With Xylem named as the north star — an OS whose whole identity is not falling over — the work since has split cleanly into the two muscles that vision actually needs: trust and truth. Trust meant designing and shipping a complete signal-permission model so processes can't step on each other; truth meant pushing "does real software run" all the way to a SQLite database on disk. Both arcs landed across both kernels — the C++ kernel and the Rust one, JefeRust — under the same dual-review, zero-revert discipline we've leaned on all year.

The Trust Model: Designed Before It Was Built

An OS that wants to host other people's workloads has to answer a deceptively boring question: which process is allowed to affect which other process? We took it seriously enough to write the spec first. Before a single line of kernel code, the signal-permission trust model went out as an RFC, through an internal security-design review and an external review pass — and both reviews caught soundness issues in the design that we fixed in the spec, not in production. That is the entire point of writing it down before building it: the cheapest place to fix a security mistake is in a document. The owner signed off on the corrected design, and only then did implementation start.

Shipping It in Phases, Twice Over

What shipped is defense-in-depth, in layers. A native-task shield keeps Linux-compat workloads from reaching past their own world into the kernel's native processes. A same-uid baseline brings the familiar POSIX rule that you can only signal your own user's processes, with an opt-in privilege-drop launch flag that leaves the default behavior untouched. And an opt-in, descendants-only sandbox lets a process voluntarily confine itself — either captured at launch or via a one-way runtime entry point exposed on both ABIs — that two independent security reviewers confirmed is inescapable, mutual, and one-way: you can step into the cage but never widen it or climb out. Underneath all of that, we widened task IDs to 64 bits on both kernels so identities are never reused — making the no-reuse invariant the sandbox depends on true by construction rather than by hope. Every phase shipped to both kernels in lockstep, every PR carried a code review and a security review, nothing merged on fewer than two approvals, and the whole arc — RFC through the final native-boundary hardening — closed with zero reverts and zero regressions. On-VM, the trust-model test suites stay green on both kernels, and the existing Linux stack (apk, busybox, Alpine init, SSH) didn't so much as flinch, because the new privilege-drop is opt-in until we've done a proper workload-impact audit.

The exec-argv Unlock

The truth track started somewhere far more mundane and immediately load-bearing: you couldn't pass a quoted argument to a Linux interpreter. lua -e 'print(1+2+3)' would arrive shredded, because the shell's exec_linux path split on whitespace and then capped at sixteen arguments. Three PRs fixed it across both kernels: a quote-aware tokenizer so 'a b' survives as one argv element with its inner spaces intact, a raised cap from 16 to 32 to match native exec and the kernel's own EXECVE_MAX_ARGS, and — the part I appreciate most — observable truncation diagnostics, so when an argument list is too long the kernel says so on the serial line instead of silently eating the tail. The JefeRust side went one better and asserted its cap against the real downstream byte sink (EXECVE_MAX_ARG_BYTES), sidestepping a blind spot the C++ side had to learn about the hard way. Small feature, but it's the on-ramp for every "drive a real interpreter from the shell" probe that follows.

SQLite on Disk, and the Reviewer Who Said No

With quoted args working, a workload-truth probe drove straight into the next real gap: sqlite3 could run an in-memory database fine but failed on an on-disk one with disk I/O error (10). The cause wasn't disk I/O at all — it was that the Linux-ABI fcntl didn't implement POSIX advisory record locks (F_GETLK/F_SETLK/F_SETLKW), which SQLite leans on to guard its database file. The first cut of the fix was a grant-all stub: claim every lock succeeds and move on. A code reviewer flagged it with REQUEST-CHANGES, correctly — a lock that always says yes is a correctness bug wearing a feature's clothes. The reworked version routes those commands through the kernel's existing shared file_locking subsystem, the exact same path native fcntl uses: real per-inode conflict detection, EAGAIN on a genuine conflict, proper lock release on close and task exit, one enforcement model instead of two divergent ones. After it landed, the on-disk database created a table, inserted rows, and read back 60|3 at exit 0; reopening the file in a fresh process returned the prior rows, proving real persistence. The Linux-compat counters came back clean — zero unimplemented syscalls where there had been two — and the broader regression sweep (CPython, Node, lua, busybox) stayed green.

What's Next

• The signal-permission trust model is the process-isolation foundation the JSL Linux-compat track and the Xylem clustering direction will both stand on — next is the workload-impact audit that gates flipping the privilege-drop from opt-in to default.
• Keep the workload-truth probes running: the heaviest staged software (JVM, Node, CPython, SQLite) now runs clean, so the next gap is wherever the next real package trips.
• Hold the two-kernel parity discipline — every capability landing on C++ and JefeRust together is what keeps the Rust rewrite a real second implementation and not a museum piece.