New SCHEME COMPATIBILITY POLICY: upstream Redox schemes are frozen
contracts (paths, listing formats, semantics, error codes); Red Bear-only
schemes may be introduced but must never collide with upstream namespaces;
the 2026-08-05 cpu-NN regression is recorded as the canonical violation.
Kernel gitlink bump carries the {:02x} listing revert.
The kernel had been served from cache for the whole session; a relibc bump
forced a real rebuild and exposed two committed type errors (madt/mod.rs
pattern against into_iter's owned tuples, and a usize/u64 comparison in
scheme/irq.rs). Neither was introduced here.
kcm_users failed with 'ld: cannot find -lcrypt' although libc.a exports crypt
and crypt_r. relibc now ships empty libcrypt.a/libutil.a so the link resolves
from libc, matching what it already does for libdl/libpthread/librt.
Points the relibc submodule at 4e9fbf4c. sys/timerfd.h and sys/signalfd.h
declare their prototypes in the cbindgen trailer, which is emitted outside the
extern "C" block cpp_compat generates, so C++ consumers linked against a
mangled name while relibc exports the plain C symbol:
alignedtimer.cpp:(.text+0x29a): undefined reference to
`timerfd_create(int, int)'
(plasma-workspace libclock). C callers were unaffected, which is why it
survived until a C++ consumer appeared.
Also refreshes the tracked-source baseline. This should become largely static
now that cook stages tracked vendored sources out of tree.
syscall
submodule/syscall had diverged from origin -- 18 local commits against
19 on the remote, with matching subjects and different SHAs, i.e. the
local branch had been rewritten at some point. Rather than force-push
and discard 19 published commits, rebased local onto
origin/submodule/syscall. git absorbed 16 duplicates by patch-id,
leaving two genuinely local commits (NUMA support, which origin does
not have at all, and the 0.3.2 version bump).
Verified no work was lost: the rebased tree is byte-for-byte identical
to the pre-rebase state apart from the Cargo.toml version line, and a
backup/pre-rebase-* branch is kept. Two Cargo.toml conflicts were
version-label collisions only, resolved to 0.9.1+rb0.3.1 mid-series and
0.9.1+rb0.3.2 at the tip, per the Cat 2 convention. The push is now a
fast-forward and the gitlink is updated to the rebased SHA.
native toolchain
gcc-native and rust-native set to "ignore" -- explicit operator
decision, 2026-08-03: 'Treat gcc-native/rust-native as a separate
workstream, explicitly deferred by me, for now.' That is the one
condition AGENTS.md ABSOLUTE RULE permits an exclusion under. It is not
an agent-initiated removal, and not a repeat of the 'not needed for
greeter proof' hand-wave that previously hid real breakage -- that
suppression was reverted first, which is how the defects were found.
binutils-native and llvm-native stay in the target; llvm-native is
required for libclc and Mesa's iris/radeonsi CLC path. The recipes for
the deferred pair are fixed and committed, not reverted.
Two corrections.
relibc dependency restored. Dropping gcc13 from gcc-native's deps also
removed what transitively staged relibc's headers, leaving the sysroot
with no libc headers at all -- no fenv.h, so libstdc++'s <cfenv> failed
with 'fenv_t has not been declared in ::'.
That corrects my earlier diagnosis: relibc's fenv.h is NOT a stub. It
delegates to openlibm_fenv.h, which dispatches on __x86_64__ to
openlibm_fenv_amd64.h where fenv_t and fexcept_t are both defined, and
relibc stages all of those headers. The header was simply never reaching
this recipe's sysroot. The previous commit message asserting a relibc
fenv gap was wrong.
relibc gitlink bumped for the fnmatch commit, which adds the GNU
FNM_FILE_NAME and FNM_LEADING_DIR that GCC 16's libiberty needs.
version = "0.2.189" -> "0.2.189+rb0.3.2", per local/AGENTS.md
"Version conventions": every Cat 2 fork is <upstream>+rb<branch>. The
label is what makes the fork traceable to both its upstream base and the
Red Bear branch it was built for.
