Aegis OS activation tasks¶
Status: draft requiring review
| Task ID | Requirement IDs | Work | Dependencies | Acceptance | Owner |
|---|---|---|---|---|---|
| T01 | REQ-BOOT-02 | M00 / E00-1: Governance gate reported with its limits | - | Positive: make verify-all passes. Negative: a drifted generated client file fails compile-context --verify. Boundary: the report states preparation/governance scope only; simulated boot output is never cited as evidence. |
cordanaLLM/Aegis-OS |
| T02 | REQ-GOV-01 | M00 / E00-2: Split licence scaffold committed | T01 | LICENSING.md and REUSE.toml record EUPL-1.2 for technical material and CC-BY-SA-4.0 for prose. The proposal Cargo workspace (export-006) also declares EUPL-1.2; no workspace manifest is committed in the repository yet. | cordanaLLM/Aegis-OS |
| T03 | REQ-GOV-02 | M00 / E00-3: Remote declared; proposal identity recorded for reconciliation | T01 | origin resolves to cordanaLLM/Aegis-OS with main present remotely. The proposal identity cordanaLLM/aegis-os (export-006) differs in letter case and is carried into the M01 register; hosted readback is not claimed. | cordanaLLM/Aegis-OS |
| T04 | REQ-WS-01, REQ-P14-07, REQ-P16-07, REQ-P08-08, REQ-P09-08, REQ-P06-07, REQ-P13-08, REQ-P12-08, REQ-P15-05 | M01 / E01-1: Crate and UI inventory with manifest status | M00 | Positive: 12 Rust and 3 UI candidates are listed with source id and hash. Negative: a candidate without a source hash fails review. Boundary: Vulcan and Hestia appear with status 'not a proposal-workspace member', and the P01/P02 crate location is decided. | cordanaLLM/Aegis-OS |
| T05 | REQ-GRAPH-01, REQ-GRAPH-02, REQ-GRAPH-03, REQ-GRAPH-04, REQ-GRAPH-05, REQ-P09-03, REQ-P09-05, REQ-P10-07, REQ-P15-07, REQ-P14-05, REQ-P12-07, REQ-P12-09, REQ-UI-02 | M01 / E01-2: Graph and source contradiction register | M00, T04 | Each disputed edge or value names both sources and the affected contract. export-062 stays the graph of record until a decision changes it. | cordanaLLM/Aegis-OS |
| T06 | REQ-GOV-02, REQ-P01-08, REQ-P02-06, REQ-CI-03, REQ-UI-01, REQ-REL-02, REQ-P01-07, REQ-P03-08, REQ-P04-08, REQ-P01-01 | M01 / E01-3: Toolchain, identity and version-drift register | M00, T04 | Every pinned or floating toolchain is listed with its source and marked as proposal data. Nothing is installed. Each drift item becomes a decision. | cordanaLLM/Aegis-OS |
| T07 | REQ-CI-01, REQ-CI-02, REQ-BOOT-02, REQ-REL-01, REQ-P14-08 | M01 / E01-4: Imported workflow quarantine | M00, T04 | Imported CI, release and integration scripts stay inactive. Their failure-suppressing and simulated-output steps are listed as defects to fix before any activation. | cordanaLLM/Aegis-OS |
| T08 | REQ-P06-07, REQ-P16-08, REQ-GOV-01 | M02 / E02-1: Workspace root, manifest, lock and Rust toolchain admission | M01 | Positive: the crate builds under cargo build -p aegis-justitia and a workspace-wide invocation. Negative: an unlocked dependency change fails cargo build --locked. Boundary: clippy with -D warnings passes with zero warnings. |
cordanaLLM/Aegis-OS |
| T09 | REQ-P06-01, REQ-P06-03, REQ-P06-04, REQ-GOV-03 | M02 / E02-2: Decision engine with positive, negative and boundary tests | M01, T08 | Positive: a Tier C action is allowed, and two distinct non-maker checkers are accepted. Negative: maker as checker is rejected, and a duplicate checker is rejected. Boundary: due timestamps equal to now and to now-1 both fail closed, and the killswitch blocks Tier C. | cordanaLLM/Aegis-OS |
