The config comment referencing this file was dangling. Captures the
twelve gcc-native and four rust-native findings so the work is not lost:
the GCC 13 -> 16 move and why (char8_t, libcody's C++11-only probe, the
cpuid macros GCC 15/16 removed, then an ICE), the stale same_as symlink,
the gnu17 exemption, the missing relibc dependency, the getopt.h
shadowing, and the fnmatch extensions implemented in the fork.
Records two things explicitly because they are easy to get wrong again:
- The old 'Redox C++/pthread header gaps' justification was false.
llvm-native cooks clean in isolation; it only failed in parallel builds
because of a cookbook race on shared staging paths. A build-system bug
had been misdiagnosed as a porting gap and used to exclude a required
package.
- My own 'relibc fenv.h is a stub' diagnosis was also false. relibc
delegates to openlibm_fenv.h which defines both types; the header just
was not reaching the sysroot. Generalised into a rule: an undeclared
identifier against relibc is more often a header-path problem than a
missing implementation.
Also notes the exact stopping point (host libstdc++ headers leaking into
a target compile), the re-enable procedure, and the advice to diagnose
with COOKBOOK_COOK_JOBS=1 since several wrong turns came from attributing
one recipe's error to another in the interleaved parallel log.
version = "0.2.189" -> "0.2.189+rb0.3.2", per local/AGENTS.md
"Version conventions": every Cat 2 fork is <upstream>+rb<branch>. The
label is what makes the fork traceable to both its upstream base and the
Red Bear branch it was built for.
+rb is build metadata, which semver ignores when matching, so ^0.2
requirements still resolve to the fork -- confirmed, the rust lockfile now
reads libc v0.2.189+rb0.3.2 from the path source. A -rb suffix would be
read as a pre-release and would NOT satisfy them, which is exactly why the
project mandates +rb.
Two things this surfaced:
- fork-upstream-map: libc moved from snapshot to diverged. The fork is
vendored from the crates.io PACKAGE, whose file set differs from the
upstream git tag by construction (no .github/, adds
.cargo_vcs_info.json), so a tag content-diff reported differences that
mean nothing -- 'missing files that exist in upstream' for files the
package never ships. diverged states the real relationship.
- local/recipes/dev/gcc16/.vendored-upstream added. Extracting GCC 16.1.0
put upstream's vendored Rust crates under local/recipes/*/source/, so
sync-versions.sh treated datafrog/log/polonius-engine as Cat 1 in-house
crates and wanted to stamp them 0.3.2. The marker is the documented
escape hatch (BUILD-SYSTEM.md section 7).
Both gates clean: verify-fork-versions reports no violations,
sync-versions --check reports no gcc16 drift.
The fork was an unmapped tree -- verify-fork-versions.sh reported
'libc NOT-MAPPED'. Register it properly so it is governed like every other
Cat 2 fork rather than sitting outside the checks:
- local/fork-upstream-map.toml: libc -> rust-lang/libc 0.2.189, snapshot
mode (vendored from the registry, so its history is unrelated to
upstream's), with the temporary status noted inline.
- verify-fork-versions.sh: src/unix/redox/mod.rs added to the declarative
expected-differ list, so the content check keeps verifying the rest of
the tree instead of being blanket-skipped.
- local/docs/VENDORED-LIBC-FORK.md: what the fork adds, the relibc source
and evidence for every symbol, why the values come from relibc rather
than Linux (Redox's idtype_t is c_int where glibc uses an enum), and a
five-step retirement procedure.
- local/AGENTS.md: listed in the fork table, marked temporary.
Kept vendored for as long as it is required. The gap is upstream-
reportable and belongs in the libc crate.
Round 18's N22 'stale-doc removal' deleted three docs on the stated
premise that they had 'no references anywhere in the repo'. That premise
was wrong for two of them, and SUPERSEDED-DOC-LOG.md's recorded
absorption destinations for those two do not exist:
- CUB-PACKAGE-MANAGER.md was said to be absorbed into a 'redbear-cub
recipe README.md' and NETWORKING-IMPROVEMENT-PLAN.md section 8.2.
Neither exists -- there is no cub README under local/recipes/system/cub,
and that plan has no package-manager section (its 'cubic' matches are
TCP congestion control). README.md meanwhile links the doc from its
Documentation list and names cub in six places, so this left a headline
component with no documentation at all.
- BLUETOOTH-IMPLEMENTATION-PLAN.md was said to be merged into
NETWORKING-IMPROVEMENT-PLAN.md section 3.x. That file contains three
passing mentions of Bluetooth, not a 703-line plan. local/AGENTS.md,
docs/README.md and docs/07 all still list it as a first-class subsystem
plan, and AGENTS.md forbids treating Bluetooth as secondary.
Both restored from aa480f7ca3^ and their SUPERSEDED-DOC-LOG entries
retracted with the reason. USB-VALIDATION-RUNBOOK.md's supersession is
genuine -- USB-IMPLEMENTATION-PLAN.md carries the runbook as section 6.x
test procedures -- so it stays removed and its one reference now points
there.
Also de-dangled references to docs the authorised 2026-07-27
consolidation (092d1b39c3) removed but which canonical docs still cited
as openable: the driver-manager ASSESSMENT-2026-07-22 and D5-AUDIT
evidence files and the archived migration plan, across eight documents.
They now name what they were and where the supersession is recorded.
Remaining unresolved references are upstream KWin's vendored README
pointing at upstream's own CONTRIBUTING.md, which is deliberately not
touched.
New local/docs/FORK-BUMP-PATCHING-POLICY.md, wired into AGENTS.md,
local/AGENTS.md and docs/README.md. Core rule: a version bump is a
REBASE, never a REPLACEMENT.
Written from the libredox 0.1.19 incident, which hit three failures at
once -- wholesale replacement that dropped the acpi re-export,
F_DUPFD_CLOEXEC, the mandated authors entry and the Single-Repo
repository URL; a version-named branch that also tripped the build's
fork-branch gate; and a stale fork-upstream-map.toml that failed
verify-fork-versions.sh with a fake-label violation. Covers the vendored
recipe-fork mirror image (metadata moves, build input does not -- how Qt
shipped 6.11.0 against a 6.11.1 recipe), patch handling during a bump,
and toolchain bumps as version bumps.
Also fixes the two bookkeeping gaps that failed this build:
- local/fork-upstream-map.toml: libredox 0.1.18 -> 0.1.19, never updated
when the fork was bumped.
