Track B — Linux-compat research (keep ctos specificity)

Tracker epic: issue #40. Child issues B1–B7.

Driving force (non-negotiable)

This track is subordinate to ctos core principles (principles.md). Linux-compat research must not abandon honesty, fail-closed sensors, the three pillars, or virt learning scope. Do not override principles for a “runs Linux” headline.

• Honesty ledger — Verified only with a probe
• Antifragility — fail-closed smoke + ratchets
• Security — threat model; probed mitigations only
• Performance — measure first; no invented benches
• Document-first / one milestone → one branch → one PR

Track A (track-a.md) should largely complete before deep Linux ABI work. Reuse A1–A9 where they help. Full Linux ABI is not a promise. Not claiming Linux userspace yet (ADR-031). Guest OCI/Docker/k8s is a non-goal (ADR-029) — not a later Planned row on this track.

Goal

Explore what Linux userspace / ABI-subset work would take without dropping ctos specificity. Frame: ADR-031. This is an ADR/research ladder, not a distro.

Keep

Honesty ledger, fail-closed smoke (including Docker/arm64 workstation ratchets), pillars (antifragility / security / performance), ADR-gated ISA/memory/EL0 decisions, QEMU virt until an ADR widens it.

Ordered research

B1 — Linux-compat frame

ADR-031 is the Track B frame. Linux-compat here means research into a possible Linux AArch64 ABI subset, not a promise to run a distro, glibc, musl, a shell, or Linux userspace.

Keep: honesty ledger, fail-closed smoke (including host Docker/arm64 workstation ratchets), three pillars, the freestanding Track A path (A1–A9 first cuts), QEMU virt until an ADR widens it.

Out: full Linux ABI as a promise; guest containers (ADR-029); replacing SVC #n / libctos with Linux x8 numbers in a research mile; claiming userspace because A3 loads ELF64 or A9 reads FAT /hello.

B2 is Documented (syscall gap table). B3 is Documented (process-model stance). B4 is Documented (ELF / auxv / PT_INTERP gap). B5 is Documented (VFS concept compare). B6 is Decided (never) (ADR-036): no Linux-compat layer or reimplementation from this ladder. File presence of these ADRs is not a Linux userspace probe.

B2 — syscall gap map

linux-aarch64-syscall-gap.md maps a representative Linux AArch64 set (exit, write, read, openat, close, brk/mmap, clone/execve/wait4, ioctl, plus CRT/namespace neighbors) onto today’s ctos SVC surface (reserved 0–2, public 16–23).

Keep: no Linux svc #0 / x8 numbers in src/ this mile. Track A SVC #<n> stays. No row is present (convention + number space both miss). Related Track A SVCs are partial. Namespace/mount stay never-per-ADR-031 (ADR-029).

B3–B5 must not treat this table as an implementation backlog. B6 chose never (ADR-036).

B3 — process model vs standing EL0

ADR-035 compares Linux fork / exec / wait to ctos standing EL0 (ADR-024) and the EL1 cooperative scheduler (ADR-010).

Keep: standing EL0 is one loaded trip until exit. EL1 coop workers are not Linux threads. A1–A9 probes stay. Do not add clone / execve / wait* to src/ this mile.

Out: treating A4 or A9 FAT /hello as execve; treating SYS_EXIT as exit_group; a pid table; CLONE_NEW* (already never-per-ADR-031).

On Linux AArch64, userspace fork() is clone. There is no fork syscall. B4 is Documented (ADR-033). B5 is Documented (ADR-034). B6 is Decided (never) (ADR-036). File presence of ADR-035 is not a Linux process table.

B4 — Linux ELF / auxv / PT_INTERP vs the freestanding loader

ADR-033 compares Linux exec of an ELF (interpreter + auxv + PT_DYNAMIC) with today’s A3 loader (ADR-023).

Keep: the Track A parser reusable (ET_EXEC, PT_LOAD, reject PT_INTERP, reject W+X). In-tree libctos apps stay on that path.

Out: accepting PT_INTERP in src/; claiming musl/glibc or dynamic Linux ELF; treating A9 FAT /hello as execve.

Static musl still needs a Linux stack/auxv and the B2 syscall surface. Dynamic musl/glibc also need an interpreter. Not claiming dynamic Linux ELF. B3 is Documented. B5 is Documented. B6 is Decided (never) (ADR-036).

B5 — Linux VFS vs thin ctos VFS

ADR-034 compares Linux VFS objects (dentry / inode / path / mount) to today’s thin VFS (ADR-027 / ADR-028).

Keep: no POSIX open flags, dentries, cwd, or mount(2) in src/ this mile. Track A VfsOps stays five calls. No Linux VFS object is present. Path strings and handles are partial. Mount / overlay stay never-per-ADR-031. File-descriptor numbers stay on the B2 gap map (openat / read / write / close partial).

B6 chose never (ADR-036) — this compare is not an implementation backlog. B3 and B4 are Documented. Not claiming a Linux filesystem.

B7 — containers are a non-goal

ctos guests do not host containers. OCI / Docker / Kubernetes need a Linux kernel (namespaces, cgroups, a Linux ABI, usually overlay). This tree has none of that in src/.

Today the arrow is reversed: a Linux host may run Docker/docker-smoke.sh to build and QEMU-smoke the ctos image. That is a host harness (NFR-04 / NFR-05), not a guest runtime.

Do not claim a Docker/OCI host. Do not treat this as far-later work waiting on Track B. Reopen only with a new GitHub epic plus a new ADR — not a Track B “win,” and not a new FR/NFR ID.

B6 — decision (never)

ADR-036 records the Track B outcome: never start a Linux-compat layer or Linux-like reimplementation from B1–B5.

Keep: Track A freestanding path; B1–B5 / B7 as the honesty record of the gap; principles over tracks.

Out: treating the research tables as a backlog; accepting PT_INTERP / Linux x8 / clone/execve / POSIX VFS / guest containers “later on Track B.”

Reopen only with a new epic + ADR + named workload probe.