Maataa OS v0.1.0-alpha.9

Release type

Evidence alpha for QEMU (netduinoplus2) and the NUCLEO-F411RE board.
Three things that were only tested in QEMU or the host are now shown on
the board: the store survives power cuts during writes (9 real cuts, each
reading back the last acknowledged value or the one in flight), priority
inheritance (with it H gets the lock before M runs; without it L starves
holding the lock), and panini capsule 10. New in the code: 8.3.19 after
ayadi in the sandhi crate and capsule (decision (b)), E_FULL checked
through the svc instruction, and a CI check that the docs still say what
the code does. The kernel's syscalls, the host-channel protocol and the
sandhi wire format (keys 40/41) are unchanged. Every item passed the QEMU
smoke test (15/15) and CI.

Changed for users: join and the panini capsule now answer
hare+iha with hara iha (rule 10, 8.3.19), not harayiha; o/O still
give av/Av. The first word is taken as a pada, so a stem and an affix
(hare+e, nE+aka) no longer give haraye, nAyaka. Capsule 10 must be
installed with a signed commit (maataa-link --dev capsule-install assets/capsules/panini.mcap on a development kernel).

Validation

./scripts/smoke-alpha.sh          # 15 checks, QEMU (8: EFULL through the svc; 15: hare+iha, vizRo+iha)
./scripts/sizecheck.sh            # all four kernels within 128 KiB, no warning
./scripts/check-docs.py           # docs against the code (CI also runs it with --sizes)
./scripts/board-test.sh           # NUCLEO-F411RE: build, flash, host-channel checks

Board runs for this release, 2026-11-04, development key: three power-cut
runs (Board power cut test.command; 9 cuts, all PASS), the priority
inheritance test (Board inversion test.command; both kernels PASS, then
the normal kernel back), and panini 10 installed by a signed commit
(hare+iha -> hara iha MATCH).

Changes

Feature	Board	Docs
Power cut during a store write, on the board: scripts/board-power-cut-test.sh (Board power cut test.command) with maataa-link power-cut-write / power-cut-check: numbered values to key 63, the USB cable pulled while they are written, then key 63 must hold the last acknowledged value or the one in flight	yes (2026-11-04: three runs, 9 power cuts, all PASS, incl. one write in flight and cuts after compaction)	docs/persistence.md
Drift check: scripts/check-docs.py compares the docs with the code (version, number of smoke checks, kernel lint sets, the SVC call and error tables and limits, the size table and the measured sizes within 2 KB); CI runs it twice (before the build, and after the size check with --sizes). It found BUILD_GUIDE saying nine kernel lint sets (CI has eight)	-	doc/BUILD_GUIDE.md
E_FULL through the SVC: task 3 fills the kernel queue with 16 messages to itself, gets EFULL, and takes all 16 back at once (smoke 8). E_MUTEX_FULL and E_SEMAPHORE_FULL cannot happen through the SVC (9 waiter places, at most 9 tasks, a waiting task cannot ask again): docs/SVC_TEST_COVERAGE.md now says so	-	docs/SVC_TEST_COVERAGE.md
Priority inheritance on the board: scripts/board-inversion-test.sh (Board inversion test.command) flashes the inversion-test kernel and its pi-off twin, checks the USART2 log as smoke 14 does in QEMU, then flashes the normal kernel back	yes (2026-11-04: both runs PASS)	docs/engineering/SCHEDULER.md
Sandhi: 8.3.19 after ayadi (decision (b)): e/E before a vowel drop the y and the words stay apart (hare+iha -> hara iha, rule 10); o/O keep the v (vizRo+iha -> vizRaviha, rule 6). Crate and capsule together; panini capsule version 10 (3,684 bytes). Wire format unchanged	yes (2026-11-04: v10 installed with a signed commit, hare+iha -> hara iha MATCH)	docs/panini.md

---

Source: doc/RELEASE_NOTES.md at v0.1.0-alpha.9. Board runs and logs: docs/EVIDENCE_MATRIX.md. Updates: https://maataa-os.allb.xyz/updates

Alpha software: not for production or safety-critical use.

Maataa OS v0.1.0-alpha.8

Release type

Security alpha for QEMU (netduinoplus2) and the NUCLEO-F411RE board. New
are signed host requests and store key owners (docs/SECURITY_DESIGN.md):
committing an install, removing the run-time capsule and writing a task key
outside the host's own now need an ed25519 signature by the capsule key over
a per-boot challenge, and each store key is written only by its owner (the
host channel, or a capsule by its signed name). Reads stay open by decision.
Also more syscall error paths checked through the svc instruction, the
architecture and build docs rewritten, and debug builds 8 KB smaller.
Panini capsule 9 and the sandhi wire format (keys 40/41) are unchanged.
Every item passed the QEMU smoke test (15/15) and CI.

