Track A — freestanding app hosting
Tracker epic: issue #31. Child issues A1–A9.
Driving force (non-negotiable)
This track is subordinate to ctos core principles (principles.md). Do not skip a probe, drop a ratchet, or invent a “secure/fast app runtime” to finish a row faster.
- Honesty ledger — Verified only with a probe
- Antifragility — fail-closed smoke + ratchets
- Security — threat model; probed mitigations only
- Performance — measure first; no invented benches
- Document-first / one milestone → one branch → one PR
A9 (OS/app slot disconnect) sits after A1–A4. It does not override the list above. The first cut plus ADR-032 leftover mile: cross-update on ba6541c, no hello embed. Product “app hosting is done” is Verified under ADR-048 / ADR-052 (not Linux/POSIX/containers).
Goal
A freestanding (non-POSIX) application can be loaded and run with honest probes. Not Linux containers. Not glibc.
Ordered work
One loop unit each. Each row needs a fail-closed ledger probe.
| ID | Work | Status (2026-09-12) |
|---|---|---|
| A1 | Stable SVC / syscall ABI + docs | ABI mile Verified on 8846bc5 (#32, ADR-021, syscall.md). Not app hosting. |
| A2 | Freestanding CRT / libctos | CRT mile Verified on c9b292b (#33, ADR-022). Not app hosting. |
| A3 | ELF (or raw) loader into user TTBR0 | Loader mile Verified (#34, ADR-023). Not a Linux ABI. Not app hosting. |
| A4 | Standing EL0 as normal mode | Standing-task mile Verified on this tip (#35, ADR-024). Loaded app until exit; fail-closed restore. Not isolation. Not app hosting. |
| A5 | Isolation completion (remaining identity tear; PAN only if CPU + ADR) | Identity tears Verified; PAN CPU reopen Accepted (ADR-079 / #125; -cpu cortex-a76, pan: present). PAN enable still locked (ADR-080). Umbrella “EL0 isolated”: Verified only as the accepted ADR-091 sentence (M6); this mile alone is not it. |
| A6 | Thin VFS + memfs | memfs mile Verified (#37, ADR-027). In-RAM named buffers; create / write / read / close. Not POSIX. Not app hosting. |
| A7 | virtio-blk + FAT16 | block + FAT mile Verified on this tip when the ledger has blk: ok / fat: ok (#38, ADR-028). Same VFS open. FAT write depth: ADR-050. Root listing: ADR-056. Root delete: ADR-057. Not POSIX. Not a Linux FS. |
| A8 | Documented sample apps | Recipes Verified (docs + existing smoke markers) (#39). Rebuild recipes: what-can-run.md, apps-today.md, in-tree user/README.md. Coop UART, RX echo, standing EL0 / libctos hello; optional memfs + FAT16. No new ADR (docs-only). No new runtime markers. Not app hosting. |
| A9 | Disconnect OS image from app payloads | First cut (#48, ADR-030) + leftover (ADR-032): OS ELF + published hello-libctos.elf + FAT /hello. A2–A4 load that file (no production embed). Cross-update: same ELF on this OS and ba6541c when qemu-smoke prints both cross-update … slot:ok lines. Slot-load CNTPCT pair (ADR-046): perf: app-load + probe-only perf: embed-load + perf: slot-delta (QEMU TCG lab; not a percent). Not OTA. Product claim Verified under ADR-048 / ADR-052 (not Linux/containers). |
Out of scope for Track A
OCI/Docker containers (non-goal, ADR-029), glibc/musl ports, SMP, networking (Track N — ADR-063; Planned until N1). See host-apps.md.
Samples today: site what-can-run.md (extra: apps-today.md). Porting: site porting.md (extra: building-or-porting.md).