What 1.2 is
1.2 was planned around one named goal — diagnostic accuracy: when the kernel reports a stall, a reap, or a fault, the report is a measurement, or it says it is a hypothesis. Around that goal the release cleared the C++ kernel's entire high-severity queue to zero, audited the signal subsystem end to end, and built the machinery that now scores a release from evidence instead of prose. JefeOS and JefeRust ship as separate releases; this page is the C++ kernel only.
Headline changes since 1.1.2
- Signal path hardened.
sigreturnnow strips unblockable bits and sanitizes the restored interrupt frame before returning;sigaltstack,sigsuspendrestore ordering and fault-killed child zombies forwait4all behave like Linux. Two user-to-kernel escalation paths in this area were found by review, reproduced with red/green witnesses, and closed. - Memory-protection foundations. SMEP, a CPL0 fall-through guard on the user-handler path, and an SMAP entry-stub witness are in; every ELF segment and every fixed mapping is bounded inside the user half of the address space.
- NTFS index safety. Writes that would have rewritten an internal index
node — the root cause of the long-standing "ghost directory" — are refused with one
latched notice instead of silently orphaning a subtree. FILETIME copies stay in sync
across
$FILE_NAMEand$I30; sub-sector MFT geometry is refused. - POSIX modes on NTFS. File modes persist in a dedicated attribute;
native and Linux-ABI
access(2)select one permission triad by caller with an admin override; a non-admin SSH session is class other on every object. - Host identity. A per-guest ED25519 host key persists across boots on an enrolled guest and rotates without elevation; an un-enrolled guest keeps password authentication off.
- Xylem supervision. A 39.65-hour production-bot run with zero organic harvests or reaps closed the last wedge class; the circuit breaker re-arms on its own after a cooldown; both death classes leave durable crash evidence.
- Linux ABI. 160 syscalls; per-task working directory;
pidfd,eventfd/timerfd/signalfd,sendfile/splice;stat()on a missing path isENOENT;unamereports1.2.0-jefeos. - Diagnostics. The exec guard says what its holder is stuck on; stall dumps carry the futex-wait census; the boot banner carries both a build id and the exact 40-hex source commit, and every release harness binds to that commit.
How this release was proven
The artifact below was not built on the developer machine. The release commit was bundled and rebuilt from a fresh checkout inside a digest-pinned Linux container on a separate host; that build's kernel and ISO hashes, suite counts and a QEMU boot proof feed a machine-scored manifest. The same ISO was then booted on Hyper-V for the application gate (22 workloads including Python, BusyBox and an Alpine chroot, joined to a signed host/guest boot attestation) and for the fault-injection gate (a Tier-2 livelock, a Tier-1 crash storm, a no-false-reap control and a post-fault serviceability check). Every row is bound to the exact commit and ISO hash; a stale or unbound result scores NOT-RUN, never PASS.
- Independent clean build — PASS
- QEMU boot proof (exact commit identity on the serial line) — PASS
- Tier-1 application gate, 22/22 + signed-boot join — PASS
- Fault-injection recovery, 5/5 arms — PASS
- Source integrity (clean tree at the declared commit) — PASS
- Four-hour stability soak — not run for this release (see below)
Known limits, stated plainly
- A Linux-ABI Node process grows its address space by roughly 35 KiB per TLS handshake (DNS-only and plain HTTP are flat). This was measured identically on the previous baseline and on this release — it is pre-existing, not a regression — but it means the four-hour soak's flat-memory criterion cannot pass with the Node workload as written. The standing soak evidence is the 39.65-hour reap-free production run plus the fault-injection gate at this commit.
- Sequential 32 KiB appends to a fragmented NTFS volume can exhaust a file's data runlist at about 5 MB; preallocate large files first.
- Guest writes into host-built directories deeper than two index levels are refused;
stage fixtures from the host.
chmod 0000on NTFS is not persisted across a cache eviction. - The legacy NIC driver logs periodic transmit-engine recoveries under load on Hyper-V; recovery succeeds and traffic continues.
- Cross-vessel failover on kernel panic — the marquee Xylem proof — moved to 1.3 by decision; 1.2 ships its foundations.
Get JefeOS 1.2.0
The clean-build release artifact is 7491584 bytes.
⬇ Download jefeos-1.2.0.iso