Changed for users: maataa-link capsule-install and capsule-remove
need --dev (development kernel) or --seed-file ~/.maataa/capsule-release.seed (release kernel); without one the kernel
refuses the commit or remove. Board persistence check.command uses key 21
instead of panini's key 40.

Validation

./scripts/smoke-alpha.sh          # 15 checks, QEMU (12: signed install/remove, refused unsigned/wrong-key/replay)
./scripts/sizecheck.sh            # all four kernels within 128 KiB, no warning
./scripts/board-test.sh           # NUCLEO-F411RE: build, flash, host-channel checks

Board runs for this release, 2026-11-03, development key: store key owners
at d29a343 (panini 9 MATCH, host put 32 refused, put 21 stored) and
signed host requests at bbce5ca (unsigned remove and commit refused, a
signed put refused when replayed, panini 9 re-installed by a signed commit,
MATCH after reset).

Changes

Feature	Board	Docs
Error codes through the svc instruction: task 2 makes seven calls the kernel must refuse (bad mutex and semaphore ids, unlock of an unowned mutex, recursive lock, park while holding a mutex, svc #20) and smoke check 8 checks each result. Found: an unknown call from a task returns ENOCAP (the mask refuses it first), not E_PERM as ABI_SVC.md said; docs corrected	-	docs/SVC_TEST_COVERAGE.md
More refused calls through the SVC, checked by smoke 8: task 3's existing bad-buffer and missing-task lines (EPERM, ENOTASK), new length limits (SEND of 65 bytes, UART write of 257 bytes: ETOOLONG), and semaphore 3 overflowing after 65,535 posts (ESEMOVERFLOW). E_MUTEX_FULL, E_SEMAPHORE_FULL and E_FULL stay tested in the kernel functions only	-	docs/SVC_TEST_COVERAGE.md
Debug builds 8 KB smaller (F411 90.2% -> 84.1% of 128 KiB): third-party crates build without overflow checks in debug builds too, as in release; the kernel and workspace crates keep theirs	-	docs/size.md
Signed host requests (docs/SECURITY_DESIGN.md, Part A): CHALLENGE (0x0C: chip id, boot count, sequence) and SIGNED (0x0D: ed25519 by the capsule key over label, challenge, operation, arguments) for remove, commit and store put to any task key. Unsigned commit and remove are refused. maataa-link --dev / --seed-file, put-signed, signed-replay-test. Smoke 12 checks unsigned, wrong-key and replayed requests refused	yes (2026-11-03, bbce5ca: unsigned remove and commit refused, signed put accepted once and refused when replayed, panini 9 re-installed with a signed commit, 2 MATCH after reset)	docs/SECURITY_DESIGN.md
Store keys have owners (docs/SECURITY_DESIGN.md, Part B): the host channel writes 16–31, 63 and 40–41; telemetry 32–35; panini 40–47; any other task or capsule name writes nothing (EPERM). Reads unchanged. Board persistence check.command moved from panini's key 40 to 21. Smoke 11 checks the host cannot write key 32	yes (2026-11-03, d29a343: board test PASS, panini 9 MATCH ×3, host put 32 refused, put 21 stored and read back)	docs/persistence.md
doc/ARCHITECTURE.md and doc/BUILD_GUIDE.md rewritten for alpha.7 (they still described the alpha.1 prototype)	-	doc/ARCHITECTURE.md
docs/SECURITY_DESIGN.md: the design of signed host requests and store key owners, with the user's decisions (signed commit; reads stay unsigned, the store is not confidential; one release seed). Same-version reinstall kept, with the reason, in the threat model	-	docs/SECURITY_DESIGN.md
scripts/flash.sh removed (alpha.1: built nothing, ran the default QEMU ELF on a Black Pill)	-	doc/BUILD_GUIDE.md

---

Source: doc/RELEASE_NOTES.md at v0.1.0-alpha.8. Board runs and logs: docs/EVIDENCE_MATRIX.md. Updates: https://maataa-os.allb.xyz/updates

Alpha software: not for production or safety-critical use.

