fds-os/docs/developer/implementation-status.md

Implementation through M12

Development reference and historical context. For current operating instructions, use the user manual. Acceptance applies only to the source and artifacts identified in each record.

This is the software acceptance ledger for the 67 sections of the master plan. The user authorized implementation through M12 and deferred tests requiring the physical Raspberry Pi or attached hardware. The current release checkpoint is recorded in M12 validation.

M0–M12 software acceptance is complete. The signed local 0.1.0 release passed two fresh network-isolated builds with all 27 artifacts identical. Those artifacts also match the complete post-Clap VM acceptance. Signature verification and actual source/input archive round-trips passed; see final release evidence.

The final command-line migration uses shared, locked Clap for every Rust command-line interface, including the VM helpers. Its 48 Rust tests, actual ARM CLI checks and complete runtime acceptance are recorded in Clap validation. The dependency-free smoketest has no argument interface. Kernel command-line files and cartridge metadata use their own strict format parsers; they are not process argument parsers.

Workstation software and emulator extension

Current sources extend the frozen 0.1.0 checkpoint with native Linux fds-cartridge and fds-emulator tools. The software format uses metadata plus m payload partitions containing xz tarballs. Software builds and complete image creation run on the workstation; the guest verifies, extracts and runs selected commands as UID 1000. See usage, format, and current acceptance. Historical M0–M12 and Clap reports describe their recorded artifacts; they do not by themselves validate these new sources.

Requirement coverage

“Verified” below means software, artifact or isolated ARM VM evidence. It does not mean the assembled Pi has been tested. The detailed milestone reports retain the commands, artifacts, failures that led to fixes, and measured results.