| T10 | REQ-P06-09, REQ-P16-09, REQ-P16-01 | M02 / E02-3: Audit ledger algorithm decision and trait boundary | M01, T08 | Positive: one algorithm is recorded and a chain re-walk verifies. Negative: a single flipped byte is detected, and a missing signer returns an error. Boundary: an empty ledger verifies as the genesis state. MD5 is removed. | cordanaLLM/Aegis-OS |
| T11 | REQ-P09-03, REQ-P09-05, REQ-GRAPH-04, REQ-GRAPH-02 | M14 / E14-1: Action-gate direction decision and action proposal contract | M02 | Positive: a signed, well-formed proposal round-trips. Negative: an unsigned or malformed proposal is rejected. Boundary: a proposal at the maximum field lengths is accepted, and one byte over is rejected. | cordanaLLM/Aegis-OS |
| T12 | REQ-GOV-03, REQ-P06-08, REQ-P06-10, REQ-P16-03 | M14 / E14-2: DecisionRequest and audit record contracts | M02, T11 | Positive: both schemas round-trip. Negative: an unknown schema version is rejected. Boundary: an audit record whose previous hash is the all-zero genesis value is accepted only as the first record. The PLD effective date is tracked as an external deadline. | cordanaLLM/Aegis-OS |
| T13 | REQ-P06-02 | M14 / E14-3: Hardened unit contract | M02, T11 | Positive: the unit file declares IPAddressDeny=any. Negative: a review check fails if the directive is removed. Boundary: the unit is not installed or started in this milestone. | cordanaLLM/Aegis-OS |
| T14 | REQ-P01-02, REQ-P01-03, REQ-P02-03, REQ-P02-07, REQ-P01-10, REQ-CI-01 | M03 / E03-1: Repart analyzer gate | M02 | Positive: the dry run exits 0 with no ignored-key diagnostics. Negative: a missing Type= exits non-zero, and an unknown key fails the gate. Boundary: ESP min equal to max is accepted, and inverted min greater than max is rejected. | cordanaLLM/Aegis-OS |
| T15 | REQ-P01-04, REQ-P02-04, REQ-P02-06 | M03 / E03-2: Sysupdate transfer gate | M02, T14 | Positive: the rewritten transfer lists without error offline. Negative: the imported transfer is rejected (exit 1). Boundary: a transfer with both root slots and no writable target parses, and one with a single slot is flagged against the A/B requirement. | cordanaLLM/Aegis-OS |
| T16 | REQ-P01-02, REQ-P01-10, REQ-WS-01 | M03 / E03-3: Definition parser crate | M02, T14 | Positive: the definitions round-trip through the parser. Negative: a duplicate section or malformed size is rejected. Boundary: 512M and 1G parse exactly, and 511M below the minimum is flagged. | cordanaLLM/Aegis-OS |
| T17 | REQ-P01-05 | M03 / E03-4: PCR measurement acceptance target | M02, T14 | The PCR 0/4/7/11 strategy is documented as the acceptance target for M11 boot evidence. It is not claimed here. | cordanaLLM/Aegis-OS |
| T18 | REQ-P01-01, REQ-P01-06, REQ-P01-08, REQ-GOV-02 | M18 / E18-1: Product input manifest schema | M03 | Positive: the manifest built from the M03 files validates. Negative: a manifest without a correlation id or exact revision is rejected. Boundary: a retry count at the bound is accepted, and one above is rejected. | cordanaLLM/Aegis-OS |
