While Claude's credits recharged, Codex worked through three focused JefeOS sprints: 22 issue-focused PRs across kernel hardening, runtime recovery, and test infrastructure, then took JefeOS from its first Nova boot to a first-class OpenStack guest. The final pass added native ISO 9660 config-drive support, applied Nova identity and SSH keys, enabled nested KVM, fixed QEMU networking behavior, and turned the experiment into a repeatable smoke test.
Updated July 29 after the OpenStack compatibility work merged as PR #2632.
Three Sprints, Twenty-Two PRs
The first sprint merged fourteen PRs (#2599–#2612) across the least glamorous and most important parts of a kernel: memory isolation, loader W^X, heap bounds, descriptor lifetime, shared-memory cleanup, huge-page splitting, NTFS validation and sparse-write behavior, plus stronger regression guards. Two reviewer follow-ups landed separately. Sprint two added four PRs (#2622–#2625) for non-executable test stacks, fail-closed HTTP metadata, safer directory-entry copies, and bounded compatibility smoke tests. Review on the directory-copy work caught a real path that bypassed the first pointer gate; it was corrected in one round before merge. Sprint three closed four more (#2626–#2629): empty smoke runs now fail honestly, SSH and console commands share dispatch behavior, every Linux-compatibility test runs from a manifest, and an SSH session that disconnects during program execution no longer strands the executor.
| Sprint | Merged work | Theme |
|---|---|---|
| 1 | #2599–#2612 | Kernel and filesystem hardening |
| 2 | #2622–#2625 | Security gates and bounded tests |
| 3 | #2626–#2629 | Harness truthfulness and SSH recovery |
A Real Nova Instance
The OpenStack work started with a fresh DevStack host and application credentials carrying only manager, member, and reader roles—no administrator token in the guest workflow. The last known-good JefeOS ISO was imported into Glance with explicit BIOS, machine, disk, video, and E1000 properties, then launched through Nova on the shared DHCP network. The resulting instance reached ACTIVE, identified the emulated PC platform, initialized its E1000 adapter, acquired a DHCP lease, initialized its SSH host key, and exposed the complete boot trace through Nova's serial console. That proves a second virtualization lane beyond Hyper-V using ordinary OpenStack image and instance operations.
The Cloud Made the Contract Honest
The first launch exposed exactly what an OpenStack guest must handle: Nova's default config drive arrives as an ISO 9660 CD-ROM, its boot and metadata discs share one IDE channel, and the emulated E1000 was raising interrupts even though JefeOS's driver is polling-only. The fix was guest-side compatibility, not a permanent cloud workaround. ATA gained correct master/slave packet-device discovery, READ CAPACITY(10), and bounded READ(10); a compact read-only ISO parser gained strict extent, record, and file-size validation; cloud-init moved outside the NIC-only gate; and E1000 now keeps device interrupts masked. The same pass repaired an unrelated master build blocker discovered during the fresh-image build.
First-Class, Not Merely Booted
A clean image then launched under nested KVM with Nova's ordinary ISO config-drive setting. Serial proof showed both ATAPI CD-ROMs, the ISO parser self-test, the config-2 volume, metadata and network-data discovery, Nova hostname application, one authorized SSH key installed, a DHCP lease, SSH startup, and complete kernel initialization without the former IRQ flood. The final artifact passed an automated disposable launch and teardown, and a named instance remains visible in Horizon for inspection. PR #2632 merged the complete 13-file implementation after a focused bounds, cleanup-path, build, and live-boot review.
A Faster Second Test Lane
The Hyper-V host now exposes nested AMD virtualization to the DevStack VM, Linux provides /dev/kvm, and Nova launches new guests with KVM plus a host-model CPU instead of software-only QEMU. ISO config drives are the lab default, while existing instances remain untouched until recreated. The new scripts/openstack-smoke.sh uploads a private Glance image, creates a config-drive-backed Nova server, checks the serial log for storage, metadata, DHCP, and boot markers, rejects fatal markers, and cleans up unless told to keep the result.
What's Next
- Add virtio-net and virtio-blk to remove the compatibility image properties
- Apply static
network_data.jsonconfiguration and tighten the routine management path - Make Titan the durable OpenStack control point, then grow the lab into a deliberate HA topology