Wi-Fi is a track: the accepted AX2xx design's stages with owners and exits, and the issues it owes

[Japabu]

Landing this records the accepted Wi-Fi design as main's track. It builds nothing, and it changes only issues/. The branch is c7505cf55 on origin/main 36aff86fc; a merge of origin/main ab655a115 (#861 included); 24b0fbc63, which answers the track's first review (comment 6129602265); a merge of origin/main 97f07c381 (#888 included); and f0c1e1c2b, which answers its second (comment 6130506978). The design round's empty commit is dropped.

• issues/there-is-no-wifi.md, the issue this pull request takes up, becomes the track:
  • the stages: S1, S2, the specification, P1 to P6 and P8 (P7, the key store, went with Q4), and W1 to W11, each with its owner, what it depends on and an exit something can read, pointing here for the design;
  • S1 done, both exits met: P1's Q2 condition and W5's S1 dependency are met, the NVMe joins P1's T14 exit, and what S1 does not separate (CFIS=0 alone) is recorded;
  • the owner's rulings, as §0 records them;
  • the two weaknesses those rulings leave: saved networks in plain text from W11, and a network's Transition Disable mark lost at reboot from W4 until W11.
• Six issues §8 owed, filed:
  • issues/pcidev-moves-a-bar-behind-a-bridge-out-of-the-range-the-bridge-forwards.md, P1's;
  • issues/netstack-drives-one-card.md, P5's;
  • issues/no-access-point-answers-to-the-harness.md, the orchestrator's, which also names W8's access points;
  • issues/acpiserver-serves-no-client.md, P8's;
  • issues/a-platform-with-no-transmit-power-table-joins-no-wifi-network.md, W6's;
  • issues/the-wifi-demos-commits-still-resolve-on-origin.md, the orchestrator's.
• The specification stays outside the tree, on ToyOSOrg/evidence pr-876, as accepted.
• Net lines: git diff --shortstat origin/main...f0c1e1c2b reads 7 files, +601 and −37, all under issues/; 0 production, 0 test. No production code changes, so no negative control or oracle is owed, and no guest test is reached.
• Unsure:
  • The track runs to 362 lines, where issues/README.md writes a track to a defect's length. That is because every stage carries its owner, what it depends on and its exit.
  • The two weaknesses sit in the track rather than in files of their own. Neither is true of the tree before W4 or W11 lands, and §4 and §5 have those pull requests file them.
  • Every W stage's owner is written as the orchestrator, who briefs its writer.
  • The demo's issue records what still holds. The demo's branches went from origin: E12 §1 at origin/main ab655a115 finds no ref there carrying the AMD bench's model name. What still holds is that its commits resolve through GitHub's commit API for origin. Over the 12 tips E10 prints, git rev-list <tips> --not --remotes=origin prints 52 commits; no ref on origin holds any of them, pull requests' refs included, origin has no fork, and all 52 resolve (E15). E10, E11 and E13 print hashes among them. The owner ruled to leave the commits on GitHub ("leave it"), so the exit, none of the 52 resolving, waits for GitHub's garbage collection. No branch on origin was touched by this pull request.

The design below was accepted by the orchestrator (comment 6125972534) with its seven named changes applied. Every path it cites exists at 24b0fbc63, the six issue files this branch adds included (E14). It is the design and its roast for ToyOS's Wi-Fi:

• one driver for Intel's AX2xx radios: the AX200 on the AMD bench, the AX210 on the T14;
• the 802.11 and WPA layers above it: WPA2 and WPA3, with protected management frames (PMF);
• netstack over several links;
• a clean room of two roles: a reader writes a specification from the references, and a writer writes the driver from it.

It takes up issues/there-is-no-wifi.md.

0. Rulings

The owner's, as the orchestrator recorded them. Everything else is this design's.

• R3: "reference code may only be used as clean room information. we want no notice for it. full speed from start." Read as: references are information, never copied, and nothing enters NOTICE for them; full speed is HT, VHT and HE rates and block-ack in the first version.
• R4: asked whether a machine with LAN and Wi-Fi gets one netstack interface chosen by the manifest or several, he chose several.
• Round 1 (comment 6120490125):
  1. "Saved networks: yes. Remembered networks and passphrases are held by the supplicant program alone, encrypted at rest, and never visible to netstack or the radio driver."
  2. "WPA3 and PMF are in the first version. The crypto crate (lib/crypto, still being written outside the tree) gains SAE over P-256 and AES-CMAC first." Its record adds: "That work goes to the crypto agent now."
  3. "The driver split is confirmed. Each card's driver is its own program, and netstack runs every link a driver brings, wired first, with failover. The LAN track's stage 3 (every card behind a link session) is a prerequisite, as the design reads it."
• Round 2 (comment 6121747502):
  • Q2: "reversing the MSI-X table-page refusal: yes, after the measurement. The page is handed over only where interrupt remapping verifies the source, and only once S1's T14 boots read compatibility format blocked. If they don't, that is filed as a kernel-wide defect."
  • Q3: "6 GHz: right after the first version, as W9, once a 6 GHz access point is at the bench."
  • Q4: "for now we dont have any key store concept for toyos. just keep it simple i dont care. plain text whatever until the key store concept exists." Recorded as saved networks in plain text, held by the supplicant alone, a present-state weakness the orchestrator owns until a ToyOS key store exists. It overrides ruling 1's "encrypted at rest".
• The clean room (comment 6125437246): "what is this annoying thing. one reads source writes a doc. the other reads from the doc not the source." Recorded as: a reader reads the references and the demo and writes the specification; a writer writes the driver from it and the public standards, and never reads the references or the demo, a sentence in the writer's brief and role. It replaces the strictness ruling (comment 6122123509) and, with it, ruling 4's audit and similarity check, and Q1's second clone is not made.
• The standing ruling, the owner's, as the orchestrator recorded it on x86-64 kernel leaves are global under a declared CR4.PGE, and only a kernel-half change drops them #873 (comment 6124769421) and A design follows what its hardware's manufacturers or the published state of the art back, and a bench verdict never blocks it #885 (comments 6125405603 and 6125787320):
  • "No: vendor practice wins": "if the manufacturers and published practice say do it, we do it. Bench numbers are reported and never block. A slowdown we see is investigated, not used to reject."
  • Such a design is left only "if intel and amd go away from it": "we listen to what the manufacturers and reports say".
  • "Review on merits", for a design no vendor document or published practice covers: "it is reviewed on correctness and simplicity like any code. A speed claim is measured and reported but does not decide by itself, unless the design's only purpose is speed." Speed decides only when it is the whole purpose.
  • "Yes, keep the 2x guard", the T14 suite's failure of a measured time more than twice its best recorded value: "a doubling is treated as a probable bug, not a design verdict. It fails, and is fixed or investigated before landing."

Applied here: VT-d and the PCI bridge windows decide P1, the AMD IOMMU specification P2 and P3, Intel's firmware interface the driver (§3, §7), IEEE 802.11 and the WPA3 specification §4, W1 and W2, ACPI P8. The program split, link, radio, wifi and the saved-network file are this design's, for review on their merits. Throughput is reported and never blocks; the link hop's cost is the merits clause's: measured and reported, and deciding nothing by itself.

lib/crypto's route (§6 P6) is the orchestrator's: this pull request holds no record of the owner's on it. This body's authors are readers in §7's sense (round 1's read the demo's driver and log), and none writes a line of the driver.

1. Where the tree and the demo stand

On main:

• netstack drives one card, the first of CARDS the supervisor endowed (system/netstack/src/main.rs), behind Card, an enum of in-process drivers (card.rs); the node is one interface and its DHCP client (system/netstack/node/src/lib.rs), and Shard::new adds one (system/netstack/shard/src/lib.rs). [ip] already routes over several: only up interfaces count, the default route takes the first up one with an active gateway, and "the lower index wins a routing tie" (system/netstack/ip/src/{lib,route}.rs).
• pcidev (kernel/src/pcidev/mod.rs, module doc) hands a BAR over as a 2 MiB window re-placed from the root-bridge windows, never maps the BAR holding the MSI-X table or PBA, arms MSI only without MSI-X, and refuses a function whose only BAR holds its table (NoMappableBar). No claim is handed over without interrupt remapping, which verifies the requester: VT-d with SVT=01b (kernel/src/arch/x86_64/vtd/interrupt.rs), the ITS by device id (kernel/src/arch/aarch64/irqchip.rs). VT-d leaves compatibility format blocked (CFIS clear), and S1 read it blocked on the T14, which runs with EIME set as well, so CFIS=0 alone is still unmeasured on silicon (§6; issues/qemu-passes-compatibility-format-interrupts.md, item 1). AMD-Vi isolates no device: every claim is refused NotRemapped (issues/an-amd-vi-machine-isolates-no-device.md, stages 5 and 6).
• toyos-transport (lib/blockring/transport), "the transport every client/server session runs over": entry queues, an arena of runs, a tag table, and byte streams with their wants, between ends that trust each other for nothing ("no reference to the peer's bytes is formed"). Blockring runs on it; netring: a session region replaces the pipes between netstack and its clients (design, and the track that stages it) #863, still open, would put netstack's clients on it.
• The LAN track's stage 3 (issues/the-lan-is-not-yet-production-grade.md): a driver process per network function, netstack the stack alone, drivers bound "from a declared match table by vendor, device and class"; it "lands before a second real NIC family is added", and "a stage lands whole". Wi-Fi is that family.
• The supervisor starts a row's program where its device is absent, saying "no … on this machine" (refused, system/supervisor/src/main.rs).
• Every program resolves paths against one machine-wide tree until the per-program views land (root CLAUDE.md, Capabilities); stage 2 of issues/every-program-sees-only-the-files-it-was-given.md has every row declare its files, with the exit that "nothing still sees the global tree".

The demo on the AMD bench (never landing; its log is evidence only) ran the AX200's firmware, found the test network by passive scan, completed a WPA2 association with keys installed, and got a lease, a DNS answer and a TCP connect. It was a non-HT, non-QoS station at the lowest basic rate, without block-ack or A-MSDU, every wait a spin, its commands able to block netstack's loop for up to 2 s. The platform it needed, read from configuration space: BAR 0, the only BAR, 16 KiB, with the MSI-X table at +0x2000, behind a bridge forwarding 1 MiB; pcidev moved the BAR onto eight 2 MiB windows outside it, the function answered at none and the claim was refused, so the demo kept the BAR in place, untranslated and unremapped, on MSI. What its runs fixed about access points, which W2 tests: an AP echoes the station's own group frames back. Two more rules W2 tests were measured by no run: that a unicast frame's key ID selects nothing (the runs sent unicast frames under key ID 0 alone), and that a message 1 resent under a higher replay counter keeps its ANonce. These, and what the runs fixed about the device, enter the specification as measured facts, each with its run (§7).

2. Programs and authority

program	holds	serves	receives	untrusted input it decodes
ax2xx (new), one per radio function	the radio's claim and IOMMU domain; the firmware, embedded; the temporal keys while installed	radio	link	every frame off the air; every word the device writes; every entry netstack writes into its link session
wlan (new)	the credential of the network being joined and the handshake state; each network's Transition Disable mark (§4); from W11, the saved networks	wifi	radio	EAPOL-Key and SAE frames from the AP; every radio message
netstack	the stack; one interface per link	netstack, link	—	every frame a link delivers
wifi (new): the network settings program; the desktop's later (W10)	the person's choice of network and the passphrase as typed	—	wifi	every wifi answer

• The settings program has a row of its own ([programs.wifi], receives = ["wifi"]), started by the login launchers' starts: a toybox row's endowments reach every applet (images/system.toml), so as an applet cat and ls would hold wifi. Its job exists only on ToyOS: exempt (build/userlandhost.rs).
• The driver is its own program: the LAN track places stage 3 before a second family and ruling 3 confirms it, and ax2xx parses whatever any transmitter in range sends, so apart it falls alone while netstack, its connections and other links stay and the supervisor restarts it (restart = true). Not for failover: an in-process driver's lost link fails over too.
• The supplicant is apart from the driver: the passphrase, the PMK and SAE's password element are the long-term secret, and a PSK network's PMK decrypts every station whose handshake it saw; ax2xx holds only temporal keys, which it hands the firmware anyway.
• Ports, each in a lib/ crate: link, served by netstack to each NIC driver so only a driver presents an interface, a protocol on toyos-transport as blockring is (P4), using its queues, arena, tag table and wants and adding no transport primitive; radio, served by ax2xx to wlan (commands, events, EAPOL and SAE frames), shared as lib/acpiserver-api is; wifi, served by wlan to network settings programs alone, so nothing holding netstack can scan, join or see a credential.
• Binding. pci:8086:2723 and pci:8086:2725 are rows of P4's match table: one ax2xx per present matching function, none elsewhere. ax2xx ships only once that table has landed (W5 depends on P4): without it the supervisor starts the row where the claim is refused "no … on this machine" (§1), and every QEMU image would run ax2xx under restart = true. That list is the feature set: the parts the benches test.

3. The driver, ax2xx

What every ToyOS program owes, applied to this one; how the driver divides its work is its writer's design round.

• What the device and netstack can write. Everything the device writes (frames, completions, notifications, error records) lands in ax2xx's own grants and is decoded through toyos_untrusted in its own memory; nothing of netstack's is lent to the device (no pcidev::dma_map on a link region). A received data frame becomes an Ethernet frame in ax2xx's memory and is copied once into the link arena; EAPOL and the management frames wlan acts on go to it over radio, and no management, control or EAPOL frame reaches netstack. On send the Ethernet header is copied out of the arena before anything is decided, and the 802.11 header and payload are built in ax2xx's own grant, all the device reads; netstack copies each received frame out before parsing it, as the transport asks. Until wlan installs keys the link is down and netstack's frames are refused; an EAPOL-ethertype frame from netstack is always refused and counted. Cost: two copies received, one sent, which S2 reports.
• Firmware. Each part runs its newest linux-firmware build at W3's pin (one file for the AX200, two for the AX210) unless a measurement overrules. Under the vendor-firmware rule: unmodified, pinned by version and sha256, with NOTICE and COMMITTED_FILES rows, in system/ax2xx/firmware/, loaded only into grants only the radio's domain maps, never run on the CPU. Embedded so the binary and the bytes W3's host test decodes cannot drift (not for secrecy: both are readable). The rule admits firmware "a device … verifies by its maker's signature": the specification establishes from a vendor statement that each part verifies each file, and one nothing shows verified waits for the owner; none is ever tested modified, the licence permitting use only "without modification". The licence also says "No reverse engineering, decompilation, or disassembly of this software is permitted", so anyone reads of a file only the container a loader parses (record kinds and lengths, section headers, declared versions and capabilities), never a section's contents.
• Event-driven. One loop waits on the claim's interrupt, the link and radio doorbells and its next deadline; a command's answer arrives as an event; a step with no notification is a bounded poll failing by name, its source cited; no pass is due while the link idles.
• Typed. Every command and notification is a fixed-size type asserted at compile time, one per version the firmware declares, and firmware declaring a command ax2xx sends at an untyped version is refused by name; the demo's two byte-offset layouts were the wrong size and the firmware asserted on each. Every device word decodes through toyos_untrusted: a malformed frame is counted and dropped; a device writing what none of the specification writes ends ax2xx by name. Every notification is counted by kind.
• Interrupts. MSI-X, one vector; P1 hands the table's page over with the BAR, and what the device keeps there is the specification's. One CPU carries the radio until netstack spans CPUs and a claim has more than one vector (one per slot today, kernel/src/arch/x86_64/idt/user_dev.rs).
• Firmware errors, restarts, RF-kill. On a firmware error ax2xx logs the device's error records decoded, resets, reloads, and reports the link down to netstack and the loss to wlan, which rejoins; restarts are bounded in a window, past which it ends by name, and one inside keeps its claim. RF-kill is a link-down with its reason; its return starts a scan.

