OpenVMX V0.7-9

OVMX V0.7-9 Release Notes

Generated by tools/gen_release_notes.py from the merged history since V0.7-8 (135 commits). Do not hand-edit this file -- re-run the tool against the release tag instead.

Highlights

• A real VAX running OpenVMS V7.3 now joins an OVMX-founded cluster. OVMX founds the cluster, and the real VAX joins it as a member. OVMX answers the VAX's boot-time closes it used to withhold (vms-db1), and an OVMX-first boot no longer partitions the cluster (vms-d52c, vms-52d). A lost block-transfer REQUEST DATA is retransmitted instead of stalling (vms-c1d). A founding OVMX member now answers a join another member relays to it, so a node that boots last is admitted through any member (vms-6ec). A refused connection-manager send no longer leaves a gap in the message sequence; that gap could crash a real VAX with CNXMGRERR when OVMX joined late (vms-cd8). When OVMX frees a lock resource it mastered, it now removes the resource's entry at the remote directory node as a real VMS master does, so a stale entry at a real VAX no longer leaves a requester waiting on OVMX (vms-e09).
• Clusterwide logical names (vms-94a): LNM$SYSCLUSTER and LNM$CLUSTER_TABLE are executive state, and LNM$SYSTEM searches LNM$SYSCLUSTER after LNM$SYSTEM_TABLE. When another member creates or deletes a clusterwide logical name or table, OVMX applies the change. A node that joins late pulls the cluster's logical-name database from an existing member.
• The terminal driver is in the executive on Linux and NetBSD (vms-f8c). DCL, LOGINOUT and $QIO reach it: carriage control, VMS line editing and command recall, timed and end-of-file reads, broadcasts, permanent terminal characteristics, and process-permanent files. These are checked against a byte-exact keystroke oracle of a real VAX V7.3 session (vms-370).
• EDT line mode and keypad mode, compared against the same oracle.
• Native VMS images run unchanged: .EXE files LINKed on real OpenVMS Alpha V8.4 and on real VAX V7.3 run on OVMX. On Alpha they reach the rights database, $CHKPRO and RMS. On VAX they get page 0 per process through the executive.
• Process lifecycle: the executive creates each process before it runs ($CREPRC, DCL image tasks and PIPE segments, DEC C vfork/exec, the TCP/IP auxiliary server's services, PROVISION at boot), and deletes it when it ends. No process registers itself: only its creator ($CREPRC) or the boot task's single ESTABLISH_SYSTEM makes a VMS process, and the executive refuses any other task (vms-2a5, vms-a2c).
• No substrate root: a root audit runs in the acceptance battery on x86_64, Alpha and VAX. TCP/IP services run under their own accounts with an executive-given substrate identity, never root. The setuid-root mount helper is gone.

Known open items

• A VAX admitted by an OVMX founder reaching Username: is still in progress: the startup traffic OVMX used to withhold is now answered, but no capture yet shows that VAX completing startup (vms-d52c).
• Clusterwide logical names are not sent from OVMX yet: OVMX applies other members' changes and pulls the database, but it does not broadcast its own changes yet. Until it does, a local change to a clusterwide table is refused with SS$_UNSUPPORTED while other members exist (vms-94a follow-up).
• Lock-tree remastering between cluster members is not implemented yet.
• A third node does not join when an OVMX member holds the highest SCSSYSTEMID in the cluster (vms-6e3).
• A former master does not yet answer "not master here" (the 0xf7 reply) to a lock request for a resource it has freed (vms-657).
• Executive privilege checks that still read the substrate's credential (ESTABLISH_SYSTEM) are being replaced by checks on the process's VMS privileges, and SETIDENT is being confined to a login (vms-a2c). STARTUP and JOB_CONTROL still run as substrate root after boot (vms-137e).