| T19 | REQ-P01-09, REQ-P07-01, REQ-P06-05, REQ-P13-02, REQ-P07-06 | M18 / E18-2: Kernel requirement schema and kernel identity decision | M03, T18 | Positive: the payload lists the kernel features required by P06, P07 and P13. Negative: an unknown architecture is rejected. Boundary: an empty requirement list is rejected explicitly, not accepted as 'no requirements'. | cordanaLLM/Aegis-OS |
| T20 | REQ-P01-08, REQ-P02-06 | M18 / E18-3: mkosi admission decision | M03, T18 | Positive: if admitted, mkosi summary parses the Output stanza. Negative: a version below the floor is refused. Boundary: the floor version itself is accepted. |
cordanaLLM/Aegis-OS |
| T21 | REQ-P02-08, REQ-P02-01, REQ-P02-02 | M15 / E15-1: A/B lifecycle state machine | M03 | Positive: the happy path reaches Bless. Negative: a signature failure reaches Discard. Boundary: watchdog expiry exactly at the timeout takes Rollback, and one tick before does not. | cordanaLLM/Aegis-OS |
| T22 | REQ-P02-05, REQ-P16-05 | M15 / E15-2: Reversible consolidation decision | M03, T21 | The decision is recorded, and a test shows that a reopened slot still requires a verity match before Bless. | cordanaLLM/Aegis-OS |
| T23 | REQ-P13-01, REQ-P13-06, REQ-P13-07, REQ-P13-08 | M05 / E05-1: Tellus SCI arithmetic | M14 | Positive: a hand-computed SCI matches. Negative: functional_units <= 0 falls back without NaN. Boundary: 300.0 is not deferred, 300.001 is deferred, and slices never exceed 16. | cordanaLLM/Aegis-OS |
| T24 | REQ-P16-01, REQ-P16-02, REQ-P16-05, REQ-P16-10, REQ-P15-04 | M05 / E05-2: Athena lifecycle and Pareto gate | M14, T23 | Positive: a passing candidate reaches Publish. Negative: exceeding any single bound reaches Invalidate with a ledger entry, and an empty id is rejected. Boundary: latency 1.5 and retention 0.99 are exercised exactly. | cordanaLLM/Aegis-OS |
| T25 | REQ-P16-03, REQ-P16-09, REQ-P06-09 | M05 / E05-3: Hash-chained ledger in Rust | M14, T23 | Positive: a chain re-walk verifies. Negative: a tampered record is detected. Boundary: the genesis record is verified, and the algorithm matches D02. | cordanaLLM/Aegis-OS |
| T26 | REQ-P13-05, REQ-P13-03, REQ-P16-06, REQ-P01-04 | M05 / E05-4: Evolution-loop edge contracts | M14, T23 | Positive: typed request and response round-trip for each edge. Negative: malformed payloads are rejected. Boundary: the sysupdate call is stubbed, and an empty candidate list is handled explicitly. | cordanaLLM/Aegis-OS |
| T27 | REQ-P09-01, REQ-P09-02, REQ-P09-06, REQ-P09-07, REQ-P09-08 | M06 / E06-1: Minerva router, replay and solver logic | M14 | Positive: expert registration and routing succeed. Negative: route returns None when no expert matches. Boundary: the 32nd expert is accepted and the 33rd rejected; the 128th trajectory step is accepted and the 129th rejected; relabelling flips only negative rewards. | cordanaLLM/Aegis-OS |
| T28 | REQ-P10-01, REQ-P10-04, REQ-P10-05, REQ-P10-06, REQ-P10-07 | M06 / E06-2: Vesta bounded controllers | M14, T27 | Positive: 64 microVMs and 128 capsules are accepted. Negative: terminating an unknown id returns false. Boundary: the 65th microVM and 129th capsule fail. The boot-time literal is marked unmeasured. | cordanaLLM/Aegis-OS |
| T29 | REQ-P10-08, REQ-P10-02, REQ-P10-03 | M06 / E06-3: Wasm runtime boundary decision | M14, T27 | The decision is recorded. Venus and AF_VSOCK pricing stay deferred hardware-backed requirements (M21). | cordanaLLM/Aegis-OS |