Maataa OS v0.1.0-alpha.7

Release type

Consolidation alpha for QEMU (netduinoplus2) and the NUCLEO-F411RE board.
The kernel's syscalls, the wire format (SLP1 in store keys 40 and 41) and
panini capsule version 9 are as at the end of alpha.6; the boot report no
longer has the storage mounted line. New are the AEC docs written from the
source (ABI, memory map, threat model, rule and evidence registries, SVC test
coverage), the removal of code no build used (14 sketch files, the embassy
dependencies, the virtual StorageManager), more smoke checks (MPU faults,
RECV timeout and sender, an unfinished capsule install), the Hints API of
maataa-sandhi (host only) and fixes to the board scripts. Every item passed
the QEMU smoke test (15/15) and CI; the board column says what was also run
on a NUCLEO-F411RE.

Validation

./scripts/smoke-alpha.sh          # 15 checks, QEMU
./scripts/sizecheck.sh            # all four kernels within 128 KiB
./scripts/board-test.sh           # NUCLEO-F411RE: build, flash, host-channel checks

Board runs for this release, 2026-11-03, development build at a897978:
Board test.command PASS (selftest 13/13, panini 9 installed); Flash kernel stack test.command PASS (guard report, watchdog reset, crash record on the
next boot); panini 9 MATCH for rules 4, 13, 14, 15, 20 and 21; a 30-minute
soak with no reset. Board runs must keep the Mac awake: when it sleeps the
ST-LINK resets the board (docs/EVIDENCE_MATRIX.md).

Changes

Feature	Board	Docs
release.sh refuses to build when dist/ for the version already exists or when the version's tag is on another commit (alpha.6 was first tagged on a commit still versioned alpha.5, and the build overwrote alpha.5's dist/)	-	docs/release.md
maataa-sandhi Hints (host library only): join_with / join_request_with with Hints { dual, verb } give 1.1.11 for duals (rule 31: dve+iti -> dve iti), 6.1.94 pararupa (new rule 32: pra+ejate -> prejate), 6.1.89 for i and eD (new rule 33: upa+eti -> upEti) and 6.1.91 (new rule 34: pra+fcCati -> prArcCati); default hints are join. Capsule and wire format unchanged	host tests	docs/panini.md
AEC-01 docs, from the source: docs/ABI_SVC.md, docs/HARDWARE_MEMORY_MAP.md, docs/SECURITY_THREAT_MODEL.md, docs/PANINI_RULE_REGISTRY.md, docs/EVIDENCE_MATRIX.md; README (alpha.6, 15 checks), ROADMAP, SYSTEM_MANIFEST (STM32F411RE) and kernel-mpu.md (kernel may write flash) brought up to date. No code change	-	docs/EVIDENCE_MATRIX.md
panini version 9: the same rules as version 8 in fewer bytes (five data segments without the zeros between them, half of each 128-byte table stored, helpers $stem and $rest): image 3,662 of 4,096 bytes (was 3,949; 434 left), worst fuel 4,390; capsule == host on the whole host test	yes (2026-11-02, panini 9, 18 requests)	docs/panini.md
Board evidence for sandhi rules 4, 13, 14, 15, 20 and 21 with panini 9; the differential test now tries z and s after khar (8.3.35, kz), not only S	yes (2026-11-03, 12 requests MATCH)	docs/PANINI_RULE_REGISTRY.md
Board resets during runs traced to the Mac sleeping (reset pin or debugger, no crash); a 30-minute soak with the Mac awake had none. board-test.sh and the board .command files keep the Mac awake with caffeinate	yes (2026-11-03, soak and board test)	docs/EVIDENCE_MATRIX.md
docs/SVC_TEST_COVERAGE.md: which unit test, smoke check and board run exercises each of SVC 1–19, and the result paths none reaches	-	docs/SVC_TEST_COVERAGE.md
Removed 14 source files no build compiled (alpha.1 sketches on Embassy, LittleFS, defmt and serde) and the embassy-executor / embassy-time dependencies	-	doc/ARCHITECTURE.md
Removed the alpha.1 virtual StorageManager and src/storage/flash.rs (addresses not of this chip, never real flash). Boot report: no storage mounted line; manifest: maataa-os <version> from the package version. 6 tests of the removed code go with it (host tests 103)	yes (board test, 2026-11-03)	docs/HARDWARE_MEMORY_MAP.md
Smoke check 8 checks the MPU fault reports: task 4's kernel-RAM write and task 5's stack overflow are killed, the kernel word untouched	- (MPU on the board since alpha.1)	docs/kernel-mpu.md
Smoke check 8 checks RECV through the SVC: the timeout (E_TIMEOUT) and task 3's message with the sender in r1	-	docs/SVC_TEST_COVERAGE.md
maataa-link capsule-install-no-commit: begin and write without commit; smoke check 12 shows an unfinished install (greeter version 3) leaves the installed greeter version 2 running	-	docs/SVC_TEST_COVERAGE.md
Flash Nucleo F411.command removed (it read RTT, which the kernel no longer has; Board test.command flashes and checks). Flash kernel stack test.command reads the serial port, with LC_ALL=C so macOS tr accepts the COBS bytes (also in the watchdog test)	yes (2026-11-03, kernel stack test PASS)	docs/kernel-mpu.md
Every script and .command file is executable in git (was 644 for 15 of them, board-test.sh among them)	-	-

