +02:00

WIP: Align native mediator construction dependencies #2

erikinkinen referenced this issue from erix/lib-service 2026-09-15 14:20:40 +02:00

WIP: Align native mediator construction dependencies #2

erikinkinen referenced this issue from erix/lib-time 2026-09-15 14:20:41 +02:00

WIP: Align native mediator construction dependencies #2

erikinkinen referenced this issue from erix/lib-log 2026-09-15 14:20:42 +02:00

WIP: Align native mediator construction dependencies #2

erikinkinen referenced this issue 2026-09-18 01:28:17 +02:00

[BUG] Deferred native cleanup waits for idle intake and stalls behind one owner #3

erikinkinen added the

performance

label 2026-09-18 03:34:02 +02:00

erikinkinen referenced this issue from erix/integration 2026-09-19 11:36:52 +02:00

[FEATURE] Track Phase 6 POSIX compatibility and full EriX self-hosting #65

erikinkinen referenced this issue from erix/kernel 2026-09-19 15:39:29 +02:00

[FEATURE] Bind staged child cleanup to its native supervisor lifetime #19

erikinkinen referenced this issue 2026-09-21 16:49:39 +02:00

[BUG] Attenuated installer handoff changes the managed return slot #4

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

main

feature/posix-compat

feature/native-cli

feature/phase-4-audit

feature/dynlink

feature/program-loader

feature/e2fs-fat

feature/block-devices

feature/vfs

feature/centralized-process-authority

No results found.

Labels

Clear labels

  

bug

Something is not working

  

ci

  

docs

  

duplicate

This issue or pull request already exists

  

enhancement

New feature

  

help wanted

Need some help

  

invalid

Something is wrong

  

performance

Measured performance profiling, bottleneck analysis, and regression budgets.

  

phase-6

Phase 6: POSIX compatibility, full EriX self-hosting, and its required audits and validation.

  

question

More information is needed

  

refactor

Code cleanup, removal of obsolete paths, and structural improvements preserving behavior.

  

security

  

wontfix

This won't be fixed

No labels

bug

ci

docs

duplicate

enhancement

help wanted

invalid

performance

phase-6

question

refactor

security

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

erix/procd#1

No description provided.