4. The first version (W6): full rate, WPA2 and WPA3

From IEEE Std 802.11-2020 and 802.11ax-2021:

• An HT, VHT and HE station. The association request carries HT, VHT (5 GHz) and HE capabilities, extended capabilities and WMM; the width, up to 160 MHz, is the AP's operation elements'.
• QoS data on per-TID queues (best effort until netstack hands a priority); block-ack both ways: ADDBA answered, a reorder window per TID with its timeout, BAR and DELBA (the window's owner is the specification's), and a transmit session per TID once traffic flows, the firmware aggregating; A-MSDU inside A-MPDU received (the demo refused it).
• The firmware's rate control, configured with the peer's HT, VHT and HE MCS sets, streams, width, guard intervals, LDPC and STBC. No data frame forces a rate.
• Security (ruling 2): WPA2-Personal (PSK, CCMP-128 in the firmware); WPA3-Personal, SAE over P-256 by hash-to-element only (no hunting-and-pecking: zero legacy); PMF required under SAE, used under WPA2 where offered. A transition-mode AP is joined with SAE where it offers hash-to-element, else PSK; SAE without hash-to-element and no PSK is refused by name.
• Transition Disable (WPA3 Specification v3.5, §8) answers the downgrade Vanhoef and Ronen published in "Dragonblood" (IEEE S&P 2020, §4.1.1): a BSS offering a network's SSID with PSK alone draws the station's message 2 and attacks the passphrase offline.
  • W2 reads the Transition Disable KDE from message 3 of an SAE join, once its MIC verifies (§8.3.1, Table 5).
  • wlan marks the network when the KDE's WPA3-Personal bit (bit 0, Table 6) is set, and keeps the mark: for the boot until W11, and in the saved file from W11 (§5).
  • A marked network is joined only by SAE, with PMF, as §8.3.2 asks, and never by PSK: W4 refuses its PSK-only BSS and W2 refuses a PSK handshake for it, by name ("transition disabled: this network is WPA3-only").
  • The weakness, present-state, until W11: a reboot loses every mark, and until the boot's first SAE join of a network a PSK-only BSS of its SSID draws message 2. Owner: the orchestrator. Exit: W11 keeps the mark in the saved file. The pull request landing W4 files it.
• Transmit limits apply before the first frame sent.
  • Each channel's limit is the tighter of the platform's per-device power table (its ACPI namespace carries it under the radio's device, acpiserver serves it: P8) and the AP's country element.
  • The country element is untrusted input, decoded by W1. It only ever lowers a limit, never raises one, and a malformed one refuses the join by name.
  • A platform with no table transmits nothing. ax2xx joins no network there and says so ("no transmit limits for this platform"); W5's passive scan still runs. What such a platform could transmit at is open (§11), and it stays refused until the specification or a measurement answers that and the owner rules on it.
• A wrong credential is refused on evidence the station holds. Under SAE, the AP's Confirm does not verify under the station's key, the station's own computation. Under PSK no AP says so: it drops message 2 and resends message 1, so the refusal names what was observed, "the AP did not answer message 2", which a lossy link can also produce.

Not in the first version: 6 GHz (W9, directly after W6, once a 6 GHz access point is at the T14's bench: Q3); power save (W8: until then the radio stays awake and a laptop's battery pays); background scan, roaming and beacon-loss recovery beyond a rejoin (W8); saved networks (W11, after the per-program views: §5).

Speed is measured against Linux on the same machine, AP and position, and reported: evidence, never a row. The ceiling, HE-MCS 11, two streams, 160 MHz, 0.8 µs GI, is 2,401.96 Mb/s from the standard's rate tables, 200,163 packets of 1,500 bytes a second (E4): a standard's bound, not a measurement.

5. Saved networks (ruling 1, as Q4 overrides it)

• Plain text (Q4), until a ToyOS key store exists.
• wlan alone opens it: a file in wlan's own state that no other row names.
• That is true only once views land. Q4's "held by the supplicant program alone" and ruling 1's "never visible to netstack or the radio driver" are false of any file today (§1). So W11 depends on stage 2 of issues/every-program-sees-only-the-files-it-was-given.md, with wlan's row the only one whose view holds the file.
• Each network keeps its passphrase as typed, which is what Q4's "plain text whatever" asks for. It joins by SAE and by PSK alike, and still joins once the network's AP moves to WPA3, where a PMK joins only by PSK and SAE's password element only by SAE.
• Each network's Transition Disable mark is kept beside its passphrase (§4).
• The weakness, present-state: whoever reads the disk (another OS booted on the machine, the disk taken out, a program holding the disk's claim or serving the file) reads every saved network's passphrase, joins that network, under PSK decrypts every handshake it saw, and holds the passphrase wherever else it is used. Owner: the orchestrator. Exit: a ToyOS key store. The pull request landing W11 files it.

6. Measurements and platform prerequisites

S1, the T14 read-out and compatibility format: done, both exits met. A measurement-only scout, never landing, run by the orchestrator (Evidence, S1).

• The A/B read compatibility format blocked. Boot A left the MSI of the xHCI at 00:0d.0 in compatibility format with IRE set and CFIS clear: fault 0x25 (compatibility-format-interrupt-blocked, vtd/fault.rs) and no delivery. Boot B left it remapped: delivered, no fault. So Q2's condition is met, and P1 may hand the table's page over where remapping verifies the source.
• What it does not separate. The T14 runs with EIME set on every unit, and VT-d §5.1.4 blocks compatibility format where EIME is set or CFIS is clear; A read the block with both. So S1 does not show CFIS=0 alone blocking it, which exit 1 of issues/qemu-passes-compatibility-format-interrupts.md still asks, and on which a VT-d machine the kernel leaves without EIME rests.
• The read-out. The AX210 is 09:00.0 behind root port 00:1c.4: BAR 0 alone, 16 KiB, mem64, its MSI-X table at BAR 0 + 0x2000 and PBA at BAR 0 + 0x3000, so the table shares BAR 0 with the registers, and MSI with one vector. No DMAR unit's scope names it, so it is the INCLUDE_PCI_ALL unit's, and no reserved region names it. The ACPI read-out found the radio's device under its root port, with its names below it. The T14's NVMe keeps its MSI-X table at BAR 0 + 0x2000 as well, so P1's T14 exit drives it through that table.

S2, the link hop's cost on the T14, reported. A scout likewise: two processes over toyos-transport, one entry per 1,514-byte frame, batches of 1, 8 and 32, both directions, each side copying each frame once as ax2xx does; cycles per frame and frames a second on one CPU, beside the 200,163 each way that full rate needs (§4). By itself it decides nothing (§0, the merits clause): P4's design round reports it, and P4's build reruns it as evidence.

P1. A BAR stays where firmware put it, in 4 KiB pages, its table's page included. No issue exists yet. The relocation exists only because a window is 2 MiB, and on the AMD bench it moved the BAR out of the range its bridge forwards. At 4 KiB a BAR inside every window on its path to the root is mapped in place; one sharing a 4 KiB page with another function's moves within those windows, never out, or is refused by name. The table's page is mapped with the rest: remapping verifies each message's requester (§1), so a holder rewriting its table reaches only its own entries; compatibility format is blocked, as S1 read on the T14 (on AMD, once P2 and P3 read their analogue); and DMA aimed at the interrupt range already sends any message. This reverses a security boundary, and the owner accepted it (Q2): only where remapping verifies the source, and only once S1 reads compatibility format blocked, which it has. P1 rewrites the exit of issues/a-controller-whose-msix-table-is-in-bar-0-cannot-be-driven-from-userland.md from a refused write to the table's page to the NVMe driven through a table in BAR 0. It needs 4 KiB user leaves for device windows: stage 3 of issues/process-memory-is-2-mib-pages-and-that-caps-the-process-count.md, or the slice its holder accepts.

P2 and P3, AMD-Vi translation and interrupt remapping: the orchestrator's AMD track (issues/an-amd-vi-machine-isolates-no-device.md), whose exit is a QEMU boot. The AX200 needs three readings on the AMD bench: the stick's xHCI and the NVMe working in their domains under translation; the radio's claim handed over with its own remapping table; and, before the table's page is mapped there, a message naming no valid entry of the radio's own table refused into the event log. Without them the AMD bench has no Wi-Fi; the T14 does not wait.

P4. The LAN track's stage 3, whole. The link protocol on toyos-transport, in one region netstack makes: a hello with the link's kind (wired or wireless), MAC and MTU; RX and TX entry queues and an arena of frame runs; the link state in the region's header; doorbells on the connection, whose hang-up ends the link. Its round names the published design its queues follow. The I219/82574 and virtio drivers move out onto it and Card goes. The supervisor binds drivers from a declared match table by vendor, device and class, which gives one ax2xx per radio function and none elsewhere: W5 waits for it. Its exit is the track's: a driver killed and restarted with the stack's connections intact, and an unlisted but matching NIC up with no configuration change. It lands on a bench reading that it works and regresses nothing on the path it moves: the network suite under QEMU, and the I219 on the T14. No T14 row reads the wired card yet, since no image gives netstack the I219 until the outbound rows of issues/toyos-has-its-own-network-stack.md, so P4 waits for those rows. Whether a wired driver lends the arena to its device is P4's round; ax2xx lends nothing.

P5. netstack over several links (R4, ruling 3). No issue exists yet. One interface per link, each with its DHCP client, lease and mDNS responder, under one host name; [ip] ranks wired before wireless, then arrival, so a restarted driver changes nothing. New flows take the best-ranked up interface with a usable address, so they leave on Wi-Fi when wired goes and return with it; a flow bound to a downed interface's address stays bound (strong host model) and resumes if the link returns before TCP gives up; no connection moves between addresses. Resolvers are the best-ranked lease's. Its T14 row, both links leasing with the wired one the default route, is W6's, since it needs a radio; it also needs the image giving netstack the I219, the same outbound rows P4 waits for. P5 takes the NIC out of the virtio bullet of issues/first-match-selection-that-remains.md (kind: rejected), which ruling 3 reverses.

P6. lib/crypto. The route is the orchestrator's (§0): his pull request brings the crate in unchanged at the commit the crypto agent names as qualified. Its holder works outside the tree, in a clone with no remote; round 2 read it at 82ae7f9 on codex/crypto-quality (unopenable on GitHub until it lands), with derive_pmk, hmac_sha1, the 802.11 PRF and RFC 3394 unwrap under wpa2, and HMAC and HKDF under kdf. First, as ruling 2 says: (1) AES-CMAC-128 (RFC 4493); (2) SAE over P-256 by hash-to-element, against Annex J and RFC 9380. The public constant-time comparison and owned secret that wipes on drop, which wlan needs too, come with them (this design's). TLS and the rest of the crate's queue follow. wlan builds the 802.11 KDF and key hierarchy on those, with nonces and SAE scalars from SYS_RANDOM. No RustCrypto crate enters for Wi-Fi, and the qualified commit carries none of the crate's tools/*.py (reviewer.md, Arrivals).

P8. acpiserver serves a driver its own device's tables: it evaluates the methods under one PCI function's ACPI device for that function's driver alone, over a connection the supervisor opens for that binding; nothing names another device's scope. Before W6. Today acpiserver serves no client.

7. The clean room: two roles

• A reader reads the references and the demo and writes the specification. It lands no line of a W stage.
• A writer writes the W stages from the specification and the public standards, and never reads the references or the demo. That sentence is in every writer's brief, and the first W stage's pull request, briefed to, adds it to .claude/agents/implementer.md, the role a writer runs under.
• A W stage's reviews and design acceptance quote no reference. That sentence is in the orchestrator's brief for each W stage's review and design acceptance. A defect someone finds through a reference reaches the writer only as a reader's revision of the specification.
• The S and P stages are no part of the driver and need neither role.

The references: OpenBSD's iwx and 802.11 stack; Linux's iwlwifi firmware-API headers (the dual-licensed ones), mac80211 and cfg80211; hostapd and wpa_supplicant; the demo's branches and logs. The public standards: IEEE Std 802.11-2020 and 802.11ax-2021, the Wi-Fi Alliance's WPA3 specification, and the RFCs the stages cite.

The specification is a document of the device's own interface: its registers and their fields, the structures it reads and writes, its commands and notifications and their fields, its firmware containers' elements, and the steps it needs in order with their conditions and bounds. It also carries measured facts about the device's peers, each with its run, such as the three about access points that W2 tests (§1). Each fact has one sentence of meaning and its source: a reference by name, a firmware container, a measurement with its run, or a standard's clause. It holds no code or pseudo-code of a reference.

• Intel's own published firmware-interface headers decide what they state (the standing ruling): the specification takes such a fact from them and the bench checks that it works, and another reference disagreeing does not reopen it.
• A fact those headers leave unsaid is taken from the other references. One they disagree on or leave unsaid is open until a reader's scout measures it: a branch on the demo's line, kept local, never pushed to origin and never landed, run by the orchestrator, its result entering as a measured fact.
• The reader commits each revision to ToyOSOrg/evidence on pr-876. A writer's brief names the revision by commit, and its pull request links it there; its NOTICE names no reference, only the firmware.

8. Stages

Order:

1. S1, the orchestrator's T14 run: done, compatibility format read blocked.
2. In parallel: P1 (Q2's condition met by S1), P2 and P3, S2 then P4 (P4 once the outbound rows read the I219), P6 (AES-CMAC and SAE first), P8; the specification, W1, and W2 (after W1 and P6).
3. P5 (after P4), W3 (after the specification's first revision), W4 (after W1, W2).
4. W5 on the T14 (after P1, P4, W3, W4); 5. W6 on the T14; 6. W9, directly after W6, once a 6 GHz access point is at the T14's bench (Q3); 7. W7 on the AMD bench, once P2 and P3 have landed; 8. W8, W10, W11 (W11 once the views' stage 2 has landed).