Section	Implementation and evidence	Physical or later boundary
1. Project objective	Pi 5 images, all cartridge classes, native s6, Dasung base support and 12-device virtual stress; overview, stress evidence	Assembled FP-85, battery, display and all physical bays deferred
2. ABI strategy	Every profile uses aarch64 glibc packages; all eight production Rust programs are static ARM musl; rootfs and ELF audits pass	Actual Pi execution deferred
3. Limited musl scope	No target musl runtime package or second general-purpose package repository; glibc compiler/desktop acceptance passes	None in software scope
4. Native init	s6-linux-init hands PID 1 to s6-svscan; s6-rc database compiled during image construction; native init evidence	Pi startup timing deferred
5. Packages	Nine FDS base packages selected and audited; forbidden init/runtime packages rejected; packages	None in software scope
6. Build host	x86_64 Arch bootstrap, glibc cross-package and static Rust checks; build host	Other host distributions are not validated
7. Repository layout	Complete build/runtime components and public interfaces; location choices documented below	No placeholder component claims
8. Void upstream	Pinned commit, unchanged tracked upstream files, protected overlays, exact frozen package inputs; offline builds	Normal online bootstrap still uses rolling repositories
9. Rust workspace	All required tools and aliases built; release/static settings and shared dependencies; tooling	None in software scope
10. Dependencies	Locked synchronous dependencies, Clap policy and all 68 third-party crate notices; z/2/3 builds and repeated boot comparison	Physical optimization winner deferred
11. Boot architecture	Pi kernel → static stage0 → read-only SYSTEM → native s6 and ordinary-user console; boot evidence	Firmware, RP1 and physical NVMe/USB handoff deferred
12. Internal NVMe	BOOT/RECOVERY/INTERNAL GPT layout; root-private atomic settings and bounded diagnostic snapshots persist across VM reboot; internal storage	Actual NVMe and power-loss durability deferred
13. SYSTEM	Named GPT partition and EROFS, strict manifest/architecture checks, immutable update by replacement; media evidence	Physical cartridge write/boot deferred
14. Stage0	Direct Linux/sysfs/netlink discovery, mount and root handoff; mandatory early Dasung process; nine-case real-kernel VM matrix	Physical display keepalive/recovery deferred
15. Missing SYSTEM	Explicit wait state, event-driven insertion/resume and independent recovery verified	Physical insertion latency deferred
16. Multiple SYSTEMs	Ambiguity enters recovery instead of choosing enumeration order; explicit recovery verified	Interactive selector is a later-version option
17. Kernel	Pinned Pi kernel package, built-in critical driver delta verified after Kconfig resolution, modules/DTBs packaged	Actual RP1, PCIe, graphics and USB support deferred
18. Initramfs	Minimal static early userspace; raw/gzip/lz4/zstd construction, extraction and boot checks	Pi decompression/timing comparison deferred
19. Firmware	Production/development EEPROM previews, exact readback and rollback preparation; EEPROM	No EEPROM was read from or applied to a physical Pi
20. Filesystems	SYSTEM stays read-only; volatile logs, temporary directories and state; root ownership is explicitly root:root 0755	Physical persistence/durability deferred
21. User data	Persistent DATA at /data, temporary /home/fds, unprivileged sessions; DATA evidence	Home persistence is not claimed
22. Service graph	Native boot bundle includes console, devices, cartridge and mandatory Dasung services; optional bundles excluded	Hardware service behavior deferred
23. Fast boot	Console depends on runtime filesystem/hostname, not cartridge scan, DHCP or desktop; blocked-service VM tests pass	Pi timing targets deferred
24. eudev	Native supervision and trigger without settle barriers; console opens with eudev blocked	Physical hotplug races deferred
25. Cartridge daemon	Static event-driven daemon, private metadata probes, bounded IPC, mount lifecycle and restart behavior; cartridge evidence	Real device-controller behavior deferred
26. Bay topology	Controller/protocol/port identity, strict map validation, 12 virtual bays independent of block/bus enumeration	User must calibrate the physical wiring
27. Metadata	Strict bounded TOML, six class values, architecture and payload validation, unknown fields rejected	None in software scope
28. Hardware cartridges	Filesystem-free VID/PID/class catalog and input/Ethernet recognition; no catalog autorun	Catalog starts empty until physical devices are identified
29. ENVIRONMENT	Validated declarative activation of the trusted WindowMaker profile	GUI runtime on the cartridge itself is a later-version option
30. WindowMaker	SYSTEM includes Xorg, WindowMaker, packaged caches/fonts; authenticated X11 and transitions verified; desktop evidence	Real graphics/input path deferred
31. E-Ink	White/black/grayscale profile, Terminus and reduced decorations/animations; mandatory Dasung in base and early boot	Picture quality, refresh and power-cycle recovery deferred
32. PROGRAM	Metadata-first GPT software bundles plus legacy reading; xz verification, read-only runtime caches and UID 1000 consumers; see current evidence	Physical application cartridge behavior deferred
33. CLI	Complete typed Clap command hierarchy, aliases, nested JSON, help/errors and unchanged child-argument forwarding; usage	None in software scope
34. Media writer	Static create/inspect/burn/eject, insertion-bound confirmation, protected disks and full readback; actual virtual write then boot	Physical throughput, cache and power-loss behavior deferred
35. Installation model	Immutable SYSTEM images contain packages; replacement cartridge provides update/rollback	Physical swap/boot deferred
36. Profiles	CLI, development and independent recovery rootfs/images; profile-specific package audits and runtime checks	None in software scope
37. Build interface	Complete make all, packages, kernel, initramfs, rootfs, SYSTEM, boot and internal outputs; offline builds	No command silently flashes hardware
38. Cross compilation	Static Rust, glibc XBPS and Pi kernel cross-built on x86_64; generated target files inspected/executed under emulation	Native Pi build performance deferred
39. QEMU	Packaged ARM OS, real kernel, disposable USB/NVMe media and serial evidence across all runtime suites	QEMU does not emulate the Pi firmware/display/electrical system
40. Boot targets	Actual CLOCK_BOOTTIME reports and repeated comparisons; performance	No physical cold-boot target is claimed
41. Boottrace	T0–T6 event model, first-console event retention, reports and persisted diagnostic exports	Firmware timing and physical display events deferred
42. Regression rule	+100 ms investigation threshold, alternating before/after boots and z/2/3 comparison; Clap measurements	VM samples are not Pi performance claims
43. Boot blacklist	No systemd, runit, BusyBox, shell PID 1, boot-time cache compilation, settle or sleep-based readiness barriers	Dasung protocol pacing/backoff is not a console readiness barrier
44. Network	Ethernet recognition and on-demand native DHCP bundle; console remains usable without DHCP	Physical adapter/link testing deferred
45. Logging	Runtime logs stay volatile; explicit bounded diagnostics can be stored on internal media or exported; recovery	Physical storage durability deferred
46. Shutdown	Ordered desktop/jobs/network/DATA/services stop with native halt/reboot; busy and writeback-error paths remain powered on; power evidence	Real power removal deferred
47. Shutdown timing	Idle/workload/error-path VM measurements retained without artificial waits	Sub-second Pi/battery/flash targets deferred
48. Eject	Consumers stopped, DATA syncfs/unmount before SAFE, quarantine across failure/restart and insertion identity checks	Physical LEDs are optional later work; electrical/cache durability deferred
49. Recovery	Independent EROFS boots without usable SYSTEM, read-only DATA defaults, root-confirmed repair, media replacement and diagnostics; M12 evidence	Physical recovery/EEPROM path deferred
50. Security	No cartridge root autorun; unprivileged managed applications, strict metadata/IPC, protected media operations and tested failure paths	Distribution signatures do not implement secure boot
51. Initial UI	Direct ordinary-user FDS console without artificial delays, display manager, splash or automatic desktop	Physical presentation/input latency deferred
52. Development	Native GCC/C++, Rust/Cargo, Make/CMake/Meson/Ninja, Git, GDB, strace, Vim and display tools execute in the development image	Optional example tools such as LLVM are not mandatory; Pi throughput deferred
53. M0	Host validation, repeated after Clap	Optional host qemu-aarch64 smoke execution skipped; separate ARM execution suites pass
54. M1	Rootfs validation, all three current profile audits	Physical boot deferred
55. M2	Native s6 validation, repeated after Clap	Physical Dasung behavior deferred
56. M3	Tooling acceptance, complete Clap migration and static ARM tests	None in software scope
57. M4	Boot matrix, repeated after Clap	Physical Pi boot deferred
58. M5	Console/performance evidence, current repeated Clap comparison	Physical speed targets deferred
59. M6	Cartridge acceptance, repeated after Clap	Real bay calibration deferred
60. M7	DATA acceptance, repeated after Clap	Physical storage durability deferred
61. M8	Desktop/network acceptance, repeated after Clap	Physical display/input/link behavior deferred
62. M9	Media acceptance, repeated after Clap	Physical write/readback deferred
63. M10	Shutdown acceptance, repeated after Clap	Physical power/timing deferred
64. M11	Twelve-device stress and fault injection, repeated after Clap	Simultaneous physical devices and electrical tests deferred
65. M12	Final release evidence, signatures, input lock, independent offline builds, recovery, internal settings and guides	Hardware qualification and publication are separate actions
66. Implementation rules	Buildable milestones, justified dependencies, strict ABI/init policy, stable topology and measured regressions	No fabricated physical benchmarks
67. First task	Original M0 setup/negative checks completed and repeated; complete scope explicitly authorized afterward	Historical M0-only gate was superseded by the user's through-M12 request

