A clean-room x86-64 operating engine woven from replaceable cells.
WE ARE THE CELLS WE ARE THE FIRST CELLS!!! LOOM HAS NO RESIDENT KERNEL THE BOOTSTRAP CREATES THE FIRST CELL GRAPH TRANSFERS OWNERSHIP ERASES ITS DATA UNMAPS ITS EXECUTABLE PAGES AND CEASES TO EXIST.
MILESTONE 000: NO-KERNEL CONTRACT Merged. Host contract tests pass normally and under UBSan.
MILESTONE 001: UEFI SEED TRACE Implemented as the first freestanding PE32+ bootstrap stage.
MILESTONE 002: PHYSICAL SEED OWNERSHIP Firmware allocates separate code and data pages. Image and ownership-ledger adversarial tests pass.
MILESTONE 003: OWNED PAGING LOOM leaves Boot Services, activates an owned PML4, enables NXE and CR0.WP, and audits live PTEs against cell ownership.
MILESTONE 004: ROOTLESS HANDOFF MACHINE-OBSERVED PASS. QEMU/OVMF produced the complete ordered trace, exited with host status 39, and preserved raw and normalized serial bytes.
MILESTONE 005: ORGANIC REPLACEMENT MACHINE-OBSERVED PASS. A real generation-1 UD2 was captured by graph-owned fault infrastructure, generation 2 was published through one active graph snapshot, generation 1 was zeroed and unmapped, the temporary coordinator was zeroed and unmapped, and generation 2 remained callable.
MILESTONE 006: REPLACEABLE FAULT ROUTER CONTRACT OPEN. Issue #10 defines a single-CPU whole-IDT handoff from Router1/IDT1 to Router2/IDT2, followed by real post-swap UD2 capture and retirement of Router1 and IDT1. No implementation claim exists yet.
GRAPH_LINKED
OWNERSHIP_TRANSFERRED
BOOTSTRAP_ERASED
HARDWARE W^X ENFORCED
REAL CPU UD2 CAPTURED
GENERATION-2 PUBLICATION OBSERVED
GENERATION-1 DATA ZEROED
GENERATION-1 CODE/DATA UNMAPPED
TEMPORARY COORDINATOR ZEROED
TEMPORARY COORDINATOR UNMAPPED
POST-RECOVERY G2 GRAPH CALL OBSERVED
BOUNDED ORGANIC CPU-FAULT RECOVERY OBSERVED
ARBITRARY CORRUPTION RECOVERY
BROKEN PAGE-TABLE RECOVERY
RECOVERY-STACK CORRUPTION RECOVERY
MALICIOUS CPL0 ISOLATION
SMP ROUTER REPLACEMENT
NMI-SAFE ROUTER REPLACEMENT
TRIPLE-FAULT RECOVERY
- No permanent privileged nucleus.
- No syscall dispatcher.
- No central scheduler.
- No permanent allocator, linker, registry, or interrupt router.
- All continuing services are cells.
- Every cell is replaceable, including cells that replace other cells.
- One trusted address space. No internal security boundary is claimed.
Each final M005 marker occurred exactly once and in order:
LOOM:M005
GRAPH:REV=1
CELL:G1_LIVE
FAULT:UD_INJECTED
FAULT:G1_CAPTURED
CELL:G1_FAILED
SHADOW:G2_READY
STATE:G2_READY
GRAPH:REV=2
CELL:G2_LIVE
CELL:G1_QUIESCED
CELL:G1_UNMAPPED
COORDINATOR:ERASED
GRAPH:G2_CALL_OK
RUNTIME:CONTINUES
PASS:M005
Observed Windows judge result:
QEMU_EXIT=51
IMAGE_SHA256=b2dfeaa28b95c8affb1ec1c21b6b76d0ab048824c4fe24ffc6feb3cef99b8fe7
LOOM_WINDOWS_M005_SELFTEST=PASS
LOOM_WINDOWS_M005=PASS
Observed binary gates:
DETERMINISTIC DOUBLE BUILD=PASS
AMD64 EFI APPLICATION=YES
IMPORTS=0
BASE RELOCATION=PRESENT
WRITABLE PE SECTIONS=0
FORBIDDEN RUNTIME HELPERS=0
COPIED CELL RELOCATIONS=0
INVLPG=5
FULL-PAGE STOSQ LOOPS=3
FULL-PAGE SCASQ LOOPS=3
NX PERMISSION TRANSITION=YES
INDIRECT GRAPH CALLS=8
Evidence is preserved under:
evidence/m005/windows-machine-2026-07-22/
Reconstructed archive contract:
FILE=m005-windows-machine-evidence.zip
SIZE=22291
ENTRY_COUNT=13
SHA256=811c1b8e172224b3f19ab4cdfabe9f2a641dec03fb81aa52e8153bfb0723fa70
Host contracts through M005:
make CC=clang verify
Windows M005 host-contract judge:
PROVE-M005-HOST.cmd
Windows final M005 machine judge:
PROVE-M005.cmd
Windows final M005 evidence packager:
PACKAGE-M005-EVIDENCE.cmd
Linux final M005 image verifier:
make m005-verify
Linux final M005 QEMU judge:
make qemu-m005
Issue #10 defines M006:
PREPARE ROUTER2 + COMPLETE IDT2
VALIDATE OWNERSHIP + IST + VECTOR 6
LIDT IDT2
SIDT READ-BACK
REAL UD2 CAPTURED BY ROUTER2
QUIESCE ROUTER1
ZERO + UNMAP ROUTER1
UNMAP IDT1
CONTINUE THROUGH ROUTER2
M006 is currently a contract only. Reports or source code cannot move its claims without observed machine evidence and preserved bytes.
Issue #4 remains open. GitHub Actions has not produced current workflow runs, terminal job results, or uploaded serial artifacts. Independent Windows judges closed the machine-proof gates for M004 and M005, but they do not close the CI execution-plane issue.
boot/uefi/ M004 rootless handoff image
boot/m005a/ isolated real-UD2 proof
boot/m005b/ graph-owned publication proof
boot/m005/ final retirement and erasure proof
include/v0/ version-0 ABI and contracts
src/ host-contract implementations
tests/ adversarial host verification
scripts/ image, QEMU, Windows, Linux, and evidence judges
docs/MILESTONE-005.md organic replacement failure model
docs/M005-FINAL-MACHINE.TXT final retirement and erasure contract
evidence/m004/ preserved rootless-handoff evidence
evidence/m005a/ preserved real-UD2 evidence
evidence/m005b/ preserved publication evidence
evidence/m005/ preserved final organic-recovery evidence
The v0_ prefix is the version-0 ABI namespace. It is not the project name.
LOOM is inspired by the unfinished cell architecture of Unununium / UUU. It is a new implementation. No Unununium source code or Git history is copied.
GNU General Public License version 2. See LICENSE.
REPORTS ARE CLAIMS. PRESERVED SERIAL BYTES, IMAGE BYTES, OBJECTS, PAGE-TABLE STATE, ARCHITECTURAL READ-BACKS, EXIT STATUS, AND HASHES ARE EVIDENCE.