Tier 1 message fixes (Part 5.3):
- M18/M19 (build-redbear.sh:523-524): reworded patch-application messages
to reflect local fork model (forks have patches committed; recipe patches
for non-fork recipes applied atomically by repo fetch)
- M46 (build-redbear.sh:923): 'immutable archives' → 'local forks'
Tier 2 doc consolidation (Part 7):
- GRUB-INTEGRATION-PLAN.md: updated all 'make all CONFIG_NAME=' commands
to canonical './local/scripts/build-redbear.sh' equivalents
- SLEEP-IMPLEMENTATION-PLAN.md: archived (referenced 0.2.4 branch, pre-0.3.1)
Assessment doc Part 7 updated: all Tier 1 (items 1-6) and Tier 2 (items 7-13)
marked as verified complete with per-item status.
All Q1-Q10 quality improvement opportunities from Part 6.2 and all Tier 1-3
items from Part 7 are now resolved.
Q1 from assessment Part 6.2 — closes the largest robustness gap (Mechanism #2):
corrupt cached pkgar that passes mtime check was previously not detected
until runtime.
Publish side (repo_builder.rs):
- Accumulates BLAKE3 hash of each published file (pkgar, toml, dep_hashes,
auto_deps) into a BinaryStoreManifest
- Writes <recipe>.manifest.toml alongside published artifacts in repo/
Restore side (cook_build.rs):
- BinaryStoreManifest struct with read() returning Result<Option<Self>, String>
(same pattern as DepHashes: Ok(None) for missing = backward compat,
Err for corrupt TOML = loud WARN + skip)
- After restoring from binary store, verifies each file's BLAKE3 against
the manifest. On mismatch or missing file: WARN + all_restored=false
(forces rebuild). Missing manifest = backward compatible (older cookbook
published without one).
Helper (fs.rs):
- compute_file_blake3_hex(): 64KB chunked BLAKE3 hash, avoids loading
entire pkgar into memory
Tests: 3 new (roundtrip, missing-file Ok(None), corrupt-TOML Err).
Total: 38/38 pass. cargo check clean. No new clippy warnings.
Assessment doc Part 6.2/6.3/7 updated: Q1-Q6 all marked resolved.
Auto-correction table updated: transient network failure (Q2 retry) and
corrupt cached pkgar (Q1 BLAKE3 manifest) moved from 'does NOT auto-correct'
to 'auto-corrects'.
Tier 3 code improvements (from BUILD-SYSTEM-ASSESSMENT-2026-07-18 Part 6.2):
- Q2: Add run_command_with_retry() helper with exponential backoff (1s, 2s, 4s).
Wrap download_wget and git clone with 3 attempts. Git clone closure cleans
partial tmp dir between retries (git refuses non-empty clone targets).
- Q3: Preserve auto_deps.toml alongside dep_hashes.toml in binary store publish
(repo_builder.rs). Restore path prefers the preserved copy, falling back to
declared-depends-only reconstruction only when the preserved copy is absent
(e.g. published by an older cookbook). Preserves full ELF dynamic dep graph.
- Q4: DepHashes::read now returns Result<Option<Self>, String> discriminating
'missing' (legitimate first build, fall back to mtime) from 'corrupt' (loud
WARN + force rebuild). Closes a silent-swallow gap where a corrupt
dep_hashes.toml produced an incorrect mtime-fallback rebuild.
- Q6: Standardize error reporting in repo.rs nonstop path to {:#} format,
matching the pattern established in the earlier Tier 1 message commit.
Tier 1 message fixes (remaining items from assessment Part 5.3/5.4):
- M26: build-redbear.sh:569 '30-60 minutes' -> config-dependent range
- A6/A8: Makefile container messages add remediation hint
- B3: mk/config.mk sccache hint adds install guidance
- H2: mk/qemu.mk Unsupported ARCH lists supported values
- mk/redbear.mk comment 'fully-patched' -> 'versioned'
Verification: cargo check 0 errors, cargo test --lib 35/35 passed,
cargo clippy 0 new warnings vs baseline, make -n live + validate clean.
Phase 1 remediation of the build-system assessment:
- Makefile: wire 'validate' target into build/live/reimage flows; surface
lint-config and init-service validators as a first-class gate.