Features

• cut: V0.7-9 — real VAX joins an OVMX-founded cluster (relay admission, directory removal on free, block-transfer retransmit), clusterwide logical names, executive terminal driver + EDT, native VAX/Alpha images, registration by ioctl gone (#1685)
• vms-6e3: a merge-rebuild ADD runs no barrier (OVMX never admitted the next joiner) (#1684)
• vms-562ac: op-0x03 carries the transition's commit time; op-0x14 names the real hardware (#1683)
• vms-e09: a master that frees a resource removes its entry at the remote directory node (named DLM op 0x04) (#1682)
• vms-2a5: registration by ioctl is gone -- only a creator (CREPRC_PCB) or the boot task's one ESTABLISH_SYSTEM makes a VMS process (#1681)
• vms-6ec: a founding OVMX member answers a coordinator's op-0x12 relay (Node C last was never admitted) (#1675)
• vms-c1d: ring block-transfer frames that fit, so a lost REQUEST DATA is retransmitted instead of breaking the circuit (#1669)
• vms-2a5 (harness): no suite registers itself; test_kmod_* run as processes the executive created (#1676)
• vms-7dd: $CREMBX puts a temporary mailbox's name in LNM$JOB, a permanent one's in LNM$SYSTEM (#1679)
• vms-94a: clusterwide logical names -- LNM$SYSCLUSTER/LNM$CLUSTER_TABLE as executive state, 0b/04 apply + startup database pull (0b/05/06) (#1677)
• vms-a2c: vouching for a network terminal needs SETPRV on the caller's VMS process, not a substrate credential (#1674)
• vms-a2c: the executive constructs SYSTEM once, for the boot task; every later process gets its identity from its creator (#1673)
• vms-cd8: no send-msg# hole when a CM send is refused, and the emit guard counts a peer's category-0x0b messages (#1672)
• vms-d52c: OVMX-first no longer partitions -- member PARAMS state membership, quorum/QDSKVOTES; the self record carries its incarnation (CN=3 in the lab) (#1667)
• vms-a2c: PROVISION is a subprocess the executive makes; PID 1's SIGCHLD reaper can no longer steal its status (#1670)
• release notes: a cut's docs/release-highlights/.md leads its generated notes (#1671)
• vms-52d: OVMX answers a booting VAX's cat-0x0b op-0x01 startup query (0x8b/0x01), value read from the CSB (#1668)
• vms-1f8 (PR2d-3): TCPIP$INETD creates each service process DETACHED with the service's identity (#1664)
• ci-alpha: run the public sys$ tier on every push to main, not only nightly/dispatch (#1594)
• vms-db1: OVMX answers a booting VAX's kind-10 (write-back, 5) and kind-5 (pull, 4) closes -- withheld, they held VAX startup (#1655)
• vms-d01 sweep: TCP/IP Services clients read how a $QIOW ended from the IOSB (#1586)
• vms-1f8: remove vms_mount_helper, the retired vmsfs's setuid-root mount helper (#1666)
• vms-1f8 (PR2d-4): DEC C vfork()/exec*() creates its subprocess through the executive (DECC$SHR) (#1665)
• vms-1f8 (PR2d-2): in-tree forkers make their children subprocesses through the executive (ovmx_subprocess.h) (#1663)
• CI: every job that pulls through the docker daemon points it at the registry mirror first (gated) (#1660)
• cluster-web-demo gate: the real VAX passes on offering Username: and is never logged in to; DEMO_PASS_VAXC removed (#1661)
• setup-buildx: pre-pull the BuildKit image with retries, falling back to the public mirror (#1662)
• vms-1f8 (vms-9f32 PR2d-1): DCL PIPE segments are subprocesses DCL creates (CREPRC_PCB), and run verbatim (#1653)
• x86_64 C RTL base: build musl from a vendored, checksum-pinned tarball (hermetic), network as a retried fallback (#1658)
• vms-d4f + vms-232 + vms-0315 + vms-ae8: IVQUAL on its own line, EDT keypad TAB/LINEFEED/PAGE and line-mode COPY/MOVE/WRITE/INCLUDE, RECALL/ALL with line editing, one buffered I/O per file open (#1659)
• vms-e50 (vms-9f32 PR2b): DCL makes its image task its own VMS process (CREPRC_PCB CONTINUE), not REGISTER_CONTINUE (#1651)
• vms-3fa (vms-9f32 PR2c): every QEMU suite runs as a process the executive created (#1652)
• Terminal UX vs the VAX V7.3 keystroke oracle: DCL messages, LOGINOUT, HELP, paging, RECALL, EDT line + keypad mode (#1639)
• vms-cdbd: fire repository_dispatch(release-tagged) to openvmx-site after cut (#1284)