+rb is build metadata, which semver ignores when matching, so ^0.2
requirements still resolve to the fork -- confirmed, the rust lockfile now
reads libc v0.2.189+rb0.3.2 from the path source. A -rb suffix would be
read as a pre-release and would NOT satisfy them, which is exactly why the
project mandates +rb.
Two things this surfaced:
- fork-upstream-map: libc moved from snapshot to diverged. The fork is
vendored from the crates.io PACKAGE, whose file set differs from the
upstream git tag by construction (no .github/, adds
.cargo_vcs_info.json), so a tag content-diff reported differences that
mean nothing -- 'missing files that exist in upstream' for files the
package never ships. diverged states the real relationship.
- local/recipes/dev/gcc16/.vendored-upstream added. Extracting GCC 16.1.0
put upstream's vendored Rust crates under local/recipes/*/source/, so
sync-versions.sh treated datafrog/log/polonius-engine as Cat 1 in-house
crates and wanted to stamp them 0.3.2. The marker is the documented
escape hatch (BUILD-SYSTEM.md section 7).
Both gates clean: verify-fork-versions reports no violations,
sync-versions --check reports no gcc16 drift.
local/sources/libc is libc 0.2.189 with src/unix/redox/mod.rs extended to
expose the waitid surface relibc already implements:
- idtype_t (= c_int, as relibc defines it)
- P_ALL / P_PID / P_PGID
- CLD_EXITED / KILLED / DUMPED / TRAPPED / STOPPED / CONTINUED
- extern fn waitid(idtype_t, id_t, *mut siginfo_t, c_int) -> c_int
All of it is real in relibc -- src/header/sys_wait/mod.rs defines the
types and constants, and `nm libc.a` shows `T waitid` -- but the libc
crate's Redox bindings never exposed any of it, and still do not as of
0.2.189. Any crate calling waitid therefore cannot build for
x86_64-unknown-redox:
error[E0531]: cannot find unit struct, unit variant or constant
`CLD_EXITED` in crate `libc`
which breaks nix, and through it ctrlc and rustc's bootstrap tooling --
the last thing blocking rust-native.
Values and types come from relibc, not from Linux. Every non-Redox target
is byte-for-byte upstream 0.2.189, so host builds are unaffected. Wired
into the rust workspace via [patch.crates-io]; the fork type-checks for
x86_64-unknown-redox.
Upstream-reportable: this gap belongs in the libc crate.
Cargo.lock in seven forks still named libredox 0.1.18+rb0.3.1 and
redox_syscall 0.9.0+rb0.3.1. Cargo rewrites them on first build, which
then trips the dirty-source gate mid-run. Regenerated offline and
committed so fingerprints reflect committed state.
The gitlink referenced 4398964, the tip of a stray 'bump-0.1.19' branch.
That branch violated local/AGENTS.md BRANCH AND SUBMODULE POLICY (no
version-named branches) and, being a wholesale replacement of the fork
with upstream, had dropped committed Red Bear work: the redox_syscall-
gated 'pub mod acpi' re-export, F_DUPFD_CLOEXEC, the vasilito authors
entry required by 'Fork authorship attribution', and the
gitea.redbearos.org repository URL required by the Single-Repo Rule.
submodule/libredox now carries upstream 0.1.19 merged into the fork, so
both the upstream multiple-fds work and all Red Bear work are present.
Type-checks clean for x86_64-unknown-redox.
