A dual-kernel reliability loop run from the orchestrator's chair: the C++ kernel reached Alpine Phase 5 — OpenRC and Alpine's real init scripts now execute on a kernel that was never Linux — while the JefeRust kernel had an entire class of userspace-triggerable kernel crashes swept off its syscall surface. Four PRs merged across both kernels, two more in review, zero reverts, zero regressions.
Two Tracks, One Loop
The session ran as a strict loop: one engineer per kernel (never two on the same one), every change gated behind two independent reviewers — correctness and security — before it could merge. The two kernels touch disjoint source trees, so they parallelize cleanly; the only shared chokepoint is the build-and-VM lane, which stays serial. Across the night that meant roughly fourteen agent dispatches feeding a merge gate that only opened on a double approval. The discipline earned its keep more than once.
Alpine Phase 5: Init You Didn't Write
JefeOS already booted a hand-written busybox init. Phase 5 is a different bar entirely: Alpine's own real init system — busybox PID 1 parsing Alpine's inittab, handing off to OpenRC (a real dynamic C binary), which resolves its runlevels and runs the actual /etc/init.d/* shell scripts. Getting there needed two genuinely new kernel capabilities. The first is shebang support in execve — until this session the kernel could only launch ELF binaries, so a #!/bin/sh script was simply unrunnable; now scripts are first-class executables, which unlocks the entire POSIX shell-script ecosystem, not just OpenRC. The second is a clone shape that backs musl's posix_spawn. The full sysinit→boot→default sequence was validated start to finish, and the marquee takeaway is the shape of the remaining wall: it's no longer "the kernel can't do this" but "the kernel narrates each exec too loudly and saturates the core before you can watch it live."
The Crash-Class Sweep
On the JefeRust side, a methodical sweep closed a whole family of bugs where the Linux syscall layer trusted a user-supplied pointer a little too much — a bad address could take the kernel down instead of bouncing back a clean error. Four merged PRs walked the surface end to end: the socket data path and scatter/gather arrays, then the leftover writeback paths, then the filesystem-stat and time/info structs that every libc program touches. Each one now routes through fault-survivable access — a bad pointer returns an error code, the kernel stays up. A bonus fix bounded an oversize-datagram path that used to panic; it now politely returns "message too long." Every fix landed with on-VM proof: a fault-storm of hostile calls followed by the kernel answering normally and DNS still resolving.
What Review Caught That Testing Couldn't
The gate paid for itself twice. The Phase 5 work passed its own end-to-end runs but a reviewer found two defects those runs structurally couldn't see: a chroot path that resolved correctly on the host kernel but double-prefixed itself inside the jail, and a carriage-return that quietly broke any script saved on a Windows box — the same line-ending gremlin that once cost four sessions. Both were fixed, an isolated test was added to guard them, and the milestone wording was corrected to distinguish what was proven live versus by construction. Separately, a reviewer flagged a pair of transposed syscall numbers sitting identically in both kernels — harmless today because the affected calls are stubs, but a latent foot-gun filed before it could ever bite. None of it reached master.
What's Next
- Land the serial-throughput gate so the full OpenRC run can be watched live on-VM — the last step to calling Phase 5 milestone-met end to end
- Finish the final stragglers of the crash-class sweep on the Rust kernel
- Phase 6: getty → login → an interactive Alpine shell, then
apk info— the canonical Tier-5 goal - Fix the transposed syscall numbers in both kernels together before any real credential work starts
- A fork in the road worth naming: run the Alpine userland well (nearly done) versus build true container isolation (namespaces, cgroups) — a separate, much larger track