ISO9660

ISO9660 support in Cupid OS

Native normal fixture publication

The installed qualified CupidBuild now owns complete fixture capture, independent candidate checking and guarded ISO publication. Its paired cohort and reviewed release are complete content inputs. The normal fixture is 61,440 bytes with SHA-256 40359c1cec72219f21e87ce71b31e621209036042440e1b38c5e59de157e0fb6. Fresh OS builds and feature 17 completion pass on both hosts. See the handoff.

Complete guarded ISO command, 2026-10-06

Commit 344a9eee adds the source CupidBuild command publish-iso-fixture. It freezes complete fixture inputs, both six-tool seed cohorts and the selected release, launches the host's frozen CupidObj and independently checks every candidate image byte before publication. Retained observations stay bound through the final rename checks. Equal output keeps its timestamp; ordinary rejection restores verified prior bytes or absence.

Native and Cupid-built API and command checks pass on Windows and Linux. The composed matrix has 343 executions and three platform skips. Four complete 512-entry requests produce the same 66,342,912-byte image from 67,176,834 input bytes, SHA-256 44f47e3463e4a7f046b7d52034b7fcf411b799b9d1ecbf71a316bf7f8378ebe1. Seven checked object pairs match. The publisher is 22,200 bytes, SHA-256 94695810e4e385bfb78724a34307455cc215cbd93e202595560846d61e44761c. The production author deadline remains sixty seconds.

Native Make and both producer plans carry the codec and all four ISO modules. The Linux plan has 34 C sources; five new Windows profiles bind source counts 85, 90, 91, 91 and 92 to both plan digests. Historical supported plans remain. Both complete preprocessing suites and seven-tool source-link/runtime parity checks pass. The graph has 780 active inputs and 452 transforms, with 447 CupidBuild and five Python actions.

The 162,971-byte manual passes installed-seed OS/image checks and strict private four-CPU max/e1000 boot with completed ls and SMP verification. Independent rereading checks all 429 objects and sixteen artifacts. Its 200 MiB image has SHA-256 f30afc3b7e591146e1457d5aa65e7447454df5f1a5eeee98915080b258d150e5. Complete new source-cohort bootstrap qualification, seed installation, normal ISO regeneration and feature 17 remain open. The installed normal ISO recipe retains its accepted cohort and Python coordinator. See ADR 0430.

Cupid OS mounts ISO files as read-only ECMA-119 filesystems. Rock Ridge NM records provide long display names.

Quick start

1. Run make sync-iso on the host. Checked CupidBuild publishes the exact 4,096-byte big.bin spanning fixture through assemble-iso-pattern. CupidBuild's publish-iso-fixture then freezes the complete declared members and paired seed trust unit, runs the retained checked CupidObj, independently verifies every candidate byte and publishes test_iso/hello.iso. Hostbuild stages the resulting image into FAT16 as /hello.iso. No external ISO utility or mcopy is needed.
2. Boot Cupid OS with make run.
3. Run mount /disk/hello.iso /iso.
4. ls /iso lists big.bin, gen_big.sh, jpeg_baseline_8x8.jpg, long_named_file.txt, readme.txt, and sub/.
5. cat /iso/readme.txt prints the fixture text.
6. Run umount /iso when finished.

Reader and writer behavior

The reader supports case-insensitive ASCII lookup, read, stat, seek, and directory iteration. Directory listings preserve the original case. Up to four ISO files may be mounted at once. The reader follows bounded SUSP CE continuation chains for long names.

CupidObj writes sorted uppercase 8.3 base identifiers, file versions, both path-table byte orders, fixed UTC metadata, and the fixture's RRIP_1991A profile. An extensionless file keeps the required empty extension, such as README.;1. The writer emits PX and TF records for other readers; Cupid OS ignores those records.

CupidBuild rejects undeclared or missing members, links and Windows reparse points, special files, case-only name collisions, unsupported names and input drift. It owns complete ISO capture, independent candidate rendering and guarded publication, as well as the spanning pattern transaction. Equal bytes retain their timestamps. Python still owns staging that ISO into the persistent FAT disk image.

Publication records

The source handoff records complete retained capture, native image checking, bounded CUPISO1 transport, observer binding, qualified paired seeds and normal recipe acceptance. The complete contract keeps 512 entries, 127-byte names and eight directory levels, including empty files and directories. Its full large-image matrix produces matching independently checked outputs on both hosts.