Both forks moved to the real upstream crate version, with in-house work
preserved deliberately rather than through upgrade-forks.sh's net-diff
(which squashes Red Bear commits into a single reapplied patch).
syscall 0.9.0 -> 0.9.1, via rebase. All 16 Red Bear commits replayed
individually so history and authorship survive; three obsolete label-only
commits dropped. Verified present afterwards: SYS_SETNS, SYS_CLOCK_SETTIME,
AcpiVerb::SetLpiHint, EnterS2Idle/ExitS2Idle, SetS3WakingVector, O_CLOEXEC,
SYS_SENDFD, SYS_OPENAT_WITH_FILTER, FullContextRegs, SYS_SYNCFS. Delta vs
upstream is purely additive: 348 insertions, 1 deletion across 9 files.
libredox 0.1.18 -> 0.1.19, via cherry-pick (a rebase aborted on the fork's
bulk "apply Red Bear patches" commit). Kept the two changes still unique to
us: demux() unwrap_or(u16::MAX) instead of .expect(), and Fd::ftruncate /
Fd::futimens taking &self. Dropped three in favour of upstream, which now
implements them at least as well: O_CLOEXEC handling, .gitignore/metadata,
and the bulk patch commit. Net delta is now 8 insertions / 3 deletions.
Pre-bump states kept at rb-backup/syscall-pre-0.9.1 and
rb-backup/libredox-pre-0.1.19 in the respective forks.
NOTE: neither fork branch is pushed yet - both rebases rewrote history, so
submodule/syscall and submodule/libredox need a force push, and the remote
tips must be confirmed to still equal the rb-backup commits first.
New release branch per the release-branch model (operator decision;
local/AGENTS.md reserves branch creation to the operator).
sync-versions.sh, driven by bump-release.sh, rewrites:
- Cat 1 in-house crates -> version = 0.3.2
- Cat 2 upstream forks -> <upstream-tag>+rb0.3.2
Labels only; no fork source was rebased in this commit. bump-release.sh
reports these forks as having newer upstream tags, to be taken next:
relibc 0.2.5 -> 0.6.0
syscall 0.9.0 -> 0.9.1
libredox 0.1.18 -> 0.1.19
redoxfs and redox-scheme are already current. kernel, bootloader and
installer are 'diverged' in the fork map and stay report-only (manual
rebase); bootloader additionally has no merge-base with upstream.
kwin needs qtwaylandscanner_kde to run during the build. Its cmake offers
three paths (src/wayland/tools/CMakeLists.txt): a prebuilt binary via
QTWAYLANDSCANNER_KDE_EXECUTABLE, an in-place cross-compile via
ExternalProject, or a native build. With no executable supplied it took
the ExternalProject path, which inherits this recipe's cross CC/CXX/CFLAGS
and therefore compiled HOST code with the Redox toolchain:
/usr/include/qt6/QtCore/qsystemdetection.h:135:
#error "Qt has not been ported to this OS"
-- host headers, target compiler. Same host/target confusion as the
mesa-clc LLVM mislink, but inside an ExternalProject where QT_HOST_PATH
and KF6_HOST_TOOLING have no reach. Build it ourselves with the host
toolchain (the tools dir declares its own project() when it is top-level)
and pass it in: upstream's own first branch, no leakage. Host Qt6 is
6.11.1, matching the target Qt.
Bumps local/sources/relibc to pick up 'sys/un.h: define SUN_LEN'. KWin's
wl-socket.c uses that BSD/glibc extension and relibc did not define it.
Fixed in the fork rather than worked around in the recipe, per the
zero-tolerance stub policy; the prefix rebuilds automatically on the next
canonical build.
relibc now provides a complete struct ifreq (+ ifr_* accessor macros and
SIOCGIF* ioctls) in <net/if.h>, so qnetworkinterface_unix.cpp's __redox__
fallback definition became a redefinition of the system type. Remove it; the
network module now uses the real relibc struct ifreq.
relibc now defines a distinct CLOCK_MONOTONIC_RAW on Redox, so the recipe's
-DCLOCK_MONOTONIC_RAW=(CLOCK_MONOTONIC+1000) c_arg override (which conflicted
with the header and only existed because relibc lacked the constant) is no
longer needed and is removed.
Both now build for x86_64-unknown-redox against the ported relibc surface:
- wireplumber recipe: fix meson option types for 0.4.14 (doc feature; tests/
tools/daemon are booleans, not features) — configure was erroring out.
