Immutability (scoped, not absolute)
Compatible with ctos principles only as scoped immutability: code and other RO regions stay non-writable after a probed lock-down; later, loaded app images can be RO too. That lines up with security (NFR-10), honesty (NFR-06), and antifragility (NFR-05) — a region is RO when a probe says so, and a Failed write-to-RO stays in the ledger.
Incompatible if absolute. A kernel must mutate heap, page tables, device MMIO, and task state. “Immutable OS” as marketing is a status inflation. Do not write it.
Hub: overview.md. Site SoT: Advantages — Immutability. Pillars: pillars.md. Threat model: security.md.
Plan issues (open on 2026-09-11): Track A #31 / in-repo track-a.md, Track B #40 / track-b.md. A9: #48. Tracks are subordinate to principles.md.
Already practiced (probed)
These are scoped cuts on QEMU virt. They are not an immutable kernel.
| Scope | Probe | ADR |
|---|---|---|
Identity .text/.rodata RO+X; .data/heap RW+NX | ro: nx data / ro: write fault / ro: ok | ADR-015 |
SCTLR.WXN on | same RO+NX smoke | ADR-015 |
Live identity .text torn after high-VA jump + vtable rewrite | ident: reloc / ident: live / ident: ok | ADR-020 |
Heap, PTEs, UART/GIC, and coop stacks stay writable on purpose. Identity .rodata / .data / heap tears are ledger-Verified (ADR-025 / ADR-037 / ADR-038). Leftover identity RAM after the heap is torn (ident: ram*, ADR-049); smoke rejects ident: ram-stay. _start stays mapped (ident: start-stay, ADR-047).
Track A — RO app payloads, then A9 slot disconnect
The goal of this stance (sponsor clarification) is to disconnect OS updates from apps: a separate OS image vs app payloads. Update/replace the kernel without rebuilding apps, and the reverse. That is A9 #48. It is not an “immutable OS” product sentence.
Track A #31 landed A1–A8 first. A1 is a kernel SVC ABI mile (syscall.md). A2 is a libctos CRT mile (ADR-022). A3 is a guest ELF64 PT_LOAD loader (ADR-023). A4 is standing EL0 as normal mode for that loaded image (ADR-024). RO app payloads are that loader mapping an image RO+X (R-only PT_LOAD already uses map_el0_ro; RX text stays Exec). A9 is the slot first cut (ADR-030), not an absolute immutable OS.
Today (Verified freestanding hosting under ADR-048/052): two host artifacts (kernel ELF + target/hello-libctos.elf) and a FAT16 /hello load path. A2–A4 load that file (no production include_bytes!). Cross-update is the host two-boot probe on this OS and ba6541c (ADR-032). Product claim: ADR-048 / ADR-052. Do not say OTA / “immutable OS” marketing / Linux hosting. Performance: perf: app-load plus probe-only perf: embed-load / perf: slot-delta are a QEMU TCG measurement pair (ADR-046, performance.md) — not a percent and not “slots are free.”
Track B #40 must not use Linux-compat research to claim an immutable or container host. Frame: ADR-031 (not claiming Linux userspace yet). Containers stay a non-goal (ADR-029).
Claim gate (ADR-style, no new ADR here)
Same rule as ADR-001 / ADR-011:
- Name the scope (which pages, which image).
- Cite a probe (serial +
#[test_case], or source absence). - Only then Verified. Unprobed stays Unknown. Future work stays Planned.
- Do not say “immutable OS,” “W^X kernel” as a product sentence, or “secure because RO.”
File presence of this note is not that probe. See the honesty ledger.