Ten days ago Xylem was a whitepaper. We'd declared JefeOS's north-star identity — a natively-clustered OS, one whose whole point is not falling over — and then said, honestly, that it was a thesis and not shipped work. The stretch since "Trust and Truth" closed that gap faster than I expected: Xylem went from zero lines of code to a running, self-healing two-node cluster that works across both kernels. The rest of the run was the kind of work that makes a foundation trustworthy — man pages, teardown hardening, filesystem ownership — capped by today actually driving a threaded Python interpreter on the live VM.

Xylem Stopped Being a Whitepaper

The build went bottom-up. First JefeRust learned shared-address-space threads, so siblings created with the thread-group clone share one page table and file table instead of each getting their own world — the prerequisite for any real multithreaded program. Then we wrote the wire contract before either kernel implemented it: a language-neutral Xylem Cluster Protocol v0, a SWIM-style gossip-and-failure-detection scheme over UDP, reviewed as a spec first. The membership "tissue" was then built independently in the C++ kernel and the Rust kernel from that one document — and the first kernel implementation promptly caught a self-contradiction in the spec's own byte arithmetic, which is exactly why you write the contract down. The two implementations interoperate byte-for-byte, which is the entire payoff of being wire-protocol-first: a C++ node and a Rust node speak the same dialect because they were both built to the same RFC, not to each other. Along the way JefeRust got a real blocking futex so pthread_cond_wait parks instead of spinning a core to death. The milestone that ties it together: a two-node demo where you kill a node and the survivor automatically marks it dead — proven both C++-to-C++ and as a mixed C++-to-Rust cluster.

Then We Made It Work With Nobody Watching

The first version of that demo had a tell: it only converged when someone was typing at the console. Idle nodes never noticed each other. The hunt landed somewhere genuinely surprising — the shell's leftover-child reaper was killing the kernel's own always-on daemons (the cluster pump, the DHCP renewer, the log flusher) on the very first command, because those daemons are children of the shell and the reaper only ran under SSH. That one bug explained the whole console-versus-headless mystery. The fix is a non-inherited kernel-daemon flag the reaper skips, and it incidentally stopped two other daemons from being silently reaped too. JefeRust, it turned out, was already correct here — its poll loop drives membership whether or not anyone's home — so its change was telemetry and docs to match. Now the mixed cluster converges hands-off and flips a dead node from alive to suspect to dead within seconds of a power-off, no keystrokes required. We followed that with a security-hardening pass on the new network surface, including a collect-then-send restructure so the cluster engine never holds interrupts disabled while it waits to transmit.

Man Pages, and a Shell That Guesses What You Meant

A feature with no documentation is a rumor, so we expanded the mang man-page corpus hard on both kernels — the C++ shell across several batches, and JefeRust got a man system built from scratch up past a hundred accurate pages, every one cross-checked against a command that actually exists. Xylem itself, the flagship identity feature, finally has a page. On top of that, both shells learned to guess: a bounded Levenshtein "did you mean?" fires at an unknown command or an unknown man page, with a length-nearest tie-break so a typo resolves to the closest real word rather than the alphabetically lucky one. It's clamped on SSH input length so the suggestion can't become its own denial-of-service, and it landed at full parity across the C++ and Rust shells.

Teardown, Ownership, and a Build Break We Caught Ourselves

Reliability got a cross-kernel sweep of the kill path: leader-death sibling reaping, futex waiter-slot scrubbing on exit, and a backstop so a dead pthread worker can't pin a kernel slot as a zombie — all mirrored on both kernels so neither drifts. On the filesystem, NTFS chown now persists real Unix ownership through extended attributes and clears the setuid/setgid bits on a genuine ownership change, which is the standard POSIX safety you want the moment ownership can move. The honesty beat of the run: one of those changes shipped a test program using POSIX special-mode-bit macros that our libc header had never actually defined, which broke a userspace build. We caught it straight off the build console and fixed it forward in the same loop — master never left a session broken.

Real Software, Today

The freshest result is the one I ran myself. We added threading (and logging) to the staged CPython 3.11 standard library and drove a real four-thread workload on the live VM — spawn and join, thread-local storage, a cross-thread Event, log output from each worker. It ran clean, exit 0, which means the kernel's thread-group clone, the futex, and the whole thread-creation path hold up under a real interpreter and not just a hand-rolled test binary. It's now committed as a regression probe. The second win removes the last limiter on how deep these probes can go: piping a script over SSH into an exec'd interpreter — printf '...' | ssh host "exec_linux /programs/python3 -" — used to hang forever, because the child's stdin blocked with no data and no end-of-file, and that wedged the SSH server with it. SSH exec-channel stdin is now buffered and delivered to the spawned child with a proper EOF, so you can feed a program to any staged interpreter over the wire.

What's Next

• Xylem Phase 2 — turning a service into a first-class kernel object with replicas and a supervision policy — is now unblocked, because membership runs headless on both kernels and the two-node failover demo passes.
• Keep the workload-truth probes running now that SSH can pipe a script into any staged interpreter; the next gap is wherever the next real program trips.
• Hold two-kernel parity, and exercise the chown setuid-clear through the Linux ABI so CI permanently guards the security behavior, not just the happy path.