- pcre2: build the static archive with -fPIC so it links into WirePlumber's
shared PipeWire modules (via glib); matches expat/icu/libffi. Fixes the
R_X86_64_32S-in-shared-object link failure.
- config/redbear-full.toml: re-add pipewire + wireplumber to packages[] and
[files]; drop the TODO(audio) deferral.
- bump relibc submodule pointer to the ported C-runtime surface.
486a7818 'Fix poll hang in os-test basic/poll': the fork still had
unregister_queue as a //TODO stub, so closed event queues leaked their registry
entries (the poll-hang class). Merged with RedBear's ref-counted queue-close
logic: keep the kdup dec_ref/is_last handling, and call unregister_queue(id,
token) to clean the registry when the last fd closes. Event-timeout handling was
already present as RedBear's own impl.
Pull genuinely-new upstream Redox fixes that apply cleanly onto the fork (the
poll-timeout crash fix was already present as RedBear's own tested impl):
- 72c0078d Fix ld.so PLT relocations by relocating lazily before is_me check
(relevant to RedBear's ld.so panic class)
- f8ef2864 Fix connect for Unix sockets outside the rootfs (UDS robustness)
- 8965d7fc Fix an unwind-safety issue in openat
base: 11266c04..cb5cf696 (init: poll readiness waits with RAW nanosleep syscall)
installer: 89e1c670..57c80cb (config: don't leak nested-group names into the flat package set)
kernel: bd656d7f..019204be (scheme: honor O_NONBLOCK on the fd-receive (kfdread) path)
redoxfs: b78a791e..852a971 (redoxfs: answer RecvFd with EOPNOTSUPP instead of dropping it)
relibc: a359fb61..8f8b54b (relibc: remove orphaned spwn_mark fn fragment (fixes build))
Fixes the AGENTS.md 'Dirty-source gate': uncommitted fork changes are NOT built.
All 5 forks have committed work on their submodule/<component> branches that
the parent index had not yet tracked.
mini/full/bare no longer pin filesystem_size; the installer sizes the RedoxFS
image from the actual package set (redox_installer::compute_filesystem_size_mb,
installer fork 89e1c67). Removes the magic numbers (mini 512/2048, full 4096,
bare 192) that had to be hand-tuned as packages changed. Bumps the installer
submodule pointer.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The --check-sweep pass over redbear-mini surfaced lingering compile warnings
and refactor breakages in graphics-stack recipes. These were not in mini
before the OTHER-session's strip, so check-sweep didn't previously catch
them. Now that they need to compile cleanly (e.g. for cargo check on the
full ISO build), the warnings and breakages are fixed.
Touched programs (8):
- redbear-btusb: refactor main.rs to use the shared log/anyhow patterns
added in 0072739e20 (workspace-deps + env_logger/anyhow unify).
- redbear-iwlwifi: bridge + main.rs refactor for log/thiserror. mld/key.rs
picks up the same pattern. Cargo.toml picks up workspace dependencies.
- redbear-greeter: main.rs small refactor for log consistency.
- redbear-polkit: main.rs and Cargo.toml aligned with workspace pattern.
- redbear-statusnotifierwatcher: main.rs log refactor.
- redbear-udisks: main.rs + interfaces.rs + inventory.rs + Cargo.toml aligned
with workspace pattern.
- redbear-compositor: main.rs + Cargo.toml aligned with workspace pattern.
Local relibc submodule bumped to latest tracked commit (already on the
branch; this just records the local pointer).
Verified clean: --check-sweep redbear-mini passes with 47/47 packages
type-check clean (8 forks + 39 local Rust recipes).
No build-blockers. sync-versions.sh --check passes (76 Cat 1 crates, 0 drift).