- verify-fork-versions.sh: record redoxfs's legitimate divergence in the
declarative allowlist the script already provides for libredox, with
the originating commit for each file -- a936d00 (Red Bear, Vec from
alloc for no_std bootloader builds) for filesystem.rs and record.rs,
852a971 (Red Bear, RecvFd EOPNOTSUPP) for mount/redox/mod.rs, and
d807dd3 (upstream symlink fix imported ahead of the 0.9.1 tag) for
mount/redox/scheme.rs. Documented rather than bypassed with
REDBEAR_SKIP_FORK_VERIFY.
Docs:
- Baseline was stated as 0.3.1 across the canonical set while the branch,
Cat 0/1 crates and every Cat 2 fork are 0.3.2. AGENTS.md also cited a
sources/redbear-0.3.1/ archive that does not exist; the only archive
present is sources/redbear-0.1.0/. Versioning examples now match the
forks as they actually stand (redoxfs/syscall 0.9.1, libredox 0.1.19).
- Repaired 18 instances of 'immutable archived' across 8 documents, where
a global find/replace had turned sync/synced/archived into that phrase
and produced ungrammatical text ('never auto-immutable archived',
'### Source immutable archived').
- Settled the apply-patches.sh contradiction empirically. Both sides were
wrong: the GROSS WARNING blocks (x5) described it as routine
patch-linking, and SCRIPT-BEHAVIOR-MATRIX.md said build-redbear.sh
'never invokes' it. It is invoked at build-redbear.sh:487, but only to
auto-repair a failed verify-overlay-integrity.sh check.
- Dropped the dangling reference to a local/AGENTS.md section
'NO OVERLAY-STYLE PATCHES — SCOPED POLICY' that does not exist.
Build system:
- mk/prefix.mk hardcoded 13.2.0 in the limits.h removal, which silently
no-ops after a toolchain upgrade and leaves the conflicting header.
Version-globbed.
- Parameterized GCC_RECIPE so the from-source toolchain path is not
pinned to gcc13.
- The three cstdlib strtold seds were not idempotent -- the shipped GCC
13 toolchain carried that comment block 17 times from repeated
'make prefix' runs. Each is now guarded.
Root cause of the Qt 6.11.0/6.11.1 and KDE 6.10.0/6.28.0 divergences: a version
bump rewrote recipe tar=/blake3= but never propagated into the vendored source/
tree (the actual build input), and nothing caught the resulting drift.
Adds the missing pieces (see local/docs/VERSIONING.md):
- sync-recipe-source.sh: propagation engine — rebases a vendored source/ onto
the recipe's declared version (pristine + patches + captured baked delta),
with baked-shim preservation and corruption drop; reports patches/shims that
need a manual rebase instead of applying with fuzz.
- verify-external-source-versions.sh: preflight gate (build-preflight.sh Phase
1.0C, REDBEAR_SKIP_EXTERNAL_SOURCE_CHECK) that fails loudly on recipe-vs-
source-vs-tarball version divergence — the tar-recipe analogue of
verify-fork-functions.sh.
- bump-graphics-recipes.sh: now calls the sync engine after a bump, so a bump
can never again silently no-op on a vendored recipe.
- source/.redbear-src-version stamp; seeded for the corrected qt modules.
Add the --check-sweep option to the authoritative build-system reference
since it was missing from the documentation despite being a key gating
mechanism.
BUILD-SYSTEM.md (canonical reference):
- Added --check-sweep row to the §2 Options table with a clear pointer
to the new §2.1 section
- Added §2.1 'Pre-build check sweep' section that documents:
* What it does: cargo check --target <triple> --offline on every fork
+ every config recipe BEFORE the cook/prefix cycle
* Why it exists: surfaces all type/borrow errors at once instead of
one-at-a-time deep inside a multi-minute relibc rebuild
* Implementation: redbear_check_sweep() in build-redbear.sh
* Toolchain requirement: ~/.redoxer/<triple>/toolchain/bin/cargo
* Skip list: bootloader (bare-metal/UEFI, custom targets)
* Log location: $REDBEAR_BUILD_LOGS_DIR/check-sweep-<name>.log
* Exit codes: 0 on success, 1 on any failure with summary
* Current evidence: 48/48 packages pass on redbear-mini with
--check-sweep after the 2026-07-28 refactor round
SCRIPT-BEHAVIOR-MATRIX.md (per-script roles):
- Updated the build-redbear.sh table entry to call out --check-sweep
in the 'enforces' description
- Added a new 'build-redbear.sh Flag Reference' table with the full
flag list and effect descriptions (mirrors the actual --help output)
- The new section highlights that --check-sweep is the recommended
pre-build gate to surface all type/borrow errors up-front
Verification: --check-sweep redbear-mini passes 48/48 packages, matching
the documented behavior.
The 2026-07-28 FIRST-CLASS CITIZEN POLICY was initially drafted with all 48
redbear-* recipes wired into redbear-mini. The operator corrected this:
MINI target includes just packages whicha are not related to graphics.
While FULL must contain all text+graphial packages.
So the corrected architecture is:
- redbear-mini = text-only binaries (24 original + a few more)
- redbear-full = ALL redbear-* (text + graphics, via inheritance + explicit
full-only entries)
Updated docs:
- REDBEAR-FIRST-CLASS-CITIZEN-POLICY.md: rewrote with the wiring table per
program classification (text-only binary / graphics binary / library-only /
hardware peripheral driver). Library-only recipes follow their consumers'
target: tui-theme (consumed by power/cub/tlc in mini) goes in mini;
hid-core/login-protocol/passwd (consumed by desktop-only programs) go in full.
- ORPHAN-STATUS.md: rewrote as 'Library-only Red Bear Crates' reference.
Documents the 4 library-only recipes, their consumers, and the config
they are wired into per the corrected policy.
- FIRMWARE-SUBSETS-DECISION.md: rewrote. All 5 firmware recipes (monolithic
+ 4 subsets) are now correctly classified as graphics-related and wired
into redbear-full (not mini). Original decision was to KEEP-ORPHAN them,
but the corrected FIRST-CLASS policy promotes them to first-class citizens
in redbear-full.
- REDBEAR-UFW-STATUS.md: rewrote. redbear-ufw is a text-only firewall prototype
and is wired into redbear-mini (the text-only target), not redbear-full.
The prototype is built on every canonical build invocation per the
FIRST-CLASS CITIZEN policy.
- 5 firmware README.md files: removed stale 'KEEP-ORPHAN' / 'STUB-DATA'
markers that were written before the corrected policy. Each now reads
'FIRST-CLASS CITIZEN (wired into config/redbear-full.toml [packages])'
per the corrected wiring.
All 48 redbear-* recipes remain reachable from at least one config:
- text-only binaries + their consumers' libraries in redbear-mini
- graphics binaries + library-only recipes for desktop consumers in redbear-full
- hardware peripherals in redbear-{wifi,bluetooth}-experimental.toml (inherited by full)
sync-versions.sh --check still passes (75 Cat 1 crates, 0 drift).