- mk/disk.mk: add 'validate' target running lint-config, init-service
validator, and file-ownership validator; suppress noisy unmount warnings
that masked real failures.
- mk/redbear.mk: add source-fingerprint tracking so integrate-redbear.sh
re-runs when local/recipes, local/Assets, or local/firmware change.
- src/cook/cook_build.rs: atomic dep_hashes.toml write (tmp + rename) to
prevent torn-write cache corruption; binary-store restore now checks
dep_hashes before silent restore; fix production bug in
collect_files_recursive that silently dropped subdirectories whose
name matched an exclude pattern.
- src/cook/fetch.rs, src/cook/fetch_repo.rs: harden atomic patch
application and protected-recipe gating.
- AGENTS.md, local/AGENTS.md, local/docs/COLLISION-DETECTION-STATUS.md:
sync collision-detection status to 'implemented (Phase 15.0)' now that
CollisionTracker is wired across all four installer layers
(installer submodule pointer tracked separately in 13cc6fb0c3).
Verified: cargo check (0 errors), cargo test --lib (35/35 passed),
cargo clippy (0 new warnings vs baseline), make -n validate, make -n live.
- Track base submodule pointer for output_level Warn console-quiet change.
- Capture brush entry.rs redox edits (tokio current-thread runtime, default
minimal input backend) as patches/brush-redox-runtime-and-input.patch and
apply it in the recipe, so a clean source re-fetch keeps the Redox port.
Track base e9342b78 (fbcond bidirectional serial mirror) + kernel 229046c6
(debug fevent readable). Disable the standalone 31_debug_console getty since
fbcond now owns the serial/debug console (avoids competing for the shared debug
input queue and duplicated output). Gives headless serial login on mini + bare.
- build-redbear.sh: detect changes to the 4 forks the staleness loop missed
(userutils pkgar; syscall/libredox/redox-scheme crate path-deps force a full
userspace relink) — prevents stale-binary skew (bash -n validated).
- glib: drop the stale '#undef AT_FDCWD' Redox workaround — relibc now provides
faccessat()/AT_FDCWD, and glib's HAVE_FACCESSAT path needs AT_FDCWD.
- mesa: remove the dropped '-Dosmesa=true' meson option (unknown option) and
guard the osmesa.pc pkg-config edit.
- libinput: unblocked by syncing the fresh relibc libc.a (with timerfd_*) into
the stale prefix sysroot (prefix-sysroot staleness — see notes).
The fork branch normalization it described is done — all local/sources forks are
on submodule/* branches (submodule/relibc, submodule/base, ... in active use).
Unreferenced one-time handoff; recoverable from git history if needed.
Track base 01200174 (smolnetd empty-router/broadcast warnings silenced, e1000e
82574 NIC support). redbear-sessiond: suppress the harmless first dbus connect
retry so it does not print an alarming line on every boot.
SESSION-2026-07-13-DOC-CLEANUP.md was an explicitly-transient session handoff
log (marked not-edit-me) recording a past cleanup; its content is fully
historical. Durable records (post-mortems, policy, resolved-plan implementation
notes) are intentionally kept.
Text login (getty -> brush) works on bare/mini after the relibc F_DUPFD_CLOEXEC
fix; document storage/USB/GOP bare-metal boot coverage and the outstanding
Intel 2.5GbE igc (I225/I226) and e1000e (I219) network driver gap for modern
Arrow Lake boards.
Track base 1769b083 (condition_path_exists for optional daemons, ahcid no-media,
netstack no-NIC idle, dhcpd fast-fail). Re-enable the serial debug console on
the bare target so it has a headless-visible login prompt (matching mini up to
login).
Track relibc submodule pointer 733da068 (translate POSIX F_DUPFD_CLOEXEC 1030 to
Redox syscall value 5, so OwnedFd::try_clone and thus tokio Runtime::build stop
failing with EINVAL). Also revert the ineffective epoll_ctl retry.
Remove temporary tokio/sessiond EINVAL diagnostics now that the root cause is
fixed.