Every metal row first needs issues/a-metal-row-names-no-hardware-and-a-bench-without-it-reds.md. Each stage is its own design round; a W stage's is its writer's.

stage	scope	host	metal	QEMU	oracle	depends on
S1, done	§6	—	T14, two boots	—	the T14; VT-d 4.0 §5.1.4	—
S2	§6, reported	—	T14	—	the T14	—
spec	each W stage's facts, the device's and its peers'	—	readers' scouts	—	Intel's headers; the references; the containers; the hardware	—
P1	§6	placement in every window on a path; the pages mapped	T14: claim_reuses_its_remapping_entry and claim_refused_without_remapping unchanged; the AX210 claimed with its BAR in place; the NVMe through its table at BAR 0 + 0x2000, where S1 found it	none new; the NVMe guests on QEMU's default layout	bridge windows; VT-d §5.1.4; the T14	4 KiB device windows; S1 reading compatibility format blocked (Q2), met
P2, P3	AMD-Vi	the track's	AMD bench: §6's three readings	Profile::MetalAmdVi	the AMD IOMMU specification; the bench	—
P4	§6	link: every Violation a hostile peer can cause; the match table's binding	T14: the I219 working, nothing regressed; S2 rerun, reported	the network suite unchanged; a driver killed and restarted under live connections	the suite; the T14	the T14's outbound rows (issues/toyos-has-its-own-network-stack.md)
P5	§6	rank, failover and return, resolvers, mDNS per link, a flow bound to a lost address	— (its row is W6's)	two virtio NICs: the first's link set off over QMP, traffic leaves on the second	RFC 1122's multihomed host	P4
P6	§6	the crypto agent's vectors and timing evidence	—	—	the crate's	its qualified commits
P8	§6	the binding's refusals	T14: the AX210's tables read	—	ACPI 6.5; the T14	—
W1 frames, a lib/ crate	management, control (BAR, BA) and data frames; SSID, rates, DS, TIM, country, RSN, RSNXE, HT, VHT, HE, extended capabilities, WMM; A-MSDU; 802.11↔Ethernet (RFC 1042, bridge-tunnel); the reorder window	every refusal and hostile length, a malformed country element included; seeded structured fuzz of a fixed count, as build/ssh/tests/fuzz.rs; a third-party capture corpus from outside the references beside its crate, with provenance, terms and NOTICE rows, pinned by hash	—	—	the standards; the corpus	—
W2 handshakes, in wlan	4-way and group-key, SAE by hash-to-element, PMF's keys; Transition Disable read from message 3 (§4); sans-IO	Annex J; RFC 6070, 3394, 4493, 9380; refusals: a replayed counter, a retransmitted message 3 that reinstalls nothing, a resent message 1 keeping its SNonce, message 3's RSNE or RSNXE differing from the beacon's (the RSNXE one is the downgrade from hash-to-element), group key ID 0, a MIC mismatch, an SAE Confirm that does not verify, an SAE Commit with an invalid scalar or element, a PSK handshake for a network marked by Transition Disable; a captured handshake	—	—	Annex J; the RFCs; the WPA3 specification §8; the capture	W1, P6
W3	firmware containers; commands and notifications typed per declared version; the parts served, any other refused by name; the firmware committed	the pinned files decode and every command sent is declared at a typed version; sizes asserted against the specification's; recorded bench traces, addresses scrubbed	—	—	the vendor's files; recorded answers	the specification's first revision
W4	wlan, radio, wifi, the settings program	BSS choice (joinable security, SAE before PSK, band, signal, a marked network's PSK-only BSS refused); the mark kept per network for the boot; connect, disconnect, status; §4's wrong-credential refusal; hostile radio answers	—	— (no radio)	IEEE 802.11; the WPA3 specification §8	W1, W2
W5 bring-up, passive scan	ships a radio that scans	against W3's types	T14: firmware up, its MAC address, the test network seen; its name arrives per run through a test job holding wifi, so no shipping path reads the ESP	—	the hardware	P1, P4 (its match table), S1 (met), W3, W4; the test networks, an access point at the T14's bench serving WPA2-Personal and WPA3-Personal by hash-to-element, with PMF and HE, an instrument the orchestrator owns
W6 full-rate join	§4; link up; firmware restart and rejoin	block-ack state; the restart's decisions; the limit as the tighter of table and country, a raising country element, a platform with no table refused	T14: WPA2 and WPA3; lease, DNS, TCP; HE (else VHT) at the AP's width; block-ack both ways; HT/VHT/HE rates as reported; limits before the first frame; a wrong credential refused with its evidence; ax2xx killed and rejoining; both links leasing, the default route wired (P5's); throughput against Linux, reported	—	the hardware; Linux, throughput only	W5 and its test networks, P4, P5, P6, P8
W7 the AX200	its start-up beyond the AX210's	the same	AMD bench: W5's and W6's rows, all but the I219's	—	the hardware	P2, P3, W6; W5's test networks in reach of the AMD bench
W8	power save, background scan, roaming, beacon loss, RF-kill	the decisions	both benches; power and latency, reported	—	the hardware	W6; W7 for the AMD bench; at each bench, an access point the harness silences and two of one network (issues/no-access-point-answers-to-the-harness.md)
W9	6 GHz on the AX210	discovery's rules	T14 with a 6 GHz AP	—	the hardware	W6; a 6 GHz access point at the T14's bench, an instrument the orchestrator owns (Q3)
W10	the desktop's Wi-Fi status and settings	the state machine	—	the compositor's surface; its round says why	—	W4
W11	saved networks, plain text: each a passphrase as typed and its Transition Disable mark (§5)	the file's format, a mark included, and refusals	T14: a saved network joined at boot	—	—	W6; stage 2 of issues/every-program-sees-only-the-files-it-was-given.md

Why each guest test is in QEMU:

• P1 adds none. The T14 row reaches a BAR in place under VT-d, host tests reach placement. P1 removes msix-exclusive-bar=on from tests/common/qemu.rs and build/qemu.rs, which accommodated the refusal it removes, so the NVMe guests drive QEMU's default controller, table in BAR 0, and hold what the AX210 row cannot until W5: a device driven through a table in a mapped BAR.
• P4: a driver killed and restarted under live connections is the kernel's and the supervisor's behaviour, which no host test runs. The T14 cannot hold it even once the outbound rows read the I219: its bench opens no peer that holds streams (issues/toyos-has-its-own-network-stack.md), and a test reaches no internet (.claude/agents/reviewer.md, Tests). Connections kept across a driver restart are held only in a guest.
• P5: link events reach the node through a driver and a session, which only a guest assembles, on virtio's link status, a VM's real link state and no test hook; on the T14 a link set off needs a hand on the cable (§9, item 9), and the row that both links lease is W6's.
• W10: its guest test is on the compositor's surface, and its round says why no cheaper tier holds it.

No other Wi-Fi stage has a guest test: QEMU has no radio.

Issues owed, filed by this pull request, each with an owner, evidence and an exit:

• the BAR moved out of its bridge's window: issues/pcidev-moves-a-bar-behind-a-bridge-out-of-the-range-the-bridge-forwards.md, P1's. Placement counts every bridge's forwarded range as taken (kernel/src/pcidev/mod.rs, the forwarded() loop feeding placement::free_runs), so a function on a secondary bus is offered only addresses its bridge does not forward. Both benches put their radio behind a bridge: main's kernel on the AMD bench (E13 §1) and S1 on the T14. It names issues/nothing-reds-when-the-bar-survey-drops-an-assigned-bar.md and issues/no-boot-reaches-the-retry-that-undoes-a-placement-nothing-answered.md, which rest on placement as it is, and P1 closes each or rewrites its exit.
• netstack driving one card: issues/netstack-drives-one-card.md, P5's. It names the rejected entry it reverses, issues/first-match-selection-that-remains.md.
• no AP the harness commands: issues/no-access-point-answers-to-the-harness.md, the orchestrator's instrument: deauthentication and a group rekey on demand, and W8's access point the harness silences and two of one network.
• acpiserver serving no client: issues/acpiserver-serves-no-client.md, P8's.
• a platform with no transmit table joining no network: issues/a-platform-with-no-transmit-power-table-joins-no-wifi-network.md, W6's.
• the demo's commits on origin: issues/the-wifi-demos-commits-still-resolve-on-origin.md, the orchestrator's. E10 counted 11 demo branches on origin at c0cdddf4e; E12 at ab655a115 counts none, and no ref carrying the AMD bench's model name. But the 52 commits git rev-list <E10's 12 tips> --not --remotes=origin prints still resolve through GitHub's commit API for origin, and no ref there holds any of them (E15); E10, E11 and E13 print hashes among them. Its exit is no ref carrying the name and none of those 52 resolving. The owner ruled to leave them on GitHub ("leave it"), so the exit waits for GitHub's garbage collection. The local branches are kept for readers' scouts, which stay off origin (§7).

The two weaknesses, saved networks in plain text (owner the orchestrator, exit a ToyOS key store) and a network's Transition Disable mark lasting only the boot (owner the orchestrator, exit W11 keeping it in the saved file), are recorded in the track. They are not true of the tree until W11 and W4 land, and the pull requests landing W11 and W4 file each as its own issue.

9. Roast

1. Every frame crosses one process more and is copied more (two copies received, one sent); the split is ruled, so no in-process fallback, and S2 reports what the hop costs.
2. Three new programs and three protocols where the demo had one, each buying a property: the stack outlives the driver; the long-term secret stays out of the program parsing the air; only a settings program holds wifi.
3. The table's page rests on silicon blocking compatibility format: P1 reverses a written boundary, accepted only once S1 read it blocked (Q2), which it did on the T14 with EIME set; CFIS=0 alone, what a VT-d machine without EIME rests on, is still unmeasured.
4. No host model of the device is an oracle: it would come from the driver's own specification, and these parts have no public datasheet [I]; the oracles are the containers, recorded traces and the hardware.
5. The clean room is the two roles and nothing more, as the owner ruled: nothing checks what a writer read or compares what it wrote with the references, so a structural copy or a copied name would land unseen; and a writer is a model trained on public code, which includes the references.
6. Saved networks are plain text (Q4) and wait for per-program views (W11); even then whoever reads the disk reads every saved passphrase and joins every saved network, a weakness until a ToyOS key store exists. Until W11 a network's Transition Disable mark lasts only the boot (§4).
7. Scope costs: WPA3 rests on a crate outside the tree (W2 and W6 wait for its import with AES-CMAC and SAE); hash-to-element only, so an AP offering SAE without it and no PSK is refused; the downgrade stays open on a network whose APs never send Transition Disable, which the WPA3 specification has an AP leave off by default (§8.2); the radio stays awake until W8; 6 GHz waits for W9 and an access point at the T14's bench (Q3); transmitting waits on acpiserver (P8), a new authority there, and a platform with no table transmits nothing.
8. Depth. A WPA3 lease at full rate on the T14 needs the specification, P1 (with the 4 KiB slice), P4 (after the outbound rows), P5, P6's import, P8 and W1 to W6, and waits on the crypto agent, the outbound rows and the T14. The AMD bench adds P2 and P3.
9. Six rows have no instrument: deauthentication, a group rekey on demand, beacon loss and roaming need access points the harness commands (whatever runs one answers to Arrivals); a firmware failure on demand needs a trigger the firmware may not offer (§11); failover on metal needs a hand on the cable, never a row.
10. A scan lists the neighbours' networks: logs carry counts only, fixtures fabricate every address, and the test network's name and passphrase arrive per run and are never logged.
11. One CPU and one vector carry the radio until netstack spans CPUs; S2 reports what one CPU carries through the hop.
12. An end of ax2xx costs a new claim, spending device addresses its slot never gets back (issues/a-claim-spends-device-addresses-its-slot-never-gets-back.md); a firmware error is handled inside and costs none.
13. The licence bounds what anyone may learn from the firmware: what the container does not give and no reference states is measured at the interface or stays open.

10. Questions for the owner, and 11. what this design is unsure of

No question is open.

Unsure: what the AX210 keeps in its MSI-X table's page, which S1 read at BAR 0 + 0x2000; whether the reorder window is the driver's or the firmware's; whether each part verifies each firmware file, and by which vendor statement; whether A-MSDU subframes arrive split or whole; what the firmware enforces where a platform has no table; whether it offers a failure trigger; whether one CPU carries HE160 2×2 through the hop (S2).

Evidence

Each measurement, with its command and exit, is on ToyOSOrg/evidence branch pr-876.

• The host suite at f0c1e1c2b: cargo run -- --ci host, exit 0 (76 steps, all green), ci-host-f0c1e1c2b.log. The change is issues/ alone, so no guest test is reached, and no image or metal row is affected.

• E10 e10-demo-branches-on-origin.log: E3's count over origin as it stood at c0cdddf4e. 13 branches held the demo's first commit and 11 touched a Wi-Fi-named path; none added a NOTICE line naming a reference.

• E11 e11-demo-notice-entries.log: each of the 11 adds one NOTICE entry, the AX200 firmware's, with the bench's model name masked.

• E12 e12-demo-on-origin.log, exit 0, at origin/main ab655a115: §1, no ref of 1,119 on origin carries the AMD bench's model name, and the two holding the demo's first commit (wt/toyos-survey and Survey image for an unknown laptop (measurement only, never lands) #834's head) touch no Wi-Fi-named path and carry no line with the name; §2, each of the 12 tips E10 prints past wt/toyos-survey resolves through gh api repos/ToyOSOrg/ToyOS/commits/<tip> (exit 0) and its answer carries the name; §3, the message of E10 line 52's tip says its netstack/src/wifi.rs was "written against OpenBSD's ISC-licensed if_iwx (22000 family)". Masked; no tip printed.

• E13 e13-amd-ax200-bar.log, exit 0: §1, main's kernel on the AMD bench (amdvi: the firmware-left actuator invalidates with one INVALIDATE_IOMMU_ALL, and its metal row judges AMD-Vi units #884's metal run at f2c537a51): the AX200 at 01:00.0 with BAR 0 at 0xd0600000, bridge 00:02.2 forwarding 0xd0600000..0xd0700000, and the free runs, none reaching into that range; §2, the demo's two commit messages recording its eight candidates from 0x450200000, every one outside that range, every moved BAR reading 0xffffffff. Masked.

• S1, the orchestrator's T14 run of wt/toyos-wifi-s1:

  • the A/B and the PCI and DMAR read-out at bd135c4db, s1/judge.log: "compatibility format blocked: fault 0x25 and no delivery in A, delivery in B" and PASS wifi_s1_compat_format at lines 44 and 45, every unit eime=y and cfis=n at lines 19 to 22, the NVMe's table at line 52 and the AX210's at line 59. Its read-out row failed only on the ACPI names, the scout's own defect;
  • the ACPI read-out, boot B re-run at a6934ff22, s1-r2/judge.log: PASS wifi_s1_readout, and the run's verdict "1 passed, 0 failed";
  • s1/wifi-s1-a-kernel.log, lines 111 to 116: the AX210 at 09:00.0, BAR 0 at 0xbc300000 and 16 KiB, behind root port 00:1c.4 forwarding 0xbc300000..0xbc400000. The pcidev issue cites it.

• E15 e15-demo-commits-on-origin.log, exit 0, at origin/main 97f07c381: §1, git rev-list <E10's 12 tips> --not --remotes=origin prints 52 commits; §2, of 1,132 refs on origin, 916 of them pull requests', none holds any of them; §3, origin has 0 forks; §4, all 52 resolve through gh api repos/ToyOSOrg/ToyOS/commits/<commit> (exit 0). No commit printed.

• E14 e14-cited-paths.log, exit 0: every path the body, the track and the six issues this branch adds cite exists at 24b0fbc63. The one path f0c1e1c2b adds, the track's kernel/src/arch/x86_64/vtd/mod.rs, exists there: git cat-file -e f0c1e1c2b:kernel/src/arch/x86_64/vtd/mod.rs, exit 0.

• No access point in the tree: git grep -i 'access point' ab655a115 -- tests build system lib kernel printed nothing and exited 1.

• E3 e3-demo-footprint.log: the demo's branches on origin, masked.

• E4 e4-ceiling.log: the HE ceiling, 1,960 subcarriers × 10 bits × 5/6 over 13.6 µs, 1,200.98 Mb/s a stream.

• E9 e9-cited-paths.log: every path design round 4's body cited exists at 867ec23ed, and of them only lib/blockring moved since 528b9a6c2 (toyos-transport: a byte stream between two ends that do not trust each other, and its wake handshake (netring stage 2) #878); netring: a session region replaces the pipes between netstack and its clients (design, and the track that stages it) #863 is open.

E1, E2 and E5 to E8 stay on the branch; nothing here rests on them. Every other fact is read from the tree at 867ec23ed, the demo's log and commit messages, and round 2's reading of the crypto agent's clone, each citing its site; Transition Disable from the WPA3 Specification v3.5 (Wi-Fi Alliance, 2025), and the downgrade from Vanhoef and Ronen, "Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd" (IEEE S&P 2020; IACR ePrint 2019/383), each at its section. Inferences are marked [I].

🤖 Generated with Claude Code

https://claude.ai/code/session_015xhaydXCVRNscoccHYFUWy

[Japabu]

Owner's rulings on this design's four questions, recorded by the orchestrator.

1. Saved networks: yes. Remembered networks and passphrases are held by the supplicant program alone, encrypted at rest, and never visible to netstack or the radio driver.
2. WPA3 and PMF are in the first version. The crypto crate (lib/crypto, still being written outside the tree) gains SAE over P-256 and AES-CMAC first. That work goes to the crypto agent now.
3. The driver split is confirmed. Each card's driver is its own program, and netstack runs every link a driver brings, wired first, with failover. The LAN track's stage 3 (every card behind a link session) is a prerequisite, as the design reads it.
4. The clean room as designed is enough: separate readers and writers, access audited per PR, and a similarity check of each diff against the references.

These join his earlier rulings: clean room with nothing in NOTICE for the references, full speed from the start, and several interfaces. A design review is running; the design is accepted once it passes.