Phase 1 critical fixes:
1. redbear-netctl-console/recipe.toml: add missing [package] name + version
fields. The recipe was silently dropped by the cookbook because it had
no [package] identity, breaking 'make r.redbear-netctl-console'.
2. redox-drm/recipe.toml: add missing [package] name + version. Same defect
class as redbear-netctl-console.
3. redbear-tui-theme/recipe.toml: create from scratch. The source/ crate
existed but no recipe.toml meant the cookbook never cooked it. Now wired
into redbear-mini (Phase 3).
4. redbear-ufw/recipe.toml + REDBEAR-UFW-STATUS.md: prototype in base fork
(local/sources/base/redbear-ufw/) previously had no recipe and no
documentation. Per AGENTS.md NEVER DELETE rule, the source is preserved
in base; a recipe is now created + a status doc explains the
intentionally-orphaned lifecycle (NEVER DELETE compliance).
5. Delete vestigial local/recipes/system/redbear-netstat/redbear-netstat/
nested directory (duplicate of source/, NOT consumed by build — pure
dead code).
First-class-citizen policy:
- REDBEAR-FIRST-CLASS-CITIZEN-POLICY.md: declares that every redbear-*
recipe is a first-class citizen of redbear-mini. No recipe may be left
unreachable from the build. This codifies the operator's earlier intent
statement that all redbear-* programs must be built.
- ORPHAN-STATUS.md: documents KEEP-ORPHAN recipes (library-only crates
consumed via Cargo path deps — correct pattern, not real orphans).
- FIRMWARE-SUBSETS-DECISION.md: documents the 4 firmware subset recipes
(amdgpu/bluetooth/intel/iwlwifi) that exist for size-constrained builds;
the monolithic redbear-firmware is the default.
- REDBEAR-ULW-ASSESSMENT-PLAN.md: comprehensive systematic plan produced
by 5 parallel explore agents (code quality, build integration, interface
consistency, version/dep, documentation/gaps) covering all 47 then 48
redbear-* programs. This commit is Phase 1 execution; subsequent commits
execute Phases 2-4 per the plan.
Verified: sync-versions.sh --check passes (75 Cat 1 crates, 0 drift).
Append §17 documenting the implementation round that closed the blocking
and high-severity items flagged by the round-2 5-lane review (§16).
Version bumped from 4.1 to 4.2.
§17 R1 — StatusNotifierWatcher: fix bus name wire-mismatch (BUS_NAME +
#[interface(name)] now org.kde), canonicalize item keys as
<sender><path> to fix multi-client collision, narrow purge to vanished
unique names, emit unregister signals on purge.
§17 R2 — sessiond: add per-FD POLLHUP monitoring to reap inhibitors
when the returned FD closes (logind contract compliance). The §16
G8 claim that reaping was missing was factually wrong (the sender
reaping was already in place); the gap was actually FD-close detection.
§17 R3 — notifications: full lifecycle — bounded at 1024 with FIFO
eviction, replaces_id semantics (update existing record), expiry-timeout
sweep emitting NotificationClosed(EXPIRED), sender-loss purge via
DBusProxy::name_has_owner, InvokeAction cleanup removing the record.
§17 R4 — wifictl: add AccessPointInterface and serve it at every
returned path via serve_at(). ActiveAccessPoint now returns the
actual matched index instead of always 0.
§17 R5 — Mesa: fix three batch pool follow-on defects — format=0
→ 0-byte BO allocation (redox_drm_bo.c handles PIPE_BUFFER +
NONE format specially), unchecked mtx_init failure (winsys now returns
false on init failure + initialized flag), oversized batch size
truncation (rejects byte_count > UINT32_MAX).
§17 R6 — doc corrections: §16 G1 honesty flag (bus name NOW changed),
§16 §3.3 note (daemon IS wired into redbear-full.toml:233), §16 G8/G9/G14
(inhibitor reaping WAS applied — G2 above is the actual FD-close gap).
§17 R7 — remaining gaps documented: dbus_nm backend wiring (deferred
to NM round), NM StateChanged signal, partial write_all error propagation,
hardcoded root password (operator decision out of scope), no canonical
build-redbear.sh redbear-full run yet.
All 6 implementation commits already pushed to origin/0.3.1:
1ffc9299be — mesa batch pool follow-ons
5fdfa4384c — sessiond FD-close inhibitor removal
25cb25c373 — statusnotifierwatcher bus name + identity + lifecycle
cd429e8c74 — wifictl dbus_nm AP interface + active index
4d00f7ad09 — notifications full lifecycle
+ this §17 doc commit.
Adds 5.10.4 Round-6 summary section to DRIVER-MANAGER.md covering
N20-E1 (error_channel OOM cap), N20-E2 (6-variant decode), N20-A4
(aer BDF validation), N20-S6 (heartbeat log failures), and N22 (stale
doc removal). Updates last-updated header and test count (164->166).
Removes three orphaned docs that had zero references in the repo
and were last-modified Jul 10-14 vs every other doc Jul 26-27:
BLUETOOTH-IMPLEMENTATION-PLAN.md, CUB-PACKAGE-MANAGER.md, and
USB-VALIDATION-RUNBOOK.md. Backup tarball at
/tmp/opencode/stale-doc-backup-2026-07-27-round18.tar.gz; audit trail
in SUPERSEDED-DOC-LOG.md Round-18 entry.
E1: bound incoming payload length to 64 KiB at both vec![0u8; len]
sites (request_recovery + test daemon) so a buggy or malicious
child cannot trigger OOM by sending len=0xFFFFFFFF.
E2: decode all 6 RecoveryAction discriminants in
DriverErrorResponse::decode (previously 4/5 silently dropped to None).
Extend encode_decode_response_round_trip to cover CanRecover and
Recovered.
libredox: pulls in d6b223d (revert O_CLOEXEC to literal in protocol
module — fixes standalone build). Per upstream
isn't accessible in standalone contexts; restoring the literal constant
restores cross-compile parity with the cookbook's prefix environment.
The relibc fork already imports etc. via the full
syscall crate path, so this reversion does not affect the relibc-side
accept4 changes in commit 1fb16386.
local/docs/evidence/round-17-network-stack-tier-a-b.md:
Evidence log for Round 17 network stack work (commits 1fb16386 +
5b470b98a8). Records:
- 10-file relibc fork diff (+1117/-160)
- doc updates that landed concurrently in aa12991053
- pre-existing P0 defects confirmed resolved in prior sessions
- pre-existing errors and stale files left as-is per session contract
- verification status (cargo check passes modulo ld_so errors)
Round 17 audit cleanup. Two main fixes plus one incidental update:
1. local/recipes/system/iommu/source/src/lib.rs — removed the entire
host_redox_stubs module (341 lines, lines 815-1155). The module
was guarded by #[cfg(not(target_os = 'redox'))] so it never compiled
for Redox targets, but it ALSO failed to compile for host (Linux)
builds because it used a 'libc' crate that isn't in iommu's
Cargo.toml dependencies — 41 compile errors. Verified by:
cargo check --target x86_64-unknown-linux-gnu
before the deletion: 41 errors (all in host_redox_stubs).
after the deletion: clean build, Finished 'dev' profile in 0.21s.
