[Sunrisepeak]

Summary

openkal-posix 0.1.0 is an implementation of openkal 0.25 written above the system's POSIX C library. It serves the systems whose stable interface is the C library (OpenBSD, Haiku, GNU/Hurd, illumos) and any POSIX host without an implementation of its own, for programs and for okrun (design 2026-11-10 §6.2 K2).

• provides = ["mcpp:kernel-abi=openkal"], requires = ["mcpp:c-abi"] (E14): it is placed above a C library, never beneath one written above openkal.
• [kernel-abi] provides-interfaces lists fifteen interfaces: abort, stream, memory, env, time, random, fs, process, task, exec, terminal, timeout, map, region and space. net, datagram, prof and debug are absent, not stubbed (SPEC 6.1): their names are not defined, and neither the manifest nor kal_interfaces() states them.
• Within the stated interfaces, an unclaimed property answers kal_err_not_supported (clause 6.2). This covers confinement, bound lifetime and one-string starts; the 0.24 observable units, unit usage and limits; rename without replace; and the timeout forms of accept and recv_from, whose resources are the absent network interfaces.

Starting point: the earlier experiment, which measured 148 held, 8 did not hold and 4 not observed, then hung in openkal.process. The changes from it:

• The process hang. kal_process_terminate sent SIGKILL. It now sends SIGTERM, a request a program may take over, and kal_process_stop_requested and kal_process_end_as_requested are implemented. The handlers count each request and skip zero (0.25); they write to a pipe so that a context can wake the word's waiters; and a request ignored before arming stays ignored.
• Handles. A program found by its identifier and the program itself are told apart: a program does not wait for itself, and a program found by its identifier is not the caller's to end. The status and processor time of an awaited program are kept until its handle is released.
• Spawn. One resource preference at most, conveyed in KAL_RESOURCES as the other implementations convey it. The null device beside a placed stream at the same position is refused.
• fs.
  • kal_fs_hard_link uses linkat; a directory is refused before the call, and EXDEV → not_supported.
  • A lock belongs to the open file (F_OFD_SETLK, else flock for the whole file), and a mode that is neither shared nor exclusive is refused.
  • Node information respects self_size, and listings respect wanted.
  • A directory is not made executable.
• exec and map. kal_exec_map_part validates alignment, granularity, the file's end and the bits of how, and honours PREFETCH. kal_map_file refuses a region beyond the file's end.
• memory. kal_memory_info states total and available pages where the system does.
• The source states no host dependency beyond POSIX and the system macros it tests.

Test plan

• Local, Linux x86_64 (glibc, gcc 16.1), run-conformance.sh openkal-posix . full,exec,random,terminal,space,timeout,map,region: 329 held, 0 did not hold, 12 not observed. Under mtest 0.5.2: 348 passed, 0 failed, 12 skipped. The three-way check: "the exported names state the interfaces the manifest states".
• CI run 42736331587 green at e87cec2: conformance through mtest. linux-x86_64 gcc and llvm: 348 passed, 0 failed, 12 skipped each. macos-arm64 llvm: 344 passed, 0 failed, 12 skipped. Each job reports, and the report job joins them.
• macOS needed four changes:
  • getentropy from <sys/random.h>.
  • A program is started by the name its descriptor keeps (F_GETPATH); an answer about the program itself (ENOEXEC) ends the attempts.
  • A bounded wait is relative (pthread_cond_timedwait_relative_np), since its condition variables have no monotonic clock.
  • A region at an address is refused where neither MAP_FIXED_NOREPLACE nor MAP_EXCL exists (PLACE is not claimed).