ctos honesty ledger
Status words are claims. Each row needs a probe. Unprobed = Unknown. Never round Unknown up to Verified because the file exists, a PR is open, or a README teaches cargo run.
Allowed flags: Verified (probe passed), Unknown (no probe or probe blocked), Planned (not built yet), Failed (probe ran and lost).
| Claim | Probe | Status | Notes |
|---|---|---|---|
UART hello source present (println!("Hello World!"); + PL011 writer) | Read src/main.rs and src/uart.rs on this branch | Verified | Source inspection. Boot is a separate row. |
.cargo/config.toml present (build-std, aarch64-ctos.json, qemu runner, json-target-spec) | Read .cargo/config.toml | Verified | Presence. Build success is the next row. |
cargo build for aarch64-ctos.json | cargo +nightly build on 2026-09-08 (rustc 1.100.0-nightly cea272fa3) | Verified | First attempt failed: invalid aarch64 ABI combination until the JSON had both "abi": "softfloat" and "rustc-abi": "softfloat". Then the ELF built (target/aarch64-ctos/debug/ctos, AArch64, entry 0x40080000). |
| QEMU aarch64 serial shows Hello World | qemu-system-aarch64 8.2.2, -machine virt -cpu cortex-a57 -display none -serial stdio -kernel target/aarch64-ctos/debug/ctos; timeout 4 | Verified | Serial printed Hello World! then the VM was killed (exit 124). Same string on -machine virt,gic-version=3 and -cpu max. One cloud environment, not CI. Not a Raspberry Pi probe. |
| x86_64 VGA / bootimage path | Historical probes on 2026-09-08 (PR #2) | Historical | Path removed by ADR-003. Those Verified rows do not apply to this tree. |
| CI on GitHub | Workflow file exists and a run is green | Verified | .github/workflows/smoke.yml: push run 34285784458 success (ubuntu-24.04 52s, ubuntu-24.04-arm 1m9s). PR run 34285786641 success. ubuntu-24.04-arm label is available on this repo. |
Docker smoke (Dockerfile / scripts/docker-smoke.sh) | cts-ai Docker Desktop linux/arm64, 2026-09-09: docker build -t ctos-smoke . && docker run --rm ctos-smoke → exit 0 | Verified | After three Failed runs, ratchets landed in git and the full smoke passed on cts-ai: serial Hello World! (hello QEMU timeout 124, expected); cargo test [ok]; force-fail exit 1; qemu-smoke: ok. Failures that were ratcheted: (1) CRLF shebang → exec ./scripts/qemu-smoke.sh: no such file or directory (.gitattributes *.sh/Dockerfile eol=lf, image sed, CMD bash); (2) linker cc not found on compiler_builtins (build-essential); (3) failed to find romfile "efi-virtio.rom" (qemu-efi-aarch64 + ipxe-qemu). One sponsor host, not CI and not this cloud VM (still no Docker engine here). |
Second-brain vaults (research/) | Paths exist; README explains Procedure / Correction / Relationship / Daily Brief | Verified | Structure present. Not a claim that vaults are richly filled. Optional Obsidian UI is structure-only (PR #3). |
Thin ctos-* roles | AGENTS.md + .cursor/skills/ctos-*/SKILL.md exist | Verified | Four roles. No aea-* names. |
Frozen FR/NFR IDs (FR-01–FR-15, NFR-01–NFR-14) | Read docs/02-requirements/fr-nfr.md; IDs present; ISA text revised under ADR-003 | Verified | Frozen IDs. Text now AArch64/UART. Do not invent extra FR/NFR IDs in chat. File presence is not a claim that every Now row is implemented. |
PR identity split (author ≠ merger; artofdream vs cursor[bot]) | Read ADR-002, AGENTS.md, .cursor/rules/pr-identity-no-self-merge.mdc | Verified | Docs present. Principle reused from Café Fausse pr-coordinator (identity only). cursor[bot] merge / App APPROVE on this repo: Unknown until probed on artofdream/ctos. |
| Primary ISA is AArch64 | Read ADR-003; x86_64-ctos.json / src/vga_buffer.rs absent | Verified | Decision + file tree. QEMU boot is a separate row. |
| Integration tests / QEMU test exit (M2) | cargo +nightly test → QEMU virt + -semihosting; #[test_case]; QEMU host exit 0 | Verified | 2026-09-08 cloud: Running 2 tests / [ok]. 2026-09-09 M3: 4 tests. 2026-09-09 M4 re-probe: Running 6 tests / all [ok] (adds SPSel + stack-range cases). |
| Fail-closed test panic | cargo +nightly test --features force-fail | Verified | 2026-09-08 and 2026-09-09 cloud: panic force-fail, QEMU/host exit 1. |
scripts/qemu-smoke.sh | Ran on this cloud VM | Verified | 2026-09-09 M4 (qemu-system-aarch64 8.2.2, rustc 1.100.0-nightly 4aa1fbcf4): hello (timeout 124), exception: sync BRK (esr=0xf2000000), exception: fatal nested (kind=0x200), cargo test 0 (6 cases), force-fail 1, qemu-smoke: ok. First hello run Failed: MSR SP_EL1 at EL1 is UNDEF (esr=0x2000000) before Hello World! — fixed by setting SP_EL1 via mov sp while SPSel=1 (ADR-005). Not Docker. GHA on this PR is a separate row. |
VBAR_EL1 installed at 2 KiB-aligned exception_vectors (M3 / FR-06) | cargo +nightly test vbar_el1_points_at_table | Verified | 2026-09-09 cloud: [ok]. CurrentEL==1 and mrs vbar_el1 equals exception_vectors. ELF also had the table at 0x40080800. |
Current-EL sync BRK handler runs and returns (M3 / FR-06) | cargo +nightly test breakpoint_from_current_el; hello-kernel serial | Verified | 2026-09-09 cloud: test [ok]; hello serial exception: sync BRK esr=0xf2000000 elr=0x40081190 then timeout 124 (wfe loop). Other sync classes and lower-EL slots are parks — taking those is unprobed. |
| qemu-smoke requires BRK handler string | scripts/qemu-smoke.sh hello phase greps exception: sync BRK | Verified | 2026-09-09 cloud: qemu-smoke: BRK handler string present. Extends the M2 sensor (FR-06 / NFR-04). |
| Lower-EL AArch64 sync is live (SVC / IABORT); other lower-EL slots park | Source read of vector table; taken path is the EL0 first-mile row | Verified | Source: sync_lower_el. IRQ/FIQ/SError lower-EL and AArch32 still park. Taken lower-EL IRQ: Unknown. |