The 21 redox_open_v1/redox_dup_v1/redox_kill_v1/etc. extern 'C'
functions were supposed to provide host-side link table entries
for the upstream-crates-io 'redox-scheme' crate. But:
- iommu depends on the LOCAL redox-scheme fork
(path = '../../../../../local/sources/redox-scheme')
- the local fork doesn't call any of these symbols
- even the upstream-crates-io version doesn't call most of them
So the stubs were dead code that also happened to be broken.
Removal cleans up 341 lines + makes the package host-buildable.
2. local/recipes/gpu/redox-drm/source/src/kms/{plane,crtc,connector}.rs —
added module-level //! docstrings documenting that these modules
are software-state models, not GPU-register-programming. Per the
Round 16 audit, the gap between software-model validation and
actual hardware programming lives in the per-driver backend
(FakeDriver/IntelDriver/AmdDriver). Without these docstrings,
a future maintainer might add hardware programming here and
duplicate the driver-backend responsibilities.
3. local/docs/NETWORKING-AND-DRIVERS-SYSTEMATIC-ASSESSMENT-2026-07-27.md
— incidental update (the operator's parallel work).
Completes the round-2 docs cleanup sweep by repairing the same
stale-reference pattern in files I missed in the prior commit.
Same pattern as 5970dd226f: each replacement points at the
current canonical doc (restored to top-level, absorbed into a
different plan, or now tracked in SUPERSEDED-DOC-LOG.md for
historical reference).
- AGENTS.md: legacy-obsolete/BUILD-SYSTEM-HARDENING-PLAN.md
-> COLLISION-DETECTION-STATUS.md
legacy-obsolete/HOOKS.md -> RELEASE-BUMP-WORKFLOW.md § Git Hooks
legacy-obsolete/PATCH-PRESERVATION-AUDIT -> SUPERSEDED-DOC-LOG.md
- CONTRIBUTING.md: same legacy-obsolete repairs
- README.md: same legacy-obsolete repairs
- docs/01-REDOX-ARCHITECTURE.md:
WAYLAND-IMPLEMENTATION-PLAN.md -> 3D-DESKTOP-COMPREHENSIVE-PLAN.md
- docs/07-RED-BEAR-OS-IMPLEMENTATION-PLAN.md:
legacy-obsolete/IRQ -> top-level IRQ plan;
legacy-obsolete/05-KDE-PLASMA -> struck-through with deletion note;
WAYLAND-IMPLEMENTATION-PLAN.md -> 3D-DESKTOP-COMPREHENSIVE-PLAN.md
- docs/AGENTS.md: same legacy-obsolete repairs; 05-KDE marked as
deleted; legacy-obsolete/DRM-MODERNIZATION -> 3D-DESKTOP-COMPREHENSIVE
- docs/README.md: same legacy-obsolete repairs
- local/AGENTS.md: same legacy-obsolete repairs
- local/docs/SUPERSEDED-DOC-LOG.md: alignment with the
2026-07-27 consolidation entry
- recipes/wip/AGENTS.md: legacy-obsolete/05-KDE-PLASMA repoint
The deltas are documented verbatim in each diff; nothing was
rephrased, only the link target was corrected.
Several docs still referenced files in local/docs/legacy-obsolete-
2026-07-25/ after that directory's 2026-07-27 cleanup deleted most of
its contents. The directory now only contains SUPERSEDED.md; all
other legacy-obsolete entries were fully removed. The doc cleanup
phase of the round-2 D-Bus audit identified each broken reference and
fixed it by pointing at the current canonical location.
Repairs:
- ACPI-IMPROVEMENT-PLAN.md, BUILD-SYSTEM-INVARIANTS.md,
INIT-NAMESPACE-MANAGER-SCALABILITY-PLAN.md,
NETWORKING-IMPROVEMENT-PLAN.md, USB-IMPLEMENTATION-PLAN.md:
legacy-obsolete-2026-07-25/IRQ-AND-LOWLEVEL-CONTROLLERS-ENHANCEMENT-PLAN.md
-> IRQ-AND-LOWLEVEL-CONTROLLERS-ENHANCEMENT-PLAN.md
(restored to top-level local/docs/).
- CONSOLE-TO-KDE-DESKTOP-PLAN.md:
legacy-obsolete/BUILD-SYSTEM-HARDENING-PLAN.md
-> COLLISION-DETECTION-STATUS.md
- TOOLS.md, RELEASE-BUMP-WORKFLOW.md:
legacy-obsolete/HOOKS.md
-> RELEASE-BUMP-WORKFLOW.md § 'Git Hooks' (content merged).
- patches/README.md, RATATUI-APP-PATTERNS.md:
removed dangling refs to legacy-obsolete/PATCH-PRESERVATION-AUDIT
and redbear-power-improvement-plan (both deleted with no successor
doc; the related guidance lives in the canonical plans).
Each replacement preserves the link's intent: every old reference was
pointing to a doc whose content has either been restored to top-level,
absorbed into a different canonical doc, or replaced by a plan
reference that covers the same surface.
Bump to v4.1 and add §16 documenting the round-2 fixes verified during
the doc-cleanup phase. Each finding cites exact paths and distinguishes
working-tree present from runtime-proven, following the §15 evidence
discipline.
G1. StatusNotifierWatcher — sender validation, owner-keyed registry,
lifecycle purging, bounded entries (APPLIED, 22 tests)
Honesty flag: the const BUS_NAME remains
"org.freedesktop.StatusNotifierWatcher" — only the recipe.toml
comment was updated to reference org.kde. The actual well-known
name change was NOT applied.
G2. redbear-notifications — sender-validated InvokeAction
NotificationRecord stores { owner, action_keys }. InvokeAction
returns fdo::Result<()> with three-condition validate_invoke
(id known, caller == owner, action_key declared).
G3. redbear-wifictl — NmState enum 0..70 + OwnedObjectPath types
New NmState enum covers Unknown..ConnectedGlobal. Root state()
maps NmDeviceState via from_device_state(). All NM interface
methods now return OwnedObjectPath via try_path() helper.