---

Source: doc/RELEASE_NOTES.md at v0.1.0-alpha.7. Board runs and logs: docs/EVIDENCE_MATRIX.md. Updates: https://maataa-os.allb.xyz/updates

Alpha software: not for production or safety-critical use.

Maataa OS v0.1.0-alpha.6

Release type

Capsule alpha for QEMU (netduinoplus2) and the NUCLEO-F411RE board. The
kernel, its syscalls and the wire format (SLP1 in store keys 40 and 41)
are as in alpha.5; new are panini capsule version 8 and the same rules in
maataa-sandhi: ऋ+ऌ by the r/l varttika (version 7), 8.2.23 with 8.2.24
(rule 30), pragrhya by the letters (rule 31), the error -106 for a word
starting with M or H, and release.sh refusing to create a missing key
without MAATAA_NEW_KEYS=1. Every feature passed the QEMU smoke test
(15/15) and CI, and panini version 8 was run on a NUCLEO-F411RE.

Validation

./scripts/smoke-alpha.sh          # 15 checks, QEMU (step 15: panini 8 and maataa-link sandhi)
cargo test -p maataa-sandhi --features alloc --target <host triple>

On a board: maataa-link capsule-install assets/capsules/panini.mcap, a
probe reset, then maataa-link sandhi अमी+इति (expects MATCH: अमी इति).
A release kernel needs the release-signed dist/.../capsules/panini.mcap.

Not done: pararupa 6.1.94 (needs to know the second word is a verb), duals
as pragrhya (1.1.11; the caller does not join them), a final Y (-105; give
its pada form N). The capsule image is 3,949 of 4,096 bytes.

Changes

Feature	Board	Docs
release.sh creates a missing release key only with MAATAA_NEW_KEYS=1; otherwise it names the missing file(s) and stops before building	-	docs/release.md
-106: a word starting with M or H is refused as such on every path (was -105 after a consonant or visarga ending, and joined as written after a vowel: deva+Hari -> devaHari). Crate and capsule (version 8)	yes (2026-11-02, panini 8, 18 requests)	docs/panini.md
8.2.23 samyogantasya lopah with 8.2.24 rAt sasya (new rule 30): a first word ending in two consonants loses the last, once (mahAnt+atra -> mahAnatra, was mahAndatra; vAkH+atra -> vAgatra, was -105; Urj kept). Crate and capsule (version 8): image 3,803 of 4,096 bytes, worst fuel 4,363	yes (2026-11-02, panini 8, 18 requests)	docs/panini.md
Pragrhya by the letters (new rule 31, 6.1.125): 1.1.12 amI amU, 1.1.14 single-vowel nipAtas a i I u U (not A), 1.1.15 aho Aho aTo uto utAho keep their form before a vowel (amI+iti -> amI iti, was amIti; aho+iti -> aho iti, was ahaviti). Duals (1.1.11) and pararupa (6.1.94) need word knowledge and are not done. Crate and capsule (version 8): image 3,949 of 4,096 bytes, worst fuel 4,383; QEMU amI+iti MATCH	yes (2026-11-02, panini 8, 18 requests)	docs/panini.md
ऋ+ऌ: f, F and x meeting take 6.1.101 by the r/l varttika, long vowel F (hotf+xkAra -> hotFkAra; was 6.1.77, hotrxkAra). Crate and capsule (version 7): image 3,571 of 4,096 bytes, worst fuel 4,252; QEMU hotf+xkAra MATCH	yes (2026-11-02, panini 7, 14 requests)	docs/panini.md

---

Source: doc/RELEASE_NOTES.md at v0.1.0-alpha.6. Board runs and logs: docs/EVIDENCE_MATRIX.md. Updates: https://maataa-os.allb.xyz/updates

Alpha software: not for production or safety-critical use.

Maataa OS v0.1.0-alpha.5

Release type

Capsule alpha for QEMU (netduinoplus2) and the NUCLEO-F411RE board: the
rest of hal sandhi. The kernel, its syscalls and the wire format (SLP1 in
store keys 40 and 41) are as in alpha.4; new are panini capsule version 6
and the same rules in maataa-sandhi: every consonant ending except a final
Y, r before r, new rule numbers 27 (8.3.7), 28 (8.3.32) and 29 (8.3.14),
and a fix to 8.4.41 (8.4.43 toh zi). Every feature below passed the QEMU
smoke test (15/15) and CI, and panini version 6 was run on a NUCLEO-F411RE.