| CI on GitHub (M3 PR / this branch) | .github/workflows/smoke.yml on cursor/m3-vbar-el1-exceptions-bd73 | Verified | Push 34389110709 success (ubuntu-24.04 + ubuntu-24.04-arm). PR 34389132580 success. Same qemu-smoke.sh as the cloud probe (hello + BRK string + 4 tests + force-fail). Commit 72ecd37. |
Dedicated SP_EL1 exception stack + SPSel=0 thread stack (M4 / FR-07) | cargo +nightly test spsel_uses_thread_stack + stacks_are_distinct_and_aligned | Verified | 2026-09-09 cloud: both [ok]. SPSel==0 and current SP in __stack_*; three stack ranges 16-byte aligned and disjoint. |
| Nested current-EL exception uses fatal stack and is observable (M4 / FR-07) | Hello-kernel serial exception: fatal nested via scripts/qemu-smoke.sh | Verified | 2026-09-09 cloud: after two exception: sync BRK lines, serial exception: fatal nested then exception: fatal esr=0xf2000000 elr=0x400816cc kind=0x200. Nested AArch64 BRK after near-empty thread SP (ADR-005). Not an MMU overflow fault. Not GIC (M5). |
| qemu-smoke requires fatal nested string | scripts/qemu-smoke.sh hello phase greps exception: fatal nested and rejects fatal probe missed | Verified | 2026-09-09 cloud: qemu-smoke: fatal nested string present. Extends the M3 sensor (FR-07 / NFR-04). |
| CI on GitHub (M4 PR / this branch) | .github/workflows/smoke.yml on cursor/m4-fatal-exception-stack-c8b7 | Unknown | Not a green GHA URL on the post-fix revision before merge. M4 merged as PR #7 (180dbf2). |
| GICv2 init + CNTP PPI 30 tick observable (M5 / FR-08) | Hello-kernel serial timer: tick via scripts/qemu-smoke.sh; #[test_case] timer_tick_is_observable | Verified | 2026-09-09 cloud (QEMU 8.2.2, rustc 1.100.0-nightly 4aa1fbcf4): after Hello World!, serial timer: tick, then M3/M4 BRK + fatal. cargo test Running 9 tests all [ok] including gicd_typer_readable, cntfrq_is_nonzero, timer_tick_is_observable. Not GICv3. Not UART input (M6). |
| qemu-smoke requires timer tick string | scripts/qemu-smoke.sh hello phase greps timer: tick and rejects timer: tick missed | Verified | 2026-09-09 cloud: qemu-smoke: timer tick string present. Extends the M4 sensor (FR-08 / NFR-04). |
| CI on GitHub (M5 PR / this branch) | .github/workflows/smoke.yml on cursor/m5-hardware-interrupts-d5a6 | Verified | Push/PR run 34391557761 success (ubuntu-24.04 + ubuntu-24.04-arm) on the cloud-probe commit. Implementation commit run 34391552019 also success. Same qemu-smoke.sh (hello + tick + BRK + fatal + 9 tests + force-fail). Commit e28e4bb. |
PL011 RX of injected 0x41 observable (M6 / FR-08 input) | Hello-kernel serial input: rx 0x41 via scripts/qemu-smoke.sh + qemu-serial-inject.py | Verified | 2026-09-09 cloud (QEMU 8.2.2, rustc 1.100.0-nightly 4aa1fbcf4): after Hello World! and timer: tick, serial input: rx 0x41, then M3/M4 BRK + fatal. Not virtio-keyboard. Not QEMU LBE (unimplemented on 8.2). |
| qemu-smoke requires UART RX string | scripts/qemu-smoke.sh hello phase greps input: rx 0x41 and rejects input: rx missed | Verified | 2026-09-09 cloud: qemu-smoke: UART RX string present. Extends the M5 sensor (FR-08 input / NFR-04). |
Empty RX FIFO under cargo test (M6) | #[test_case] uart_rx_fifo_empty_without_host_byte | Verified | 2026-09-09 cloud: cargo test Running 10 tests all [ok]. Character proof is the serial row. |
| CI on GitHub (M6 PR / this branch) | .github/workflows/smoke.yml on cursor/m6-uart-rx-input-7ef6 | Unknown | No green GHA URL on the cloud-probe commit yet. |
| EL1 identity map + MMU on (M7 / FR-09) | Hello-kernel serial paging: ok via scripts/qemu-smoke.sh; #[test_case] mmu_is_enabled | Verified | 2026-09-09 cloud (QEMU 8.2.2, rustc 1.100.0-nightly 4aa1fbcf4): after Hello World!, serial paging: ok, then M5/M6/M3/M4 markers. cargo test mmu_is_enabled [ok]. Identity 1 GiB blocks (ADR-008). Not a DTB walk. |
| Frame alloc + map/unmap window (M7 / FR-09) | #[test_case] frame_alloc_aligned_and_distinct + map_unmap_roundtrip; serial marker from paging::observe_probe | Verified | 2026-09-09 cloud: both [ok]. Write-through window VA 0x8000_0000 matches identity PA. |
| qemu-smoke requires paging string | scripts/qemu-smoke.sh hello phase greps paging: ok and rejects paging: probe missed | Verified | 2026-09-09 cloud: qemu-smoke: paging string present. Extends the M6 sensor (FR-09 / NFR-04). |
| CI on GitHub (M7 PR / this branch) | .github/workflows/smoke.yml on cursor/m7-paging-frame-allocator-b567 | Unknown | No green GHA URL on the cloud-probe commit yet. |
GlobalAlloc + Box/Vec on identity-mapped frames (M8 / FR-10) | Hello-kernel serial heap: ok via scripts/qemu-smoke.sh; #[test_case] box_alloc_roundtrip + vec_grows + heap_lives_in_frame_pool | Verified | 2026-09-09 cloud (QEMU 8.2.2, rustc 1.100.0-nightly 4aa1fbcf4): after paging: ok, serial heap: ok, then M5/M6/M3/M4 markers. cargo test Running 17 tests all [ok]. First-fit + coalesce (ADR-009). Not a growing heap. Not M9. |
| qemu-smoke requires heap string | scripts/qemu-smoke.sh hello phase greps heap: ok and rejects heap: probe missed | Verified | 2026-09-09 cloud: qemu-smoke: heap string present. Extends the M7 sensor (FR-10 / NFR-04). |
| CI on GitHub (M8 PR / this branch) | .github/workflows/smoke.yml on cursor/m8-heap-globalalloc-0ee8 | Verified | Push run 34394697056 success (ubuntu-24.04-arm 59s, ubuntu-24.04 1m36s) on the cloud-probe commit ba6096a. Same qemu-smoke.sh (hello + paging + heap + tick + RX + BRK + fatal + 17 tests + force-fail). |
| Cooperative two-task yield (M9 / FR-11) | Hello-kernel serial sched: task a / sched: task b / sched: ok via scripts/qemu-smoke.sh; #[test_case] two_tasks_run_on_distinct_heap_stacks + yield_round_robin_resumes_both | Verified | 2026-09-09 cloud (QEMU 8.2.2, rustc 1.100.0-nightly 4aa1fbcf4): after heap: ok, serial sched: task a, sched: task b, sched: ok, then M5/M6/M3/M4 markers. cargo test Running 19 tests all [ok]. Cooperative EL1 yield (ADR-010). Not preemptive. Not SMP. |