G4. redbear-sessiond — host-safe Can* test
can_methods_return_na now detects host vs Redox target via
kstop_writable() and asserts the correct expected value. No
behavioral change in the production path.
G5. redbear-statusnotifierwatcher — comprehensive sender tracking
and purge-on-disconnect (covered in G1 detail).
Also corrects two stale inline entries:
- §5.1 service-name table now notes 22 tests (vs prior 12)
- §3.1 redbear-statusnotifierwatcher entry expanded with round-2
scope per the G1 changes.
Verified against committed HEAD (1dc5b0dcb0): 22 statusnotifierwatcher
tests pass; 16 notifications tests pass; 35 wifictl tests pass;
52 sessiond tests pass.
Round 16 audit follow-up. Three small fixes:
1. local/recipes/system/redbear-authd/source/src/main.rs:328 — the
validation-mode spawn-reaper thread did 'let _ = child.wait();'
silently dropping the session child's exit status. Replaced with
'match' that eprintln-logs both successful exit status and wait
failure (with errno). Operators can now see when the session
child exits abnormally in validation mode.
2. local/recipes/system/redbear-dnsd/source/src/main.rs:111 — the
loopback DNS responder did 'let _ = socket.send_to(&reply, &src);'
silently. Replaced with 'if let Err(e) = socket.send_to(...)' that
eprintln-logs the failure with the source peer address. Previously
DNS clients could fail to receive a valid reply with no visible
error.
3. local/docs/SUPERSEDED-DOC-LOG.md — appended Round 16 entries
documenting the authd/dnsd fixes plus the Round-16 audit findings
that did not require code changes (acpi-rs AML 41 panics classified
as internal-invariant, pcid panics already have messages, all stale
CONFIG refs already retired, USB-daemon let _ = is in host-only test
paths, sessiond can_* for sleep is honest stub, Mesa CS ioctl
numbers verified no drift).
3 files changed, +27/-2.
Round 16 audit follow-up. Two small but useful additions:
1. local/docs/SUPERSEDED-DOC-LOG.md — appended R15 entries:
greeter/netctl/hotplugd let-underscore-to-logged (5682072e58),
acmd setrens security fix (883e8147ec), README null+8 contradiction
reconciliation, and the redbear-live.iso stale-reference fix.
2. local/recipes/system/redbear-sessiond/source/src/manager.rs —
the can_hibernate / can_hybrid_sleep / can_suspend_then_hibernate
/ can_sleep functions all return hardcoded 'na'. Documented the
integration plan in a block comment above them: when the
/scheme/sys/sleep and /scheme/sys/hybrid_sleep schemes exist
in the Redox kernel, replace these with fs::metadata() probes
matching the kstop_writable() pattern used by
can_power_off/can_reboot/can_suspend. No code change yet —
just the docstring pointing the next maintainer at the pattern.
Without this comment, a future maintainer reading the four
hardcoded 'na' returns would not know about the kstop_writable
probe pattern that enables the matching sleep capabilities.
2 files changed, +32/-5.
Updates the canonical current-state doc to reflect the Round-5
deliverables:
- "Last updated" header bumped to
"F1-F6d fixes + Round-5 N17+N18".
- § 5.10.3 Round-5 summary section added (cross-references
the new code-audit doc).
- § 6.5 per-fix summary table extended with the 4 N18 driver-
manager bug fixes (Q1, Q2+Bug4, S3, Bug5) and a row pointing
to the new `DRIVER-MANAGER-CODE-AUDIT-2026-07-27.md` for
the full audit context.
- § 7.1 References updated to list the new code-audit doc as
the primary Round-5 internal reference.
Consolidates 4 prior code-level review agents for the
driver-manager subsystem: 2 CRITICAL (reaper-clone, every-exit-
as-crash), 3 HIGH (scheme 100 ms block, reap_pid error_channel
fd leak, watchdog-exit-on-panic), ~10 MEDIUM, ~11 LOW with
file:line refs and planned-fix table. Companion to
DRIVER-MANAGER.md; no source or recipe changes.
Round 14 audit cleanup. Six coordinated fixes across seven files
plus a documentation log update:
1. local/recipes/system/redbear-wayland-guard/ — REMOVED entirely.
The directory contained only source/wayland_guard.c — an LD_PRELOAD
interposer stub for three wl_proxy_* functions — with NO recipe.toml.
This violated local/AGENTS.md STUB AND WORKAROUND POLICY ('No LD_PRELOAD
tricks'). The correct null-guard fix lives in libwayland upstream per
QT6-WAYLAND-NULL8-DIAGNOSIS.md (already covered by Mesa win compat).
2. recipes/system/redbear-wayland-guard — broken symlink cleaned up.
3. local/recipes/AGENTS.md — catalog entry for redbear-wayland-guard was
wrong (claimed 'Rust' but the code was C LD_PRELOAD). Replaced with
REMOVED note explaining the policy violation and the correct fix
location in libwayland.
4. local/recipes/system/firmware-loader/source/src/main.rs — converted
9 .expect() calls in the daemon init path (Socket::create, scheme_root,
create_this_scheme_fd, syscall::call_wo notify, setrens, next_request,
write_response) to Result propagation. get_init_notify_fd() and
notify_scheme_ready() now return Result; run_daemon() returns Result and
main() matches on Err to log+exit(1) cleanly. The daemon was
crashing the entire firmware-delivery subsystem on any init failure;
now init can fall back or restart the daemon.
5. local/recipes/system/{redbear-keymapd,redbear-ime,redbear-accessibility}/
source/src/main.rs — three scheme daemons used the same
Socket::create().expect() + register_sync_scheme().expect() pattern.
Replaced all six .expect() calls with match expressions that
log_msg('ERROR', ...) and process::exit(1). Same pattern.
6. local/docs/NETWORKING-AND-DRIVERS-SYSTEMATIC-ASSESSMENT-2026-07-27.md —
struck through 5 references to the now-removed redbear-wayland-guard
(line 65 missing-daemons list, line 344 table row, line 397
implementation list, line 414 source-list, line 797 P3-8 backlog).
7. local/docs/SUPERSEDED-DOC-LOG.md — appended a 'Rounds 11-14 Source-Level
Supersessions' table logging every lie-grade fix and stale-doc
strike from this session. Mirrors the original deletion-log style for
consistency, and gives operators a single place to see what was
resolved and where. Documents the emerging pattern: lie-grade code in
Red Bear concentrates in (a) relibc panic-site catch-alls (addressed
rounds 9-10), (b) scheme daemon init paths using .expect() instead of
Result (rounds 11-14), (c) Mesa DRM/Wayland stubbing (rounds 12;
remaining work tracked in 3D-DESKTOP-COMPREHENSIVE-PLAN.md).