Limitations

• Write, create, and unlink return -VFS_EACCES.
• There is no ATAPI driver. The ISO must already be accessible through VFS, such as /disk/hello.iso or a file in /home/.
• Joliet is not supported. Unicode-only images fall back to base ISO names.
• Rock Ridge SL symlink records and CL, PL, and RE deep-tree relocation records are not supported.
• The repository writer rejects a primary hierarchy deeper than eight directory levels and names longer than the guest's 127-byte limit.
• A 32-bit data length limits an individual file to less than 4 GiB.

Architecture

shell mount
  -> VFS mount
    -> ISO9660 adapter (four-slot pool)
      -> PVD, directory, and SUSP reader
        -> file-backed loop device
          -> block cache
            -> VFS read on the ISO file

The reader is in kernel/fs/iso9660.cc and kernel/fs/iso9660_vfs.cc. kernel/fs/loopdev.cc provides the file-backed block device. The bootstrap guide records the checked seeds and remaining host build dependencies.

Testing

Run cc /bin/feature17_iso.cc in Cupid OS. The test checks the exact six-name listing, lookup, content, JPEG decoding, glyph rendering, and mount-pool behavior. Expect PASS feature17_readdir names=6 long=long_named_file.txt and PASS feature17_iso.

Host coverage includes tests.test_iso_cupidbuild_production, tests.test_hostbuild.HostBuildIsoTests, and tests.test_toolchain_cupidobj. The bootstrap log keeps the build and runtime evidence.

Retained observers at publication boundaries, 2026-10-05

Commit 2d47b100 binds one retained observer to a transaction with the same root identity before any publication attempt. Every publication boundary rechecks captured payloads, metadata, ancestors and exact memberships, including after candidate installation. Binding after changed publication or equal-output reuse fails. Source observation drift can still restore verified old output through the existing recovery checks.

Ten binding methods pass with native and Cupid-built callers on Windows and Linux. Eight injected rename-boundary faults preserve prior bytes and timestamp or absence, clean state and permit recovery. The complete observer and 528-input regressions pass: 292 executions and ten platform skips. Fresh preprocessing and conditional-inventory checks add 82 passing executions without skips. The graph still records 775 active sources, 452 transforms and 447 CupidBuild/five Python actions.

The 161,127-byte manual passes installed-seed kernel/image checks and a strict private four-CPU max/e1000 boot with completed ls and SMP verification. Independent rereading checks all 429 objects and sixteen artifacts; only its wrapper changes, and FAT data stays intact. The raw kernel measures 9,595,256 bytes. The 200 MiB image has SHA-256 4250559828b4a1553b1d32bcbe042c91ed20662a3a5287f7d571273d45a192f4. Complete guarded ISO publication, committed-source seed qualification and normal recipe handoff remain open. See ADR 0428.

Complete private ISO bundle capacity, 2026-10-05

Commit 564ec4f2 lets a private checked input retain its explicit capacity through capture, revalidation and tool launches. The complete ISO request can use 68,165,648 bytes, matching CupidObj's existing payload allowance plus bounded metadata. Existing candidate and public-image bounds remain 64 MiB.

A valid 512-entry, eight-level bundle measures 67,176,834 bytes while its image is 66,342,912 bytes. Native and Cupid-built producers on both hosts emit the same retained image; the independent Python oracle and native checker agree. All nine new methods pass through both host adapters and toolchains. Complete observer and 528-input regressions and eight injected rename-boundary faults also pass. Independent evidence verifies 328 executions and ten platform skips, with matching 40,128-byte caller objects. Conditional-inventory and unknown-token checks add four passing executions. The graph still records 775 active sources, 452 transforms and 447 CupidBuild/five Python actions.

The 161,772-byte manual passes installed-seed kernel/image checks and strict private four-CPU max/e1000 boot with completed ls and SMP verification. Independent rereading checks all 429 objects and sixteen artifacts; only its wrapper changes, and FAT data stays intact. The raw kernel measures 9,595,904 bytes. The 200 MiB image has SHA-256 89b1fe8694fd8fa99a53b5b29fea6977743237baed895a1de22285980552e25a. Complete guarded ISO publication, committed-source seed qualification and normal recipe handoff remain open. See ADR 0429.