Validation

./scripts/smoke-alpha.sh          # 15 checks, QEMU (step 15: panini 6 and maataa-link sandhi)
./scripts/sizecheck.sh            # all four kernels within 128 KiB
cargo test -p maataa-sandhi --features alloc --target <host triple>

On a board: maataa-link capsule-install assets/capsules/panini.mcap, a
probe reset, then maataa-link sandhi तान्+च (expects MATCH: तांश्च).
A release kernel needs the release-signed dist/.../capsules/panini.mcap.

Still refused as not yet (-105): a final Y (give its pada form, N), a
visarga after a consonant, M or H starting the second word. Words whose
final depends on their derivation (the roots of 8.2.36, kvin words, 8.2.32
to 8.2.35) are given in their pada form (rAw, dik, Duk).

Panini capsule version 6 (hal sandhi, the remaining finals)

Feature	Board	Docs
Final palatals: 8.2.30 coh kuh (c j J), 8.2.36 for C, then 8.2.39 and the version 5 rules; the roots of 8.2.36 and kvin words come as their pada form (rAw, dik); same rule numbers. Crate and capsule (version 6): image 2,926 of 4,096 bytes, worst fuel 4,246 (as version 5); QEMU vAc+ca MATCH	yes (2026-11-02, panini 6, 17 requests)	docs/panini.md
Final S z h: 8.2.36 (S), 8.2.31 ho qhah (h), then 8.2.39 q and the version 5 rules; 8.2.32 to 8.2.35 and kvin words come as their pada form (Duk, dik); same rule numbers. Crate and capsule (version 6): image 2,955 of 4,096 bytes, worst fuel 4,246; QEMU lih+atra MATCH	yes (2026-11-02, panini 6, 17 requests)	docs/panini.md
Final N R n: 8.3.32 doubling after a short vowel (new rule 28); for n, 8.3.7 before chav + am (new rule 27, with 8.3.4 anusvara: tAMSca; praSAn excepted), 8.4.40, 8.4.41 (not before z, 8.4.43), 8.4.60 (plain ll); a final Y stays -105 (pada form N). Crate and capsule (version 6): image 3,491 of 4,096 bytes, worst fuel 4,246; QEMU tAn+ca MATCH	yes (2026-11-02, panini 6, 17 requests)	docs/panini.md
Fix: 8.4.43 toh zi. A dental before z stays dental: tat+zaw is tatzaw (version 5 and the crate gave tawzaw). Crate and capsule (version 6): image 3,484 of 4,096 bytes	yes (2026-11-02, panini 6, 17 requests)	docs/panini.md
Final y l v: joined as written (rule 1; 6.1.66 lopo vyor vali deliberately not applied). Crate and capsule (version 6): image 3,512 of 4,096 bytes, worst fuel 4,246	yes (2026-11-02, panini 6, 17 requests)	docs/panini.md
r before r: 8.3.14 ro ri drops r (or ru after a vowel other than a/A), 6.3.111 lengthens a short a i u (new rule 29): punar+ramate -> punA ramate, hariH+ramate -> harI ramate, hareH+ramate -> hare ramate. Crate and capsule (version 6): image 3,562 of 4,096 bytes, worst fuel 4,246; QEMU punar+ramate MATCH	yes (2026-11-02, panini 6, 17 requests)	docs/panini.md

---

Source: doc/RELEASE_NOTES.md at v0.1.0-alpha.5. Board runs and logs: docs/EVIDENCE_MATRIX.md. Updates: https://maataa-os.allb.xyz/updates

Alpha software: not for production or safety-critical use.

Maataa OS v0.1.0-alpha.4

Release type

Capsule alpha for QEMU (netduinoplus2) and the NUCLEO-F411RE board: the
Panini release. The kernel's scheduling and syscalls are as in alpha.3; new
are the maataa-sandhi crate, the panini capsule (version 5), the
log=quiet manifest key and the maataa-link sandhi command. Every feature
below passed the QEMU smoke test (15/15) and CI; the "Board" column says what
was also run on a NUCLEO-F411RE.