Not committed in this commit (operator's parallel work, to be
committed by them):
- driver-manager/* (N-tier edits)
- redbear-sessiond/manager.rs (can_* probe refinements)
- redbear-statusnotifierwatcher/* (recipe + source)
- redbear-dbus-services/* (dbus service cleanup)
- redox-driver-core/manager.rs (test-only)
- Mesa redox_drm_cs.c (CS submit fix)
7 files changed in this commit + 2 deletions.
The Round 11 commit (a9e1c34e27) fixed both findings 14/15 and
18/18b/19 in the assessment doc; the Round 11 fix and Round 12
follow-ups (this round) update the remaining stale references.
1. local/docs/3D-DESKTOP-COMPREHENSIVE-PLAN.md §10 config table
(lines 1159-1160): marked wifi-experimental.toml and
bluetooth-experimental.toml include-typo as ✅ FIXED 2026-07-27
(was still listed as open).
2. local/docs/NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md:
struck through:
- Finding 15 (redbear-passwd missing [source])
- Critical-path P0-12/13/14 (include typo + [source] todo)
- The Critical Path Hierarchy bullet list items
- TODO priority list line 718 (redbear-passwd [source])
- Backlog line 923 (C-23)
Marked each with ✅ RESOLVED 2026-07-27 (commit a9e1c34e27).
These were the last unstruck-through references after the
Round 11 fix landed. The assessment doc is now consistent
with the post-fix state.
2 files changed, +14/-12.
§15.3 had a contradiction: the table at line 1065 listed items as
'Remaining' that were already marked DONE in §15.1 and in the
commit history. This was a documentation hazard - an operator
reading §15.3 would waste time chasing already-fixed bugs.
Update the CRITICAL row to reflect the actual current state:
- Added explicit notes on completed this-round refinements
(BufferPool v.resize completion, xHCI snapshot-before-clear,
IPv6 final-protocol+offset+AH-formula fixes, F002 RawFd,
F003 redundant cast, TCP call() override, getsockopt
todo_skip removal)
- Updated HIGH row similarly (TCP SendMsg, MSG_NOSIGNAL,
relibc option level collision now marked DONE)
§15.3 now accurately reflects the current state of the
implementation effort.
Round 12 audit cleanup. Five fixes across five files plus a
zero-tolerance stub policy win:
1. local/patches/mesa/04-sys-ioccom-stub-header.patch — DELETED.
The patch was a hand-rolled include/sys/ioccom.h with Linux IOC
bitfield constants, living as a Mesa-side stub. Per local/AGENTS.md
zero-tolerance policy: 'Any stub found in the tree is a bug to
be fixed, not a precedent to follow.' relibc's new
include/sys/ioccom.h (commit ca7a7edb on submodule/relibc,
bumped in f145e9e768) provides the same constants natively,
making the patch redundant.
2. local/recipes/libs/mesa/recipe.toml — removed the now-dead
'04-sys-ioccom-stub-header.patch' entry from the patches list.
Note added explaining the removal so a future maintainer does
not re-add it.
3. local/recipes/system/udev-shim/source/src/naming.rs —
predictable_net_name() used to return the hardcoded 'eth0' on
parse failure of the PCI address. On multi-interface systems
where multiple devices had unparseable PCI addresses, all
collided on 'eth0'. Now returns 'net-malformed-<sanitized>'
(unique per PCI string) so each device gets a distinct name.
4. local/sources/base/netstack/src/scheme/netcfg/mod.rs — the
'summary' branch hardcoded devices.borrow().get("eth0") which
made the summary output invisible to non-eth0 interfaces.
Now iterates the full devices map and prints each interface's
state. (The deeper 'ifaces' routing tree still has 20+ eth0
references — restructuring that requires a schema change;
deferred to a follow-up that adds a configurable default iface.)
5. local/docs/CONSOLE-TO-KDE-DESKTOP-PLAN.md + 3D-DESKTOP-COMPREHENSIVE-PLAN.md
— renamed 'redbear-kde-session' → 'redbear-session-launch' in the
final stale reference; clarified 'redbear-wayland.desktop' (not
yet wired).
Deferred: acpi-rs AML interpreter bare panic() (34 sites across
mod.rs) and netcfg ifaces routing tree (20+ eth0 references)
require schema-level refactors beyond one-shot fixes; tracked
for follow-up rounds.
N13 updates the policy.rs module docstring to reflect the four
current policy surfaces (blacklist + options + autoload + initfs-
manifest) and the active redbear-driver-policy state. Drops the
"before v1.4 the policy was dormant" stale reference.
N14 removes the remaining "previously marked as dormant" stale
comment in main.rs (now describes the four-count summary as
confirming the redbear-driver-policy package's curated config files
are wired). Simplifies the redbear-driver-policy README's
historical-dormant note to a single sentence about the cutover
date.
N15 — no stale doc removals needed: the 2026-07-27 doc
consolidation (recorded in SUPERSEDED-DOC-LOG.md) already
removed all known-stale docs. The 3D-DESKTOP-COMPREHENSIVE-PLAN
explicitly designates the two remaining NETWORKING assessment
files as operator-authored authoritative docs, so this round
does not delete them.
DRIVER-MANAGER.md adds § 5.10.3 Round-4 (N13–N15) summary.
164 driver-manager tests pass.
driver-manager-audit-no-stubs.py: 46 files, 0 violations.
Round 11 audit cleanup. Six fixes across six files:
1. local/recipes/system/redbear-passwd/recipe.toml — CRITICAL: was
missing the [source] block entirely. The recipe had only [package]
and [build] with template=cargo, which the cookbook cannot fetch.
Added [source] path = "source" so the cookbook locates the local
Rust crate. Also added a one-line description.
2. local/recipes/dev/libclc/recipe.toml — MEDIUM: the build script
installs via cmake but never verifies that libclc.pc (Mesa's
pkg-config dependency) and the .bc bitcode files actually landed.
Without these, Mesa's 3D driver cook fails opaquely with
'Dependency libclc not found (tried pkg-config)'. Added three
post-install test -f checks that fail the build with a precise
error pointing at the missing path.
3. local/recipes/system/redbear-sessiond/source/src/manager.rs — HIGH:
the D-Bus login1 can_power_off / can_reboot / can_suspend methods
were returning 'yes' unconditionally — the archetype lie-grade-ok
pattern (probe says success, then the real action fails because
/scheme/sys/kstop is missing). Replaced with a kstop_writable()
probe that fs::metadata()s the path. Used metadata() rather than
an actual write because writing 'shutdown'/'reset'/'s3' to
/scheme/sys/kstop would trigger the action. The actual power_off/
reboot/suspend methods still report granular errors when the
write is refused.
