1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
|
# TODO
State as of the end of the second session. Ordered by what unblocks what,
not by size.
## Do first: kill the serial dependency
Everything else is cheaper once this is done. The serial shell wedged three
times in one session and is lossy, non-interactive, and hostile to quoting.
- [ ] `/adm/keys` and a user: `auth/keyfs`, then `auth/changeuser glenda`
- [ ] service files for `keyfs`, `authsrv` (listener on 567), `listen` (rcpu
on 17019). This is literally `svc enable keyfs authsrv` from the man page
- [ ] add a 567 hostfwd to `run.sh` next to the existing 17019 one
- [ ] client: build conterm (github.com/0intro/conterm, text-only, drivable
over a pipe) or use the already-installed drawterm interactively
`tcp17019` runs `tlssrv -a /bin/rc -c server`, so it authenticates through
factotum and needs the auth server to validate. `rc/bin/service.auth/` already
ships `tcp567`. `run.sh` already forwards 17019.
## Unblocked, mechanical
- [ ] drop `svc=`; the filename is the service name
- [ ] `.ndb` extension on service files, stripped to get the name
- [ ] migrate more services per `inventory.md` — `plumber`, `webfs`,
`webcookies`, `kbdfs`, `usbd`, `realemu`
- [ ] doc drift: `/log` → `/sys/log` in `design.md` and `man/init`, with the
reason (root is mounted without create permission)
- [ ] doc drift: ctl permissions are `0644`, not `0600` — reads must be open
or ctl cannot document itself
- [ ] record the session's gotchas in `CLAUDE.md`: non-interactive rc dies on
a syntax error and takes the serial with it; `pkill -f` kills the calling
shell even with the bracket trick; rc treats double quotes as literal
characters, so `|` inside them becomes a pipe
## Needs a decision before code
- [ ] **`stop` does not work for detaching services.** `Ksrv` services have no
pid init can signal, so `stopsvc` is a no-op and a later `restart` fails
with "another instance is running". Proposed: for `Ksrv` with no `stop=`,
remove the `/srv` entry, which hangs up the channel and a well-behaved
server exits. Untested.
- [ ] **Dynamic `/srv` names.** `plumber` posts `plumb.glenda.502`, `rio` posts
`rio.glenda.1483` — user and pid in the name. `ready=srv:` cannot express
it and it is a pattern, not an exception. Needs a glob, a new `ready=`
form, or accepting `ready=exec` and losing liveness.
- [ ] **Namespace profiles.** Ship `/lib/ns/{net,disk,draw,full}`, require
every service to name one, no default. Blocked on the item below.
- [ ] **The provider circularity.** A service that provides a namespace to
others (an `import` of a remote `/net`, say) must be able to mount *and*
must post to `/srv` so dependents can reach it — so it is simultaneously
the exception to "do not bind `#s`" and to freezing the namespace. Not
resolved. Profiles built before this is settled get built twice.
## Unimplemented attributes and features
Parsed and ignored today: `ns`, `user`, `stop`, `adopt`.
- [ ] `ns=` inline lines and `nsfile=`, via `newns`
- [ ] `user=` via the capability device — note `#¤` must still be in the
namespace at the moment privilege is dropped
- [ ] `stop=` — `note:`, `write:file:word`, `exec:` forms
- [ ] `adopt=yes` for services init can stop but never started (the root file
server, `factotum`, `paqfs`)
- [ ] `halt`, `reboot`, `reset` ctl verbs and commands
- [ ] `reexec`
- [ ] rescue console when services will not come up
- [ ] base namespace construction by init, replacing the device-bind loop in
termrc
## Environment
- [ ] **The bootargs prompt needs a manual Enter every boot.** Listed as
unresolved in `CLAUDE.md`; it now blocks unattended testing, which makes
it worth actually fixing.
- [ ] sshfs has to be remounted by hand after every reboot — a candidate for
being a service itself, gated on a `sshkey` oneshot
- [ ] `9front-base.qcow2` is stale relative to `9front.qcow2`; overlays made by
`newvm.sh` lack the supervised serial shell and the rio change
## Verification debts
Claims the design rests on that have not been tested:
- [ ] does `RFNOMNT` survive `exec`? That is the last step before a service
runs, and the plausible place for a flag to be cleared
- [ ] does binding a single `/srv` entry (`bind #s/cs /srv/cs`) work as cleanly
as binding the directory? The fine-grained capability story depends on it
- [ ] does `import` have a flag to post to `/srv`, or is `srvfs` needed?
- [ ] does `bootrc` honour `init=` in `plan9.ini`? That is the escape hatch if
we ever make init the boot program and get it wrong
## Deferred deliberately
- The filesystem hierarchy rework. Until then, do not churn `/lib/svc` →
`/lib/services`; every path in init is a flag, so it is a one-line change
whenever the hierarchy lands.
- `timesync` reaching an external NTP server. It fails on DNS resolution in a
NAT'd VM and is not worth chasing; the dependency machinery around it is
already proven.
|