Validation

./scripts/smoke-alpha.sh          # 15 checks, QEMU (step 15: panini and maataa-link sandhi)
./scripts/sizecheck.sh            # all four kernels within 128 KiB
./scripts/board-test.sh           # NUCLEO-F411RE: build, flash, host-channel checks
cargo test -p maataa-sandhi --features alloc --target <host triple>

On a board: maataa-link capsule-install assets/capsules/panini.mcap, a
probe reset, then maataa-link sandhi वाक्+ईश (expects MATCH: वागीश).
A release kernel needs the release-signed dist/.../capsules/panini.mcap.

Panini capsule (vowel sandhi)

Feature	Board	Docs
crates/maataa-sandhi: vowel sandhi (6.1.77, 6.1.78, 6.1.87, 6.1.88, 6.1.101, 6.1.109) over SLP1, no_std	host tests	docs/panini.md
capsules/panini.wat: the same rules as a run-time capsule; requests in key 40, answers in key 41; checked against the crate for every pair of boundary letters	yes (2026-11-01, 8 requests)	docs/panini.md
scripts/qemu-panini-test.sh (smoke step 15)	QEMU	docs/panini.md
Manifest key log=quiet: the kernel logs a capsule's tick only when it returns a negative result; panini version 2 uses it (no more log line a second)	installed and answering (v2, 2026-11-01); the quiet log itself checked in QEMU	docs/wasm-capsules.md
maataa_sandhi::varna: the 49 phonemes with place, effort, voicing, aspiration and length; the Maheshvara sutras; pratyaharas computed from them (with the ण् choice explicit); 1.1.69 savarna widening; 1.1.9/1.1.10 savarna	host tests	docs/panini.md
join rewritten on the varna model (pratyaharas, savarna, 1.1.50 closest substitute); agrees with the first engine on all 49×49 boundary pairs in three contexts; f+x kept at 6.1.77 as an open exception	host tests	docs/panini.md
Visarga, s and r before a word: 6.1.113, 6.1.114, 6.1.132, 8.3.17 with 8.3.19 / 8.3.22, 8.3.34 with 8.4.40 / 8.4.41, 8.3.35, 8.3.36, 8.3.37, r kept; 21 textbook cases; 8.3.14 refused as not yet	host tests	docs/panini.md
scripts/sizecheck.sh builds and checks all four kernels (F411 and QEMU, release and debug): fails over 128 KiB, warns above 90% (both debug builds warn at 91%)	-	docs/size.md
panini version 3: the same rules with its constants in one data segment (was 7 of 8), leaving room for the visarga rules	yes (2026-11-01: installed, 4 MATCH, malformed refused)	docs/panini.md
panini version 4: the visarga rules (8 to 17, and -105) in the capsule, equal to the crate on about 58,800 requests; image 2,164 bytes, worst fuel 4,758	yes (2026-11-02: 8 MATCH incl. रामो गच्छति, राम इति, रामश् च, हरिर् गच्छति, स गच्छति, रामोऽत्र, देवा गच्छन्ति; हरिः+रमते refused by both)	docs/panini.md
Hal sandhi (host library): 8.2.39, 8.4.40, 8.4.41, 8.4.45, 8.4.55, 8.4.60, 8.4.62, 8.4.63, 8.3.23 for final stops and m; 18 textbook cases and a property test; fixes vAk+ISa (was vAkISa, now vAgISa)	host tests	docs/panini.md
panini version 5: hal sandhi (rules 18 to 26, and -105) in the capsule, equal to the crate on about 109,000 requests; image 2,909 bytes, worst fuel 4,883	yes (2026-11-02: 8 MATCH incl. वागीश, तच्च, सज्जन, तच्छिव, तद्धित, किं करोति, रामो गच्छति, देवेन्द्र; वाच्+ईश refused by both)	docs/panini.md
maataa-link sandhi देव+इन्द्र: Devanagari or SLP1 in, the board's answer checked against the host's (MATCH/MISMATCH); maataa_sandhi::lipi converts, refusing unsupported characters	yes (2026-11-01, 11 requests)	docs/panini.md

Board run (NUCLEO-F411RE, kernel v0.1.0-alpha.3, 2026-11-01): panini
installed over the host channel (1407 bytes, replacing greeter) and run as
task 9 after a probe reset. Answers read back from key 41: deva+indra ->
devendra, mahA+fzi -> maharzi, eka+eka -> ekEka, iti+Adi -> ityAdi,
vane+atra -> vane'tra, hare+e -> haraye, vAk+ISa -> vAkISa, deva+in+dra ->
?. Key 40 was deleted after each; STATUS tasks 8/10 alive.
(vAk+ISa -> vAkISa was wrong: version 1 had no hal sandhi. Since version 5
it is vAgISa, 8.2.39, checked on the board 2026-11-02.)