| qemu-smoke requires scheduler strings | scripts/qemu-smoke.sh hello phase greps sched: ok and both task markers; rejects sched: probe missed | Verified | 2026-09-09 cloud: qemu-smoke: scheduler strings present. Extends the M8 sensor (FR-11 / NFR-04). |
| qemu-smoke requires CNTPCT perf string | scripts/qemu-smoke.sh hello phase greps perf: cntpct and rejects perf: probe missed | Verified | 2026-09-09 cloud: qemu-smoke: CNTPCT perf string present. Extends the M9 sensor (NFR-07 / NFR-04). |
| CI on GitHub (M9 PR / this branch) | .github/workflows/smoke.yml on cursor/m9-cooperative-scheduler-7da9 | Verified | Folded from #16 (not re-probed here): push 34395786658 and PR 34395791288 success (ubuntu-24.04-arm + ubuntu-24.04) on 88a9305. Merge-commit push 34396135202 success on 4e3b732. Same qemu-smoke.sh (hello + paging + heap + two-task sched + tick + RX + BRK + fatal + 19 tests + force-fail). |
| Three pillars accepted (ADR-011); NFR-05 / NFR-07 / NFR-10 text revised in place | Read ADR-011 and fr-nfr.md; IDs still NFR-05/NFR-07/NFR-10 | Verified | Document inspection. Not a kernel boot claim. |
| Threat-model v1 exists (NFR-10) | Read security.md (assets, adversaries, trust boundaries, non-goals, mitigations→probes) | Verified | File + review (2026-09-10, #18). Replaces the ADR-011 stub. “Secure OS” / “hardened”: unclaimed. |
| Threat-model v1.1 slice (NFR-10) | Read security.md (linker stacks, guards, EL0 first mile, remaining W^X gaps) | Verified | File + review. v1.1 update, not “secure.” |
| Threat-model v1.5 slice (NFR-10) | Read security.md (standing EL0, TTBR1 first cut, EL1 high-VA fetch, PAN/identity teardown still Planned) | Verified | File + PR #25. v1.5 update, not “secure.” |
| Threat-model v1.6 slice (NFR-10) | Read security.md (identity-tear first cut, PAN/full teardown still Planned) | Verified | File + PR #26. v1.6 update, not “secure.” |
| Threat-model v1.7 slice (NFR-10) | Read security.md (high-VA jump + 16 KiB dedicated identity text range, live .text stays, PAN/full teardown still Planned) | Verified | File + PR #27 (on main 24d94e6). v1.7 update, not “secure.” |
| Threat-model v1.8 slice (NFR-10) | Read security.md (high-VA vtable rewrite + live identity .text tear, .rodata/.data/heap stay, PAN/full teardown still Planned) | Verified | File + PR #28 (on main e80dc93). v1.8 update, not “secure.” |
| W^X / NX heap + coop stacks (ADR-012) | Hello-kernel serial wx: nx heap + wx: ok via scripts/qemu-smoke.sh; #[test_case] heap_and_mmio_are_pxn + kernel_text_is_executable + execute_from_heap_is_caught | Verified | 2026-09-10 cloud (QEMU 8.2.2, rustc 1.100.0-nightly a36d05efa): after sched: ok, serial wx: nx heap then wx: ok. cargo test Running 25 tests all [ok]. L2/L3 PXN on [__kernel_end, RAM end) (ADR-012). Linker SP_EL0 / SP_EL1 / fatal stacks stay in the executable image. Device MMIO L1 is XN. Not a “secure OS” or “the kernel is W^X” claim. |
| qemu-smoke requires W^X string | scripts/qemu-smoke.sh hello phase greps wx: ok and rejects wx: probe missed | Verified | 2026-09-10 cloud: qemu-smoke: W^X string present. Extends the pillars sensor (NFR-10 / NFR-04). |
| Baseline CNTPCT loop probe (NFR-07) | Hello-kernel serial perf: cntpct via scripts/qemu-smoke.sh; #[test_case] cntpct_advances_over_loop | Verified | 2026-09-10 cloud re-probe (QEMU 8.2.2, rustc 1.100.0-nightly a36d05efa): after wx: ok, serial perf: cntpct delta=22968. Prior 2026-09-09 pillars probe also Verified. Counter-advances baseline. Not a published bench. |
| IRQ-to-handler CNTPCT delta (NFR-07) | Hello-kernel serial perf: irq-delta via scripts/qemu-smoke.sh; #[test_case] irq_delta_samples_recorded | Verified | 2026-09-10 cloud (QEMU 8.2.2): after timer: tick, serial perf: irq-delta min=12973 max=35391 spread=22418 n=8. cargo test irq_delta_samples_recorded [ok]. CNTPCT−CVAL spread on this QEMU virt guest. Not a latency budget. Not “faster than X.” |
| qemu-smoke requires IRQ-delta string | scripts/qemu-smoke.sh hello phase greps perf: irq-delta and rejects perf: irq-delta missed | Verified | 2026-09-10 cloud: qemu-smoke: IRQ-delta perf string present. Extends the NFR-07 sensor (NFR-04). |
| Linker-stack guard pages (ADR-014) | Hello-kernel serial guard: fault + guard: ok via scripts/qemu-smoke.sh; #[test_case] linker_stack_guards_unmapped + store_to_thread_guard_is_caught | Verified | 2026-09-10 cloud (QEMU 8.2.2, rustc 1.100.0-nightly a36d05efa): after wx: ok, serial guard: fault then guard: ok. cargo test both guard cases [ok]. Unmapped 4 KiB holes (ADR-014). Live stack pages stay executable. Not “the kernel is W^X.” |
| qemu-smoke requires guard string | scripts/qemu-smoke.sh hello phase greps guard: ok and rejects guard: probe missed | Verified | 2026-09-10 cloud: qemu-smoke: stack-guard string present. |
| Host debug ELF size (NFR-08) | scripts/qemu-smoke.sh prints perf: elf-size bytes=<n> and rejects < 4096 | Verified | 2026-09-10 cloud: host perf: elf-size bytes=3752056 after cargo +nightly build. Measurement only. Not a budget. Not a bench. |
| EL0 entered and returned (SVC) | Hello-kernel serial el0: svc + el0: ok; #[test_case] el0_svc_roundtrip | Verified | 2026-09-10 cloud: after guard: ok, serial el0: svc then el0: ok. cargo test el0_svc_roundtrip [ok]. is_active() stays false. Not userspace. |
| EL0 cannot execute kernel data | Hello-kernel serial el0: nx kernel; #[test_case] el0_cannot_execute_kernel_data | Verified | 2026-09-10 cloud: serial el0: nx kernel. cargo test [ok]. Lower-EL UXN IABORT on kernel .data. 2026-09-11 hello re-probe (this branch) still prints el0: nx kernel (now also a translation IABORT under user TTBR0). Not isolation. |