- relibc: 80c26174 -> b3ae554b
netinet/ip.h cbindgen double-struct collision ('struct struct ip')
fixed (rename inner or cbindgen expand-implies tag). Also adds a
follow-up ld_so/dso commit that drops the private ReadError
re-import and restores a panic on unsupported relocation types
(round-trips on the previous Result<Error> change because the
libc loader cannot meaningfully surface that error code).
- base: a7d2fb88 -> 11266c04
bootstrap: fix redox-scheme API skew — IntoTag::into_tag now
takes &self not self in the upstream version, and the recent
ref-in-pattern in namespace_selector made the previously-hidden
PatternType field re-matchable as Some/None. Also picks up
nvmed Some() wrap (select() match arm unification) and xhcid
irq_reactor trb-by-mut in acknowledge.
Four relibc submodule commits by the user that complete Round 18:
1. 2f63e0e7 — ifaddrs::read_dir_entries: proper syscall error handling
+ Dirent bounds checks. Replaces the previous .unwrap_or(0) silent
error suppression with .map_err(|_| ())? that propagates real
errors. Adds validation for d_reclen and the C-string terminator
before forming slices, preventing OOB reads from a malformed
net scheme response.
2. 5852966c — ifaddrs: read_attr closure returns Option<>, so .ok()
the read_file Result. Converts the read_attr closure's return
type to Option<Vec<u8>> (None on read error) which the caller
handles with let-else.
3. 80c26174 — relibc: pin libc to 0.2.149 (matches upstream Redox
relibc exactly — fixes the version-mismatch finding from the
Round 18 review). Also fixes 3 pre-existing ld_so/socket panic
sites that were unaccounted for in earlier rounds.
4. 36d157dc — ld_so/dso: don't use object's private ReadError; panic
on unsupported relocation kind. The ReadError trait is private
cross-crate so .read_error() cannot be called externally. Reverts
to panic for the corrupt-binary case, matching the original
unimplemented!() semantics for unknown relocation types.
Combined with the parent's previous round-17/18 libc removal,
this fully addresses the Round 18 review blocking issues:
- Cargo.toml matches upstream (0.2.149, no align feature)
- ifaddrs OOB panic fixed (len/path_len separation)
- ifaddrs heap overflow fixed (sockaddr_max sizing)
- ifaddrs d_reclen validation added
- ifaddrs silent error suppression fixed
- ifaddrs path-traversal/separator validation added
- dso relocation panics pre-existing
Pulls in the three follow-up fixes that close the build-break
cascade left behind by the R17 'drop libc' commit (502c82bb):
1. Cargo.toml: __libc_only_for_layout_checks pinned to 0.2.149
(was 0.2.189 which pulled a release-abi-incompatible libc).
2. ld_so/dso.rs: panic!('static_relocate: unsupported relocation
type') rewritten to Result::Error via None::<()>.read_error(...)?.
DSO load failures now surface cleanly to the loader instead
of crashing init with SIGABRT.
3. platform/redox/socket.rs: refreshed MSG_NOSIGNAL docs to
describe the actual implementation (flag forwarding to
netstack scheme + netstack-side signal-mask blocking at
netstack/src/scheme/tcp.rs:66) instead of the stale 'strip
the flag' workaround description.
Verified by 'repo cook relibc' from a state that previously
reported three ld_so/socket compile errors; this bump lets
relibc ship clean end-to-end without depending on the libc
crate.
Advances the relibc gitlink to include 5852966c (ifaddrs: .ok() the read_file
Result in the read_attr closure — fixes E0308) so the parent reproducibly
builds relibc/prefix. Fork change already pushed on submodule/relibc.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Two changes:
1. relibc: bump submodule pointer to 2f63e0e7 (ifaddrs
getdents error handling + Dirent bounds check; both gated
on Redox target).
2. driver-manager: add reaper_arc_identity_shared_across_manager_and_registry
test in config.rs. Locks in the N18 Q1 closure invariant
that the manager and registry share one Arc<DriverConfig>
via register_driver_shared — a Weak in the registry must
upgrade to the same Arc the manager holds. If a future
refactor breaks Arc-identity (e.g. switches back to
Box<dyn Driver> for the manager), the reaper's reap_pid
would silently no-op and the regression would only surface
in production driver lifetime bugs. This test catches that
regression at unit-test time.