• cluster-web-demo gate: a run passes only if every node, the real VAX included, reaches Username: and a logged-in DCL $ (rd vms-db1) (#1657)
• vms-9f32 PR2a (vms-c43): $CREPRC's creator creates the child's PCB before the child runs (VMS_IOCTL_CREPRC_PCB) (#1626)
• vms-deb0: no pipe into grep -q under pipefail, from any producer; the lint covers them all (#1656)
• vms-64b: OVMX DLM messages carry the cluster's DLM rebuild sequence (body[12:16]) and the measured request tail (#1648)
• vms-c02: facility_record_negctl's sandbox holds everything coverage reads (all of src/, tests/cluster/host), so its pristine baseline is green again (#1654)
• vms-eda8 + vms-eb3d + vms-bc5 + vms-53a + vms-cef + vms-bd71: VMS line editing, command recall, timed/EOF READ, broadcast, wrap and the logout line in the terminal driver (#1604)
• Stamping a process identity (VMS_IOCTL_SETIDENT) requires CMKRNL (#1642)
• vms-046: NETACP answers only into a reply mailbox its requester could read itself (#1588)
• Facility negative controls are one file each (tests/qemu/defects.d), so PRs adding controls never conflict (#1647)
• compat register: record what has merged -- a real VAX V7.3 cluster counts OVMX as a member; terminal carriage control and out-of-band ASTs (#1649)
• Conflict-free append-only lists: unreleased vector entries and known-diff entries are one file each (#1646)
• vms-1f64 + vms-b20: OVMX block transfers carry their measured port opcodes; remote MOUNT/DISMOUNT answered by block transfer (#1631)
• vms-7a8e: host_defects.sh selftest -- 285 fewer execs (heredoc cat, re-apply capture) (#1630)
• vms-15c9: NATIVEACT.EXE is a known image installed /PRIVILEGED=CMKRNL at boot; page 0 only for that copy; NATIVEACT drops CMKRNL before mapping (#1633)
• vms-549c: 20-vaxlab.yaml is the running lab -- replicas 5, image :7, partitioned RollingUpdate, 50m requests; README rolling recipe and image history (#1641)
• vms-40fb: an IOSB at any address gets every byte (packed IOSB writes in sys_qio.c) (#1634)
• vms-ci.6: lock ids and Con.IDs take the form real VAXes mint (minted-form audit) (#1645)
• vms-f0fb: out-of-band CTRL/Y, CTRL/C, CTRL/T, CTRL/O as executive ASTs; write breakthrough (stacked on #1579) (#1603)
• vms-bdc1: an installed /PRIVILEGED image runs with its privileges, granted by the executive at activation and run down at the next (#1627)
• vms-5a0: DCL TYPE/COPY read a file another process holds open for write sharing (#1623)
• vms-8c59: host_defects.sh selftest -- cut its fork cost, 25 s -> 10 s under bash (#1625)
• vms-380: controlled three-VAX remaster arms -- holder-sent 0x12 records, 82/01 new-master ids, SDA ground truth (#1644)
• AGENTS.md: never queue a PR stacked on another unmerged PR (#1643)
• vms-549c: lab VAX nodes boot with SIMH 'set clock nocatchup' (timer catch-up overflow hung lab VAXes) (#1637)
• vms-3432: native-image gate RUNs the semantic probes in a SYSTEM login (the goldens' session) (#1640)
• vms-b869: VAX native images (IHD .EXE LINKed on real VMS) RUN unchanged on OVMX/VAX; page 0 per process via the executive (#1585)
• vms-7ce: mbx_dcldrv takes back the SYS$INPUT/SYS$OUTPUT it published in LNM$SYSTEM (cause of the DCL hangs); stuck-task dumps (#1636)
• Merge-queue gates: required gate job per gating workflow; AGENTS.md merge-via-queue rules (#1635)
• A mapped red can no longer hide others: E2E checks run past a failed step, and safe_merge refuses a mapping whose skipped steps are unproven (#1632)
• vms-fc4: terminal carriage control -- records, prompts, the owed line feed (#1579)
• Remove a stray conflict marker from reference-captures.sha256; CI fails on any conflict marker in a tracked file (#1629)
• vms-f273: the pinned LibreSSL tarball is vendored; the libcrypto CI job builds it with no download (#1628)
• vms-220: INSTALL ADD has the executive copy the image into its own read-only directory; known file list in the executive; on-disk DB retired (#1612)
• vms-cab: answer a real VMS member's op-0x0f (82/15) by remaster role (#1615)