| T30 | REQ-P09-03, REQ-GRAPH-05, REQ-P14-05, REQ-P16-04 | M06 / E06-4: Agent-chain edge contracts | M14, T27 | Positive: typed contracts round-trip. Negative: unsigned or malformed proposals are rejected. Boundary: a capsule request at the capsule bound is accepted, and one over is rejected. | cordanaLLM/Aegis-OS |
| T31 | REQ-P03-04, REQ-P03-05, REQ-P03-08, REQ-P03-06, REQ-WS-01, REQ-P03-01, REQ-P03-02 | M17 / E17-1: Vulcan validation crate | M02 | Positive: an aligned BAR is accepted. Negative: a misaligned BAR is rejected. Boundary: block_count 0 and 8193 are rejected, 8192 is accepted, and the ring index wraps. | cordanaLLM/Aegis-OS |
| T32 | REQ-P15-01, REQ-P15-05, REQ-P15-06, REQ-P15-08, REQ-GRAPH-03 | M17 / E17-2: Hestia vector-store state machine | M02, T31 | Positive: an initialized store answers queries. Negative: a query before init fails. Boundary: limits 0 and 101 fail, and 1 and 100 pass. | cordanaLLM/Aegis-OS |
| T33 | REQ-P03-07, REQ-P09-04, REQ-P15-07 | M17 / E17-3: P03 and P15 interface contracts | M02, T31 | Positive: the descriptors round-trip. Negative: a malformed descriptor is rejected. Boundary: a descriptor at the maximum block count is accepted, and one over is rejected. | cordanaLLM/Aegis-OS |
| T34 | REQ-P04-04, REQ-P04-05, REQ-P04-07, REQ-P04-08 | M07 / E07-1: Compositor registry and Tier-1 socket bounds | M02 | Positive: 256 surfaces and 64 clients are accepted. Negative: the 257th surface is rejected and the 65th client is not admitted. Boundary: a pacing-constant test pins the chosen value. | cordanaLLM/Aegis-OS |
| T35 | REQ-P04-01, REQ-P04-02, REQ-P04-03, REQ-P04-06 | M07 / E07-2: wlroots and mesh design decision | M02, T34 | The decision is recorded. The Zenoh version is selected at activation after checking current upstream, with a mocked transport test: a publish round-trips, a subscriber cannot write back, and an empty key expression is rejected. | cordanaLLM/Aegis-OS |
| T36 | REQ-P07-01, REQ-P07-02, REQ-P07-03, REQ-P07-04, REQ-P07-05, REQ-P01-07 | M07 / E07-3: Lictor EWMA tiers and broker | M02, T34 | Positive: bursts below each threshold classify per the source comparisons. Negative: an unregistered focus PID throttles nothing. Boundary: bursts exactly at each threshold classify per the strict comparison. | cordanaLLM/Aegis-OS |
| T37 | REQ-P08-01, REQ-P08-02, REQ-P08-03, REQ-P08-06, REQ-P08-07, REQ-P08-08 | M07 / E07-4: Calliope plugin lifecycle and DMA-BUF descriptors | M02, T34 | Positive: 32 slots are accepted. Negative: the 33rd slot and an illegal transition are rejected. Boundary: stride arithmetic is checked at 0 and at u32::MAX/4. | cordanaLLM/Aegis-OS |
| T38 | REQ-P08-04, REQ-P08-05, REQ-P13-03 | M07 / E07-5: Real-time edge contracts | M02, T34 | Positive: typed focus-switch, RTPRIO grant and DMA-BUF stream descriptors round-trip. Negative: malformed descriptors are rejected. Boundary: an RTPRIO value at the source value is accepted, and one above is rejected. | cordanaLLM/Aegis-OS |
| T39 | REQ-P11-02, REQ-P11-07, REQ-P11-01, REQ-P11-05 | M08 / E08-1: Ludus launch-argument validator | M06 | Positive: 64 args are accepted. Negative: 65 args are rejected. Boundary: an empty argument list is handled explicitly and its authentication outcome is recorded. | cordanaLLM/Aegis-OS |