| EL0 isolation (P-SEC-3) | Standing EL0 + PAN + full TTBR1/higher-half teardown | Planned | Direction ADR-013. Standing + TTBR1 first cut (ADR-016) + EL1 high-VA fetch (ADR-017) + identity-tear first cut (ADR-018) + identity .text range tear (ADR-019) + live .text tear (ADR-020) are different rows. PAN and full identity teardown (.rodata/.data/heap) still missing. Do not claim “EL0 isolated.” |
| RO+NX text/data (ADR-015) | Hello-kernel serial ro: nx data + ro: write fault + ro: ok; #[test_case] execute-from-.data + write-to-RO-text | Verified | 2026-09-11 cloud qemu-smoke (QEMU 8.2.2, rustc 1.100.0-nightly 67eda617e, -cpu cortex-a57): after guard: ok, serial ro: nx data then ro: write fault then ro: ok. cargo test both RO cases [ok]. Identity image W^X on this virt guest (text RO+X, data/stacks/heap RW+NX, SCTLR.WXN on). Not a “secure OS.” |
| qemu-smoke requires RO+NX strings | scripts/qemu-smoke.sh hello phase greps ro: ok / ro: nx data / ro: write fault | Verified | 2026-09-11 cloud: qemu-smoke: RO+NX string present. |
| Boot-to-ready CNTPCT (NFR-08) | Hello-kernel serial perf: boot-delta; #[test_case] boot_delta_sample_exists | Verified | 2026-09-11 cloud qemu-smoke: perf: boot-delta ticks=111019 (after paging::init → after Hello World!). First attempt Failed: pre-MMU .bss store lost on the test image. Measurement only. Not a budget. Not a bench. |
| qemu-smoke requires boot-delta string | scripts/qemu-smoke.sh hello phase greps perf: boot-delta | Verified | 2026-09-11 cloud: qemu-smoke: boot-delta perf string present. |
User TTBR0 omits kernel .data | #[test_case] user_ttbr0_omits_kernel_data; walk L1_USER | Verified | 2026-09-11 cloud cargo test: user_ttbr0_omits_kernel_data [ok]. ASID=1 programmed. Not ASID isolation. |
EL0 cannot read kernel .data | Hello-kernel serial el0: no kernel read; #[test_case] el0_cannot_read_kernel_data | Verified | 2026-09-11 cloud qemu-smoke: after el0: nx kernel, serial el0: no kernel read then el0: ok. cargo test [ok]. User TTBR0 omits .data. is_active() stays false. Not isolation. Not PAN. |
| PAN on virt cortex-a57 | ID_AA64MMFR1_EL1.PAN != 0 and an EL1-vs-EL0 access fault | Planned | ARMv8.0 cortex-a57. Do not claim PAN. |
| ASID isolation | Hello-kernel serial asid: dual + asid: conflict + asid: ok; #[test_case] asid_isolation_without_vmalle1; no TLBI VMALLE1 on the switch | Verified | 2026-09-11 cloud qemu-smoke (QEMU 8.2.2, rustc 1.100.0-nightly 67eda617e, -cpu cortex-a57): after el0: ok, serial asid: dual then asid: conflict then asid: ok. cargo test asid_isolation_without_vmalle1 [ok] (Running 39 tests). Dual TTBR0 (ASID 1 vs 2) with nG pages; switch is MSR TTBR0 + ISB. EL0 trampoline still TLBI VMALLE1 (.data leaves are global). Not “EL0 isolated.” Not PAN. |
| Standing EL0 context | Hello-kernel serial el0: standing + el0: restored; #[test_case] standing_el0_enter_leave; is_active() true only while standing | Verified | 2026-09-11 cloud qemu-smoke (QEMU 8.2.2, rustc 1.100.0-nightly 67eda617e, -cpu cortex-a57): after el0: no kernel read, serial el0: standing then el0: restored then el0: ok. cargo test standing_el0_enter_leave [ok] (Running 42 tests). Dual-SVC on user TTBR0 (not a trampoline flag). Lower-EL IRQ still parks. Not POSIX. Not isolation. |
| TTBR1 kernel-private page (ADR-016 first cut) | Hello-kernel serial ttbr1: el1 + ttbr1: no el0 + ttbr1: ok; #[test_case] ttbr1_el1_sees_priv_el0_does_not | Verified | 2026-09-11 cloud qemu-smoke: after asid: ok, serial ttbr1: el1 then ttbr1: no el0 then ttbr1: ok. cargo test ttbr1_el1_sees_priv_el0_does_not [ok]. EL1-only high page. Identity teardown Planned. Not a relocated kernel. Not “EL0 isolated.” |
| qemu-smoke requires standing EL0 strings | scripts/qemu-smoke.sh hello phase greps el0: standing / el0: restored | Verified | 2026-09-11 cloud: qemu-smoke: EL0 first-mile + read-mile + standing strings present. |
| qemu-smoke requires TTBR1 strings | scripts/qemu-smoke.sh hello phase greps ttbr1: ok / ttbr1: el1 / ttbr1: no el0; rejects ttbr1: leaked and ttbr1: probe missed | Verified | 2026-09-11 cloud: qemu-smoke: TTBR1 private-page strings present. |
| EL1 fetch from TTBR1 high VA (ADR-017) | Hello-kernel serial ttbr1: el1 exec + ttbr1: vbar; #[test_case] el1_executes_from_ttbr1_high_va + high_alias_maps_kernel_text | Verified | 2026-09-11 cloud qemu-smoke (QEMU 8.2.2, rustc 1.100.0-nightly 67eda617e, -cpu cortex-a57): after asid: ok, serial ttbr1: el1 exec then ttbr1: vbar then the ADR-016 private-page lines. cargo test both new cases [ok] (Running 44 tests). _start stays at 0x4008_0000. Nested fatal ELR can be the high alias (elr=0xffffff80400839e4). Not a relocated kernel. Not “EL0 isolated.” |
| qemu-smoke requires TTBR1 high-VA exec strings | scripts/qemu-smoke.sh hello phase greps ttbr1: el1 exec / ttbr1: vbar; rejects ttbr1: exec missed | Verified | 2026-09-11 cloud: qemu-smoke: TTBR1 private-page + high-VA exec strings present. |
| Full higher-half / identity teardown | Identity .rodata/.data/heap unmapped after those accesses are proven high-only | Planned | ADR-020 tears live identity .text after a vtable rewrite (separate Verified row). _start stays at 0x4008_0000. Do not claim the kernel moved. |
Identity .rodata / .data / heap tear | Those identity ranges unmapped; accesses proven high-only | Planned | After live .text. Not started on main e80dc93. |
| Docs site at https://ctos.artof.link | HTTP(S) fetch of the published Pages site on that host | Verified | 2026-09-11 after #30: curl -sL https://ctos.artof.link/ → HTTP 200; HTML title/menu ctos (ctsOS); landing #driving-principles. This VM repeat: same 200 + title + heading. Also 200: overview/what-can-run.html, overview/porting.html, framework/honesty-ledger.html. Deploy cited on the published-site row. Not a kernel boot claim. |