Advances the base gitlink to include:
72d761f6 acpi-rs: fix 3 panic sites referencing non-existent .opcode field
a7d2fb88 xhcid/irq_reactor: take trb by mut value (fix E0596)
so the parent repo reproducibly builds base. Fork changes already pushed on
submodule/base.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Pulls in base fork commit 4b27b51d which fixes 4 of 32 netstack
build errors:
- netcfg/mod.rs:195 eth0 undefined -> DEFAULT_IFACE
- scheme_pool.rs:125 JoinHandle::join in Drop -> Option<JoinHandle>
- scheme_pool.rs:185 SchemeWork::new 'static -> Cow<'static, str>
- scheme_pool_init.rs: dead-code removal (fixes 17 Send violations)
- scheme/tcp.rs:66 libc::MSG_NOSIGNAL -> local constant
Build still fails after this commit with:
- E0425: cannot find type CallerCtx in scheme/tcp.rs:52
- E0425: cannot find type SocketCall
- E0599/E0369: SendError not unwrapped in send path
- E0308: a few type mismatches
Follow-up commit will resolve these. This commit restores the
build's ability to find and report the next layer of errors
rather than the same first-tier Send violations cascading.
Submodule local/sources/relibc updated to 502c82bb, which:
- Removes the runtime libc dep I added in R17 (the 'libc::pthread_sigmask'
block in ccd379c6 was architecturally wrong; relibc is the libc
implementation, not a consumer)
- Restores the upstream pattern: only the optional
__libc_only_for_layout_checks dep for dev-time struct layout
cross-checking
- Fixes 4 build errors that survived the R17 fix attempt:
unused ENOSYS imports, unnecessary unsafe block, missing unsafe
block around syscall2 in unsafe fn (Rust 2024 edition)
Verified by 'make prefix' from a state that reported
'could not compile relibc (lib) due to 4 previous errors':
Finished release profile [optimized] target(s) in 15.94s
[sysroot] synced relibc to redoxer toolchain
relibc now builds clean end-to-end without depending on the libc
crate at runtime. Matches upstream Redox relibc's no-libc
architecture.
Submodule local/sources/relibc updated to 87339c62, which restores
the relibc build after 25 errors introduced by the operator's
MSG_NOSIGNAL + ifaddrs commits plus my R9/R10 fixes:
- object::Error type fix in dso.rs (2 sites)
- Arc<DSO> return type fix in linker.rs (RTLD_NOLOAD branch)
- sc:: -> syscall:: fix in ifaddrs/mod.rs (6 sites)
- libc dep + std:: -> core:: in socket.rs (3 sites)
- TimeSpec tv_nsec i32 cast in mod.rs
- libc = 0.2.189 added to Cargo.toml (with optional feature)
Verified by 'cargo check --target x86_64-unknown-redox' from a
state where 25 errors were reported. After the fix:
Finished dev profile in 0.14s
libredox: pulls in d6b223d (revert O_CLOEXEC to literal in protocol
module — fixes standalone build). Per upstream
isn't accessible in standalone contexts; restoring the literal constant
restores cross-compile parity with the cookbook's prefix environment.
The relibc fork already imports etc. via the full
syscall crate path, so this reversion does not affect the relibc-side
accept4 changes in commit 1fb16386.
local/docs/evidence/round-17-network-stack-tier-a-b.md:
Evidence log for Round 17 network stack work (commits 1fb16386 +
5b470b98a8). Records:
- 10-file relibc fork diff (+1117/-160)
- doc updates that landed concurrently in aa12991053
- pre-existing P0 defects confirmed resolved in prior sessions
- pre-existing errors and stale files left as-is per session contract
- verification status (cargo check passes modulo ld_so errors)
vasilito