| T40 | REQ-P14-01, REQ-P14-02, REQ-P14-03, REQ-P14-04, REQ-P14-08 | M08 / E08-2: Hephaestus bounded loops | M06, T39 | Positive: a mesh under the bound is accepted. Negative: a missing STEP path errors. Boundary: 500000 elements are accepted and 500001 rejected, and the iteration bound is honoured. CAD and solver versions are recorded as unpinned. | cordanaLLM/Aegis-OS |
| T41 | REQ-P14-05, REQ-P14-06, REQ-P11-06, REQ-P11-04 | M08 / E08-3: P11 and P14 interface contracts | M06, T39 | Positive: the descriptors round-trip. Negative: a receipt without a signature field is rejected. Boundary: a viewport descriptor at the mesh bound is accepted. | cordanaLLM/Aegis-OS |
| T42 | REQ-P06-05, REQ-P07-06 | M19 / E19-1: action_gate LSM object | M05, M07 | Positive: the program loads, and an exec event reaches a stub ringbuf consumer where BPF LSM is active. Negative: the unchecked-pointer variant is rejected. Boundary: if BPF LSM is not active on the host, attach is recorded as unavailable rather than passed. | cordanaLLM/Aegis-OS |
| T43 | REQ-P07-04, REQ-P07-01 | M19 / E19-2: scx_cake struct_ops object | M05, M07, T42 | Positive: struct_ops loads where sched_ext is present. Negative: the unbounded-loop variant is rejected. Boundary: all-stub handlers load. | cordanaLLM/Aegis-OS |
| T44 | REQ-P13-02 | M19 / E19-3: kepler_power probe object | M05, M07, T42 | Positive: the tracepoint program loads. Negative: an out-of-bounds map access variant is rejected. Boundary: the hardcoded TDP literal is recorded as a non-measurement. | cordanaLLM/Aegis-OS |
| T45 | REQ-UI-01, REQ-CI-03, REQ-P12-08, REQ-CI-02 | M04 / E04-1: UI toolchain admission and lockfiles | M02 | Positive: the pinned Node and pnpm versions install from the lockfile. Negative: a lockfile mismatch fails pnpm install --frozen-lockfile. Boundary: the gate fails on the first violation and is not suppressed. |
cordanaLLM/Aegis-OS |
| T46 | REQ-P12-01, REQ-P12-05, REQ-P12-06, REQ-P05-06, REQ-UI-02, REQ-P12-02, REQ-P12-03, REQ-P12-04, REQ-P12-07, REQ-P12-09 | M04 / E04-2: Concordia tokens and axe-core harness | M02, T45 | Positive: zero violations on the default state. Negative: a stripped outline fails. Boundary: the focus width chosen by D16 passes, one pixel less fails; 3:1 contrast passes and 2.99:1 fails; 200% text scaling causes no overflow. The truncated container digest is recorded as non-pinnable. | cordanaLLM/Aegis-OS |
| T47 | REQ-P05-01, REQ-P05-02, REQ-P05-03, REQ-P05-04, REQ-P05-05, REQ-P05-07, REQ-P05-08, REQ-P04-07 | M16 / E16-1: Forum shell state and lifecycle with stubs | M04, M14 | Positive: each lifecycle transition in the source order succeeds. Negative: a transition from Deleted is rejected. Boundary: Rate-Limited to Quarantined at the limit is exercised exactly. | cordanaLLM/Aegis-OS |
| T48 | REQ-GRAPH-01, REQ-P13-04, REQ-P06-08 | M16 / E16-2: Consumer contracts and token-edge decision | M04, M14, T47 | Positive: DecisionRequest and Tellus telemetry payloads parse. Negative: an unknown schema version is rejected. Boundary: a telemetry update with zero watts renders without error. | cordanaLLM/Aegis-OS |
| T49 | REQ-P01-01, REQ-P01-02, REQ-P01-03, REQ-P01-04, REQ-P01-06, REQ-P01-10 | M09 / E09-1: Imago consumption of the product input manifest | M18 | Positive: an accepted request returns image digest, signature reference and boot-evidence fields. Negative: a malformed manifest is rejected with a correlated error. Boundary: a retry at the bound is recorded, and one above is refused. | cordanaLLM/Aegis-OS |