Known limits

• Hal sandhi covers final stops of the k, w, t and p rows, and final m.
  Final palatals (c j: 8.2.30, 8.2.36), S z h, the nasals Y N R n, y l v,
  and र्+र् (8.3.14) are refused with -105 (not yet), by the capsule and
  the host alike.
• ऋ+ऌ stays at 6.1.77 (an open exception), as in the first engine.
• One request at a time (key 40, answer in key 41); a request is read up
  to 64 bytes and an answer longer than 64 bytes is refused (-104).
• Both debug kernels use 91% of the 128 KiB limit (sizecheck.sh warns).
• Earlier limits still hold: one run-time capsule at a time, the store's
  rollback counter is opt-in and untested on a board, and the development
  keys are public.

---

Source: doc/RELEASE_NOTES.md at v0.1.0-alpha.4. Board runs and logs: docs/EVIDENCE_MATRIX.md. Updates: https://maataa-os.allb.xyz/updates

Alpha software: not for production or safety-critical use.

Maataa OS v0.1.0-alpha.3

Release type

Kernel alpha for QEMU (netduinoplus2) and the NUCLEO-F411RE board: the
scheduler release. Every feature below passed the QEMU smoke test (14/14)
and CI; the "Board" column says what was also run on a NUCLEO-F411RE.

Validation

./scripts/smoke-alpha.sh          # 14 checks, QEMU (step 14: priority inversion)
./scripts/sizecheck.sh            # kernel within 128 KiB
./scripts/board-test.sh           # NUCLEO-F411RE: build, flash, host-channel checks

scripts/board-test.sh needs ST-LINK firmware V2J49M36 or newer (STSW-LINK007).
The board's V2J33M25 (2019) stalled the serial port after every probe-rs
flash or reset until a USB replug; after the update it passed with no
replug (2026-11-01).

Strict priority scheduling (cede19a)

Feature	Board	Docs
Strict priority levels, round-robin within a level; host channel at 6, capsules 1 to 4 from priority= in the signed manifest	yes (2026-11-01)	docs/engineering/SCHEDULER.md
Syscall 19 park (no capability needed; E_BUSY while holding a mutex)	yes	src/syscall.rs
Switch at once when a woken task outranks the running one; semaphore posts go to the highest waiter	yes	docs/engineering/SCHEDULER.md

Board run on a NUCLEO-F411RE, host channel round trip (maataa-link ping,
20 pings each):

Firmware	Selftest	STATUS	Ping
7e4830f (round-robin)	pass	tasks 8/10 alive	15 to 21 ms, median 20.5 ms
cede19a (strict priority)	pass	tasks 8/10 alive	2 to 3 ms, median 2 ms

The host channel now preempts task 1's busy loop as soon as a UART byte
wakes it, instead of waiting for the quantum and its turn among the other
tasks. Tasks 4 and 5 are killed by the protection tests, as before; parked
tasks count as alive. The start order (task 2, task 3, task 1) is checked
in QEMU; the board's RTT log was not captured in this run.

Priority inheritance, robust mutexes, starvation monitor

Feature	Board	Docs
A lock owner runs at the level of its highest waiter, along chains, for late waiters, and falls back on release; feature pi-off turns it off for comparison	QEMU and host tests	docs/engineering/SCHEDULER.md
Mutex unlock goes to the highest waiter (oldest among equals)	QEMU and host tests	docs/engineering/SCHEDULER.md
Waiting that would close a lock cycle fails with E_DEADLOCK	host tests	docs/engineering/SCHEDULER.md
A task that dies holding a lock: the next owner gets E_OWNER_DIED (u32::MAX - 18; it owns the lock)	QEMU (demo task 2) and host tests	docs/engineering/SCHEDULER.md
Starvation monitor: a task Ready 1000 ms without running is logged once per episode; the count is kernel key 3	yes (key 3 read 0 over the host channel)	docs/engineering/SCHEDULER.md

scripts/qemu-inversion-test.sh (step 14 of the smoke test) runs the
classic inversion with and without inheritance under -icount.

Board run (NUCLEO-F411RE, e13f3a1, 2026-11-01): host channel selftest
passed, STATUS tasks 8/10 alive, kernel key 3 read 0 (no starvation in the
demo), 20 pings at 2 to 3 ms (median 2 ms, as before). The inheritance,
cycle and dead-owner paths are checked in QEMU and host tests; the board's
RTT log (which would show task 2's EOWNERDEAD line) was not captured.