[Japabu]

Design review of #876 at 8e3623e5b (one empty commit on 177e72a9e), against .claude/agents/reviewer.md and root CLAUDE.md as of origin/main.

Net lines: git diff --shortstat origin/main...8e3623e5b prints nothing. That is 0 production lines and 0 test lines. A design round on an empty commit owes no gate, and the body claims none.

BLOCKER

• #876 §5 P1, §8 item 3: The measurement cannot come first, and the contingency is a second path.
  • P1 measures compatibility-format blocking by having "a claim write a compatibility-format message into its own table entry". That needs the table page that P1 itself maps, so the measurement cannot come before P1.
  • §5's own argument makes this property load-bearing for every claim the T14 hands over today. A descriptor aimed at the interrupt address range already sends any message, with no table involved.
  • So roast 3's contingency (keep the page back, run the radio on MSI for good, change the kernel's MSI rule) is a second code path that protects nothing.
  • Change: measure it before P1's design, in S1's boot. A boot actuator leaves one kernel-armed source in compatibility format with CFIS clear. This is the A/B that issues/qemu-passes-compatibility-format-interrupts.md item 1 owes.
  • A red result is a kernel-wide isolation defect filed against every claim, not a radio fallback.
  • P2/P3's AMD bench rows take the AMD-Vi analogue before the table page is mapped there: a message from the radio that names no valid entry of its own remapping table is refused into the event log, not delivered.
• #876 §3.4, §3.5: netstack can write what iwl and wlan decode.
  • The one RX queue's buffers are posted from netstack's arena. The design says nowhere that command answers, notifications, and the management and EAPOL frames arrive anywhere else.
  • So a peer the transport "trusts for nothing" could forge firmware answers to iwl and handshake frames to wlan.
  • Converting a frame in place means deciding on a header that sits in the shared arena. toyos-transport's contract forbids that: "no reference to the peer's bytes is formed".
  • Change:
    • Everything iwl decodes for itself goes in buffers of its own grant. That can be a second RX queue for data frames (§3.4 already treats the queue count as a number) or one copy. Which queue the parts steer each kind of frame to is a fact for the specification, measured if open.
    • The header is copied out before any decision.
    • The device is lent only the arena's pages, not the session's queues and header.
• #876 §6 Enforcement: The denial misses most places the references sit, and an agent can lift it.
  • The denial names three things: the store, the reference hosts and the demo's refs. The writers' machine holds reference material in more places:
    • every reader session's transcript and tool output under ~/.claude/projects/, which hold reference text verbatim;
    • the orchestrator's job directory, whose plan cites reference function names and source lines;
    • the demo worktrees, still checked out;
    • the shared object store, where a deleted ref leaves every demo object readable by hash until the reflog expires and the store is pruned.
  • A host denylist cannot hold. GitHub, which writers need, serves mirrors of both references through gh api.
  • The Bash tool's unsandboxed escape is an agent granting itself access back, which §6 says cannot happen.
  • Change:
    • Make the denial an allowlist of what a writer may read, enforced at the OS sandbox with the escape disabled.
    • Prune the demo objects from the store.
    • Name every channel a writer reads, with its rule: the orchestrator's briefs, the review comments (a writer's PR is reviewed by an agent who is not a reader), and the similarity check's own output.
• #876 §6 The record, item 4: The similarity check is not an oracle.
  • It names no tool, normalisation, threshold or negative control.
  • "Long runs of matching code" between a C reference and Rust finds nothing by construction. A renamed transliteration carries exactly what the specification may legitimately carry (offsets, bits, step order). So the check cannot fail on the copying it exists to catch.
  • It is one agent's report, and root CLAUDE.md says "a second agent is not independence".
  • If its command or output is posted, it carries reference identifiers to the writer who reads the pull request.
  • Change:
    • Define it as a deterministic command over a reference set pinned by hash. It matches normalised identifiers, strings and comments against an allowlist of public vocabulary.
    • The record carries only counts and diff locations.
    • Before each use it must go red on a planted identifier and on a planted transliterated fragment, and the orchestrator can rerun it.
    • State in the design that access denial alone holds against structural copying.
    • Give the access audit the same negative control: a session that read the store turns it red.
• #876 §6 The reader, The specification: The firmware licence forbids what the design allows.
  • §3.2 ships the files under linux-firmware's LICENCE.iwlwifi_firmware, which says "No reverse engineering, decompilation, or disassembly of this software is permitted".
  • Yet reader and writer both "read the firmware files", and "read from the firmware file" is a fact kind with no bound.
  • Change: bound it to the container the loader must parse (section headers, declared versions and capabilities), never the contents of the sections.
• #876 §6, §3.1, §9 Q4: "No structure" cannot be checked, and nobody is named to write the scouts.
  • "No identifier, comment, structure or code of a reference" cannot be decided as written.
  • By its own account this body was written by a reader. It already brings the reference's decomposition and vocabulary into a document writers read: one transport and one op-mode, "context information", "image loader". issues/there-is-no-wifi.md already does the same.
  • The reader "writes no ToyOS code on a subject it read", yet it "runs bench measurements".
  • Change:
    • Define "structure" by a rule a check can apply, or rule this body not writer-readable.
    • Name who writes the scout for an open fact and whether it lands. The orchestrator runs it, because every metal bench is his alone.
• #876 §5 P4, §7 P4 row, §8 item 1: P4's go/no-go cannot be decided.
  • The decision rests on "T14: LAN rows unchanged" and "I219 throughput A/B". No image gives netstack pci:8086:15fc (issues/the-intel-nics-room-and-wake-are-unread-on-hardware.md), and no T14 row reads the wired card. The LAN track's throughput target has no ToyOS reading either.
  • So the branch roast 1 hangs on cannot be decided, and full speed through the added process hop is a guess (§10).
  • Change: first measure on the T14 what one toyos-transport hop costs per frame at 1500 B, against the frame rate the full-speed target needs. Decide P4's place on that measurement.
• #876 §2 table, §7 W4: The toybox applet hands the Wi-Fi port to every applet.
  • images/system.toml's toybox row says "The row's granularity is the binary, so every other applet is endowed both too".
  • So cat and ls would hold scan, join and the credential path, and "only the session's network settings receive it" is false of the manifest this design implies.
  • Change: give the settings tool a row of its own.
• #876 "Why each guest test is in QEMU", P1: A cheaper tier answers the guest test's reason.
  • The reason given is "only a guest has a bridge, a BAR and a remapping unit to put together". By §5's own words the T14's AX210 sits below a root port under VT-d, and the same stage's metal row hands that claim over. Root CLAUDE.md orders the T14 tier before QEMU.
  • Change:
    • Once S1 has read the radio, justify the q35 root-port guest on what the T14 row cannot reach, or drop it.
    • Say what moving the NVMe guests off msix-exclusive-bar=on holds that the AX210 row does not.
• #876 §5 P6, §7 P6 row: W2 depends on a crate with no route into the tree.
  • W2 depends on lib/crypto, addressed "for the crypto owner". lib/crypto is not on main. No open pull request carries it: User programs use AVX to AVX-512, saved by the best XSAVE form each CPU offers #859 and LAN stage D and B: netstack wakes only on a change, and the I219 takes a 1,000-descriptor ring at a fixed 131 µs throttle #861 change no crypto file. No issue names it. 82ae7f9 on codex/crypto-quality resolves in no repository on GitHub.
  • So the stage rests on an owner no record holds and on a citation nobody else can open.
  • Change: name the route by which it enters (a pull request, or an issue with its holder) before W2 is staged. Its tools/*.py cannot enter with it (Arrivals).

NOTE

• #876 R4 bullet, §9 Q3: R3 is quoted and R4 is not. "netstack runs every card it is given, routes by preference (wired first), and fails over" is the plan's paraphrase, and Q3 asks the owner to rule on those words. Quote him, or mark the rest as the orchestrator's. Either way Q3 gates P4's design round, and the order should say so.
• #876 §7 Order: Q4 gates W3 and every stage a reader feeds, but the order runs W3 at step 2 with Q4 unanswered.
• #876 §2, §7 W5 row: Two points on P4.
  • P4 rests on the LAN track's line ("lands before a second real NIC family") and on containing the parser of the air. It does not rest on failover: R4's case is a lost link, which an in-process driver fails over from too.
  • A scan needs iwl, wlan, radio and wifi, and nothing from P4 or P5. So P4 and P5 gate W6, not W5.
• #876 §7 P5 row: "both links lease, and the default route is wired" needs an image that gives netstack the I219. issues/toyos-has-its-own-network-stack.md owns that image, and the design does not list it as a dependency.
• #876 §5 P4: P4 takes half of the exit of stage 3 in issues/the-lan-is-not-yet-production-grade.md, which says "a stage lands whole". The binding of drivers from a declared match table is cut, yet "one iwl per radio function" needs it, because the supervisor endows all of a row's claims to one process. Take the stage whole, or have its holder accept the cut.
• #876 §3.2: The body says the firmware is "embedded in the iwl binary, so … no other program can read them". /system/bin/iwl is readable through the one machine-wide tree, and the files are public anyway. Give the true reason, or load only the present part's file.
• #876 §3.2: Preferring one API number for both parts trades the AX210's firmware fixes for a single layout set, and §3.6's per-version types already make two sets cheap. Pin each part's newest firmware unless a measurement says otherwise.
• #876 §7 W6 row, §8 item 10: Two rows lack an instrument or a criterion.
  • A firmware restart on demand needs an instrument that makes the firmware assert. That makes a fourth row with none.
  • "A wrong passphrase refused by name" needs to say what evidence the decision rests on, since no AP reports it.
• #876 §7 W5/W6 metal rows: The per-run credential should reach wlan through a test job that holds wifi in a test image, so that no shipping path reads the ESP.
• #876 §7 W1 row: The structured fuzz is seeded with a fixed count, as build/ssh/tests/fuzz.rs is. The capture corpus lives beside its crate, not under tests/corpus/, with NOTICE rows, and comes from outside the reference set.
• #876 §2: The design does not say what iwl does under restart = true on a machine with no radio, which is every QEMU image.
• #876 §4 "Not in the first version": W6 transmits without a country or the platform's SAR and geo tables until W8. The roast should name what the radio transmits at in the meantime, and put that to the owner or move it into W6.
• #876 §5 P1: A BAR kept in place must be checked against every bridge window on its path to the root, not only "its bridge's".
• #876 §5 P1: Rewriting the exit of issues/a-controller-whose-msix-table-is-in-bar-0-cannot-be-driven-from-userland.md from "a write to the table's page is refused" to its opposite reverses a security boundary. The acceptance should name that reversal.
• #876 §2, §5 P4: The design does not say where the radio and wifi protocols live. radio is shared by two programs, so it belongs in a lib/ crate. link should say what it shares with netring: a session region replaces the pipes between netstack and its clients (design, and the track that stages it) #863's netring, which runs on the same transport.

DESIGN NEEDS CHANGES: measure compatibility-format blocking (and the AMD-Vi analogue) before P1 and drop roast 3's MSI path; keep everything iwl and wlan decode out of netstack-writable memory; make the clean-room denial a sandbox-enforced allowlist covering transcripts, the job directory, worktrees and the object store, with every channel to a writer ruled; make the similarity check and access audit negative-controlled and rerunnable; bound firmware reading by its licence; define "structure" and who writes and runs scouts; measure the transport hop on the T14 before placing P4; give the Wi-Fi settings a row of their own; re-justify P1's guest test against the T14 row; name lib/crypto's route into the tree and its holder.

[Japabu]

The design review of 8e3623e5b (issuecomment-6121017029), finding by finding. The head is unchanged, still one empty commit: this round rewrites the body only. The measurements are in ToyOSOrg/evidence at pr-876 1e0625e, E1 to E4.

BLOCKER

1. Compatibility format is measured first, and the second path is gone. S1's boots carry the A/B: a boot actuator leaves one kernel-armed source in compatibility format with CFIS clear, against the same source remapped (§6 S1). A red result is a kernel-wide defect filed against every claim. The first round's roast 3 MSI path is deleted, and no path keeps a radio off MSI-X. P2 and P3 take the AMD-Vi analogue before the table's page is mapped there (§6, P2 and P3, item 3).
2. netstack can no longer write what ax2xx or wlan decode (§3.1).
   • Everything the device writes lands in ax2xx's own grants.
   • Data frames are copied once into the arena. EAPOL frames and management frames go to wlan over radio and never pass through netstack's memory.
   • On send, the header is copied out of the arena before any decision.
   • The device is lent nothing of netstack's: ax2xx never calls dma_map on a link region. That is stricter than "only the arena".
   • The cost (two copies per received frame, one per sent frame) is roast 1, and S2 measures it.
3. The denial is now a harness allow-list with the escape disabled (§7.5).
   • Bash: sandbox denyRead: / plus an allowRead list, allowUnsandboxedCommands: false, failIfUnavailable, and deniedDomains: *.
   • File tools: --restricted, blockReadsOutsideWorkingDirectories, and dontAsk with --permission-prompts none.
   • Its own CLAUDE_CONFIG_DIR, so no transcript and no job directory of a reader's is readable. No hooks, no MCP and no cross-session messages.
   • Every setting is read from Claude Code 2.1.296's own schema (E2). E2 also found that print mode silently ignores a settings file that fails validation, so the launcher pins writer.json and the binary by hash to the last run of the denial's negative control.
   • Pruning is refuted by design rather than done. Writers work in a second clone that holds only main and writers' branches (Q1). The primary's object store, the demo included, is therefore outside the room. C1's scan of the writers' object store is the measurement. The alternative fails at the first scout (Q1).
   • Every channel into a writer has its rule in §7.6: the launch line, the inbox (through the check's deliver), briefs, room reviews, the check's and the audit's output, the specification, the tree's history and the read-only roots.
4. The similarity check is defined as a command (§7.7).
   • It runs over a pinned set, with stated normalisation, hit classes, a threshold and output.
   • It runs two controls before every use: a planted identifier and a planted transliterated fragment.
   • Its output carries counts and locations only, so it can reach a writer, and it can be rerun.
   • §7.7 states that only the denial holds against structural copying.
   • The audit has its own planted-transcript control (§7.8).
5. Reading the firmware is bound by its licence to the container a loader parses, never a section's contents. Signature verification is never tested with a modified file (§3.2).
6. "Structure" is now defined.
   • §7.2 states three rules: the check, the specification's schema, and rule 3, which a room reviewer applies line by line.
   • This body is rewritten to those rules. The program is renamed ax2xx, the first round's driver decomposition and reference vocabulary are gone, and device facts move to the specification.
   • Scouts: a reader writes the scout for an open fact; it never lands, and the orchestrator runs it (§7.4). S1 and S2 are written by a neutral implementer.
7. P4's place now rests on a measurement. S2 measures one toyos-transport hop on the T14, with its copies, against 200,163 frames/s (E4), under a rule stated before the run. Ruling 3 fixes that P4 comes; S2 fixes what it must reach (§6 S2).
8. The settings program has a row of its own, [programs.wifi], and is exempt (§2).
9. P1's guest test. The q35 root-port guest is dropped. Removing the NVMe option is justified in "Why each guest test is in QEMU". S1 also reads where the T14's NVMe keeps its table.
10. lib/crypto's route, holder and queue are named, with the queue's timing (no date), and with the condition that the qualified commit carries no tools/*.py (§6 P6).