High-VA vtable rewrite + live identity .text tear (ADR-020) | Hello-kernel serial ident: reloc + ident: live + existing ident: ok; #[test_case] identity_fn_ptrs_rewritten_high + live_identity_text_unmapped_boot_stub_stays | Verified | 2026-09-11 cloud qemu-smoke (QEMU 8.2.2, rustc 1.100.0-nightly 67eda617e, -cpu cortex-a57): ident: jump then ident: reloc n=12 then ident: range lo=0x400ae000 hi=0x400b2000 pages=4 then ident: live lo=0x40081000 hi=0x400a6000 pages=37 then Hello World! then later ident: split / ident: fault / ident: high / ident: text / ident: no el0 / ident: ok. Hello BRK ELRs high (elr=0xffffff8040082990). cargo test Running 50 tests all [ok] (ident: reloc n=74, ident: live pages=45). Not a relocated kernel. Not “EL0 isolated.” .rodata/.data/heap stay. Full teardown Planned. |
| Identity text range tear (ADR-019) | Hello-kernel serial ident: jump + ident: range + ident: text + existing ident: ok; #[test_case] identity_text_range_unmapped_boot_stub_stays | Verified | 2026-09-11 cloud qemu-smoke (QEMU 8.2.2, rustc 1.100.0-nightly 67eda617e, -cpu cortex-a57): ident: jump then ident: range lo=0x400ac000 hi=0x400b0000 pages=4 then later ident: split / ident: fault / ident: high / ident: text / ident: no el0 / ident: ok. Hello BRK ELRs high (elr=0xffffff8040082758). cargo test identity_text_range_unmapped_boot_stub_stays [ok] (Running 48 tests). Live .text stays. First attempt to yank live .text after the stub Failed (unhandled sync on println! — rustc dyn Write vtables). Not a relocated kernel. Not “EL0 isolated.” Full teardown Planned. |
| Identity-tear first cut (ADR-018) | Hello-kernel serial ident: split + ident: fault + ident: high + ident: no el0 + ident: ok; #[test_case] high_ram_tables_are_independent + identity_tear_page_unmapped_high_stays + identity_tear_el1_faults_high_stays | Verified | 2026-09-11 cloud qemu-smoke (QEMU 8.2.2, rustc 1.100.0-nightly 67eda617e, -cpu cortex-a57): after ttbr1: ok, serial ident: split then ident: fault then ident: high then ident: no el0 then ident: ok. cargo test all three new cases [ok] (Running 47 tests). _start stays at 0x4008_0000. Nested fatal ELR can be the high alias (elr=0xffffff8040083bec). Not a relocated kernel. Not “EL0 isolated.” Full teardown Planned. |
| qemu-smoke requires identity-tear strings | scripts/qemu-smoke.sh hello phase greps ident: ok / ident: split / ident: fault / ident: high / ident: no el0; rejects ident: leaked and ident: probe missed | Verified | 2026-09-11 cloud: qemu-smoke: identity-tear strings present. |
| Obsidian open-vault checklist | Read research/obsidian-checklist.md; .gitignore has .obsidian/ | Verified | Structure only. .obsidian/ not committed. Not a claim that Obsidian is installed or synced. |
| CI on GitHub (pillars PR / ADR-011) | .github/workflows/smoke.yml on cursor/pillars-adr-011-325f | Verified | Cloud-probe commit cdf75eb: push 34396574483 and PR 34396590545 success. Ledger follow-up d716599: push 34396774022 and PR 34396779239 success. Same qemu-smoke.sh (hello + paging + heap + sched + CNTPCT + tick + RX + BRK + fatal + 20 tests + force-fail). |
scripts/qemu-smoke.sh (pillars follow-up / #18) | Ran on that cloud VM | Verified | 2026-09-10 (QEMU 8.2.2, rustc 1.100.0-nightly a36d05efa): hello (timeout 124) with paging: ok, heap: ok, sched: ok, wx: nx heap / wx: ok, perf: cntpct delta=22968, timer: tick, perf: irq-delta min=12973 max=35391 spread=22418 n=8, input: rx 0x41, two exception: sync BRK, exception: fatal nested / kind=0x200. cargo test Running 25 tests all [ok]. force-fail exit 1. qemu-smoke: ok. Not Docker. |
scripts/qemu-smoke.sh (pillar deepen / this branch) | Ran on this cloud VM | Verified | 2026-09-10 (QEMU 8.2.2, rustc 1.100.0-nightly a36d05efa): host perf: elf-size bytes=3752056; hello (timeout 124) with paging: ok, heap: ok, sched: ok, wx: nx heap / wx: ok, guard: fault / guard: ok, el0: svc / el0: nx kernel / el0: ok, perf: cntpct delta=20592, timer: tick, perf: irq-delta min=14477 max=24149 spread=9672 n=8, input: rx 0x41, two exception: sync BRK, exception: fatal nested / kind=0x200. cargo test Running 29 tests all [ok]. force-fail exit 1. qemu-smoke: ok. Not Docker. GHA on this PR is a separate row. |
| CI on GitHub (pillars follow-up PR / #18) | .github/workflows/smoke.yml on cursor/pillars-sec-perf-el0-9bc0 | Verified | Cloud-probe commit 8ae63bb: push 34541457222 and PR 34541473721 success (ubuntu-24.04 + ubuntu-24.04-arm). Ledger follow-up 4c610a2: push 34541534491 and PR 34541537733 success. Same qemu-smoke.sh (hello + paging + heap + sched + W^X + CNTPCT + IRQ-delta + tick + RX + BRK + fatal + 25 tests + force-fail). |
| CI on GitHub (pillar deepen PR / #19) | .github/workflows/smoke.yml on cursor/pillar-loops-deepen-48ae | Unknown | No green GHA URL on the cloud-probe commit recorded here. Merged as #19. |
scripts/qemu-smoke.sh (RO+NX / boot-delta / user TTBR0 / PR #20) | Ran on that cloud VM | Verified | 2026-09-11 (QEMU 8.2.2, rustc 1.100.0-nightly 67eda617e): host perf: elf-size bytes=3785520; hello (timeout 124) with paging: ok, heap: ok, sched: ok, wx: nx heap / wx: ok, guard: fault / guard: ok, ro: nx data / ro: write fault / ro: ok, el0: svc / el0: nx kernel / el0: no kernel read / el0: ok, perf: cntpct delta=20506, perf: boot-delta ticks=111019, timer: tick, perf: irq-delta min=4885 max=26301 spread=21416 n=8, input: rx 0x41, two exception: sync BRK, exception: fatal nested / kind=0x200. cargo test Running 36 tests all [ok]. force-fail exit 1. qemu-smoke: ok. Not Docker. GHA on that PR is a separate row. |
