0.13.0 --- openkal 0.13: whether a node may be started, and a start that is not a program (#27)

kal_fs_set_executable_at and the KAL_INFO_EXECUTABLE field of an enquiry.
This kernel stores the property as three bits; a class that may read the node
may start it, and clearing clears all three. The volume is asked through the
same classification kal_fs_props already makes, and a format that stores no
mode does not claim KAL_FS_PROP_EXECUTABLE.

ENOEXEC maps to kal_err_not_program. The report pipe already carried the
kernel's value to the caller; translate folded it into kal_err_io in its
default arm, so posix_spawn above this implementation returned EIO for a file
that is there and is not a program. tests/conformance_additions.cpp observes
the value and was run red with the mapping removed.

Comments carry no emoji.

Author: Sunrisepeak

.github/workflows/ci.yml

@@ -64,7 +64,7 @@ jobs:
       # that exists on one machine: a consumer resolving from the index is handed
       # a manifest pointing at a directory that exists nowhere.
       #
-      # ⚠️ THAT HAS HAPPENED IN THIS ECOSYSTEM, in openkal-musl, and the working
+      # THAT HAS HAPPENED IN THIS ECOSYSTEM, in openkal-musl, and the working
       # tree here has carried the same rewrite more than once since. This step
       # runs first, so what it examines is what the commit contains.
       - name: The committed manifest names no local directory
@@ -100,7 +100,7 @@ jobs:
       - name: Install mcpp
         run: |
           xlings update
-          # ⚠️ THE PIN MAY NAME THE RELEASE THIS RUN IS VALIDATING, which does
+          # THE PIN MAY NAME THE RELEASE THIS RUN IS VALIDATING, which does
           # not exist yet — that is the whole point of MCPP_SOURCE_REF. Bootstrap
           # from whatever the index has; the step below replaces it with the
           # build under review, and the pin is what an ordinary run tests.
@@ -111,13 +111,13 @@ jobs:
           fi
           mcpp --version
           mcpp self config --mirror GLOBAL
-          # ⭐⭐ CROSS-VALIDATION: BUILD THE mcpp UNDER REVIEW AND USE THAT ONE.
+          # CROSS-VALIDATION: BUILD THE mcpp UNDER REVIEW AND USE THAT ONE.
           #
           # Empty in the ordinary run, so this job keeps testing the RELEASED
           # mcpp the pin above names. Set it — `workflow_dispatch` input, or the
           # repository variable — and the same job runs against that source.
           #
-          # ⚠️ THIS EXISTS BECAUSE THE ORDER USED TO BE WRONG. Several mcpp
+          # THIS EXISTS BECAUSE THE ORDER USED TO BE WRONG. Several mcpp
           # releases went out green and only then turned this ecosystem red: the
           # engine's own CI cannot see a defect that appears only in a real
           # dependency graph, and this repository could not see the engine until
@@ -130,7 +130,7 @@ jobs:
             [ -d "$src" ] || git clone --quiet --depth 1 \
               --branch "$MCPP_SOURCE_REF" \
               https://github.com/mcpp-community/mcpp.git "$src"
-            # ⚠️ THE CLONE'S OWN WORKSPACE PIN MUST NOT DECIDE WHICH mcpp
+            # THE CLONE'S OWN WORKSPACE PIN MUST NOT DECIDE WHICH mcpp
             # BUILDS IT. `.xlings.json` at mcpp's root pins the mcpp that
             # compiles mcpp, and that pin does not move when mcpp is released —
             # so a build inside the checkout obeys it and tries to install a
@@ -143,7 +143,7 @@ jobs:
             # above, which is exactly what removing the file leaves.
             rm -f "$src/.xlings.json"
             ( cd "$src" && mcpp build --release )
-            # ⚠️ BOTH SPELLINGS, AND NO `-perm`. The matrix reaches Windows and
+            # BOTH SPELLINGS, AND NO `-perm`. The matrix reaches Windows and
             # macOS runners too: on Windows the artefact is `mcpp.exe`, and
             # `-perm -u+x` is not a question that filesystem answers the way this
             # expects. Measured: `Finished release [optimized] in 173.44s`
@@ -157,7 +157,7 @@ jobs:
                     \( -name mcpp -o -name mcpp.exe \) | head -1)
             [ -n "$built" ] || { echo "::error::mcpp did not build from $MCPP_SOURCE_REF"; exit 1; }
             echo "$(cd "$(dirname "$built")" && pwd)" >> "$GITHUB_PATH"
-            # ⚠️ Reported, because a PATH entry that does not win looks exactly
+            # Reported, because a PATH entry that does not win looks exactly
             # like one that does until something built with the wrong engine.
             echo "under review: $("$built" --version)  (from $MCPP_SOURCE_REF)"
           fi
@@ -178,7 +178,7 @@ jobs:
 