Interface and policy decisions

Design sketch	Implemented interface
image/build-rootfs	tools/build-rootfs, exposed by make rootfs
tools/qemu-test	make init-test for native init and make boot-test for the Pi-kernel/stage0 matrix
tools/burn	Packaged static fds-burn and fds burn
profiles/cli.toml, development.toml, recovery.toml	profiles/*.list select packages; immutable profile marker selects recovery policy
profiles/windowmaker.toml	Built-in windowmaker runtime profile with a native s6 desktop bundle

DATA uses /data, one of the two alternatives permitted by section 21. /home/fds remains temporary, avoiding replacement of a live shell's home on insertion/eject. Internal boot reports and cartridge inventories are explicit diagnostic snapshots, not authoritative live state or automatic boot writes. An interactive multi-SYSTEM selector, moving GUI runtime onto ENVIRONMENT media, and optional eject LEDs remain later-version options in the specification.

Hardware work intentionally deferred

The next acceptance phase needs the assembled computer: EEPROM backup/application and rollback, NVMe-to-USB boot, RP1/PCIe/USB behavior, actual bay calibration and all twelve devices, display picture/refresh/cold-power recovery, removable battery and power behavior, physical storage durability, cold boot and shutdown timing. Use stress testing, Dasung, EEPROM, internal installation and performance to collect that evidence. No physical target disk was flashed, and no Pi EEPROM or monitor was changed by the software acceptance work.