Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

ADR-048 — App hosting “done” claim criteria

  • Status: Accepted (claim gate). Product “apps run independently / hosting done” is Verified when criteria 1–5 are Met (ADR-052 records sponsor accept for #5). Do not claim Linux userspace, POSIX, containers, or “EL0 isolated.”
  • Date: 2026-09-13

Context

Track A children A1–A9 have first cuts (ABI, CRT, loader, standing-as-normal, isolation miles, memfs, FAT, recipes, OS/app slots + cross-update / embed-off). The honesty ledger and roadmap correctly refuse to round those miles up to “app hosting is done.” Sponsors still need explicit criteria so a Verified claim is fail-closed rather than mood.

Related: ADR-030, ADR-032, ADR-029, ADR-052 (sponsor accept), hosting-apps.md, ADR-047 (isolation leftovers are separate — closing them is not required to meet these criteria, and meeting these criteria does not make “EL0 isolated” true).

Decision

A1–A9 first cuts

Treat A1–A9 first cuts as Verified when the honesty ledger has matching rows for this tip (or cited merge tips). That is not product app hosting by itself.

Product claim Verified only when all criteria below are met

The sentence “apps run independently of the OS” / “app hosting is done” may move from Planned to Verified only when every criterion holds, with named probes in the honesty ledger:

  1. Documented recipes — Rebuild / run recipes for freestanding apps cite only existing serial markers and stay buildable (./scripts/docs-build.sh + A8 hub). No invented runtime.
  2. Slot cross-update — Same published app ELF loads on this OS and a documented prior OS (ba6541c or a later sponsor-pinned prior) with fail-closed host smoke (cross-update … slot:ok both boots). ADR-032.
  3. No production embed — A2–A4 / production slot path must not include_bytes! the hello app. FAT /hello (or an equivalent published slot file) is the production payload. Probe-only embeds (e.g. ADR-046 measurement) must never print slot: embed and must stay out of the production path.
  4. Honesty about missing Linux / POSIX / containers — Docs and PRs must still say: not a Linux ABI, not POSIX, not glibc/musl, guest OCI/Docker/k8s remains non-goal (ADR-029). Meeting (1)–(3) does not authorize those claims.
  5. Explicit sponsor accept — A PR that flips the product row to Verified must cite this ADR’s checklist and must not self-merge (ADR-002). Sponsor accept for the 2026-09-13 flip is recorded in ADR-052.

What does not satisfy the claim

  • A1–A9 first cuts alone
  • Isolation ladder miles / ADR-047 decisions
  • Host docker-smoke.sh (Docker hosts ctos, not the reverse)
  • Slot CNTPCT pairs / “slots are free” marketing (ADR-046)
  • Linux-compat research (Track B) or any “runs Alpine” sentence

Accepted claim (amendment)

On tip main @ be789c5+ with ADR-052: criteria 1–5 Met. Product row Verified for the scoped freestanding slot-hosting sentence. Still refuse Linux/POSIX/containers/“EL0 isolated”/OTA/immutable-OS marketing.

Honesty

Say “A1–A9 first cuts exist” when the ledger rows say so. Say the product claim is Verified under ADR-048 only with the checklist Met×5 and sponsor accept cited. Do not say “apps update independently” as OTA, or “container host” — containers stay non-goal regardless.

Consequences

  • Ledger row “Track A app hosting (slots)” is Verified and cites this ADR + ADR-052.
  • hosting-apps.md, Track A / roadmap, NFR-10 text point here.
  • No new FR/NFR IDs. Do not mint NFR-15+.

Progress checklist

Living Met/Partial/Blocked table (tip evidence): hosting-apps.md — Claim criteria and honesty-ledger.md — ADR-048 progress. Product claim is Verified when criterion 5 is Met (ADR-052).