NOTE

• R4 and the rulings. R4 is quoted as the question and his choice; the rest is the orchestrator's record of ruling 3 (§0). Q3 of the first round is answered by ruling 3, and C1 now gates every stage a reader feeds (§8 Order).
• The split's reasons. §2 rests the split on the LAN track's line and on containing the air's parser, and says failover is not the reason. W5 no longer depends on P4 or P5.
• P5's T14 row depends on the I219's image (§6 P5).
• P4 takes the LAN track's stage 3 whole, the match table included (§6 P4).
• Embedding the firmware. §3.2 gives the true reason, and no longer claims embedding hides the files.
• Firmware pins. Each part runs its newest build (§3.2).
• The W6 rows. The fourth row with no instrument (a firmware failure on demand) is roast 14. The evidence a wrong-credential refusal rests on is in §4.
• The test credential arrives through a test job holding wifi in the test image (W5 and W6 rows).
• W1: the fuzz has a fixed seeded count, and the corpus sits beside its crate, from outside the reference set (W1 row).
• restart = true with no radio. P4's match table starts no ax2xx on a machine without a radio (§2, Binding).
• Transmit limits move into W6, through acpiserver (P8). W5 scans passively (§4).
• P1 checks every window on the BAR's path to the root, and names the reversal of a security boundary as Q2 for the owner.
• Where the protocols live, and what link shares with netring (§2, the ports).

[Japabu]

Owner's rulings on Q1–Q4, recorded by the orchestrator.

• Q1, a second clone for the clean-room writers: allowed. It is one extra clone, holding main and the writers' branches only, and it reuses the primary's Rust fork. It is the one named exception to root CLAUDE.md's single primary checkout, and the rule's text gets that exception when the clone is made.
• Q2, reversing the MSI-X table-page refusal: yes, after the measurement. The page is handed over only where interrupt remapping verifies the source, and only once S1's T14 boots read compatibility format blocked. If they don't, that is filed as a kernel-wide defect.
• Q3, 6 GHz: right after the first version, as W9, once a 6 GHz access point is at the bench.
• Q4, saved networks: "for now we dont have any key store concept for toyos. just keep it simple i dont care. plain text whatever until the key store concept exists." So P7 goes. Saved networks are stored in plain text, held by the supplicant program alone. That is recorded as a present-state weakness, with the orchestrator as owner, and its exit is a ToyOS key store, which is a concept of its own the owner will rule on later.

[Japabu]

Design review, round 2, of #876 at 8e3623e5b (one empty commit on 177e72a9e; the body as revised after round 1), against .claude/agents/reviewer.md and root CLAUDE.md at origin/main 528b9a6c2. The owner's Q1–Q4 rulings (issuecomment-6121747502) are applied. Evidence read: ToyOSOrg/evidence pr-876 at 1e0625e, E1 to E4.

Net lines: git diff --shortstat origin/main...8e3623e5b prints nothing, so 0 production and 0 test. A design round on an empty commit owes no gate, and the body claims none. Of the paths E1 checked, only .claude/agents/reviewer.md has moved since 131970ac8 (#879's two lines), and the body rests on nothing in it.

Round 1's BLOCKERs

1. Compatibility format measured first, no second path: CLOSED. §6 S1 runs the A/B in S1's own boots, before P1, and fault 0x25 is the one kernel/src/arch/x86_64/vtd/fault.rs:188 names. Roast 3's MSI path is deleted, and P2/P3 item 3 takes the AMD-Vi analogue. The Q2 ruling makes P1 conditional on S1's reading.
2. netstack-writable memory: CLOSED. §3.1: everything the device writes lands in ax2xx's own grants, the header is copied out before any decision, and no link region is dma_mapped.
3. The denial: OPEN. The allowlist is configured and the escape is off. Transcripts, the job directory, the demo worktrees and the primary's object store are all outside it. But the roots it allows are writable from outside the room, and the channel list leaves out what the harness loads and what a sandboxed shell reaches besides files (BLOCKERs 1–3).
4. Similarity check and audit: OPEN. The check is now a command with two red controls, counts-only output and a rerun, and §7.7 says only the denial holds against structural copying. But round 1 asked that the audit's control be "a session that read the store", and §7.8 gives a planted transcript (BLOCKER 5). The check also has no green arm (BLOCKER 4).
5. Firmware licence: CLOSED. §3.2 limits reading to the container a loader parses.
6. Structure and scouts: OPEN on the body. §7.2 defines structure and §7.4 names who writes and runs a scout; both are closed. Round 1's alternative was "or rule this body not writer-readable". §0 declares the body writer-readable after only rule 1 has run over it, yet the body states device facts outside any record (BLOCKER 7).
7. P4's go/no-go: CLOSED. S2 measures the hop, with its rule stated before the run.
8. The settings row: CLOSED. [programs.wifi] has a row of its own, exempt under build/userlandhost.rs's manages.
9. P1's guest test: CLOSED. The q35 guest is dropped, and the NVMe guests' change is justified against the T14 row.
10. lib/crypto's route: CLOSED. §6 P6 names the route, the holder and the queue.

Round 1's NOTEs are each answered where the author's mapping says, except restart = true on a machine with no radio. W5's new dependency list reopens that one (NOTE 1).

BLOCKER

1. #876 §7.5 allowRead/allowWrite, §7.6 last two rows — Every root a writer reads can be written from outside the room, and it is scanned once.
   • The cargo home and the host store are in allowWrite, yet §7.6 calls them "read-only roots". Every reader's build and the demo's write to them too: there is one store per host, and "whichever checkout or clone first needs a product makes it" (build/keystore.rs:5).
   • Any unsandboxed session can git fetch a demo ref into the writers' repository.
   • Anyone can drop a file into an inbox, and the audit finds it only after it was read.
   • main itself is a way in. The check exempts "the tree at the diff's base", but its inputs are only readers' and the orchestrator's pull requests. Any other pull request that lands (a neutral implementer's P1, P4, P5 or P8) carries its vocabulary into the writers' repository and past every later check.
   • Why it matters: the denial is the only defence against structural copying, so it cannot rest on one scan of mutable shared roots.
   • Change: either the room runs as an OS user of its own, whose roots no other session can write, or the launcher refuses to start a session unless:
     • the writers' repository holds only main and writers' refs, and no object unreachable from them;
     • every inbox file has a delivery record;
     • the check reads clean everything added to the cargo home and the host store since the last clean scan.
       In both cases the orchestrator runs the check over each range of main before he fetches it into the writers' repository.
2. #876 §7.5 "The policy is trusted only as measured" — The pin leaves out the one settings source that outranks writer.json. The launcher pins writer.json and the binary. Under --restricted, managed settings still apply and outrank --settings, and E2's own log shows two keys there that open the room without a word:
   • filesystem.allowManagedReadPathsOnly, "managed settings only" (E2 line 73);
   • sandbox.filesystem.disabled ("skip filesystem isolation entirely … Drops the read protection from filesystem.denyRead"). The key name is read from the same 2.1.296 binary at byte 81738040. Its description is the one E2 line 103 quotes as evidence for autoAllowBashIfSandboxed, and writer.json never sets it.
   • Change: the launcher also pins every managed-settings source the pinned binary reads, by hash or by absence, to the run of the denial's control, and writer.json sets sandbox.filesystem.disabled to false.
3. #876 §8 C1 row (oracle), §7.6 — The denial's control has one arm and three targets. "A session told to read a store file, a reader's transcript and a reference mirror's URL is refused all three" cannot tell a sandbox refusal from a model that declined, a wrong path or a dead network, and it reaches none of the other ways in.
   • Change: two arms. C1 runs one probe set twice: under writer.json, and under it with the denial removed. It is green only when the transcript shows every probe's tool call issued and refused by the sandbox or the permission layer in the first arm, and reading its target in the second.
   • The probe set covers:
     • each read path on its own: Bash, Read, Grep and Glob;
     • a symlink and a hard link made in the worktree to a store file, read through the file tools, which run outside the Bash sandbox;
     • the orchestrator's job directory, a demo worktree's file, a demo object by hash through the primary's .git, and another session's directories;
     • the mirror URL through every network client the toolchain carries, plus localhost and a Unix socket;
     • other processes' argument lists, the clipboard and the file-search index.
   • §7.6 adds the two channels the harness itself opens outside the sandbox:
     • CLAUDE.md files above the working directory and in --add-dir directories;
     • the launching shell's environment.
       The launcher starts from an explicit environment, and no CLAUDE.md sits above the room's directories.
4. #876 §7.7 — The check has controls that must turn it red, and none that must leave it green.
   • One hit is red. So every two-token identifier, three-word string or six-word comment run that ordinary C networking code shares with the reference set, and that neither the standards nor the base tree happens to hold, reds an honest diff. Nobody has measured how often that happens.
   • §7.7 does not say how an identifier "occurs" in the standards' prose, or what turns their PDFs into text: a crate the pull request justifies, or a host tool declared under Arrivals.
   • A check that reds on honest code is no more an oracle than one that greens on copied code. A writer shown only path:line renames until it goes green.
   • Change: C1's exit adds a green arm: the check reads zero over same-domain code written without the references (for example the commits that added netstack's drivers and its IP and TCP, each against its own base). §7.7 states the matching rule against prose and how the text is extracted.
5. #876 §7.8 — The audit's control tests the author's idea of a transcript, not the pinned binary's.
   • The control is a planted transcript. If 2.1.296 records a session differently, the audit greens on everything and its control still reds.
   • It reads file-tool paths but not the paths a Bash command names, though Bash has the widest allowlist.
   • "Any user message other than the launch line" is undefined against the transcript's tool results and the harness's injected context, which are user-role entries too.
   • It reads "every transcript", not every file the configuration directory holds.
   • Change:
     • the control is C1's open-arm session itself, recorded by the pinned binary (round 1's "a session that read the store");
     • the launcher's pin names the binary that control last ran red under;
     • the audit reads every file under the configuration directory and the paths in every Bash command, and defines a user message by the transcript's own entry kinds.
6. #876 §7.5 "Two repositories" — "Its rust/ is taken from the primary's fork repository without a second fetch, as every worktree's is" is false of the tree. The build does that only for a linked worktree of the primary. A second clone is a primary to the build (build/lib.rs:95 and build/toolchain.rs:29 give Owner::Us). So:
   • cargo run there initialises rust/ with git submodule update --init (build/main.rs:231, ensure_submodule in build/lib.rs), which is a whole second fetch of the fork;
   • it moves rust/ with git submodule sync/update on the nested modules (build/sysroot.rs:657, :664). In a git worktree of the primary's fork, that is the core.worktree rewrite root CLAUDE.md:85 forbids;
   • every one of those fetches is one the room denies.
   • The Q1 ruling says the clone "reuses the primary's Rust fork". "C1 shows the build accepts it" would find out by running that hazard on the shared machine.
   • Change: before C1 runs anything in the clone, §7.5 states how the clone holds and moves its fork with no git submodule and no network. That is either a build change, designed in C1's round, that makes a second clone a consumer of the primary's fork, or the step of issues/the-forks-pin-is-a-file-and-a-worktree-checks-no-fork-out.md it waits for.
7. #876 §0 "Who wrote this", §3.2, §3.4, §3.6, §4 — The body is declared writer-readable but breaks its own rule 2. §0 declares the body written to §7.2 and readable by writers once rule 1, the check, has run over it. But it states device facts outside any specification record, which rule 2 forbids:
   • how many firmware files each part takes (§3.2);
   • that the firmware declares a version for each command and asserts on a command of the wrong size (§3.4);
   • that the device keeps error records (§3.6);
   • that the firmware aggregates, runs rate control configured with a listed set of fields, and does CCMP (§4).
   • No row of §7.6 rules this body as a channel, and nobody applies rules 2 and 3 to it.
   • Change: rule the body not writer-readable, so that a brief carries scope only, as §7.6 already says. Or move each such sentence into a specification record with its source kind.

The owner's rulings, applied (named changes, not blockers)

• Q1. §7.5's "(Q1)", the C1 row's and §8 Order's Q1 dependency, roast 6 and §10 Q1 record the ruling. C1's scope gains the edit to root CLAUDE.md:85 that the ruling says comes "when the clone is made": the writers' clone is the one exception to the single primary checkout and to "never make one with git clone".
• Q2. These become the ruling: §6 P1's "Accepting this design does not accept that reversal: Q2 asks the owner", roast 3, §8 Order's "after S1 and Q2", the P1 row's Q2 dependency and §10 Q2. The ruling: the page is handed over only where remapping verifies the source, and only once S1's boots read compatibility format blocked. A red S1 is filed kernel-wide, and P1 waits.
• Q3. These become the ruling: §4's "(W9; Q3)", roast 11, §10 Q3 and the W9 row. §8 Order moves W9 to directly after W6, out of step 7's batch with W8, W10 and W11. Its dependency becomes "W6 and a 6 GHz AP at the T14's bench", an instrument with an owner, not "Q3".
• Q4.
  • §0 quotes the Q4 ruling beside ruling 1, which it overrides on "encrypted at rest".
  • §5 becomes a plain-text store that wlan alone opens, and keeps "the least that joins it" as this design's own.
  • These go: the key-store, TPM and firmware-variable bullets; "Until P7, wlan asks at each boot"; §6 P7 and the P7 row; P7 in §8 Order and in W11's dependencies; roast 7's TPM wait; the §2 table's "and their key"; §4's "after P7"; and the owed key-store issue.
  • The owed issues gain the weakness the ruling names: saved networks in plain text, the orchestrator as owner, exit a ToyOS key store. The pull request that lands W11 records it.
• Q4, what the ruling cannot deliver on its own. Q4's "held by the supplicant program alone" and ruling 1's "never visible to netstack or the radio driver" are both false of a plain-text file today. Every program resolves paths against one machine-wide tree (root CLAUDE.md:46) until issues/every-program-sees-only-the-files-it-was-given.md lands. Either W11 depends on that track's per-program views, or the body asks the owner to let W11 land before them, and that readability goes into the same weakness record.

NOTE

1. #876 §8 W5 row, §2 Binding — W5 ships ax2xx and no longer depends on P4, but only P4's match table keeps it off machines without a radio. Until then the supervisor starts a row's program even when its claim is refused as "no … on this machine" (system/supervisor/src/main.rs:2365, :2597). So every QEMU image runs ax2xx under restart = true. Make W5 depend on P4's binding, or say what ax2xx does with no claim.
2. #876 §4 "Transmit limits" — the AP's country element is untrusted input. Say that the limit is the tighter of the platform's table and the AP's country, and that a beacon never raises it. Until §11's question is answered, also say what a platform with no table transmits at: refused by name, or the owner's ruling.
3. #876 §8 W2 row — the refusals name an RSNE in message 3 that differs from the beacon's, but not an RSNXE. §4 allows hash-to-element only and lets the AP's advertisement choose in transition mode, so the RSNXE comparison is what stops a forged beacon from downgrading the join. It belongs in the row.
4. #876 §7.5 allowRead — "the cargo home" as a whole includes credentials.toml, a registry token wherever one was ever made. A writer can read it, and the orchestrator posts its outbox. Allow only the cargo home's registry/ and git/.
5. #876 §0 — the lib/crypto route sits under "The owner's rulings", "as relayed to this round", with no record on this pull request. Cite where he gave it, or mark it the orchestrator's.

DESIGN NEEDS CHANGES: make the room's roots unwritable from outside it or re-checked before every session, with main checked before every fetch into the writers' repository; pin every managed-settings source with writer.json and the binary; give the denial's control an open arm and a probe for every way in, the harness's own context and environment included; give the similarity check a green arm on honest same-domain code, and state its matching against prose; make the audit's control a real session of the pinned binary, and have the audit read Bash paths and the whole configuration directory; state how the writers' clone holds and moves its fork with no git submodule and no network; keep the body from writers or move its device facts into the specification; apply the Q1–Q4 rulings, with W11 waiting for per-program views or put to the owner.

[Japabu]

Owner's ruling on the clean room's strictness, recorded by the orchestrator. He was told that round 2's named changes to the clean room amount to a tooling project of their own before any Wi-Fi code. Those are the pinned harness and managed settings, the two-arm probes of every way in, real-session audits, re-scans of shared roots before each session, main checked before every fetch, and a build change so the writers' clone holds the fork offline. He was offered three choices: a separate macOS user account as the one boundary, full rigor as reviewed, or a lighter regime. He chose full rigor as reviewed. So the design takes every round-2 named change, and the Q1–Q4 rulings are applied as the review lists them.