| T50 | REQ-P01-09, REQ-P07-01, REQ-P06-05, REQ-P13-02 | M09 / E09-2: Nucleus consumption of the kernel requirement payload | M18, T49 | Positive: a result returns kernel version/config digest, artifact digest and provenance. Negative: an unsatisfiable feature is rejected with a correlated error. Boundary: an empty requirement list is rejected explicitly. | cordanaLLM/Aegis-OS |
| T51 | REQ-BOOT-02, REQ-GOV-02 | M09 / E09-3: Pair evidence and identity status | M18, T49 | The retained pair shows correlation id and exact revisions. Simulated output is refused. Identity status is recorded. | cordanaLLM/Aegis-OS |
| T52 | REQ-P01-01, REQ-P01-06 | M09: Proposed producer cordanaLLM/imago (not accepted): accept the Aegis image request schema; return image digest, signature reference and boot-evidence fields; reject malformed manifests with a correlated error | M18 | Positive: one accepted request recorded against a pinned imago revision. Negative: one rejected request with a correlated error. Boundary: a retry at the bound. | unassigned |
| T53 | REQ-P01-09, REQ-P07-01 | M09: Proposed producer cordanaLLM/nucleus (not accepted): consume the Aegis kernel requirement payload instead of a fixed symbol list; return kernel version/config digest, artifact digest and provenance | M18 | Positive: the payload is consumed. Negative: an unsatisfiable feature is rejected. Boundary: an empty list is rejected explicitly. All recorded against a pinned nucleus revision. | unassigned |
| T54 | REQ-P01-01, REQ-P01-06, REQ-P01-08 | M11 / E11-1: Imago result consumed and verified | M09, M15 | Positive: digest and signature verify locally. Negative: a tampered image digest or bad signature is rejected. Boundary: a producer version exactly at the floor is accepted, and one below is rejected. | cordanaLLM/Aegis-OS |
| T55 | REQ-BOOT-01, REQ-BOOT-02, REQ-P01-05, REQ-P02-02, REQ-P02-01 | M11 / E11-2: Real boot evidence replaces the simulated script | M09, M15, T54 | Positive: PCR values are read back from swtpm, and the verity root hash matches. Negative: a modified root image fails verity and does not boot to the established state. Boundary: a PCR policy that omits PCR 11 fails to unseal /var. The imported script is not used. | cordanaLLM/Aegis-OS |
| T56 | REQ-CI-01 | M11 / E11-3: Analyzer gate without suppression in the image path | M09, M15, T54 | Positive: the M03 gate passes on the image inputs. Negative: an ignored-key diagnostic fails the image acceptance. Boundary: no step carries failure suppression. | cordanaLLM/Aegis-OS |
| T57 | REQ-P01-04, REQ-P02-04, REQ-P02-08 | M11 / E11-4: A/B transfer exercised | M09, M15, T54 | Positive: the second slot is written read-only and boots. Negative: a transfer with a bad signature is discarded. Boundary: watchdog expiry before bless rolls back once. | cordanaLLM/Aegis-OS |
| T58 | REQ-P06-05, REQ-P07-06 | M10 / E10-1: action_gate on the Nucleus kernel | M09, M19 | Positive: the program loads and attaches. Negative: the unchecked-pointer variant is rejected. Boundary: BPF LSM absent from the kernel config fails the milestone with a recorded reason. | cordanaLLM/Aegis-OS |