| CI on GitHub (RO+NX / boot-delta / user TTBR0 / PR #20) | .github/workflows/smoke.yml on cursor/pillar-deepen-ro-boot-el0-aadc | Verified | Cloud-probe commit 6606be8: push 34561716967 and PR 34561719542 success (ubuntu-24.04 + ubuntu-24.04-arm). Host ELF there ~3.69 MiB — smaller than cts-ai Docker 3786384. Do not copy that Verified onto the Docker host. |
Docker smoke on main b2bbb99 (post PR #20) | cts-ai Docker Desktop linux/arm64 ./scripts/docker-smoke.sh after sync to b2bbb99 | Failed | Sponsor serial: perf: elf-size bytes=3786384; Hello World!; paging: probe missed; heap: probe missed; sched: probe missed; wx: probe missed; guard: fault / guard: ok; ro: nx data / ro: write fault / ro: ok; el0: probe missed; then CNTPCT / boot-delta / tick / irq-delta / RX / BRK / fatal still printed. qemu-smoke: missing 'paging: ok' EXIT 1. Guard/ro are current-EL identity walks — they do not need frame::ALLOC or USER_MAP_OK. Same class as the PR #20 pre-MMU .bss miss, plus a single shared L3 / first-2-MiB user map that a larger nightly layout can also break. Antifragility: this host found what GHA missed. Not this cloud VM. |
scripts/qemu-smoke.sh (layout L3 pool / post-MMU frame init / this branch) | Ran on this cloud VM | Verified | 2026-09-11 (QEMU 8.2.2, rustc 1.100.0-nightly 67eda617e): host perf: elf-size bytes=3837736; hello (timeout 124) with paging: layout data=0x40201000 end=0x4023c000 pool=0x4023c000 user=1, paging: ok, heap: ok, sched: ok, wx: nx heap / wx: ok, guard: fault / guard: ok, ro: nx data / ro: write fault / ro: ok, el0: svc / el0: nx kernel / el0: no kernel read / el0: ok, perf: cntpct delta=21094, perf: boot-delta ticks=115251, timer: tick, perf: irq-delta min=12053 max=24899 spread=12846 n=8, input: rx 0x41, two exception: sync BRK, exception: fatal nested / kind=0x200. cargo test Running 38 tests all [ok] (adds layout_stress_crosses_first_ram_l2 + frame_allocator_ready_after_mmu). force-fail exit 1. qemu-smoke: ok. Loaded layout larger than cts-ai Docker’s 3.78 MiB class (__data_start in the second RAM 2 MiB). Not Docker. GHA on this PR is a separate row. |
| CI on GitHub (layout L3 pool / PR #21) | .github/workflows/smoke.yml on cursor/layout-l3-user-map-c915 | Verified | Cloud-probe commit c04b84b: push 34563006005 and PR 34563008516 success (ubuntu-24.04 + ubuntu-24.04-arm). Merge-commit push 34563104020 success on 71ee15f. MRC grepped both-matrix serial: paging: layout data=0x40201000 … user=1, paging: ok, heap: ok, sched: ok, wx: ok, el0: ok, 38 tests, force-fail fail-closed. Do not copy that Verified onto cts-ai Docker. |
Docker smoke after the layout fix (main 71ee15f) | cts-ai Docker Desktop linux/arm64 ./scripts/docker-smoke.sh after #21 merge | Verified | Sponsor re-run on 71ee15f: perf: elf-size bytes=3838592; Hello World!; paging: layout data=0x40201000 end=0x4023c000 pool=0x4023c000 user=1; paging: ok; heap: ok; sched: ok; wx: ok; guard: ok; ro: ok; el0: svc / el0: nx kernel / el0: no kernel read / el0: ok; perf: cntpct …; perf: boot-delta ticks=217103; perf: irq-delta …; input: rx 0x41; exception: sync BRK … / fatal nested …; Running 38 tests all [ok]; force-fail exit 1; qemu-smoke: ok; EXIT 0. Keep the b2bbb99 Failed row (antifragility history). Not this cloud VM. |
| qemu-smoke requires ASID isolation strings | scripts/qemu-smoke.sh hello phase greps asid: ok / asid: dual / asid: conflict; rejects asid: stale and asid: probe missed | Verified | 2026-09-11 cloud: qemu-smoke: ASID isolation strings present. |
scripts/qemu-smoke.sh (ASID isolation / this branch) | Ran on this cloud VM | Verified | 2026-09-11 (QEMU 8.2.2, rustc 1.100.0-nightly 67eda617e): host perf: elf-size bytes=3853144; hello (timeout 124) with paging: layout data=0x40201000 end=0x4023f000 pool=0x4023f000 user=1, paging: ok, heap: ok, sched: ok, wx: nx heap / wx: ok, guard: fault / guard: ok, ro: nx data / ro: write fault / ro: ok, el0: svc / el0: nx kernel / el0: no kernel read / el0: ok, asid: dual / asid: conflict / asid: ok, perf: cntpct delta=21093, perf: boot-delta ticks=115983, timer: tick, perf: irq-delta min=9499 max=29721 spread=20222 n=8, input: rx 0x41, two exception: sync BRK, exception: fatal nested / kind=0x200. cargo test Running 39 tests all [ok]. force-fail exit 1. qemu-smoke: ok. Not Docker. GHA on this PR is a separate row. |
| CI on GitHub (ASID isolation / PR #23) | .github/workflows/smoke.yml on cursor/el0-asid-isolation-f98d | Unknown | No green GHA URL on the cloud-probe commit recorded here. Merged as #23 (fb050b7). |
scripts/qemu-smoke.sh (standing EL0 + TTBR1 / this branch) | Ran on this cloud VM | Verified | 2026-09-11 (QEMU 8.2.2, rustc 1.100.0-nightly 67eda617e): host perf: elf-size bytes=3872120; hello (timeout 124) with paging: layout data=0x40201000 end=0x40243000 pool=0x40243000 user=1, paging: ok, heap: ok, sched: ok, wx: nx heap / wx: ok, guard: fault / guard: ok, ro: nx data / ro: write fault / ro: ok, el0: svc / el0: nx kernel / el0: no kernel read / el0: standing / el0: restored / el0: ok, asid: dual / asid: conflict / asid: ok, ttbr1: el1 / ttbr1: no el0 / ttbr1: ok, perf: cntpct delta=23782, perf: boot-delta ticks=127971, timer: tick, perf: irq-delta min=11604 max=27616 spread=16012 n=8, input: rx 0x41, two exception: sync BRK, exception: fatal nested / kind=0x200. cargo test Running 42 tests all [ok]. force-fail exit 1. qemu-smoke: ok. Not Docker. GHA on this PR is a separate row. |
| CI on GitHub (standing EL0 + TTBR1 / PR #24) | .github/workflows/smoke.yml on cursor/el0-standing-ttbr1-5ce0 | Unknown | No green GHA URL on the cloud-probe commit recorded here. Merged as #24 (8745939). |