The kernel event scheme now implements kdup, so dup() of an epoll fd works
and tokio's registry.try_clone() succeeds — fixing the tokio runtime EINVAL
that killed every zbus daemon and the brush login shell.
build-redbear.sh: gate the userspace build/sysroot clean on relibc/base
(the forks userspace links) instead of any low-level fork, so a kernel-only
change rebuilds the kernel + initfs + image without a full userspace re-cook.
relibc is statically linked into every userspace binary, so a relibc change
invalidates every consumer, not just the 4 initfs-critical packages the old
ABI_CRITICAL_PKGS list covered. A stale consumer silently bakes in old relibc
behaviour; diagnosing against such stale binaries wastes enormous time. Now:
if relibc rebuilds, ALL package pkgars + recipe build trees are invalidated
for a clean relink; otherwise any consumer pkgar older than relibc.pkgar (the
interrupted-build skew that shipped a broken login image) is invalidated.
Also add a temporary SESSIOND_DIAG probe that tries each tokio runtime config
and logs which one EINVALs, to pinpoint the tokio-runtime failure.
ion pulls nix 0.23.1 (git), which has the Redox SaFlags_t=c_ulong bug
(relibc/libc use c_int) and fails to compile on a clean rebuild with the
`kill`/signal feature. ion was only a bundled initfs recovery shell that
nothing execs (init runs daemons then switchroots to /usr, where the
interactive login shell is brush). Per operator directive, drop ion rather
than hold nix back on an ancient pinned version for its sake.
nix 0.30.1 wrongly types Redox's sigaction SaFlags_t as c_ulong, but
relibc and the libc crate both declare sa_flags/SA_* as c_int (nix 0.31
already uses c_int for Redox). With the `kill` feature the nix signal
module is compiled and the u64-vs-i32 mismatch breaks the SaFlags
bitflags (E0308). This was latent (uutils built from cache); the relibc
epoll rebuild forced a clean recompile and surfaced it.
Patch the nix Redox branch before cookbook_cargo, with cargo fetch first
so the registry source exists before patching.
Track relibc submodule at the epoll_ctl transient-retry fix (415fa3c8),
which lets tokio runtimes (the zbus daemons and the brush login shell)
build past the transient /scheme/event EINVAL/EBADF during early-boot
scheme churn.
redbear-bare.toml: switch [users.root]/[users.user] to /usr/bin/brush and
add the brush package, so bare and mini share an identical boot-to-login
shell (bare = minimal boot-test surface, mini = +app payload).
Switch the text-login shell from zsh to brush now that brush builds and
packages for Redox. base.toml [users.root]/[users.user] -> /usr/bin/brush
covers mini (which inherits base); redbear-bare.toml gets the same shell
plus the brush package so bare and mini share an identical boot-to-login
path (bare stays the minimal boot-test surface, mini adds the app payload).
bare/full keep their own [users.root]; full and the greeter remain on zsh
(that is the graphical/sddm path, handled separately). zsh stays installed
as a fallback. Verified: redbear-mini.iso builds and its /etc/passwd reads
`.../usr/bin/brush` for root and user.
Port the brush shell (reubeno/brush) to Redox and adopt the recipe as a
Red Bear local recipe under local/recipes/shells/brush, with the standard
recipes/shells/brush -> ../../local/recipes/shells/brush overlay symlink so
it takes priority over any upstream WIP copy (per local/AGENTS.md "Local
recipe priority vs upstream WIP"). Removes the old recipes/wip/shells/brush.
The dependency tree did not build for Redox: nix 0.31 only partially
cfg-enables Redox and the libc crate's Redox module omits POSIX symbols that
relibc provides. Fixes are reviewable unified diffs under
local/recipes/shells/brush/patches/:
nix-0.31-redox.patch cfg-enable resource/Id/waitid/from_siginfo, rlimit
import + repr(i32), SaFlags width casts, pty.
libc-0.2-redox.patch add idtype_t, P_*/CLD_*, rusage, getrusage/waitid/
forkpty externs, siginfo child accessors.
brush-umask-redox.patch mode_t is signed on Redox; cast, not u32::from.
The recipe runs `cargo fetch` to materialise registry sources before
patching (they are only unpacked during the build), resolves the right
crate version from Cargo.lock (brush pulls both nix 0.26 and 0.31), and
applies each patch idempotently, failing loudly on version drift. The
binary target is named `brush` (not `brush-shell`), so install it
explicitly. Verified: cooks from a pristine cargo cache using only the
patch files. brush is shipped in redbear-mini as a package for in-image
validation; the login shell stays zsh until brush is runtime-proven.
vasilito