Known limits

• Inheritance, lock cycles and the dead-owner hand-off ran on the board's
  firmware but were only observed in QEMU and host tests: the board run
  reads the host channel, not the kernel's RTT log.
• Under strict priority a busy task starves every level below it; the
  starvation monitor reports it but does not intervene.
• Earlier limits still hold: one run-time capsule at a time, the store's
  rollback counter is opt-in and untested on a board, and the development
  keys are public.

---

Source: doc/RELEASE_NOTES.md at v0.1.0-alpha.3. Board runs and logs: docs/EVIDENCE_MATRIX.md. Updates: https://maataa-os.allb.xyz/updates

Alpha software: not for production or safety-critical use.

Maataa OS v0.1.0-alpha.2

Release type

Kernel alpha for QEMU (netduinoplus2) and the NUCLEO-F411RE board. Every
feature below passed the QEMU smoke test (13/13) and CI; the "Board" column
says what was also run on a NUCLEO-F411RE.

New since alpha.1

Feature	Board	Docs
Preemptive scheduler, MPU-isolated unprivileged tasks, syscalls, IPC	yes	README
Host channel over USART2 (maataa-link)	yes	docs/host-channel.md
Signed capsules (ed25519) and per-task capability masks	yes	docs/capsules.md
WebAssembly capsules, one task each, schedule and version from a signed manifest section	yes (tasks 7 and 8)	docs/wasm-capsules.md
Run-time capsule install over the host channel (flash sector 5, task 9)	yes (greeter, 2026-11-01)	docs/capsules.md
Persistent store: power-loss safe, sealed with ChaCha20-Poly1305 under a chip-bound key, migration from the unsealed format	yes	docs/persistence.md
Rollback counter in OTP (feature otp-rollback, off by default)	no, on purpose: OTP writes are permanent	docs/persistence.md
Watchdog (IWDG), reset cause and crash record	yes	docs/watchdog.md
Release build with release keys (scripts/release.sh)	built; flash it yourself	docs/release.md

Flash layout (F411)

Sectors	Use
0–4 (128 KiB)	kernel
5 (128 KiB)	run-time capsule area
6–7 (2 × 128 KiB)	persistent store

Upgrading a board from alpha.1 or a development build

• A development build (the default) opens the store a development build
  sealed, and seals an alpha.1 (unsealed) store on its first boot.
• A release build (scripts/release.sh) uses another store key. It refuses
  a store sealed with the development key (sealed with a different key)
  and leaves it untouched. Erase sectors 6–7 to start a fresh store: the old
  values are lost.

Validation

./scripts/smoke-alpha.sh      # 13 checks, QEMU
./scripts/sizecheck.sh        # kernel within 128 KiB

CI also runs cargo fmt --check and clippy with -D warnings for the host
crates and six kernel builds.

Known limits

• One run-time capsule at a time; it starts at the next boot.
• The store's rollback counter is opt-in and has not run on a board.
• Records cut off the end of the store's newest bank are not detected.
• The development keys are public. They give integrity, not secrecy; a
  release build with read-out protection is needed for secrecy.

---

Source: doc/RELEASE_NOTES.md at v0.1.0-alpha.2. Board runs and logs: docs/EVIDENCE_MATRIX.md. Updates: https://maataa-os.allb.xyz/updates

Alpha software: not for production or safety-critical use.

Maataa OS v0.1.0-alpha.1

Release Type

QEMU alpha prototype.

What Works

• Boots as a Cortex-M no_std binary in QEMU.
• Emits semihosting boot logs.
• Initializes virtual drivers for UART, GPIO, SPI, I2C, and power.
• Mounts a virtual flash storage manager and records a system manifest.
• Loads two static capsule slots and tracks capsule memory usage.
• Runs a deterministic six-tick scheduler simulation.
• Reports nominal system health.
• Exits cleanly through semihosting.
• Provides host unit tests for virtual drivers, storage, and capsules.

Validation Commands

cargo check
./scripts/test-host.sh
cargo build --release
./scripts/sizecheck.sh
./scripts/run.sh

Known Limits

• The driver layer is simulated.
• The capsule layer stores static images but does not execute WASM.
• Storage is an in-memory manifest, not LittleFS.
• Hardware flashing is still experimental and not part of this release gate.
• The project directory is not currently a Git repository.

Release Gate

This alpha is releasable when ./scripts/smoke-alpha.sh passes on a clean
workspace with QEMU and the ARM binutils installed.

---

Source: doc/RELEASE_NOTES.md at v0.1.0-alpha.1. Board runs and logs: docs/EVIDENCE_MATRIX.md. Updates: https://maataa-os.allb.xyz/updates

Alpha software: not for production or safety-critical use.