• vms-ac48: the executive gives each VMS process its own unprivileged substrate identity; LOGINOUT never yields uid 0; the UIC comes only from the executive (#1609)
• vms-251b: ROOTAUDIT + substrate-root ratchet in the DCL acceptance battery (X86_64, Alpha, VAX) (#1608)
• vms-8b5: native Alpha images reach the rights database, $CHKPRO and RMS (SECURESHRP + SYS$PUBLIC_VECTORS); SP_RIGHTS/SP_CHKPRO/SP_RMS in the native gate (#1621)
• vms-8e9: the executive authorizes and delivers $DELPRC/$FORCEX/$SUSPND/$RESUME (no userspace kill() across substrate identities) (#1624)
• vms-2d0: NCP SHOW KNOWN CIRCUITS/LINES/OBJECTS read the running NETACP (oracle layout) (#1449)
• vms-bbde: userspace reaches the executive only through the libvmssys transport seam (+ CI gate) (#1589)
• vms-40fb: native image IO$_ACCESS on a terminal reaches the terminal driver (TT.ILLFUNC) (#1622)
• vms-e1a7: EVAX weak references bind by name at activation; LIB$FIND_FILE and !%I reach RMS and the rights database on Alpha (#1620)
• vms-388: host GCC's GMP/MPFR/MPC come from vendored, checksummed copies; both cc1-gate toolchain builds run with the container network disabled (#1619)
• tools/ci/safe_merge.sh: the one way to merge -- refuses STALE, red, or unmapped-red, then merges the checked SHA (#1617)
• Alpha rig: five fixture disks as functions of one PCI slot, freeing slots for a NIC (vms-4311) (#1614)
• vms-9f32 PR1: a process is deleted when it ends (exit-hook rundown; no fd-bound deletion, no reaper) (#1591)
• negctl executive-not-pinned is FATAL again: with oops=panic the Oops it causes ends the guest (revert #1601) (#1618)
• vms-ci.6: full rolling-evacuation capture with volume handoff and REMOVE_NODE (runs ci6-evac-15/16) (#1616)
• negctl fixtures: the selftest copies the whole src/ tree and runs on every PR (#1599)
• negctl executive-not-pinned: no longer fatal (main's Kernel Executive shard 3/22 red since 90b955b) (#1601)
• vms-2ef: an OVMX member answers MOUNT/DISMOUNT/CLUSTER closes (grounded close state, held-out 21/21) (#1613)
• vms-fe7: a detached $CREPRC'd process copies nobody's process logical names (root cause of the intermittent LNM.TRN.SYSIN diff) (#1605)
• negctl determinism: hiber-ast writes only once A sleeps in $HIBER (MMK knock-on declared); authorize survives a refused child exiting first (#1593)
• Alpha public-sys$ tier: register suites only where they can run; give the Alpha rig a NIC (supersedes #1592) (#1595)
• vms-768 follow-through: SYSTEM holds OPER/ALTPRI as on VMS, SET PROCESS/PRIORITY is $SETPRI, UAT corrected; skipped heavy gates must pass before merge (#1597)
• NetBSD jobs: wait for the prime job's saved image instead of reinstalling on an index-lag miss (vms-7c1) (#1611)
• Static Analysis: clang-tidy analyzes each source file once (repeats in compile_commands.json pushed it past the job cap) (#1610)
• CI layer cache: one writer per gha scope, restricted to main (vms-14da) (#1606)
• CI: the classic docker daemon pulls through mirror.gcr.io too (Docker Hub 429s on inner docker builds, vms-d6c) (#1602)
• vms-3b3f: widen the Alpha vectors at VMS ordinals (51 system services, 40 LIBRTL); lab-linked semantic probes run unchanged in the native gate (#1590)
• vms-0125: suites that attach the console give its line back -- test_syssvc_pin's rmmod proof measures the descriptor alone again (#1600)
• vms-f8c: executive terminal driver on Linux + NetBSD; DCL/LOGINOUT/sys_qio on $QIO; termios toggles gone (#1574)
• vms-b5b0: an OVMX $ENQ resolves its directory node as VMS does, at any LOCKDIRWT (#1578)
• vms-003b (NetBSD): a process ending deletes its PCB at once, so a creator's armed completion fires (#1587)
• vms-30e: NCP SHOW + SHOW NETWORK read the running NETACP (oracle layout) (#1399)
• vms-003b: a static C image's file system is RMS (x86_64 C RTL file layer over RMS) (#1549)
• vms-ci.6: first rolling-evacuation lab capture (lock takeover VAX -> OVMX; volume handoff blocked) (#1584)
• vms-dda: outbound DECnet links brokered through NETACP over _NET: $QIO (#1385)