scripts/qemu-smoke.sh (TTBR1 high-VA exec / this branch) | Ran on this cloud VM | Verified | 2026-09-11 (QEMU 8.2.2, rustc 1.100.0-nightly 67eda617e): host perf: elf-size bytes=3877712; hello (timeout 124) with paging: layout data=0x40201000 end=0x40243000 pool=0x40243000 user=1, paging: ok, heap: ok, sched: ok, wx: nx heap / wx: ok, guard: fault / guard: ok, ro: nx data / ro: write fault / ro: ok, el0: svc / el0: nx kernel / el0: no kernel read / el0: standing / el0: restored / el0: ok, asid: dual / asid: conflict / asid: ok, ttbr1: el1 exec / ttbr1: vbar / ttbr1: el1 / ttbr1: no el0 / ttbr1: ok, perf: cntpct delta=20622, perf: boot-delta ticks=117383, timer: tick, perf: irq-delta min=11983 max=21932 spread=9949 n=8, input: rx 0x41, two exception: sync BRK, exception: fatal nested / kind=0x200 (fatal elr=0xffffff80400839e4). cargo test Running 44 tests all [ok]. force-fail exit 1. qemu-smoke: ok. Not Docker. GHA on this PR is a separate row. |
| CI on GitHub (TTBR1 high-VA exec / PR #25) | .github/workflows/smoke.yml on cursor/ttbr1-high-el1-exec-136c | Unknown | No green GHA URL on the cloud-probe commit recorded here. Merged as #25 (008f7c7). |
scripts/qemu-smoke.sh (identity-tear first cut / this branch) | Ran on this cloud VM | Verified | 2026-09-11 (QEMU 8.2.2, rustc 1.100.0-nightly 67eda617e): host perf: elf-size bytes=3895632; hello (timeout 124) with paging: layout data=0x40201000 end=0x40255000 pool=0x40255000 user=1, paging: ok, heap: ok, sched: ok, wx: nx heap / wx: ok, guard: fault / guard: ok, ro: nx data / ro: write fault / ro: ok, el0: svc / el0: nx kernel / el0: no kernel read / el0: standing / el0: restored / el0: ok, asid: dual / asid: conflict / asid: ok, ttbr1: el1 exec / ttbr1: vbar / ttbr1: el1 / ttbr1: no el0 / ttbr1: ok, ident: split / ident: fault / ident: high / ident: no el0 / ident: ok, perf: cntpct delta=25355, perf: boot-delta ticks=130631, timer: tick, perf: irq-delta min=14217 max=34342 spread=20125 n=8, input: rx 0x41, two exception: sync BRK, exception: fatal nested / kind=0x200 (fatal elr=0xffffff8040083bec). cargo test Running 47 tests all [ok]. force-fail exit 1. qemu-smoke: ok. Not Docker. GHA on this PR is a separate row. |
| CI on GitHub (identity-tear first cut / PR #26) | .github/workflows/smoke.yml on cursor/identity-teardown-c0fd | Unknown | No green GHA URL on the cloud-probe commit recorded here. Merged as #26 (b0f0ee5). |
Docker smoke on main b0f0ee5 (post PR #26 / ADR-018) | cts-ai Docker Desktop linux/arm64 ./scripts/docker-smoke.sh after #26 merge | Verified | Sponsor re-run on b0f0ee5: 47 tests, ident: ok, fatal nested ELR high alias. Not this cloud VM. Keep prior Failed b2bbb99 row (antifragility history). |
qemu-smoke requires identity .text range-tear strings | scripts/qemu-smoke.sh hello phase greps ident: jump / ident: range / ident: text; rejects ident: range missed | Verified | 2026-09-11 cloud: qemu-smoke: identity-tear strings present (includes jump/range/text). |
scripts/qemu-smoke.sh (identity text range tear / this branch) | Ran on this cloud VM | Verified | 2026-09-11 3e710e1 (QEMU 8.2.2, rustc 1.100.0-nightly 67eda617e): host perf: elf-size bytes=3905712; hello (timeout 124) with ident: jump, ident: range lo=0x400ac000 hi=0x400b0000 pages=4, paging: layout data=0x40201000 end=0x40255000 pool=0x40255000 user=1, paging: ok, heap: ok, sched: ok, wx: ok, guard: ok, ro: ok, el0: ok, asid: ok, ttbr1: ok, ident: split / ident: fault / ident: high / ident: text / ident: no el0 / ident: ok, perf: cntpct delta=20293, perf: boot-delta ticks=92466, timer: tick, perf: irq-delta min=12711 max=26328 spread=13617 n=8, input: rx 0x41, two exception: sync BRK (ELRs 0xffffff8040082758 / 0xffffff8040082730), exception: fatal nested / kind=0x200 (fatal elr=0xffffff8040083bf4). cargo test Running 48 tests all [ok]. force-fail exit 1. qemu-smoke: ok. Not Docker. GHA on this PR is a separate row. |
CI on GitHub (identity text range tear / PR #27 ac3ad0b) | .github/workflows/smoke.yml on cursor/identity-tear-text-range-ea15 @ ac3ad0b | Failed | Both matrices: hello printed ident: jump / ident: range then ident: probe missed (init still required a 4 KiB __ident_tear_*; ADR-019 is 16 KiB). Keep this Failed row. |
CI on GitHub (identity text range tear / main 24d94e6) | .github/workflows/smoke.yml merge-commit push on 24d94e6 | Verified | Push 34640667227 success (ubuntu-24.04 + ubuntu-24.04-arm). Grepped both jobs: hello ident: jump / ident: range lo=0x400ac000 hi=0x400b0000 pages=4 / ident: text / ident: ok; BRK/fatal ELRs high; Running 48 tests; force-fail exit 1; qemu-smoke: ok. |
Docker smoke on main 24d94e6 (post PR #27 / ADR-019) | cts-ai Docker Desktop linux/arm64 ./scripts/docker-smoke.sh after #27 merge | Verified | Sponsor re-run on 24d94e6: ident: jump, 16 KiB range tear, ident: ok, BRK/fatal on high ELRs, 48 tests + force-fail. Not this cloud VM. Keep the b2bbb99 Failed row. |
qemu-smoke requires identity reloc + live .text strings | scripts/qemu-smoke.sh hello phase greps ident: reloc / ident: live; rejects ident: reloc missed / ident: live missed | Verified | 2026-09-11 cloud: qemu-smoke: identity-tear strings present (includes reloc/live). |
scripts/qemu-smoke.sh (ADR-020 live .text tear / this branch) | Ran on this cloud VM | Verified | 2026-09-11 0fda690 (QEMU 8.2.2, rustc 1.100.0-nightly 67eda617e): host perf: elf-size bytes=3988408; hello (timeout 124) with ident: jump, ident: reloc n=12, ident: range lo=0x400ae000 hi=0x400b2000 pages=4, ident: live lo=0x40081000 hi=0x400a6000 pages=37, paging: layout data=0x40201000 end=0x40255000 pool=0x40255000 user=1, paging: ok, heap: ok, sched: ok, wx: nx heap / wx: ok, guard: fault / guard: ok, ro: nx data / ro: write fault / ro: ok, el0: svc / el0: nx kernel / el0: no kernel read / el0: standing / el0: restored / el0: ok, asid: dual / asid: conflict / asid: ok, ttbr1: el1 exec / ttbr1: vbar / ttbr1: el1 / ttbr1: no el0 / ttbr1: ok, ident: split / ident: fault / ident: high / ident: text / ident: no el0 / ident: ok, perf: cntpct delta=21002, perf: boot-delta ticks=94258, timer: tick, perf: irq-delta min=10686 max=27025 spread=16339 n=8, input: rx 0x41, two exception: sync BRK (ELRs 0xffffff8040082990 / 0xffffff8040082968), exception: fatal nested / kind=0x200 (fatal elr=0xffffff8040083e2c). cargo test Running 50 tests all [ok]. force-fail exit 1. qemu-smoke: ok. Not Docker. GHA on this PR is a separate row. |
