Status
A row is only as strong as its witness. Where the useful half exists and the security property does not, the row says partial.
Subsystems, as the tree stands.
| State | Subsystem | Witness |
|---|---|---|
| Working | Capability engine in the Rust security core: mint, grant, subtree revocation, 64-bit serials | smoke-captest |
| Working | Capability-addressed IPC: bounded queues, one-shot replies, a receive that sleeps | smoke-recvblock |
| Working | A server distinguishes clients by the capability they were called through | smoke-captoken |
| Working | Untyped memory pays for cspaces, endpoints, notifications, frames and tasks | smoke-frame |
| Working | SMP bring-up on up to eight CPUs, SMT siblings parked, a cache flush between distrusting tasks | smoke-smp-topology |
| Partial | Scheduling. Each CPU has a run list. CPU time is a capability, and init binds no task to a budget yet, so a task that never blocks is not confined to a share. Every shipped task is at priority 255. A wake does not preempt until the next tick. | smoke-sched-invariants |
| Working | Ring-3 init supervises the servers and the shell | smoke-session |
| Working | Ring-3 console server: UART, text or framebuffer, PS/2, including a machine with no serial port | smoke-console-smp |
| Working | An encrypted, Merkle-checked volume with a journal. Unencrypted only when the installer is told so. | smoke-fs-wal |
| Partial | Whole-volume rollback. A TPM counter bound at format refuses an older copy from a previous boot. An unanchored volume has the tree only. The counter does not move inside the current boot. | smoke-rollback |
| Working | Installer onto IDE and onto SD or eMMC, with typed consent and two accounts that can each open the disk | smoke-installer-sd |
| Working | A live boot does not open an installed disk | smoke-live-locked |
| Partial | Measured boot. A machine with a TPM halts if measurement or sealing fails. One without still boots and says so, and the volume records that. The key is sealed only when a TPM was present at format. | smoke-measured-present |
| Working | Boot-module manifest. A module that fails SHA-256 cannot be read. | smoke-modules-tamper |
| Working | ELF loading in the Rust core, W^X, randomised base | smoke-elf64 |
| Partial | Device capabilities name one device. DMA is confined where the machine has an IOMMU. Where it does not, the boot says so and a bus-master reaches memory. | smoke-devcap |
| Working | A shared libc, sealed read-only before main. A task that has bound it cannot fork. | smoke-shlib-link |
| Partial | fork and exec with copy-on-write, for a task that has not bound the shared libc. The child's capabilities stay under the parent. | smoke-forkexec |
| Partial | The capability filesystem. fs_server authorises by capability, and a session root carries the union of that session's grants. Below the root, fs_server is the reference monitor. A grant names a path, not an object. | smoke-fs-perms |
| Partial | Execute. System trees are rebuilt from verified modules and cannot be changed. Elsewhere, a task that can read a file can run it, because the loader is handed bytes. | docs/LIMITATIONS.md 1.23 |
| Partial | RAM. The pool uses regions the firmware map names below 4 GiB of address. Memory above that is not used. Ragged edges above 1 GiB, under 2 MiB each, are not used either. | smoke-pool-span |
| Working | Encrypted swap of idle pages under a per-boot key. Pages that hold secrets are not yet kept out of it. | smoke-swap |
| Working | An installed disk that boots itself under UEFI. System trees are rebuilt from the verified modules at every boot. | smoke-install-boot-disk |
| Working | No sudo. A standard account is refused the kernel log, capview and useradd. | smoke-session-admin-caps |
| Working | A reproducible kernel image and install ISO. A release tag is still unsigned. | reproducible |
| Partial | Networking stops at one ARP exchange from a ring-3 driver. There is no IP stack. | smoke-net |
| Partial | One monotonic clock at 10 ms, on purpose. No wall clock and no user timers. | smoke-captest |
| Partial | SATA is identified and not read or written. NVMe, SD and IDE have ring-3 drivers in self-test builds. The installed system still uses the kernel's IDE and eMMC drivers. | smoke-sdhcid |
| Partial | Destroyed kernel objects free their names and not their memory. The well-known endpoints live for the whole boot. | smoke-cspace-release |
| Not yet | USB, and therefore a keyboard on a machine with no PS/2. No sound, no window system. | ROADMAP 2.7 |
| Not yet | Kernel ASLR, indirect-branch tracking, job control, signed releases. | ROADMAP 3.8, 4.4 |
Ceilings that are still compile-time.
A task may occupy 128 capabilities in a cspace of 256 slots. An IPC message is 256 bytes. Eight CPUs. A volume ceiling of 16 GiB, with the real size read from the disk. The task count is provisioned at boot from untyped memory, up to 256. The full table, with the symbol for each ceiling, is docs/LIMITATIONS.md section 3.1.
Work queued for later sessions.
Each item is one concern, written so a later session can take it without re-deriving the reason. The same text is in docs/ROADMAP.md. Do not start a later item while an earlier one in the same lane is open. Do not delete a witness to make room.
4.19 A nightly guest syscall fuzzer
The existing fuzz targets are parsers in the Rust core. Nothing there calls
syscall(). Off the merge path, in the same shape as the nightly fuzz workflow.5.4 Execute only from a file capability
Closes limitation 1.23. A session that can read a file and does not hold
EXECcannot run it.5.7 Rollback anchoring when a TPM is present
Refuse an unanchored volume on a machine with a TPM unless the installer recorded that choice. The counter still moves once per boot. Limitation 1.12.
5.14 Refuse a bus-master when the IOMMU is off
A build flag in the shape of
MEASURED_BOOT_REQUIRED. The default build keeps today's behaviour, which limitation 2.12 already states. This is not roadmap 2.12, which keeps secrets out of swap.5.15 An audit of the cryptography, or a replacement
A maintainer decision. Do not write new primitives. Limitation 5.4 is the status. Roadmap 4.20 watches the two compares and does not close this.
5.11 Models of the four protocols that have already raced
Spawn and teardown, the kernel-stack claim, the TLB shootdown, revocation against lookup. Each model ships with a seeded defect. Needs decision D9.
5.9 Reclaim only by revoking the untyped capability
Then, and only then, a ring-3 allocator may reuse the bytes. Limitation 2.5.
5.10 Bound each grant in the kernel
One capability per grant, after filesystem phase 2. Needs decision D8. Closes limitation 1.24.
4.4 and 4.11 Signed releases a third party can rebuild
SLSA provenance, then
verify-release.sh. The five existing releases are unsigned tags.