• vms-b869: VAX $STATUS gate — RUN images from a proof SYSTARTUP under SIMH, assert the exact $STATUS (#1581)
• vms-4ff: root-cause the demo Node A early-boot timer panic (reproduced + A/B'd), and keep Node A's worker state in the gate (#1583)
• vms-06c: EVACWL evacuation workload pair (MACRO-32 + OVMX/TCC) + takeover proof (#1571)
• vms-3b3f rungs 1-3: .EXE files LINKed on real OpenVMS Alpha run unchanged on OVMX/Alpha (system services, DECC$SHR stdio, own shareable + GSMATCH) (#1565)
• vms-a18: a '@' in a DCL PARAMETER position reaches the parameter instead of being dropped (#1577)
• vms-b71: SYS$GETLKI/SYS$GETLKIW over the executive's GETLKI ioctl (#1564)
• vms-f297: an OVMX member with the highest SCSSYSTEMID coordinates an admission a real VAX takes part in (rebased onto vms-e8b) (#1575)
• vms-025 + vms-db2a + vms-c27(3): in a MIXED cluster one resource has exactly ONE master (#1568)
• vms-e8b: lab re-fire on real VAX V7.3 -- VAX1 leaves with REMOVE_NODE, VAX2 does not bugcheck, survivors stay quorate (#1576)
• vms-c6e leg 2: the DRIVEN held-out run — 81 predictions committed before the VAX is asked to lock anything (#1573)
• vms-768: ALTPRI, SYSLCK and OPER checked in the executive (#1554)
• vms-45f: DEC C fopen/open/creat take RMS file-attribute keywords ("rfm=udf", "rat=none", ...) and apply them at $CREATE (#1557)
• Channel numbers are OpenVMS's: multiples of 16, slot N is channel N*16; a number naming no slot is SS$_IVIDENT on 64-bit (rd vms-0a2 / FAB$L_STV ruling) (#1559)
• vms-a88c: an ACL longer than the primary header continues in extension headers (#1547)
• vms-a44: DIRECTORY/FULL prints every record format and attribute as VAX V7.3 does; F$FILE_ATTRIBUTES RAT names the attribute (#1553)
• vms-263e: ODS-2 files carry real creation and revision dates (ACP + boot-image master); strict ATR$C_CREDATE check restored (#1555)
• vms-e8b: a response goes back on the connection its request arrived on -- the frame that bugchecked a real VAX (#1572)
• vms-b19: OVMX $ SET HOST logs in to a real VAX (CTERM read-characteristics handle is 4 bytes) (#1570)
• CI: tools/ci/merge_freshness.sh -- a PR's green is stale once main changes the files it changes (#1490 x #1532 broke vms.ko) (#1569)
• vms-9c95 + vms-66fe: the VMS DLM resource-name hash, determined black-box from real VMS wire values and proven 253/253 on held-out pairs (#1556)
• ledger: regenerate compat register (Ledger drift gate red on main since #1490) (#1566)
• vms-432: PID 1 disables the kernel Ctrl-Alt-Del hard reboot so the chord reaches init as SIGINT (orderly shutdown) (#1551)
• vms-370: keystroke oracle -- interactive terminal sessions vs real OpenVMS, byte-exact, ratcheted in CI (#1558)
• Process-permanent files: SYS$INPUT/SYS$COMMAND/SYS$OUTPUT/SYS$ERROR are ESC NUL IFI + the terminal device, TT a concealed terminal; logical-name equivalences carry their byte length through the userspace API and the executive arena (vms-b14e); known-diff 20 -> 16 (#1548)
• vms-b72: the executive opens a DECnet datalink for an interactive process (no reboot needed) (#1546)
• vms-47fd: inbound DECnet MAIL-11 -- a real VAX MAIL SEND lands in an OVMX user's mail file (#1490)
• vms-a666: labjoin poll survives a dropped exec session (#1552)
• Terminal permanent characteristics in the executive device row: IO$_SENSECHAR answers them, IO$_SETCHAR and SET TERMINAL/PERMANENT set them; the 64-bit console's width is the Alpha's 80, VAX keeps the LA36's 132 (vms-d900) (#1550)

Fixes

• Fix by cause the vmsdecnet_ncp_executor flake: echo "$out" | grep -q under pipefail reports a match as a miss (#1638)
• Boot E-taint, fixed by cause: the module signing key gets its own stage so cached layers can't mix two keys (vms-146) (#1607)
• test_lock_host: an interrupted-wait regression ends the suite instead of hanging CI (main's Build & Test) (#1596)
• fix main: vmsfs_acp.c uses VMS_PROT_MAXSYSGROUP/VMS_PRV_M_* (ACP_MAXSYSGROUP and ACP_PRV_M_* no longer exist) (#1561)

Reverse-Engineering / Protocol

• vms-239: OVMX reads a VAX-MSCP-served disk (MOUNT + TYPE, 0 bugchecks) + the frame-conformance gate (#1650)