CI on GitHub (ADR-020 live .text tear / this branch) | .github/workflows/smoke.yml on cursor/adr-020-live-text-reloc-322c | Unknown | No green GHA URL on the cloud-probe commit recorded here. Merged as #28 (e80dc93). |
CI on GitHub (ADR-020 live .text tear / main e80dc93) | .github/workflows/smoke.yml merge-commit push on e80dc93 | Verified | Push 34651404108 success (ubuntu-24.04 + ubuntu-24.04-arm). Grepped both jobs: hello ident: jump / ident: reloc n=12 / ident: live lo=0x40081000 hi=0x400a6000 pages=37 / ident: ok; Hello World! after the tear; Running 50 tests; force-fail exit 1; qemu-smoke: ok. |
Docker smoke on main e80dc93 (post PR #28 / ADR-020) | cts-ai Docker Desktop linux/arm64 ./scripts/docker-smoke.sh after #28 merge | Verified | Sponsor re-run on e80dc93: 50 tests, ident: reloc n=12, live pages=37, force-fail ok. Not this cloud VM. Keep the earlier 24d94e6 Docker Verified row and the b2bbb99 Failed row. |
| mdBook docs site builds locally | ./scripts/docs-build.sh (mdBook 0.5.4 + mdbook-mermaid 0.17.1) writes book/ and book/CNAME is ctos.artof.link | Verified | 2026-09-11 this cloud VM (plain-English / mermaid branch): mdbook v0.5.4; mdbook-mermaid 0.17.1; docs-build: ok; mermaid class="mermaid" nodes on landing + overview + pillars. Generator only. Live URL is a separate row. |
| Pages workflow file exists | Read .github/workflows/pages.yml | Verified | Workflow present: PR builds the book; main uploads + actions/deploy-pages. Not a live URL. |
| Pages workflow builds this PR | .github/workflows/pages.yml on cursor/docs-pages-site-c371 | Verified | PR run 34651704287 success (mdBook build 7s). Deploy job skipped on pull_request (expected). Not a live site. |
| Pages workflow builds this PR (plain-English / mermaid) | .github/workflows/pages.yml on cursor/docs-plain-english-diagrams-e4a9 | Verified | PR run 34654325467 success (mdBook build 5s). Deploy job skipped on pull_request (expected). Not a new live-site deploy. |
| Docs website published (GitHub Pages) | Green pages workflow on main and an HTTPS fetch of https://ctos.artof.link | Verified | 2026-09-11 this cloud VM after #30: main deploy 34653046584 success (mdBook build + Deploy GitHub Pages). curl -sSI https://ctos.artof.link HTTP 200; body includes Driving principles. https://artofdream.github.io/ctos (no trailing slash) 301s to the custom domain; .../ctos/ 404’d — not a second live tree. |
Public CNAME ctos.artof.link → artofdream.github.io | dig CNAME ctos.artof.link +short | Verified | 2026-09-11 this cloud VM (repeat): artofdream.github.io. DNS is in place at the public resolver. Serving the book is the Verified docs-site / reachability rows. |
Route 53 ctos CNAME in account 737290977112 zone Z1178AFMV41RWP | Sponsor stated CREATE done (zone Z1178AFMV41RWP); API list-resource-record-sets as that account | Unknown | This environment still has no AWS CLI / credentials. Sponsor named the zone and said the record exists. Do not CREATE again. Public dig is the Verified row above, not this API probe. |
Custom domain ctos.artof.link reachability | Pages Settings/API lists the hostname and curl -sSI https://ctos.artof.link is HTTP 200 with a cert for that name | Verified | 2026-09-11 this cloud VM: Pages API cname=ctos.artof.link, https_enforced=true, cert state=approved (expires 2026-12-10). HTTPS 200; TLS CN=ctos.artof.link (Let’s Encrypt). Route 53 API LIST stays the Unknown row above. |
| Guest filesystem (VFS / memfs / virtio-blk / FAT) | Serial + #[test_case] that do not exist; src/ has no FS stack | Planned | Site: docs/overview/filesystem.md. Extra stance: filesystem.md. Order Planned: memfs → virtio-blk → FAT or xv6-like. Do not say “supports FAT.” File presence is not a guest open. |
| Guest runs host apps (Linux ELF / shell / Python) | No exec, libc, or app-load serial marker | Planned | Site: docs/overview/hosting-apps.md. Extra: host-apps.md. Today: in-tree samples only. |
| Guest is a container host (OCI / Docker / k8s) | Source: no OCI, runc, cgroup, or namespace code in src/ | Verified | Absence + non-goal. Site: hosting-apps.md. Host docker-smoke.sh is a build harness, not a guest runtime. Not a later Planned feature. |
| Product “immutable OS” | Marketing sentence vs immutability.md | Planned | Non-claim. Absolute immutability is incompatible (heap/PTEs/devices mutate). Scoped RO is ADR-015 / ADR-020. Site: advantages.md. File presence is not Verified. |
| OS image vs app payloads disconnected (A9) | Two artifacts + load path + cross-update probe (app on OS n and n+1) | Planned | After Track A ABI/loader (#31 A1–A4). Issue A9 #48. Today: one linked ELF — not Verified. |
| A9 slot-disconnect performance delta | perf: boot-delta plus a new app-load CNTPCT marker on a two-artifact boot | Planned | Expected costs: boot/load, SVC, ASID/TTBR, optional COW. Neutral/win: steady EL0 compute; smaller OS updates operational. No Verified delta — still one ELF. Do not invent a bench. performance.md. |
How to update
- Run or cite the probe (command, file path + revision, or
gh runURL). - Change only the rows you probed.
- If you could not run QEMU, leave boot Unknown and say so in the PR. A prior Verified row is one environment and one boot path; do not copy the 2026-09-08 x86 VGA probe forward.