| T59 | REQ-P07-04, REQ-P07-01 | M10 / E10-2: scx_cake on the Nucleus kernel | M09, M19, T58 | Positive: struct_ops attaches. Negative: the unbounded variant is rejected. Boundary: a kernel without sched_ext is recorded as a Nucleus requirement defect. | cordanaLLM/Aegis-OS |
| T60 | REQ-P13-02 | M10 / E10-3: kepler_power on the Nucleus kernel | M09, M19, T58 | Positive: the tracepoint attaches. Negative: a missing tracepoint is reported, not ignored. Boundary: zero energy delta over an idle interval is recorded as a value, not an error. | cordanaLLM/Aegis-OS |
| T61 | REQ-P13-02, REQ-P13-01 | M21 / E21-1: RAPL-backed carbon telemetry | M05, M06 | Positive: SCI is computed from measured energy. Negative: unreadable counters fail closed with an error, not a default value. Boundary: counter wraparound between two samples yields a correct positive delta. | cordanaLLM/Aegis-OS |
| T62 | REQ-P10-01, REQ-P10-03, REQ-P16-04 | M21 / E21-2: Firecracker and AF_VSOCK sandboxing | M05, M06, T61 | Positive: a microVM boots and the candidate evaluation round-trips over AF_VSOCK. Negative: a microVM request above the memory limit is refused. Boundary: the 64th microVM on real KVM is accepted and the 65th refused. | cordanaLLM/Aegis-OS |
| T63 | REQ-P10-02 | M21 / E21-3: Venus GPU pricing deferred | M05, M06, T61 | Recorded as deferred to M12. It is not claimed here. | cordanaLLM/Aegis-OS |
| T64 | REQ-GOV-02 | M13 / E13-1: Hosted ruleset/label and identity readback | M11 | Positive: rulesets and labels read back from the hosted side match .github/rulesets and .config/labels.yaml. Negative: a missing required check is reported as drift. Boundary: the proposal identity case difference is resolved or recorded. | cordanaLLM/Aegis-OS |
| T65 | REQ-REL-01, REQ-REL-02 | M13 / E13-2: Signing and provenance for a real artifact | M11, T64 | Positive: the signature verifies against the M11 artifact. Negative: verification fails against a modified artifact, and an unverified action reference fails workflow lint. Boundary: signing an absent artifact fails rather than producing an empty signature. | cordanaLLM/Aegis-OS |
| T66 | REQ-P01-06 | M13 / E13-3: Publication settings and consumers | M11, T64 | Positive: one recorded consumer enables delivery. Negative: delivery is refused with zero recorded consumers. Boundary: a consumer without a pinned version is not counted. | cordanaLLM/Aegis-OS |
| T67 | REQ-P06-06, REQ-P06-01, REQ-GOV-03 | M20 / E20-1: PCR quote signs an audit record | M11, M14 | Positive: an audit record signed with the quote verifies. Negative: a record signed under a different PCR state fails verification. Boundary: a quote over exactly PCR 0/4/7/11 is accepted, and a quote missing PCR 11 is rejected. | cordanaLLM/Aegis-OS |
| T68 | REQ-P02-02, REQ-P02-03 | M20 / E20-2: PCR-sealed /var unseal | M11, M14, T67 | Positive: /var unseals under the enrolled policy. Negative: a wrong PCR policy fails to unseal. Boundary: changing only PCR 7 is enough to prevent unseal. | cordanaLLM/Aegis-OS |
| T69 | REQ-P08-01, REQ-P11-03, REQ-P15-02, REQ-P15-03, REQ-P08-04 | M12 / E12-1: DMA-BUF sharing paths | M08, M10, M11, M17 | Positive: one measured zero-copy transfer per path. Negative: an invalid DMA-BUF fd is rejected without a CPU copy fallback being counted as success. Boundary: the 64th buffer is accepted and the 65th refused on real hardware. | cordanaLLM/Aegis-OS |