4. local/recipes/system/redbear-dnsd/source/src/transport.rs — MEDIUM:
UpstreamConfig::default() hardcoded 8.8.8.8 + 1.1.1.1 as fallback
upstream DNS. Hardcoding third-party DNS bypasses netcfg integration
and leaks user queries without consent on first boot. Replaced with
an empty Vec — main() reads the upstream list from netcfg before
any query is dispatched; upstream queries SERVFAIL until netcfg
populates the list (honest default).
5. local/docs/GREETER-LOGIN-IMPLEMENTATION-PLAN.md — MEDIUM: 16
references to the non-existent binary 'redbear-kde-session' (now
'redbear-session-launch'). Global s/redbear-kde-session/redbear-
session-launch/g. Also updated two 'redbear-kde' profile-name
references to reflect the 2026-07-24 retirement and the current
'redbear-full' ownership of the desktop path.
6. local/docs/DBUS-INTEGRATION-PLAN.md — LOW: 7 references to
'redbear-kde-session' renamed to 'redbear-session-launch' (same
binary rename).
6 files changed, +68/-28.
Note: Mesa 04-sys-ioccom-stub-header.patch migration to relibc proper
(sys/ioccom.h with Linux-style IOC encoding) is deferred — the
patch is a genuine gap-filler (relibc's sys/ioctl.h has the basic
macros but sys/ioccom.h is the BSD include path DRM UAPI expects).
That work belongs in the relibc fork with a prefix rebuild and
should be coordinated with the operator's prefix-staleness policy.
Round 10 audit cleanup. Six fixes across nine files:
1. config/redbear-netctl.toml: stale comment referenced three
non-existent configs (redbear-minimal, redbear-desktop,
redbear-kde). Replaced with accurate include-chain note.
2. scripts/run.sh, build.sh, scripts/fetch-all-sources.sh:
replaced all 'redbear-minimal' references with the actual
canonical config names (redbear-mini, redbear-grub,
redbear-wifi-experimental, redbear-bluetooth-experimental).
Three previously listed configs (redbear-kde, redbear-live,
redbear-wayland) never existed; removed them from the loop
that preflights/scans/fetches 'ALL_CONFIGS' so those broken
references no longer abort the script.
3. local/recipes/wayland/xwayland/recipe.toml:
- removed stale '#TODO wayland-client, fix linux/input,
wayland-scanner shim' (the workarounds are now real fixes).
- added redbear-input-headers to dependencies so the
uncommented <linux/input.h> include in xwayland-input.c
resolves via Red Bear's in-tree input-headers recipe
(per local/AGENTS.md LINUX KERNEL SOURCE POLICY).
4. local/recipes/wayland/xwayland/redox.patch:
- stripped diff -ruwN timestamps from all ---/+++ headers
(AGENTS.md patch format policy).
- dropped the three xwayland-glamor.h / xwayland-window.h/c
DRM-only hunks: they commented out xf86drm.h + drmDevice
fields, but the recipe's mesonflags already sets
'-Ddrm=false -Dglamor=false' so those code paths never
compile. Removing them eliminates dead commented-out code
that future maintainers would misread as 'in-progress'.
- replaced hardcoded 0x110/0x112/0x111 button constants
with the symbolic BTN_LEFT/BTN_MIDDLE/BTN_RIGHT names
(the include is now real), matching upstream style and
making the intent self-documenting.
5. local/recipes/libs/mesa/source/src/gallium/winsys/redox/drm/
redox_drm_surface.h: rewrote the stale header comment that
still claimed 'the actual present path is a no-op until
kernel-side scanout ioctls are added' — REDOX_SCANOUT_FLIP
is wired and working; the comment now describes the real
implementation.
6. local/docs/3D-DESKTOP-COMPREHENSIVE-PLAN.md: marked
redbear-wifi-experimental.toml and redbear-bluetooth-
experimental.toml as FIXED 2026-07-27 in the config
status table (the redbear-minimal → redbear-mini typo
was corrected earlier).
7. local/docs/NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md:
struck through Findings 14, 18, 18b, C-21, C-22 and the
corresponding 'Config cleanup' todo — all resolved by
the rename to redbear-mini.toml.
9 files changed, +45/-115.
The 2026-07-27 Round 9 cleanup deleted 36 docs (3D-DRIVER-PLAN,
WAYLAND-IMPLEMENTATION-PLAN, DRM-MODERNIZATION-EXECUTION-PLAN,
REDBEAR-FULL-SDDM-BRINGUP, and the entire archived/ and
legacy-obsolete-2026-07-25/ contents) but several active docs still
cross-referenced those deleted files. This commit sweeps the surviving
docs and:
* Replaces every deleted-path reference with the live target:
WAYLAND-IMPLEMENTATION-PLAN.md -> 3D-DESKTOP-COMPREHENSIVE-PLAN.md
3D-DRIVER-PLAN.md -> 3D-DESKTOP-COMPREHENSIVE-PLAN.md
REDBEAR-FULL-SDDM-BRINGUP.md -> 3D-DESKTOP-COMPREHENSIVE-PLAN.md
legacy-obsolete-2026-07-25/DRM... -> 3D-DESKTOP-COMPREHENSIVE-PLAN.md
legacy-obsolete-2026-07-25/IRQ... -> IRQ-AND-LOWLEVEL-...-PLAN.md
archived/UPSTREAM-SYNC-PROCEDURE.md -> removed (sync procedure now in
BUILD-CACHE-PLAN.md +
sync-versions.sh)
archived/RELIBC-IPC-ASSESSMENT-... -> removed (work captured in
KERNEL-IPC-CREDENTIAL-PLAN.md)
archived/DRIVER-MANAGER-MIGRATION-PLAN -> removed (history in DRIVER-MANAGER.md
and git log)
archived/INTEL-HDA-IMPLEMENTATION-PLAN -> removed (track now in 3D-DESKTOP-
COMPREHENSIVE-PLAN.md § SOF/AVS)
* Rewrites pcid-spawner references to driver-manager in PACKAGE-BUILD-QUIRKS,
PATCH-GOVERNANCE, NETWORKING-IMPROVEMENT, LG-GRAM-16Z90TP, and the IRQ plan
status note. The retired pcid-spawner service no longer exists in any
redbear-* config as of the 2026-07-24 cutover.
* Rewrites CONSOLE-TO-KDE-DESKTOP-PLAN.md §9 plan table to point at the
post-Round-9 canonical doc map (3D-DESKTOP-COMPREHENSIVE-PLAN.md as the
single coherent 3D-render plan; IRQ plan at top-level). Drops the
misleading 'archived legacy-obsolete-2026-07-25/' status line and the
'work subsumed by Round 1-5' sentence that was explicitly rejected by
SUPERSEDED-DOC-LOG.
