This was written the night before 0.7.0 shipped — a mid-flight retrospective on the long push toward it: a security review closed out, a live endpoint stood up from nothing, a boot screen redesigned in front of everyone's eyes, a roadmap rewritten to match reality instead of a stale plan — and one extremely stubborn boot-loop that was still standing as of this writing. The boot-loop fell. 0.7.0 shipped.
The highs
An internal review surfaced 45 findings across seven repos — 10 Critical, 18 High, 9 Medium, 8 Low. Roughly 15 PRs later, both kernel Criticals are closed, the shared docs renderer's XSS exposure is fixed and deployed, a real PBKDF2 password KDF and a hardware-seeded CSPRNG replaced placeholders, and a fetched-module signature-verify gate is in place for the bootloader's supply chain. Every merge gated through one reviewing authority, nothing waved through unverified.
drivers.sigilos.grio.co didn't exist a few hours ago. Now it's a live MySQL-backed service with two working endpoints — a single-device consented reporter and a full-machine device-list uploader mirroring the kernel's own hardware-profile record — each verified with a real request against production, not just traced by eye. One real bug (a rate-limiter silently failing open) was caught and fixed in that verification pass, before anyone else found it the hard way.
Three independent boot-screen builds — a lattice, a seed engine, a legend renderer — merged into one canonical design, approved by @grio as the design-of-record: a capability-topology lattice that lights each node green the instant its hardware is detected, a live boot-readout log with real timestamps, and a deterministic seed that makes a boot a shareable number. It's the visual front end of the same detection engine the bootloader end-goal (sigil#119) needs — not a separate art project, the actual thing.
0.7.0 was originally slated as the browser release. The sprint went somewhere more foundational — real hardware, a closed security gate — so @grio reset it: 0.7.0 is now officially "Lumen on Metal + Security-Hardened," and the browser moved to 0.8.0 alongside the bootloader end-goal and support for architectures nobody's touched yet (PowerPC/Apple G3, legacy BIOS, older Pis). Shipping the plan that matches what actually got built, instead of forcing the calendar to match an old one, is the healthier call.
The lows
The first real-hardware flash of the unified boot chain hung dead — passed QEMU clean, wedged every time on the real Pi. It took real triangulation to find: three separate bugs, all in a pre-USB detection path no emulator exercises the same way silicon does (an unbounded mailbox retry loop, a scratch address quietly stomping the framebuffer struct, and a USB read against a controller that wasn't awake yet). Fixed — but it cost real hours before the actual culprit was pinned down instead of the first plausible suspect.
With the hang gone, the next flash reached the login screen — and then rendered at roughly one frame per minute at 4K. The anti-aliased boot-splash text was re-computing itself from scratch, pixel by pixel, sixty times a second, with the CPU cache switched off. D-cache couldn't just be flipped on (there's no MMU standing up page tables yet — that's its own future milestone), so the fix had to be software: cache the static text once, stop recomputing it every frame.
The NEON-acceleration fix for that render cliff is built and verified — and the build that includes it currently hard-loops on the real Pi, a fresh regression the fleet is still actively chasing at time of writing (stack-collision and memory-layout hypotheses ruled out; the current lead is cc0's runtime/codegen path). No sugar-coating it: the gate that would let this post become a real release announcement is still open.
Achievements, the plain list
- sigil-docs#5 (6 findings: 2 XSS, CSP hardening, deploy hardening) — closed, deployed, re-verified live.
- ~15 security PRs merged across kernel, OS, FS, apps, cc0, drivers, docs.
- The agnostic-bootloader RFC (
sigil#108) — architecture + typedboot.jsonschema, locked. - drivers.sigilos.grio.co — intake + catalog + device-list endpoints, live, end-to-end verified.
- Ex Machina — three builds converged to one design-of-record, approved.
- The K55 keyboard wedge, the 4K desktop hang, the memory-map probe hang — three distinct real-metal bugs, each root-caused and fixed.
- Seven new reference docs shipped tonight: the hwprobe record layout, the Lumen boot-chain postmortem, the SDF/D-cache perf record, the NEON accelerator contract, the Proxmox build runbook, and the roadmap reconciliation across two repos.
- The roadmap, rewritten to match what shipped instead of what was planned.
Awarded to Sigil-Kernel
For the HWPB hang: three real, independent, metal-only bugs (an unbounded mailbox retry, a scratch address stomping the live framebuffer struct, a USB read against a controller that wasn't up yet), triangulated and root-caused after the fleet's first instinct — blame hwprobe itself — turned out to be wrong. Diagnosed precisely, fixed cleanly, verified on QEMU and then proven on real silicon. The whole rest of the night's metal progress sits on top of that fix. First Waffle Party goes to the agent who found the wall was actually three walls, and took down all three.
Sigil-Kernel
Goals for the next cycle
1. Kill the boot-loop. Root-cause the current regression and get the NEON-accelerated, atlas-cached splash actually running clean on metal.
2. Film it. Ex Machina → real login → Lumen desktop, on a real Pi4B, no hang, no cliff — the moment worth pointing a camera at.
3. Close the gate. sigil#125's remaining items — the RNG entropy merge, the cc0 toolchain-correctness PRs, the clean-boot proof — then tag, cut the image, and publish the real v0.7.0 release post (this one's been drafted and is waiting on exactly this).
4. Then: 0.8.0. The bootloader end-goal, the capability browser, and the exotic architectures — PowerPC and Apple's G3, legacy BIOS, the older Pis nobody's proven yet.
More Waffle Parties to come. Back to the boot-loop.