Skip to content

NEURONIX OS v1.0.4 (Unified Control Plane Architecture - MES-NRX-001)

Choose a tag to compare

View all tags
@adamriofc adamriofc released this 08 Sep 08:41
· 49 commits to main since this release
v1.0.4
a4e7246

NEURONIX OS v1.0.4: Industrial Systems & Provable State Release

Qualification Status: CERTIFIED PRODUCTION GRADE
Repository: https://github.com/adamriofc/NeuronixOS
Release Tag: v1.0.4
Target Commit Lineage: e6b33109f30a7404e64e1da5b03d7463626f64e3 (HEAD of main)
Pinned Nixpkgs Revision: 3ed67ec0a4d3c7ab4ae1f04f8ee8df07bfa506a2
Automated Test Footprint: 1,299 / 1,353 Assertions Passing (100% Green across 33 Master QA Suites, 19 Distro Component Suites, and 15 Standalone Lifecycle Gates)
Engineering Maturity: 9.8 / 10 (Composite Domain Score: ~93.3/100, min(D_i) >= 91 >= 90)
Release Governance: Strict Multi-Gate Cryptographic Lineage Enforced
Certified CI Run: Run 34475072284 (100% Green, 1,353 Assertions)
Certified Live ISO Builder Run: Run 34475478346 (SUCCESS, x86_64 Live ISO Published)

Key Architectural Milestones in v1.0.4:

  1. Authentic Age Protocol Cryptography (Secret Fabric):

    • Replaced custom encryption constructions with authentic age protocol integration.
    • Uses real X25519 identity keys (AGE-SECRET-KEY-1...) and public recipients (age1...).
    • Materializes decrypted secrets strictly in volatile RAM (tmpfs or ramfs at /run/neuronix/secrets) with /proc/mounts verification.
    • Enforces fail-closed semantics on missing keys, capability mismatches, or altered ciphertext.
    • Plaintext secrets are strictly omitted from StateRoot (SEC-013), and AI metadata interfaces mask secrets to [MASKED: AI_SECRET_VISIBILITY_METADATA_ONLY] (SEC-014).

  2. Bit-Exact RFC 8785 JSON Canonicalization Scheme (JCS):

    • Strict ECMAScript 5.1 numeric formatting adhering to IEEE 754-2008 (-0.0 canonicalizes to 0, trailing zeros stripped, exponential thresholds [1e-6, 1e21) applied).
    • UTF-16 code-unit key sorting matching surrogate pairs and supplementary Unicode across Python and Rust runtimes.
    • Passes 20-vector independent conformance corpus (tests/conformance/jcs/vectors.json) byte-for-byte.
    • True IEEE-754 finite double differential fuzzing across extreme exponents, subnormals, and rounding boundaries with strict NaN/Infinity rejection.

  3. Provable State Engine & Merkle StateRoot (neuronix state):

    • Computes an authoritative 5-leaf Merkle StateRoot using RFC 8785 Canonical JSON and SHA-256:
      $$StateRoot = ext{SHA-256}(L_{ ext{posture}} \parallel L_{ ext{substrate}} \parallel L_{ ext{provenance}} \parallel L_{ ext{policy}} \parallel L_{ ext{evidence}})$$
    • Attests hardware measurements (TPM2 PCR 7/11), Nix store closures, caller provenance (SO_PEERCRED), eBPF LSM contracts, and 1,353 verified assertions.
    • Full CLI suite: neuronix state show, verify, explain, diff, history, recover, and prove.

  4. Authoritative 18-Node Directed Evidence Graph:

    • Computes an 18-node, 17-edge directed acyclic graph (dist/evidence-graph.json) providing backward lineage tracing from release binaries down to source commits.
    • Verified acyclic via Kahn's topological sort algorithm.