[Japabu]

Round 2's design review (issuecomment-6122030223), finding by finding. The head is unchanged, 8e3623e5b, one empty commit: this round rewrites the body only. This round's measurements are on ToyOSOrg/evidence pr-876, E5 to E8 (commits 1c75712, 4b6239b, 97dbf95, 4002f71).

BLOCKER

1. Roots writable from outside the room; main a way in (§7.5). The owner chose full rigor over a separate user account (comment 6122123509), so the room is re-checked rather than walled.
   • Its own roots. The room's roots sit on a volume of its own under /Users/Shared, with its own home, host store (keystore::host is $HOME/.cache/toyos) and cargo home. Readers' builds never write those, and the orchestrator copies the compilers in by key, through the check.
   • The launcher refuses a session unless:
     • the writers' repository holds only main and writers' refs, with no unreachable object and no objects/info/alternates;
     • every inbox file has a delivery record;
     • the specification release and the standards match their hashes;
     • every root the session reads matches its last clean manifest, or the check reads clean what differs. That covers the room's own roots and the shared ones: the rustup home and the primary fork's object store.
   • After every session it scans again, and a red change discards the session's commits.
   • Every range of main is checked, diffs and messages, before the orchestrator fetches it into the writers' repository. That repository is shallow at its first commit of main, made after issues/there-is-no-wifi.md is rewritten.
   • "Read-only roots" is gone from §7.6.
2. Managed settings unpinned (§7.5, item 1).
   • The launcher pins the binary (by its versioned path), writer.json and every managed-settings source the pinned binary reads, by hash or by absence, to the last run of C1's two-arm control: the managed file and drop-in directory, the two managed-preference plists, and any other source C1 lists from the binary, a served settings document included.
   • E7 reads all four files absent on this host.
   • writer.json sets sandbox.filesystem.disabled to false, and the launcher never passes --managed-settings.
   • I did not re-read the binary for its source list this round: the harness refused a script that reads it. C1 lists the sources from the pinned binary, and §11 says so.
3. One-arm control (§7.9). The control now has two arms, both real sessions of the pinned binary: closed under writer.json, and open with the denial removed. It is green only when every probe's call was issued, refused in the closed arm and read in the open one.
   • The probes: Bash, Read, Grep and Glob alone; a symlink and a hard link to each target, read through the file tools; the job directory, a demo worktree, a demo object by hash and another session's directories; the mirror through every toolchain network client, localhost and a Unix socket; argument lists, the clipboard and the file-search index.
   • The rule: C1 does not exit while any probe stays open.
   • The new channels in §7.6: the instruction files the harness loads, and the launch environment. The environment is empty plus a listed set. The room's volume has no instruction file above it: E7 finds the home directory holds the readers' .claude/ with a CLAUDE.md, while /Users/Shared, /Users and / hold none.
4. No green arm, prose matching unstated (§7.7). This is the coordinator's question too, so the answer is stated plainly: round 2's one-hit rule cannot read zero on honest code.
   • Over commits that added ToyOS's own wired networking, it reads 6 of 6 tuning commits red (E5) and 7 of 8 held-out commits red (E6).
   • The proposed rule, rule E:
     • alphabetic tokens of two or more letters, numeric literals skipped;
     • identifiers of 4 or more tokens, strings of 4 or more words, comment runs of 6 words;
     • one more exemption: a pinned background corpus of same-domain code outside the reference set.
   • Rule E was fixed and pushed (E5) before it ran on anything else. It reads 0 of 6 tuning commits and 0 of 8 held-out commits, and still reads the demo's delta red: 20 hits in 2 files, both on Wi-Fi paths, against round 2's 204 hits in 18 files (E6).
   • What it costs: names of three tokens or fewer and three-word strings, which are left to the denial with structure.
   • The honest arm is now a per-use control beside the two red ones.
   • Prose: a candidate occurs in a standard where its tokens are contiguous inside one paragraph. PDFs are extracted by a Rust crate C1 names, and a standard whose text lacks its listed clause titles is refused.
   • A writer is told only green or red with a count, so it cannot rename until green. A red stops the stage for the orchestrator.
   • A Wi-Fi-domain green arm is C1's, with the standards in hand.
5. The audit's control is the author's idea of a transcript (§7.8).
   • The control is C1's open-arm session, recorded by the pinned binary, and the launcher's pin names the binary it last ran under.
   • The audit's grammar is the entry kinds that binary writes in both arms. A user message is a user-role entry carrying no tool result, and must equal the launch line. Tool results and harness context are content. A queued message reds.
   • The audit reads every file in the configuration directory, and the paths in every Bash command.
6. The second clone's rust/ (§1, §7.5). The body now states what the build does:
   • toolchain::owner answers Owner::Us in a second clone, and fork_checkout moves an off-pin rust/ there with submodule_update wherever the commit is missing.
   • C1 carries a build change, designed in its own round, before anything runs in the clone. A rust/ whose .git names another repository's fork is treated as a linked worktree's: never moved, never given git submodule, refused off its pin by name.
   • The orchestrator makes and moves that rust/ outside the room, as fork_checkout does for a linked worktree.
   • Its negative control is a host test on fixture repositories, so the hazard never runs on the shared machine.
   • The arm goes with toolchain::Owner under issues/the-forks-pin-is-a-file-and-a-worktree-checks-no-fork-out.md.
7. The body breaks its own rule 2. It is ruled not writer-readable (your first option).
   • §0 says so, and §7.6 lists this body, its reviews and its thread as reaching no writer.
   • A brief restates scope without a device fact.
   • What lands from this pull request lands under a body stating none, and is checked with main's range before the room fetches it.

The owner's rulings, applied as named

• Q1:
  • §0 quotes it, and roast 6, §8 Order and the C1 row no longer wait on it.
  • C1's scope gains root CLAUDE.md's exception for the clone (§7.5).
  • §10 records no open question.
• Q2: §6 S1 and P1, roast 3, §8 Order and the P1 row's dependency now read "once S1 reads compatibility format blocked". A red S1 is filed kernel-wide, and P1 waits.
• Q3:
  • §4, roast 8 and the W9 row now follow the ruling.
  • §8 Order puts W9 directly after W6.
  • W9's dependency is "W6; a 6 GHz access point at the T14's bench, an instrument the orchestrator owns".
• Q4:
  • §0 quotes it beside ruling 1, which it overrides on "encrypted at rest".
  • §5 is a plain-text store wlan alone opens, and "the least that joins it" is marked this design's own.
  • These are gone: the key-store, TPM and firmware-variable bullets; "asks at each boot"; §6 P7 and its row (P8 keeps its label); P7 from Order and from W11; roast 7's TPM wait; "and their key"; "after P7"; and the owed key-store issue.
  • The owed issues gain: saved networks in plain text, owner the orchestrator, exit a ToyOS key store, filed by the pull request that lands W11.
• Q4 and views:
  • W11 depends on stage 2 of issues/every-program-sees-only-the-files-it-was-given.md (§5, §8).
  • §5 records the plain-text weakness: whoever reads the disk joins every saved network.

NOTE

1. W5 depends on P4 (its match table), in §2 Binding, §6 P4 and the W5 row, so no image without a radio runs ax2xx.
2. Transmit limits (§4, W6 row):
   • each channel's limit is the tighter of the platform's table and the AP's country element;
   • the country element, untrusted, only lowers a limit, and a malformed one refuses the join;
   • a platform with no table transmits nothing and joins no network, refused by name, until the specification or a measurement answers and the owner rules;
   • that gap is an owed issue.
3. The W2 row refuses message 3's RSNXE differing from the beacon's: the downgrade from hash-to-element.
4. allowRead takes only the room's own cargo home's registry/ and git/. No credentials.toml exists there.
5. lib/crypto's route is marked the orchestrator's (§0, §6 P6), with no owner's record on this pull request.

Round 1's open items

Round 1's BLOCKERs 3, 4 and 6 are answered by round 2's BLOCKERs 1–3, 4–5 and 7 above, and its NOTE on restart = true by NOTE 1.

[Japabu]

Design review, round 3, of #876 at 8e3623e5b (one empty commit on 177e72a9e; the body as revised for round 3), against .claude/agents/reviewer.md and root CLAUDE.md at origin/main 867ec23ed. Applied: the owner's Q1–Q4 (issuecomment-6121747502), strictness (issuecomment-6122123509), and the standing ruling the orchestrator relayed in this review's brief. Evidence read: ToyOSOrg/evidence pr-876 at 4002f71, E2 and E5–E8.

Net lines: git diff --shortstat origin/main...8e3623e5b prints nothing, so 0 production and 0 test. Since E8's 528b9a6c2, of the cited paths only lib/blockring/transport moved (#878, +748 −32, byte streams and their wants), and nothing the body rests on is contradicted by it.

Round 2's BLOCKERs

1. Roots writable from outside; main a way in: OPEN, in part.
   • Closed: the room's own volume, launcher items 3–6, the rescan after the session that discards its commits, and the check over every range of main before fetch (§7.5).
   • Open: three reds have no consequence.
     • A red main range is fetched "only after examining its hits", with no rule for what admits a hit.
     • The clone's first commit and every root's first scan are a baseline whose "hits [are] listed", with no rule either.
     • An audit red (§7.8, "Output") goes to the orchestrator and nowhere else. The audit alone catches an inbox file dropped mid-session.
   • Content in the base is exempt from every later check and readable by every writer, so a hit admitted the first or second way is permanent, and one the audit reds costs nothing.
   • Change:
     • A red main range or baseline enters the room only when each hit is recorded as stated by a published source outside the reference set and joins the public-names list with its citation, as a writer's hit does. Otherwise the room is not fetched past it, and is re-made shallow at a main that no longer holds the text.
     • An audit red discards the session's commits and restarts the stage in a fresh session, as a check red does.
     • A session whose commits were discarded is never resumed.
2. Managed settings unpinned: CLOSED.
   • §7.5 item 1 pins the binary by its versioned path, writer.json and every managed source the binary reads, by hash or absence, to C1's last two-arm run, and a source off its pin refuses the session.
   • writer.json sets sandbox.filesystem.disabled to false, and the launcher never passes --managed-settings.
   • E7 reads the four named files absent.
   • Whether the list is complete is weighed in NOTE 1.
3. One-arm control: CLOSED as named. §7.9 has two arms, round 2's probe list and the rule that C1 does not exit while a way stays open. §7.6 adds instruction files and the launch environment, and E7 finds no instruction file above /Users/Shared. The open arm cannot be configured as written (NOTE 2), and one class of ways in is missing (BLOCKER C).
4. No green arm; prose matching unstated: CLOSED as named. Rule E reads 0 of 6 (E5) and 0 of 8 (E6) and is a per-use control, and §7.7 states prose matching and extraction. What rule E's evidence does not show is BLOCKER A.
5. The audit's control: CLOSED. The control is C1's open-arm session under the pinned binary, the grammar is that binary's, and the audit reads Bash paths and every file in the configuration directory. What its red leads to is item 1.
6. The second clone's rust/: CLOSED.
   • §1 matches the tree: toolchain::owner (build/toolchain.rs:29), primary_checkout (build/lib.rs:95), ensure_submodule (build/lib.rs:145) and fork_checkout's submodule_update.
   • The build change refuses an unowned fork checkout by name.
   • Its host test on fixtures reds with the change reverted.
7. The body breaks its own rule 2: CLOSED. §0 and §7.6 rule this body, its reviews and its thread out of every writer channel, and what lands lands under a body stating no device fact.

The Q1–Q4 rulings are applied as round 2 named them. Round 2's NOTEs 1–5 are each answered: §2 Binding and the W5 row, §4's limits, the W2 row's RSNXE, allowRead's registry/ and git/, and §0's marking of the crypto route.

BLOCKER

A. #876 §7.7 "Its measurement, and its cost"; E5, E6 — Rule E's red arm, its cost and its held-out arm rest on less than the body says.

• Red arm. E6 reads the demo red with neither the standards nor the public-names exemption applied.
  • The body sets both aside because they "only lower a count". Lowering a count can only turn a red green, so that argument holds for the green arms, not the red one.
  • C1's oracle never reruns the demo with them read, and the per-use red controls are planted.
  • So the room could start with a check that reads the only real carry-over on record green, and nothing would red.
• Cost. "The other 184 are the kind E5 lists on honest code" has no measurement behind it.
  • E6 prints counts only.
  • Round 2's 204 hits fall in 18 files, which include the 2 Wi-Fi files rule E reds.
  • How many of the 184 lie in those files, carry-over that rule E has stopped seeing, is never read. One counts-only run of the existing tool tells it.
• Held-out set. The record does not show it was fixed before the run.
  • E5 fixes rule E's flags, but held-commits.txt first appears in E6, and no run carries a time.
  • E6 was pushed 101 s after E5 (pr-876 push activity: 12:49:51, then 12:51:32).
  • Each held-out run re-reads its commit's base tree once per commit: 2,054 files, 17,358,539 bytes at 6df4a4100^ (git ls-tree -r -l), plus the background.
  • All 14 commits are chosen by hand from main's wired-networking history.
• Change:
  • C1's exit reruns the demo's red arm under rule E as specified, with the pinned standards and the public-names list read. §7.7 says that a green there means the check has no red arm on real carry-over, and it goes back to design before any writer stage.
  • Split round 2's 204 hits, counts only, by file (the 2 Wi-Fi files rule E reds, the third Wi-Fi file, the 15 others) and by class and token count. State §7.7's cost and roast 5 from that split.
  • Rerun the held-out arm over every commit selected by a query committed to pr-876 before the run, for example every non-merge commit on main that adds Rust under the wired-networking crates' paths.

B. #876 §6 S2, P4 row, roasts 1 and 12 — S2's rule gates P4 on a gain.

• "At most a quarter of one CPU at that rate both ways … more, and P4's round carries the transport work … landing only on a rerun under" holds P4's landing to a throughput bound.
• The owner's standing ruling, as relayed in this review's brief: "designs follow the hardware manufacturers' documentation and the published state of the art, and a bench measurement checks that a design works and regresses nothing; a gain is reported, never gated."
• The P4 row already calls S2's rerun "evidence", so the body contradicts itself.
• Change:
  • S2 and its rerun are reported and gate nothing.
  • P4's round names the published design its queues follow.
  • P4 lands on a bench reading that it works and regresses nothing on the path it moves. Where no metal row reads the wired card yet (round 1: no image gives netstack the I219), the body says so and says what that reading waits for.
  • §0 records the ruling.

C. #876 §7.9 Probes — No probe has a process outside the sandbox read for the writer.

• Every listed probe is a read the sandboxed shell or a file tool makes itself, or a service read (clipboard, file-search index).
• A sandboxed command can also ask an unsandboxed process to copy a store file into the outbox or the worktree:
  • launchd (launchctl submit or bootstrap);
  • Apple Events (osascript to Finder, Terminal or System Events);
  • LaunchServices (open).
• denyRead and blockReadsOutsideWorkingDirectories do not govern these; only the sandbox profile's IPC rules do. §7.9's rule closes only the ways that are probed, and the denial is the only defence against structural copying.
• Change: add this class to the probe set, each probe issued in both arms with a store file as its target.

D. #876 §7.5 "The launcher", C1 row (host column) — The launcher as staged cannot land under Arrivals.

• C1 host-tests "the launcher's … refusals and controls", which puts the launcher in the tree.
• The launcher is what starts the pinned claude binary. A tree crate spawning it is a host tool not built from C or C++ source ToyOS can one day build and run (reviewer.md, Arrivals; root CLAUDE.md, Dependencies).
• No tree code does this today: git grep -E 'Command::new\("claude"' on origin/main finds nothing.
• Change: say where the launcher lives. Either the tree's part checks items 1–6 and prints the record, and the orchestrator's own tooling outside the tree spawns the harness, pinned by hash in the room's evidence; or the body puts an exception to the owner. The check and the audit only read files, so they can stay host crates of the tree.