| T70 | REQ-P03-03, REQ-P03-06, REQ-P03-07, REQ-P09-04 | M12 / E12-2: VFIO and P2PDMA paths | M08, M10, M11, M17, T69 | Positive: one measured NVMe-to-GPU transfer. Negative: a device outside its IOMMU group is refused. Boundary: a transfer of exactly 8192 blocks succeeds, and 8193 is refused before dispatch. | cordanaLLM/Aegis-OS |
| T71 | REQ-P10-02, REQ-P03-02 | M12 / E12-3: GPU template boundary | M08, M10, M11, M17, T69 | Positive: one backend fixture result is retained, or a not-needed decision is recorded. Negative: a Go library as a direct Rust dependency is rejected. Boundary: an ABI mapping with zero functions is not accepted as a boundary. | cordanaLLM/Aegis-OS |
| T72 | REQ-P03-07, REQ-P10-02 | M12: Optional candidate template-native-gpu (Golusoris-family template, not accepted): provide or confirm a native/GPU template boundary with ABI mapping and one backend fixture, or record that no Aegis component needs it | M08, M10, M11, M17 | Positive: one retained backend fixture result, or a recorded not-needed decision. Negative: a Go library proposed as a direct Rust dependency is refused. | unassigned |
Dependencies are milestone ids, plus the first task of the same milestone where
the work builds on it. A task may start when every listed dependency is done.
Owner is the repository that must produce the evidence. unassigned marks work
that no repository has accepted yet; a proposed producer named in the Work
column is not an owner until it accepts the contract.
Unresolved work¶
| Item | Blocker | Owner |
|---|---|---|
| Decisions D01-D20 (see project plan) must be recorded before the milestone that cites them closes | none; planning work | cordanaLLM/Aegis-OS |
| Update docs/integration/stack.md activation order to defer to the roadmap (D19) | reviewed change required | cordanaLLM/Aegis-OS |
| Canonicalize builder repository identities and complete request/artifact payloads | non-canonical identities in builder workflows and unresolved producer origins (private readiness matrix) | unassigned |
| Resolve hosted acceptance checks (sign-off and linear history on historical commits) before any hosted publication | rewriting history is out of scope (private readiness matrix) | unassigned |
| Reports for P09, P13 and P16 are absent from the export; their requirements rest only on code candidates, the graph and the trade-off guide | missing sources | unassigned |
| Select upstream versions at activation: wlroots, Mesa, PipeWire/Carla/Yabridge, PGlite/pgvector, Steamworks bindings, truck/Manifold/Gmsh/OpenFOAM/CalculiX/Elmer/Z3, Firecracker, Wasm engine, mkosi, systemd floor, Zenoh | no active pins in sources; lookup against current upstream docs required | cordanaLLM/Aegis-OS |
| Rewrite the imported repart and sysupdate definitions to keys accepted by the admitted systemd | systemd 261 ignores two repart keys and rejects the transfer definition | cordanaLLM/Aegis-OS |
| Replace every hardcoded scaffold literal (fd 42, boot 112 ms, 15 W TDP, proof hash 0x42, fake Steam id) with measured values | needs M10, M11, M12, M20 or M21 evidence | cordanaLLM/Aegis-OS |
| Host specification for M11/M12/M20/M21 (KVM host, TPM2/swtpm, GPU vendor, NVMe, RAPL) | {{unresolved}} in sources | unassigned |
| Hosted ruleset/label readback and publication settings for origin (D11) | hosted acceptance checks recorded privately; no consumers yet | cordanaLLM/Aegis-OS |