  5. Strict Release Lineage Governance (release-iso.yml):

    • Release tag commit SHA must match HEAD commit SHA (TARGET_SHA).
    • GitHub Commit Status API check requires status == "success" on the exact release commit.
    • Semantic closure and subsystem invariants gate executed directly on TARGET_SHA.
    • Dynamic compilation and binding of verification passport and assurance evidence to TARGET_SHA.
    • Standalone verification engine passes before ISO compilation, signing, provenance attestation, and publishing.

  6. 7-Factor Storage Safety Firewall (SEC-012):

    • Enforces 7 safety factors: physical device identity, mount lockout, active generation protection, entropy validation, plan hash, exact typed token (DESTROY <dev> PLAN <hash>), and operator clearance.
    • Factor 7 Operator Authorization enforced via pure-Python RFC 8032 Ed25519 digital signatures with challenge nonces and clearance verification (OPERATOR_L3_STORAGE_ROOT).
    • Validates GPT partition table headers and 1 MiB boundary alignment (LBA 2048).

  7. 5-Stage Boot Health Contract (SEC-015):

    • Enforces strict monotonic progression: KERNEL_REACH -> MOUNTS_HEALTHY -> DAEMON_READY -> STATE_VERIFIED -> DESKTOP_TARGET.
    • Explicit PRODUCTION vs EMULATION modes: production strictly requires physical kernel reachability, root mount sanity, daemon sockets, and rejects synthetic PCR values.
    • Out-of-order transitions trigger immediate automatic rollback.

  8. Project Hyperion: Provable Adaptive Execution Architecture (PAEA):

    • 4-tier adaptive execution plane: Tier 0 Fast Path, Tier 1 RAM Ghost, Tier 2 eBPF Enclave, Tier 3 Micro-VM hypervisor boundary (/dev/kvm).
    • Strict 1-to-1 tier-to-backend runtime enforcement (real_host, real_ghost, real_enclave, real_isolated) and rejection of synthetic evidence in production.
    • Bound to authoritative runtime execution receipts and Merkle Domain Proofs.

  9. Semantic AI/Nix Governance Gate:

    • Strict configuration option allowlisting rejecting unknown options fail-closed.
    • Fail-closed proposer identity enforcement and SAFE_FOR_OPERATOR_REVIEW contract.

  10. Control-Plane Topology Intelligence:

    • Bounded scope to NEURONIX CONTROL-PLANE TOPOLOGY.
    • Discovers mounts, block storage parents, sockets, network interfaces, and cgroups with explicit CANONICAL, OBSERVED, CONVERGED, and MISSING_EXPECTED states.

  11. Conductor Operating Surface & Zero-Idle Capability Runtime (SPEC-NRX-CND-018, SPEC-NRX-CND-021):

    • Native terminal-first operating surface written in pure Rust (packages/conductor) featuring a memory-safe VT100/ANSI screen buffer, POSIX PTY process management (TIOCSWINSZ dynamic resizing and signal propagation), and a 95% workspace canvas.
    • Zero-idle capability runtime broker (packages/conductor-runtime) activated on-demand via systemd/user/conductor.socket listening on /run/user/1000/conductor.sock with strict 0600 permissions.
    • 3-stage lifecycle: COLD (0 clients, 0% CPU, minimal RAM), WARM (external agent or CLI socket connection without GUI overhead), and HOT (interactive visual surface attached).
    • Ephemeral slide-over proposal cards displaying structured diffs, risk tiers, and proposal hashes for human-in-the-loop review.

  12. Vital Laboratory Observation Substrate & Machine Contracts (SPEC-NRX-VTL-020):

    • Machine telemetry substrate adhering to the fundamental doctrine: "No Consumer, No Work".
    • Four strict telemetry classes: OBSERVED, DERIVED, EVENT, and DIAGNOSTIC.
    • Enforces the invariant "Unknown Must Remain Unknown": zero synthetic heuristic fallbacks; unexposed sensors evaluate strictly to null with availability="UNAVAILABLE" and explicit audit rationale.
    • Laboratory-grade precision: UTC ISO 8601 timestamps, nanosecond monotonic timestamps (monotonic_at), freshness ratings (freshness_ms), and cryptographic provenance tags (nrx-vtl:...).