       - name: Every interface, every kind of examination
         run: |
-          # ⚠️⚠️ `optional` IS PART OF THE SET AND WAS NOT, WHICH MADE THE STEP'S
+          # `optional` IS PART OF THE SET AND WAS NOT, WHICH MADE THE STEP'S
           # OWN NAME UNTRUE.
           #
           # `full` expands to `standard,abi,stability,cost`, and `standard` is
@@ -229,7 +229,7 @@ jobs:
           # fails to compile and the diagnostic names it.
           list="$(grep -vE '^[[:space:]]*(#|$)' .spec/SURFACE.txt | sort -u)"
           {
-            # ⚠️ THE MODULE LIST IS DERIVED, NOT WRITTEN OUT.
+            # THE MODULE LIST IS DERIVED, NOT WRITTEN OUT.
             #
             # It used to be written out, and it fell out of step the first time
             # the specification gained an interface: SURFACE.txt listed four
@@ -272,7 +272,7 @@ jobs:
           # by construction.
           permitted='^(memcpy|memmove|memset|memcmp|__libc_start_main|main|_GLOBAL_OFFSET_TABLE_|kal_[a-z_]+|__init_array_start|__init_array_end|__preinit_array_start|__preinit_array_end|_ZN3okl.*)$'
 
-          # ⭐⭐ ONE NAME IS PERMITTED ONLY IF IT IS WEAK, AND THE WEAKNESS IS
+          # ONE NAME IS PERMITTED ONLY IF IT IS WEAK, AND THE WEAKNESS IS
           # THE WHOLE OF THE PERMISSION.
           #
           # `environ' is how src/env.cpp recovers the vectors the kernel placed

.gitignore

@@ -20,7 +20,7 @@ Thumbs.db
 
 # The specification tree tools/run-conformance.sh clones beside the sources.
 #
-# ⚠️ NO TRAILING SLASH. `.spec/' matches a directory and does not match a
+# NO TRAILING SLASH. `.spec/' matches a directory and does not match a
 # SYMBOLIC LINK to one, which is what a working checkout naturally has; the link
 # was consequently committed once, pointing at a path that exists on one
 # machine.

README.md

@@ -5,10 +5,10 @@ for Linux, written on the kernel's own system-call interface.
 
 ```toml
 [dependencies]
-openkal = "0.9.0"
+openkal = "0.13.0"
 
 [target.'cfg(os = "linux")'.dependencies]
-openkal-linux = "0.9.0"
+openkal-linux = "0.13.0"
 ```
 
 ## Why it does not use a C library

mcpp.toml

@@ -1,7 +1,7 @@
 [package]
 namespace   = "mcpplibs"
 name        = "openkal-linux"
-version     = "0.12.0"
+version     = "0.13.0"
 description = "The reference implementation of openkal for Linux, written on the kernel's own system-call interface so that it can be placed beneath a C library as well as above one."
 license     = "Apache-2.0"
 
@@ -18,7 +18,7 @@ authors     = ["mcpplibs"]
 repo        = "https://github.com/mcpplibs/openkal-linux"
 
 [dependencies]
-openkal = "0.12.0"
+openkal = "0.13.0"
 
 # The package contributes definitions and no modules. The interface it
 # implements is declared by the specification package, which this package

src/env.cpp

@@ -35,14 +35,14 @@ okl_ulong auxval(okl_ulong key) {
 
 namespace {
 
-// ⚠️⚠️ ONE C LIBRARY PASSES THESE AND ANOTHER DOES NOT, AND THE ONE THAT DOES
+// ONE C LIBRARY PASSES THESE AND ANOTHER DOES NOT, AND THE ONE THAT DOES
 // NOT IS THE ONE THIS PACKAGE EXISTS TO SIT BENEATH.
 //
 // glibc calls every `.init_array' entry with (argc, argv, envp). musl calls
 // them with NO ARGUMENTS. A function declared to take three therefore receives
 // whatever the argument registers happened to hold, and this one recorded it.
 //
-// ⭐ MEASURED 2026-08-29, WITH THE CONTROL THAT SEPARATES THE TWO EXPLANATIONS.
+// MEASURED 2026-08-29, WITH THE CONTROL THAT SEPARATES THE TWO EXPLANATIONS.
 // It was found by running the tests for aarch64, where the first enquiry after
 // the count faulted --- which reads as an architecture defect. It is not:
 //
@@ -65,7 +65,7 @@ bool plausible(int argc, char* const* argv, char* const* envp) {
     return true;
 }
 