NOTE

1. #876 §7.5 item 1 — Weighed: leaving the binary's source list to C1 is acceptable only if C1's row makes that reading an exit, with its owner and method.
   • Why it is acceptable: the mechanism is right, and it fails closed for every source on the list.
   • Why the condition is needed: a source missing from the list is never checked, and §7.9's open arm only exercises sources that are present during C1.
   • A fifth file source. A read of the pinned 2.1.296 binary for this review found one. The binary's shasum is E2's c9b53416…, and grep -a -o -F managed-mcp.json counts 30 occurrences.
     • The source is managed-mcp.json, joined to the same managed directory (/Library/Application Support/ClaudeCode on macOS).
     • The binary says it "is present and has exclusive control over MCP servers; ignoring … supplied via --mcp-config".
     • It is absent here, since that directory is absent.
   • Other sources the binary reads:
     • the CLAUDE_CODE_MANAGED_SETTINGS_PATH and CLAUDE_CODE_REMOTE_SETTINGS_PATH overrides, which the empty environment excludes;
     • server-managed settings, which it says "apply regardless", and for which §7.5 gives the launcher no reader.
   • Change:
     • C1's row has the orchestrator read the source list from the binary as an exit, since the harness refused an agent's script.
     • The served document gets a reader, or C1 shows the room's account receives none.
     • managed-mcp.json joins the pin list now.
2. #876 §7.9 — The open arm cannot read through the file tools as written.
   • It is launched "as §7.5 launches a writer", so --restricted still "confines the file tools to the working directories" (E2, --help), and dontAsk denies what is not pre-approved.
   • So the file-tool probes cannot read in the open arm, and C1 cannot go green.
   • Change: the open arm adds each target's directory with --add-dir, so that the arms differ only by the denial.
3. #876 §7.5 item 6 (prose) — "every one the build reads is unwritable on this host (E7)" claims more than E7 shows. E7 tests nine named paths, not the set the build reads, and that set is C1's to list.
4. #876 §8 C1 row — C1's exit is circular.
   • The exit needs runs in the clone: §7.9's arms, three gates green and a commit inside.
   • The clone holds main only, and needs C1's build change on main "before anything runs in the clone".
   • Change: split C1 in two. One stage lands the build change, the tools and the issue rewrite. The other makes the clone, edits root CLAUDE.md (Q1) and runs the controls.
5. #876 §7.7 background; C1 row "a Wi-Fi green arm" — Two things are unstated.
   • The Wi-Fi green arm's corpus is unnamed, and so is how its independence from the references is shown.
   • "Same-domain code outside the reference set" would admit code that shares ancestry with a reference or is written against its API, such as FreeBSD's or NetBSD's net80211, or Linux drivers on mac80211. Such code launders the references through the exemption.
   • Change: state the corpus, and an admission rule that excludes such code.
6. #876 §7.7; E5 REF_PARTS — The arms read only the reference slice's .c and .h files. The real check's reference-file set must be the one measured, or both arms rerun.
7. #876 §7.7 Controls — The planted identifier can be drawn from an exempt name. It is drawn from names "found in neither base nor background", which still admits a name a pinned standard or the public-names list exempts. Exclude both from the draw.
8. #876 §7.3 (standing ruling) — The manufacturer's own interface should decide a fact it states. Where Intel's own published firmware-API headers state a fact (iwlwifi's BSD-dual-licensed headers, already in the readers' set), the specification records it from them, and the bench checks it works. A disagreement with another reference does not make it an open record that waits for a scout.
9. #876 §6 P6 — The crypto queue departs from ruling 2. P6 queues AES-CMAC and SAE "after TLS and with no date". Ruling 2 says the crate gains them "first", and its record adds "That work goes to the crypto agent now". Follow it, or put the order to the owner.
10. #876 §1 (prose) — under "On main", "netring: a session region replaces the pipes between netstack and its clients (design, and the track that stages it) #863 puts netstack's clients on it" describes a pull request that is still open. main has moved from E8's 528b9a6c2 to 867ec23ed.

DESIGN NEEDS CHANGES: give every red a consequence (a red main range or baseline enters only with each hit recorded as public; an audit red discards the session's commits, and a discarded session is never resumed); make the demo's red arm under rule E, with the standards and public names read, an exit of C1, measure what rule E gives up from round 2's hits by file, and rerun the held-out arm over a query fixed before the run; make S2 and its rerun reported and not a gate on P4, under the standing ruling; probe delegation to unsandboxed processes (launchd, Apple Events, LaunchServices) in both arms; place the launcher where Arrivals admits it; and the non-prose NOTEs.

[Japabu]

Owner's ruling on the clean room, recorded by the orchestrator; it replaces "full rigor as reviewed". He was shown that round 3 found more ways in again: a writer asking macOS itself (Finder, launchd, open) to read for it, a launcher that would bring the claude binary into the build, and no rule for what a scan's red admits. He was told there is still no Wi-Fi code. He ruled:

"what is this annoying thing. one reads source writes a doc. the other reads from the doc not the source."

So the clean room is the two roles and nothing else:

• A reader reads the references (other drivers, the demo) and writes the specification document.
• A writer writes the driver from that document and the public standards, and never reads the references or the demo. That is a sentence in the writer's brief and role, not machinery.

What goes:

• the sandbox, the launcher, the pinned settings, the denial probes and their two arms;
• the transcript audits, the root rescans and the checks of main before a fetch;
• the second writers' clone (Q1's exception is no longer needed);
• C1's tooling stage.

The similarity check is machinery too, and goes with the rest. The driver track's other rulings (Q2–Q4, WPA3/PMF and the rest) stand.

[Japabu]

Round 4: the clean room is the owner's two roles (issuecomment-6125437246). The head is unchanged, 8e3623e5b, one empty commit; only the body and title changed. The body went from 65,021 characters to 38,743.

Deleted, because the owner ruled the clean room is a reader writing the specification from the references and a writer working from it and the public standards, and nothing else:

• the room's volume, home, store and cargo home;
• the launcher, writer.json, the pinned binary and managed settings;
• the two-arm denial probes, the transcript audit, the rescans of roots around each session, and the check of main before every fetch;
• the second clone, its fork-checkout build change and root CLAUDE.md's exception under Q1;
• C1, the similarity check and rule E, and C1 as a dependency of the specification, W1 and W2;
• the specification's schema and releases, the room reviewer, the neutral implementer, and "this body is not writer-readable", all of which served the check or the denial.

As a result, round 3's BLOCKERs A, C and D and NOTEs 1 to 7 have nothing left to review. E2 and E5 to E7 stay on pr-876, but nothing in the body rests on them now.

What replaces it (§7): the writer's sentence goes in every writer's brief and, through the first W stage's pull request, into .claude/agents/implementer.md. The specification is committed revision by revision to ToyOSOrg/evidence pr-876, and each writer pull request links the revision it used.

Round 3's other findings, applied:

• BLOCKER B:
  • S2 is a reported figure and gates nothing.
  • P4's round names the published design its queues follow.
  • P4 lands on a bench reading that it works and regresses nothing on the path it moves. On the T14 that is the I219, which no row reads until the outbound rows of issues/toyos-has-its-own-network-stack.md, so P4 now waits for them.
  • §0 records the standing ruling and where it applies.
• NOTE 8: where Intel's published firmware-interface headers state a fact, the specification takes it from them and the bench checks that it works. Another reference disagreeing does not reopen it.
• NOTE 9: P6 brings AES-CMAC and SAE first, as ruling 2 says.
• NOTE 10: netring: a session region replaces the pipes between netstack and its clients (design, and the track that stages it) #863 is described as open. E9 (cd610ca) checks every cited path at 867ec23ed.

Q2 to Q4, WPA3 and PMF in the first version, and the plain-text saved networks are unchanged.

[Japabu]

Design review, round 4, of #876 at 8e3623e5b (one empty commit on 177e72a9e; the body as revised for round 4), against .claude/agents/reviewer.md and root CLAUDE.md at origin/main cc52b456c. Applied: rulings 1–3 (issuecomment-6120490125), Q2–Q4 (issuecomment-6121747502), the clean-room ruling (issuecomment-6125437246), and the standing ruling as this round's brief relays it. Evidence read: ToyOSOrg/evidence pr-876 at cd610ca, E3, E4 and E9.

Net lines: git diff --shortstat origin/main...8e3623e5b prints nothing (exit 0), so 0 production and 0 test. origin/main has moved from E9's 867ec23ed to cc52b456c (#880). Of what moved, only .claude/agents/orchestrator.md (+3) is a prompt, and the body cites nothing in it.

Round 3's BLOCKERs

• A (rule E's arms), C (delegation probes), D (the launcher under Arrivals), and the part of round 2's BLOCKER 1 that round 3 held open: all withdrawn with the machinery they reviewed, by the owner's ruling (issuecomment-6125437246). Not judged.
• B (S2 gates P4): CLOSED.
  • §6 S2 now "gates nothing".
  • P4's round names the published design its queues follow, and P4 lands on a reading that it works and regresses nothing.
  • The body says that no T14 row reads the wired card and that P4 waits for the outbound rows.
  • §0 records the ruling, and roasts 1 and 11 say "reports".
  • The wait is real: images/system.toml:95, tests/images/metalcase.toml:42 and tests/images/netcase.toml:28 give netstack only 1af4:1041 and 8086:10d3.

Round 3's NOTEs:

• 1–7: withdrawn with the room.
• 8: CLOSED (§7: Intel's headers decide what they state).
• 9: CLOSED (§6 P6: AES-CMAC and SAE first).
• 10: CLOSED (§1; gh pr view 863 reads OPEN).

The author's flagged decisions

• P4 and W5 wait for the wired card's T14 rows: accepted.
  • The LAN track's stage 3 "lands before a second real NIC family" and "lands whole" (issues/the-lan-is-not-yet-production-grade.md:70, :14), which puts W5 after P4.
  • P4 moves the I219's driver, and only a T14 reading checks that. The track's standing section (:89) asks for the same reading.
  • What this wait breaks is BLOCKER 1.
• The specification on ToyOSOrg/evidence pr-876: accepted.
  • The branch is append-only and each revision is pinned by commit.
  • It sits outside the tree, as root CLAUDE.md:18 requires and as the network stack's readers' specifications already do (issues/toyos-has-its-own-network-stack.md:9).
  • A W pull request links its revision on pr-876 rather than on its own pr-<N> (.claude/agents/implementer.md:52). That is a departure, and the body states it.
• The two clauses marked as this design's own:
  • P6's constant-time comparison and wiping secret: accepted. W2 needs both, and taking them first keeps W2 off TLS's queue.
  • §5's "least that joins it": see NOTE 1.
• The owed issue on the demo's branches: see NOTE 2. Its [I] holds where I could check it: the demo's branch adds the AX200 firmware's entry to NOTICE, and nothing for any reference.

BLOCKER

1. #876 §8 "Why each guest test is in QEMU", P4; §6 P4 — the P4 guest test's reason no longer holds.
   • The reason it skips metal is "no T14 row reads the wired card until the outbound rows". P4 now lands only after those rows, so the T14 tier is open by the time the test lands.
   • A reason a cheaper tier answers is a BLOCKER (reviewer.md:138).
   • Change: state the reason that still holds after the rows land. The T14's bench "opens no peer that holds streams" (issues/toyos-has-its-own-network-stack.md:35), and a test reaches no internet (reviewer.md:123). So connections kept across a driver restart can only be held in a guest.
2. #876 §4 Security, W2 and W4 rows, §5 — transition mode has no answer to the published downgrade.
   • The attack: a station that has joined a network by SAE will join by PSK any BSS of that SSID that offers PSK alone. Its message 2 then lets that BSS attack the passphrase offline (Vanhoef and Ronen, "Dragonblood", 2019).
   • The WPA3 specification's answer is the Transition Disable indication an AP sends in message 3. Nothing in §4, W2, W4 or §5 processes it.
   • Under the standing ruling, the WPA3 specification decides §4.
   • Change:
     • W2 reads the indication.
     • wlan keeps it per network: for the boot until W11, and in the saved file after that. Losing it at reboot before W11 is recorded as a weakness.
     • A marked network is never joined by PSK, and the refusal is by name.
     • W2's refusals gain a PSK handshake for a marked network, and W4's BSS-choice tests gain a marked network's PSK-only BSS.

NOTE

1. #876 §5 "Each network keeps the least that joins it" (the design's own clause) — this rule costs the network's upgrade to WPA3.
   • A network saved as its PMK can never be joined by SAE. Once its AP offers hash-to-element, W4's "SAE before PSK" cannot be followed, and a WPA3-only AP refuses it until the passphrase is typed again.
   • A network saved as its SAE element cannot join a PSK-only BSS of the same network.
   • The passphrase as typed joins in all three cases, and it is what Q4's "plain text whatever" asks for.
   • Change: keep the passphrase, or state this cost and the refusal in §5 and in W11's row.
2. #876 §8 "Issues owed", the demo's branches — the record is incomplete.
   • It names an owner and evidence but no exit (reviewer.md:121 asks for all three).
   • E9's 13 are the branches holding a8e1c96, a commit of the closed survey (Survey image for an unknown laptop (measurement only, never lands) #834). Two of them touch no Wi-Fi path, so the issue's subject is E3's 11.
   • Those branches' names, and the NOTICE text the demo adds, carry the word E3 masks, and they sit on a public repository.
   • §7's scout is now "never landed", where round 3 said "never landed or pushed". .claude/agents/orchestrator.md:61 now speaks of a scout branch as "pushed and never merged".
   • Change: give the exit (E3's count over origin reads 0, with the local branches kept for the scouts), and keep readers' scouts off origin.
3. #876 §7 "A writer's briefs and reviews quote no reference" — only the writer's brief and implementer.md are said to carry this.
   • A W stage's reviewer, and the orchestrator accepting a W stage's design round, carry nothing. A reviewer checking the driver against another stack is the most likely to quote one.
   • Change: the orchestrator's brief for each W stage's review and acceptance carries the sentence. A defect someone finds through a reference reaches the writer only as a reader's revision of the specification.
4. #876 §7 "The specification", §1 — the specification's scope leaves out facts W2 needs.
   • The specification is "a document of the device's own interface". But W2 tests three facts the demo's runs established about access points (§1), and a writer who never reads the demo has no document to learn them from.
   • Change: the specification also carries measured facts about peers, each with its run.
5. #876 §0, the standing ruling (prose) — the relayed ruling leaves out "speed decides only when it is the whole purpose".

DESIGN NEEDS CHANGES: give P4's guest test the reason that holds once the outbound rows exist; process WPA3's Transition Disable in W2, W4, wlan and the saved file, and never join a marked network by PSK; and NOTEs 1–4.

[Japabu]

Design acceptance, by the orchestrator, with round 4's named changes (#876 (comment)). The design is accepted as the body states it, once these are applied:

1. P4's guest test gives the reason that holds once the outbound rows exist: the bench opens no peer that holds streams, and a test reaches no internet.
2. WPA3 Transition Disable:
   • W2 reads the indication;
   • wlan keeps it per network (for the boot until W11, and in the saved file after that, with the pre-W11 loss recorded as a weakness);
   • a marked network is never joined by PSK, refused by name;
   • W2's refusals and W4's BSS-choice tests gain those cases.
3. §5 keeps the passphrase as typed, which joins SAE, PSK and the upgrade alike and is what "plain text whatever" asks for.
4. The demo-branches issue gets an exit: E3's count over origin reads 0, local branches are kept for scouts, and readers' scouts stay off origin.
5. The orchestrator's brief for each W stage's review and design acceptance carries the no-reference sentence. A defect found through a reference reaches the writer only as a reader's revision of the specification.
6. The specification also carries measured facts about peers, each with its run.
7. §0 relays the standing ruling whole, including "speed decides only when it is the whole purpose".