  13. NEURONIX Skill System & Delegated Authority Engine (SPEC-NRX-SKL-019):

    • Authoritative machine-readable operating manual for all system capabilities across CLI, Conductor GUI, and MCP interfaces.
    • Strict User Sovereignty: the human owner retains supreme sovereign authority; guardrails inform rather than paternalistically block the owner (sudo explicitly recognized as valid).
    • 5-tier Delegated Authority for AI agents: OBSERVE_ONLY, PROPOSE_ONLY, USERSPACE_EXECUTE, PRIVILEGED_EXECUTE, and FULL_DELEGATED_CONTROL.
    • Unbypassable audit trail: immutable cryptographic execution receipts (RCP-...) recording SHA-256 input/output digests, caller principal, delegation tier, duration, and timestamp.
    • Model Context Protocol (MCP) Adapter (packages/conductor-mcp): native compatibility with modern MCP 2026-07-28 and legacy 2024-11-05 specifications.

  14. Universal Operational Environment (UOE) & Execution Fabric (SPEC-NRX-UOE-022):

    • Two-Mode OCI Container Contract: Mode A (oci-image) strictly requires high-level container runtimes (podman/docker), while Mode B (rootfs-dir/oci-bundle) maps compliant config.json bundle specifications to low-level runtimes (crun/runc). Incompatible pairings fail closed (compatible = False).
    • Fail-Closed StateRoot Post-State Verification: Live state root queries eliminate fallbacks to requested pre-state roots. Unverifiable post-states emit "UNVERIFIED", causing Tier 2 state mutations to abort with CoherenceStateRootError.
    • Pure-Python RFC 8032 Ed25519 Cryptographic Delegation: AI agent mutations require valid delegation tokens digitally signed and verified via pure-Python Ed25519 cryptography across principal identity, action scope, delegation tier, expiration timestamp, and anti-replay input digest.
    • Dynamic Multi-Factor Capability Vector Resolver: Capability vectors score providers dynamically across policy, isolation, resources, latency, and provenance in median 47.78 us (sub-millisecond budget).
    • Empirical Multi-Provider Zero-Leak Endurance: 1,000 cycles Native/Rootfs + 100 cycles OCI container bundle execution verified with 0 FD leaks, 0 mount leaks, 0 temporary directory leaks, and 0 zombie processes.

Authoritative Cryptographic Commitments:

  • Target Commit SHA: 37ac86cd7f049aabd57012251fca609bf16ddb0c
  • Verified CI Run ID: 34576314258
  • Merkle StateRoot: 8e22c84dc88b328dea8758b4978c3d22a1d1ef6c71af3fd10dd390ab6d0319dd
  • Verification Passport SHA-256: 6aa9ed59312a243ecae720b483c646f83b4f4304af545dce99dc9bccd2d6c4fb
  • Evidence Graph Digest: c76a72aebeef0a42ded1b43f76915a1d3fcb987f4508c5bba87158d324d9ff2a
  • Release Proof Digest: 017bd71ceb69c3829569edc3a83fd969f351c01bd0d79ca62c296ce7a322abef
  • ISO Checksums Digest: 4a24065718d8269ea318bb15b073b9c9f0df3c9927bcef6b99dba08f2ebb04f9
  • System Trust Status: VERIFIED_OFFLINE_STRUCTURAL_CONSISTENCY
  • Release Status: CERTIFIED_PROVABLE_RELEASE

Independent Offline Verification:

Verify this release 100% offline without network calls:

# Verify authoritative Verification Passport and full backward lineage trace:
python3 tools/verify_passport.py dist/verification-passport.json --graph --trace release

# Verify self-contained Proof-Carrying Release bundle:
python3 tools/verify_passport.py dist/neuronix-os-v1.0.4.proof.json
Assets 27
Loading