-// ⚠️ WEAK, AND DATA RATHER THAN A CALL. The independence check in this package
+// WEAK, AND DATA RATHER THAN A CALL. The independence check in this package
 // forbids reaching for the C library's names, because a CALL into the runtime a
 // program supplied would resolve to the program's and could re-enter this
 // implementation without bound. A pointer cannot: it is read once, it executes
@@ -100,7 +100,7 @@ bool recover(char*** argv_out, int* argc_out, char*** envp_out) {
     return false;
 }
 
-// ⚠️⚠️ A PROGRAM ABOVE openkal SHALL NOT BE ENDED BY SOMETHING openkal NEVER
+// A PROGRAM ABOVE openkal SHALL NOT BE ENDED BY SOMETHING openkal NEVER
 // TOLD IT ABOUT, AND WITHOUT THIS LINE ONE WAS.
 //
 // openkal defines no signals. `kal_stream_write' is required to REPORT that the
@@ -110,7 +110,7 @@ bool recover(char*** argv_out, int* argc_out, char*** envp_out) {
 // it stopped, with a status no operation here produced and no wording anywhere in
 // the specification.
 //
-// ⭐ MEASURED THROUGH A CONSUMER, AND THE SHAPE IS WHY IT TOOK SO LONG TO SEE. A
+// MEASURED THROUGH A CONSUMER, AND THE SHAPE IS WHY IT TOOK SO LONG TO SEE. A
 // C library above this one answers `signal(SIGPIPE, SIG_IGN)' --- openkal has no
 // signals, so the library has nothing to set and truthfully reports success. The
 // program is then killed anyway, four layers below the call it made to prevent
@@ -121,7 +121,7 @@ bool recover(char*** argv_out, int* argc_out, char*** envp_out) {
 // fails with EPIPE, which `kal_stream_write' translates and reports, which is
 // what the interface said would happen all along.
 //
-// ⚠️ NOT A POLICY CHOICE ABOUT SIGNALS IN GENERAL. This is the one signal an
+// NOT A POLICY CHOICE ABOUT SIGNALS IN GENERAL. This is the one signal an
 // ordinary openkal operation provokes; the rest are left exactly as this program
 // was started with.
 [[gnu::constructor(101)]] void quiet_the_signal_openkal_cannot_report() {

src/exec.cpp

@@ -44,29 +44,29 @@ int kal_exec_publish(void* p, kal_uintptr size) {
                                 okl::prot_read | okl::prot_exec);
     if (okl::failed(r)) return okl::translate(r);
 
-    // ⚠️⚠️ THE INSTRUCTION CACHE IS NOT INVALIDATED HERE, AND ONE OF THE THREE
+    // THE INSTRUCTION CACHE IS NOT INVALIDATED HERE, AND ONE OF THE THREE
     // IMPLEMENTATIONS DOES INVALIDATE IT. THE ASYMMETRY HAS A RULE.
     //
     // A processor with separate caches for data and instructions has just had
     // bytes written through the data path that it is about to fetch through the
     // instruction path, and nothing in the protection call makes the second path
     // observe the first's writes.
     //
-    // ⭐ THE SPECIFICATION PLACES THE MAINTENANCE UPON THE PROGRAM, and the
+    // THE SPECIFICATION PLACES THE MAINTENANCE UPON THE PROGRAM, and the
     // conformance suite performs it itself and says why: the program is the
     // party that knows which bytes it wrote. So an implementation that performs
     // it is being helpful rather than conforming, and one that does not is not
     // deficient.
     //
-    // ⚠️ AND THE ONLY MEANS AVAILABLE HERE IS ONE THIS IMPLEMENTATION MAY NOT
+    // AND THE ONLY MEANS AVAILABLE HERE IS ONE THIS IMPLEMENTATION MAY NOT
     // USE. `__builtin___clear_cache' expands to nothing on x86_64 and becomes a
     // CALL into the compiler's support library on the other two architectures
     // --- `__riscv_flush_icache' on riscv64. This implementation is linked into
     // programs that carry no other runtime, so acquiring that dependency to
     // perform an operation the specification does not require of it is not a
     // trade worth making.
     //
-    // ⭐⭐ MEASURED, AND NOT ON THIS SYSTEM. openkal-macos added the builtin on
+    // MEASURED, AND NOT ON THIS SYSTEM. openkal-macos added the builtin on
     // the reading that aarch64 would expand it inline, and its own independence
     // check reported within the hour:
     //