The author applies these to the body, and no further design review follows. The track's stages start in order, S1 first: the T14's compatibility-format A/B.

[Japabu]

Acceptance's seven changes applied to the body (issuecomment-6125972534; head unchanged, 8e3623e5b): (1) §8 gives P4's guest test the reason that holds after the outbound rows, the bench opening no peer that holds streams and no test reaching the internet; (2) §4, W2, W4, W11 and §2 process Transition Disable per the WPA3 Specification v3.5 §8 against Vanhoef and Ronen's "Dragonblood" downgrade, with the pre-W11 loss recorded as a weakness; (3) §5 keeps the passphrase as typed; (4) the demo-branches issue gets its exit, E3's count over origin reading 0, with readers' scouts kept local; (5) §7 puts the no-reference sentence in the orchestrator's brief for each W stage's review and design acceptance, with defects reaching a writer only as a specification revision; (6) §7 has the specification carry measured facts about peers, each with its run; (7) §0 relays the standing ruling whole from #873 and #885.

[Japabu]

Review of #876 at c7505cf55 (one commit on 36aff86fc), against .claude/agents/reviewer.md and issues/README.md at origin/main ecd6d1cc5. I read the rulings in issuecomment-6120490125, 6121747502, 6125437246 and the acceptance 6125972534. I also read E3, E4, E9, E10, E11 and ci-host-c7505cf55.log on ToyOSOrg/evidence at the commits the body links.

Net lines: git diff --shortstat origin/main...c7505cf55 reads 7 files changed, 504 insertions(+), 37 deletions(-). All of it is under issues/: 0 production lines and 0 test lines.

Evidence: cargo run -- --ci host at c7505cf55 exits 0 with "Host: 76 step(s), all green". No guest test or hardware is reached.

Machine identity: I scanned the diff, the commit message, the body, E10, E11 and the host log. Each has 0 MACs, public addresses, serials, personal hostnames or home paths, and 0 occurrences of the word E10 and E11 mask. What the masks leave open is NOTE 4.

Round 4's design BLOCKERs, both by reading the body and the track at this head:

• 1, P4's guest-test reason: CLOSED. Body §8 P4 now says the bench opens no peer that holds streams and a test reaches no internet.
• 2, Transition Disable: CLOSED.
  • Body §4 and the W2, W4 and W11 rows carry it.
  • Track :211-225, :247-255 and :299-324 carry it.

The author's three unsure items:

• The 330-line track: not sent back. reviewer.md asks every stage for an owner and an exit, the brief asks for the same, and 15 tracks on main already run past 150 lines.
• The two weaknesses kept in the track: accepted. Neither is true of the tree before W4 or W11.
• The orchestrator as every W stage's owner: accepted.

BLOCKER

• issues/there-is-no-wifi.md:149-150 — P4 has no owner.
  • The track names its owner as "stage 3 of issues/the-lan-is-not-yet-production-grade.md". That track is status: open and has no owner, holder or "held by" line anywhere in it (grep -c reads 0).
  • Naming another owner also takes P4 out of the orchestrator's catch-all at :65-66.
  • So W5 and W6 depend on a stage nobody holds.
  • Change: "Owner: the orchestrator; P4 is stage 3 of the LAN track, whole."
• issues/there-is-no-wifi.md:113-116 — the specification's sources narrow the ruling as the accepted design applies it.
  • "A fact the references leave unsaid, or disagree on, stays open". Intel's headers are among §7's references, so this reopens a fact Intel's headers state whenever another reference disagrees.
  • Body §7 says the opposite: "the bench checks that it works, and another reference disagreeing does not reopen it". Round 3's NOTE 8 closed on that clause, and §0 rests it on the standing ruling ("if the manufacturers … say do it, we do it").
  • Change: restore §7's two clauses. Another reference disagreeing does not reopen a fact Intel's headers state, and a fact those headers leave unsaid is taken from the other references. Only a fact those disagree on, or all leave unsaid, stays open.

NOTE

1. issues/there-is-no-wifi.md:59-61 — the link hop is tied to the wrong clause of the ruling.
   • The track ties the link hop's "never gated" to "Bench numbers are reported and never block". That clause is about designs vendors back.
   • Body §0 classes the split and link as "this design's, for review on their merits", where a speed claim "does not decide by itself".
   • Change: cite that clause for the hop, and keep "never block" for throughput.
2. issues/there-is-no-wifi.md:172-173, :263 — P5 and W6 wait on each other.
   • P5's exit needs a T14 row "after W6", and W6 "Depends on: … P5". So P5 cannot exit before W6 starts, and no stage lands that row after W6.
   • Change: move the row (both links lease, default route wired) into W6's T14 exit.
3. issues/the-wifi-demos-branches-are-on-origin.md:20 — a citation points at nothing.
   • "Wi-Fi is a track: the accepted AX2xx design's stages with owners and exits, and the issues it owes #876 §8 records them as written by an agent that read the references", but §8 at this head says nothing of the kind.
   • Change: cite where that is recorded (the demo's commit messages, by hash, masked as E10 masks) or drop the sentence.
4. issues/the-wifi-demos-branches-are-on-origin.md:22-30 — the exit leaves the masked word on origin.
   • The issue counts the masked model name in the branch names as part of the defect. Its exit (E10's Wi-Fi-touching count reads 0) leaves wt/toyos-<bench> (E10 line 41), which touches no Wi-Fi path.
   • I ran git ls-remote origin at review time. 12 refs on origin carry the word in their name: the 11 the exit removes and that one.
   • E10 and E11 print all 13 tips in full hex, which resolve to those unmasked names on the public origin until the branches go.
   • Change: make the exit "no ref on origin carries the word", or drop the model-name sentence.
5. issues/there-is-no-wifi.md:286-288, :271-277 — two exits rest on instruments nothing owns.
   • W8's "rows on both benches" needs W7 for the AMD bench, but W8 depends on W6 alone.
   • W8 also needs instruments nothing owns: two APs of one network for roaming, and an AP the harness silences for beacon loss. issues/no-access-point-answers-to-the-harness.md names only deauthentication and rekey.
   • W6's T14 rows need an AP at the T14's bench offering WPA3-Personal with hash-to-element and HE. W9 names its 6 GHz AP as an instrument the orchestrator owns, and W6 names none.
   • Change: name these instruments as dependencies, or add them to the access-point issue.
6. issues/pcidev-moves-a-bar-behind-a-bridge-out-of-the-range-the-bridge-forwards.md — it does not name the two placement issues P1 changes under.
   • issues/nothing-reds-when-the-bar-survey-drops-an-assigned-bar.md asks for a guest that reds when the forwarded-range push is deleted. That is the push this issue indicts, and that file says "No machine in reach puts a BAR it hands over behind a bridge", which this issue refutes.
   • issues/no-boot-reaches-the-retry-that-undoes-a-placement-nothing-answered.md:39-44 wants a function behind a pcie-root-port to settle at a later candidate. No candidate ever lies inside a port's window.
   • Change: name both, so P1 takes them up.
   • Also: the AMD reading at :21 (16 KiB, +0x2000, 1 MiB, eight windows) cites "the demo's log", which nothing links. Put its lines (masked) on pr-876, or rest the issue on the code alone.
7. issues/netstack-drives-one-card.md:17-19 — it reverses a rejected entry without naming it.
   • issues/first-match-selection-that-remains.md (kind: rejected) says a second virtio NIC "would be dropped" and "Neither is a defect today". This defect reverses that under ruling 3.
   • Change: name that entry, so P5 retires its virtio bullet.
8. PR body — two statements are false of the body.
   • §8 "No Wi-Fi stage has a guest test" contradicts W10's QEMU column and the track's :295-297.
   • "Every path it cites exists at 867ec23ed (E9)" is false for the six issue paths this branch adds.

SEND BACK

[Japabu]

S1 on the T14 (wt/toyos-wifi-s1 at bd135c4db, two boots; request, judge). Each image's sha256 matched before its flash.

Compatibility format is blocked.

• Boot A: the Type-C xHCI's MSI was left in compatibility format. It was not delivered, and 1 fault record names it.
• Boot B: remapped, delivered, no fault.
• The judge reads "compatibility format blocked: fault 0x25 and no delivery in A, delivery in B" (A kernel, B kernel).

So the owner's Q2 condition is met: P1 may hand over the MSI-X table's page where remapping verifies the source. One caveat stands, as the scout recorded: the T14 runs with eime=y, so A read the block with EIME set and CFIS clear together.

The read-out:

• The AX210 (8086:2725) at 09:00.0:
  • BAR0 is 16 KiB, mem64, non-prefetchable.
  • MSI-X has 16 entries, its table at BAR0+0x2000 and PBA at BAR0+0x3000, so the table shares BAR0 with the registers.
  • MSI has 1 vector.
  • It sits behind root port 00:1c.4.
• DMAR: no unit's scope names it, so it is the INCLUDE_PCI_ALL unit's (unit3). No reserved region names it.
• The NVMe (04:00.0): MSI-X table at BAR0+0x2000.

One part failed: the ACPI names under the radio and its root port read empty ("host bridge(s) []"), so the judge exited 1 on the read-out row. That is a defect in the scout's ACPI read-out, not a reading. It is fixed and re-run in one more boot.

[Japabu]

Review of #876, round 2, at 24b0fbc63 (one commit on ae65fed2a, which merges origin/main ab655a115 into c7505cf55), against .claude/agents/reviewer.md and issues/README.md at origin/main 97f07c381. git merge-tree --write-tree origin/main 24b0fbc63 exits 0. I read comments 6129664955 and 6130069570, and ToyOSOrg/evidence pr-876 at 4fc01d1: s1/ and s1-r2/ whole, E10 to E14, and ci-host-24b0fbc63.log.

Round 1's BLOCKERs

• 1, P4 has no owner: CLOSED. issues/there-is-no-wifi.md:158-159 reads "Owner: the orchestrator; P4 is stage 3 of issues/the-lan-is-not-yet-production-grade.md, whole."
• 2, the specification's sources: CLOSED. :119-124 carries both clauses:
  • another reference disagreeing does not reopen a fact Intel's headers state;
  • a fact they leave unsaid is taken from the other references;
  • only a fact those disagree on, or all leave unsaid, stays open.

Round 1's NOTEs 1 to 8 are applied:

• the link hop's clause at :62-67, which implementer.md:31-32 carries;
• the two-link row at :183-184 and :292-293;
• the demo issue's citation and exit, at :33-36 and :44-46;
• the instruments at :268-274 and :299-308, and in the access-point issue;
• the pcidev issue at :21-49;
• issues/netstack-drives-one-card.md:21-24 and :35-36;
• the body's §8 and its E14 line.

Net lines: git diff --shortstat origin/main...24b0fbc63 reads 7 files changed, 577 insertions(+), 37 deletions(-). All of it is under issues/: 0 production lines and 0 test lines. This round's commit changes 6 files, +146 and −73.

Evidence: ci-host-24b0fbc63.log runs toyos-build --ci host and ends "Host: 76 step(s), all green" (:9089), and its commit records exit 0. Its FAILED and SIGABRT lines (:7614-8171) are inside mutation controls, each of which closes "verdict(s) reached". No guest test or hardware is reached.

The masked word: a case-insensitive search finds it 0 times in each of these:

• the diff and the branch's three commit messages;
• the pull request's title, its body and all 16 comments;
• every tree and message of the 15 commits on pr-876;
• the pr-884 AMD log that E13 quotes.

git ls-remote origin lists 1,128 refs, and no ref name carries the word. I re-ran E12 §2's gh api repos/ToyOSOrg/ToyOS/commits/<tip> for the tips at E10 lines 41 to 52: all 12 exit 0, and each answer carries the word. So the demo issue's defect still holds, and that same command reads its exit. S1's logs hold no MAC-shaped string, and the stick's serial number is masked.

BLOCKER

None open.

NOTE

1. issues/there-is-no-wifi.md:86-99, :128, :132-145, :269 — the track does not record that S1 is done, or that Q2's condition is met.
   • Why: S1's A/B was posted (comment 6129664955, 17:54 UTC) before this head was committed (18:12 UTC). Its read-out was completed after that (6130069570).
     • s1/judge.log:17-22, :30 and :44-45 read fault 0x25 and no delivery in A, and delivery in B: PASS.
     • s1-r2/judge.log:234 and :240 read the read-out PASS.
   • Change: record S1 done with both exits met, P1's Q2 condition ("once S1's T14 boots read compatibility format blocked") met, and W5's S1 dependency met. The record also needs two more things:
     • The EIME caveat, which s1/request.txt:48-50 fixed before the run. A read the block with eime=y and cfis=n on every unit (s1/judge.log:19-22), and under VT-d §5.1.4 either one blocks. So S1 does not separate CFIS=0, which exit 1 of issues/qemu-passes-compatibility-format-interrupts.md asks for. A VT-d machine that the kernel leaves without EIME (kernel/src/arch/x86_64/vtd/mod.rs:297) rests on CFIS=0 alone.
     • The NVMe row in P1's T14 exit, which Wi-Fi is a track: the accepted AX2xx design's stages with owners and exits, and the issues it owes #876 §8 makes due "if S1 finds one". S1 found one: the T14's NVMe keeps its MSI-X table at BAR 0 + 0x2000 (s1/judge.log:52), so P1 drives that NVMe through that table on the T14.
2. s1-r2/wifi-s1-b-kernel.log and s1-r2/judge.log:32-232 on pr-876, and comment 6130069570 — the S1 read-out publishes what acpiserver says is quoted in no record.
   • Why: the kernel log carries 966 lines that open "(this machine's own, quoted in no record)". The judge log and the comment quote the firmware-chosen ACPI paths those lines carry. system/acpiserver/src/host.rs:58-60 and s1/request.txt:63 keep those paths out of every record.
   • Change: the track's S1 record cites the read-out on pr-876 and quotes none of those paths. What to do about the lines already published is the orchestrator's call.
3. issues/the-wifi-demos-commits-still-resolve-on-origin.md:21-24, :44-46 — the exit reads 12 tips, but the defect covers every demo commit.
   • Why: git rev-list <E10's 12 tips> --not --remotes=origin prints 52 commits, and 47 of their messages carry the word.
   • E13 names one of them by hash: E13 §2 quotes a 9-hex build hash (e13-amd-ax200-bar.log:80) that 9 of the tips hold.
     • gh api repos/ToyOSOrg/ToyOS/commits/<it> resolves it today (exit 0), and its message carries the word.
     • E13's header (:12) says no commit is named by hash.
   • Change: name E13 beside E10 and E11 as evidence that prints a resolving hash, and have the exit read every commit that rev-list prints, not only the tips.
4. PR body, §6's S1, §8's order (item 1) and §11's "where the AX210 keeps its MSI-X table (S1)" — these still read S1 as owed. S1 has answered them, for example the AX210's table at BAR 0 + 0x2000 (s1/judge.log:59). The orchestrator corrects these.

LAND AFTER NAMED CHANGES

[Japabu]

S1 read-out, completed (boot B re-run at a6934ff22, judge exit 0; the judge and kernel logs are on ToyOSOrg/evidence pr-876 under s1-r2/). The first run's empty ACPI names were the scout's own defect: the boot ended 15 ms after acpiserver started. The fix holds the boot until the read-out is logged.

The read-out found the radio's ACPI device under its root port, with its names below it. The paths themselves are this machine's own and are not quoted in any record (system/acpiserver/src/host.rs:58-60). With the first run's compatibility-format and PCI/DMAR readings (#876 (comment)), S1 is done, and P1 may proceed under Q2.

[Japabu]

Owner's ruling, recorded by the orchestrator. He was asked whether to ask GitHub support to purge the deleted demo branches' commits, which still resolve by hash and mention the AMD bench's model. He chose "Leave it": the branches are gone, the commits are reachable only by exact hash, and GitHub's garbage collection will remove them.