The week of July 20–26 was the highest-throughput week in JefeOS history: 88 PRs merged, 200+ issues closed, across six parallel work streams. Both kernels got security audits, the JefeRust NTFS write arc went from partial to near-complete, the C++ kernel gained OpenStack self-configuration at boot, and a cross-kernel shared-VHD test rig now proves the two kernels agree on every byte of NTFS they write.

JefeRust NTFS Write: From Partial to Production

The §3.9 NTFS write parity push was the dominant JefeRust thread. Over ~20 PRs, JefeRust gained root split and depth grow (building multi-level B-tree directories), depth-2→depth-1 collapse on remove with freed-VCN reclaim, de-promotion of a large $INDEX_ALLOCATION directory back to a resident $INDEX_ROOT, rename into and out of large parents, resident→non-resident $DATA promotion, and the depth-1 empty-leaf reclaim that unblocked the separator-remove UNDERFLOW case (a file whose name was a resident-root separator was previously undeletable). Convention mismatches between the two kernels’ $INDEX_ROOT format — header-inclusive vs. entries-only — were settled in favor of the SPEC convention, with opportunistic repair at all four delta sites so any write operation silently upgrades the legacy format.

Security Audit Across Both Kernels

JefeRust’s first systematic security audit ran in parallel with ongoing C++ hardening. The highlights:

• Arbitrary kernel R/W closed — SysV IPC and POSIX semaphore/message-queue registries used is_mapped() as a trust boundary, but a ring-3 caller could pass any kernel address that happened to be mapped. Three separate 2-syscall arbitrary-write primitives and one arbitrary-read were confirmed live and patched by deleting the is_mapped gate entirely
• SMAP enabled — CR4.SMAP now prevents the kernel from accidentally reading user-space pages. Six raw user-pointer sites needed stac/clac bracketing, and a CPUID guard ensures older CPUs don’t panic on the unknown CR4 bit
• Crafted-volume guards — 13+ new bounds checks across both kernels: AllocatedSize in convert_to_nonresident, usa_offset in read_mft_record, $INDEX_ROOT walk window at 3 sites, $INDEX_ALLOCATION header parse, and a bitmap witness that catches invisible subtrees behind a SUBNODE-cleared LAST entry
• IPC ownership model — POSIX sem/mq and SysV semctl/msgctl now enforce creator-PID checks on IPC_RMID and IPC_SET

Open HIGHs dropped from 12 to 1 (#742, the JefeRust uaccess RSOD epic). The C++ kernel has zero open HIGHs.

Leak-on-Death Class Closure

A multi-session effort to close every resource-leak-on-abnormal-death window converged this week. The process_packets() re-entry bug (#2482) was a sev:high unrecoverable hang: any lock held across a packet send could deadlock when the network stack re-entered the shell. The capture-sink UAF (#2507) was a live kernel-heap use-after-free on the abnormal-death funnel. Siblings included the pipe-read drain, pipe PIN, recv pin, and serial backpressure bounding. The SSH non-atomic ‘executing’ guard (#2501) was unsound after our own #2491 fix — replaced with owner-stamped CAS.

OpenStack Track A: Boot Self-Configuration

The C++ kernel now self-configures from an OpenStack config-drive at boot — reads a FAT/ISO 9660 metadata disk, parses meta_data.json for hostname/SSH keys/network config, and applies it before the shell prompt appears. The freestanding JSON parser landed earlier (#2282), and this week it grew count-mode/parse-mode parity on malformed input plus a to_i64 INT64_MIN UB fix. Cloud-init hardening followed: hostname sanitized against control characters and RFC 1035, SSH key_line buffer widened to 1024 for RSA-3072+ keys.

Cross-Kernel Infrastructure

The shared-VHD test rig (#2558) is the most interesting CI addition: a single NTFS volume is written by one kernel and read by the other, catching convention disagreements that per-kernel tests can’t. It immediately found #2545 — the C++ kernel’s rmdir destroying populated directories written by JefeRust, because the $INDEX_ROOT format disagreement made non-empty dirs look empty. The PIT timer was measured at ~46.5 Hz (not the documented 1000 Hz), which meant every get_ticks()-based security timeout was ~22x its intended bound; three security-critical timeouts were migrated to get_uptime_ms() (real monotonic clock).

Dual-Reviewer Discipline

Every security-sensitive PR went through parallel code-reviewer + security-engineer agents before merge. The payoff was measurable: in PR #2596 alone, the code reviewer caught a null-deref kernel-panic path in a test fixture that the security reviewer missed, while the security reviewer caught a stale soundness claim that the code reviewer accepted at face value. Neither alone would have caught both. A recurring theme this week: agents refused the briefed prescription 8 out of 8 times when the brief was wrong — five-for-five in one session where the briefed fix would have been worse than what the agent found independently.

Roadmap

Milestone gates were defined for 1.2, 1.3, and 2.0. The 1.2 gate requires one-command release evidence (no more reconstruction from shell history), an independent clean build, QEMU boot proof, honest test accounting, and claim/doc true-up. Lane allocation shifted: C++ targets 1.2 forward features (cross-vessel failover, OpenStack), JefeRust targets 1.0 parity with its own security HIGHs. The JefeRust NTFS write gap is the last material PARTIAL — only fragmented multi-run allocation and $MFT grow remain.

What's Next

• JefeRust 1.0 parity: close the NTFS write gap (fragmented alloc + $MFT grow)
• C++ 1.2: cross-vessel Xylem failover + #2295 root-cause pursuit
• JefeRust #742: the last open HIGH (uaccess RSOD epic)
• Backlog burn: 512 open issues, 60% of merged PRs historically lacked a closing link (PR template now enforces it)