* Updates 3D-DESKTOP-COMPREHENSIVE-PLAN.md §10 to mark the REPLACE, RESTORE,
and DELETE pre-execution audit as completed 2026-07-27. Tables remain as
historical record of what was done, with a pointer to the backup tarballs
and SUPERSEDED.md log.
* Bumps 'Last updated' of CONSOLE-TO-KDE-DESKTOP-PLAN.md to v6.1.
13 files changed, +78/-65.
Round-3 closes three real operational gaps from Round-2 follow-ups:
- N9 — SIGHUP reloads all 4 policy surfaces (not just blacklist)
- N10 — initfs-manifest stage-aware probing (was a single pass)
- N11 — linux-kpi SAFETY comment cleanup (already done in
parallel by commits b295b80882 and a56cf84154; documented)
Updated:
- Last-updated banner
- § 5.10.2 Round-3 (N9–N11) summary section
- § 6.1 test inventory table (164 driver-manager tests, 200+ total)
The doc is now consistent with the current source state.
The first-round assessment (NETWORKING-AND-DRIVERS-SYSTEMATIC-
ASSESSMENT-2026-07-27.md) was never committed to the parent 0.3.1
branch. It captures the docs audit that preceded the code audit
(now at NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md).
Both files live in the repo as the docs and code halves of the
audit series.
SUPERSEDED-DOC-LOG.md is the change-log file referenced from
local/docs/legacy-obsolete-2026-07-25/SUPERSEDED.md. Previously
untracked; this commit makes it visible to the doc audit trail.
libredox O_CLOEXEC now references syscall::flag::O_CLOEXEC instead
of duplicating the literal 0x0100_0000. Per Single Source of Truth
and the Local Fork Supremacy Policy: a primitive constant should be
defined once in the most-primitive crate that has it (syscall) and
re-exported by higher-level crates (libredox).
R002 fix: netstack/src/filter/conntrack.rs captured '(is_orig, entry_key)'
in an if/else, but the 'if let' arm early-returned, so is_orig was
always true. Reply-direction state machine was unreachable for
already-established flows. Flattened the conditional: reply-side
'if let' early-returns; fall-through uses original key directly.
The is_orig variable is gone; orig-side path calls
advance_entry_state with is_orig=true explicitly.
Three-touchpoint fix for the option level collision (option 4 reads
as TCP_KEEPIDLE at SOL_SOCKET vs IP_TOS at IPPROTO_IP):
1. relibc/src/platform/redox/socket.rs: setsockopt/getsockopt
wire format changed from [SocketCall, option] to
[SocketCall, level, option]. The stale 'TODO convert back to
match when we support more levels' comment removed.
2. base/netstack/src/scheme/socket.rs: SocketT::set_sock_opt and
get_sock_opt now take (level, name) separately. The scheme dispatch
reads metadata[1] as level and metadata[2] as option.
3. base/netstack/src/scheme/{tcp,udp}.rs: TCP and UDP SocketT impls
updated to the new (level, name) signature.
libredox API bug: Fd::ftruncate and Fd::futimens previously took 'self'
(consuming the Fd), which would trigger Fd::drop and close the fd as
a side effect. POSIX ftruncate/futimens do NOT close the fd. Changed
to '&self' to match the surrounding methods (fsync, fdatasync) and
match POSIX semantics.
HIGH DEF-P0-7: relibc MSG_NOSIGNAL now properly blocks SIGPIPE via
pthread_sigmask around the syscall, instead of stripping the flag.
sendmsg does the sigprocmask block; sendto forwards the original
flags to sendmsg (removing the previous 'flags & !MSG_NOSIGNAL'
workaround).
Also removed the stale 'TCP lacks SocketCall::SendMsg handling' TODO
- the netstack scheme handler at
local/sources/base/netstack/src/scheme/socket.rs:519-533 does handle
SocketCall::SendMsg for both SOCK_STREAM and SOCK_DGRAM.
The relibc commit (f7f27a91f3) accidentally included phantom deletions
of local/docs/networking-validation-log.md because the relibc
submodule's working tree had a stale reference to a file that
belonged only to the parent 0.3.1 branch. Restoring the file in
the parent.
The relibc commit itself only affects the relibc submodule pointer
in the parent. The MSG_NOSIGNAL fix lives in the relibc submodule
at its own branch (submodule/relibc), not in the parent 0.3.1
branch. The parent 0.3.1 only tracks the submodule pointer bump.
CRITICAL F003 fixed: netstack/src/scheme/mod.rs had 2 unsafe
File::from_raw_fd sites with redundant 'as RawFd' casts. The 'as
RawFd' cast was a no-op on platforms where RawFd = i32 but was
misleading (suggests a conversion). Removed the cast. Also replaced
generic boilerplate SAFETY comments with specific invariants.
CRITICAL progress: 13 of 13 original findings now addressed
(F001, F1.6, F1.1, F2, F3, DEF-P0-6, DEF-P0-7, F18/F18b, F20,
F21, F3.1, F22, P001).
CRITICAL F002: worker_pool from_raw_fd changed from 'raw: usize' to
'std::os::fd::RawFd' (c_int). A garbage 64-bit value can no longer
be cast to a valid i32 fd; the value can only have come from a
previously-validated fd (via IntoRawFd::into_raw_fd, libredox::Fd::raw,
or a similar source that went through the kernel's open-fd table).
CRITICAL progress: 12 of 13 original findings now addressed.
Remaining: F003 (scheme File ownership, 3 unsafe sites in
scheme/mod.rs around lines 183 and 195).
Adds two new rows to the Implementation Status table:
- CRITICAL F22: btintel ECDSA firmware length check — now uses
ECDSA_FULL_LEN = 964 (full header: CSS 128 + PKEY 96 + SIG 96 bytes
after the 644-byte header start). Was 645..963 byte blobs would
panic on the PKEY/SIG slices.
- P001 (firewalling): IPv6 ext header firewall bypass fix — added
ipv6_transport_offset() walker that properly walks the IPv6
extension header chain (Hop-by-Hop, Routing, Fragment, Destination,
AH) to find the actual transport-layer offset. Was using a fixed
40-byte offset, so any IPv6 packet with extension headers caused
parse_ports() to read wrong bytes and silently fail to match
firewall port rules (firewall bypass).
Both pushed to origin.
CRITICAL progress: 11 of 12 original findings now addressed
(F001, F1.6, F1.1, DEF-P0-6, DEF-P0-7, F18/F18b, F20, F21, F3.1,
F22, P001). Remaining: F002 worker_pool from_raw_fd + F003 scheme
File ownership (the two remaining F-series items in netstack/src/).
vasilito