Due Diligence Exceptions Register
Exception Policy
P0findings cannot be accepted as residual risk. UnclosedP1findings remain blocking. DD30 alone has the terminal owner-approved dispositionRETIRED_ACCEPTED_GAP, documented in DD30 retirement decision.- Active exceptions reference a finding and retain risk owner, approving authority, compensating controls, decision date and expiration date.
- Active exceptions expire automatically; expired exceptions force
FAILuntil renewed or remediated. DD30’s retired entry usesN/Afor expiry and cannot be used to accept another finding or an open regression.
On 2026-09-14 Lukas Bower approved permanent retirement of DD30’s recurring
milestone/release approvals, whole-file source bindings and expiry. DD30 retains
P1 severity and the unexecuted dynamic fault/wake test. Its repaired historical
finding is RETIRED_ACCEPTED_GAP, and EX30 is RETIRED. Ordinary IPC review,
regression coverage and other audit/target requirements remain in force.
The original release waiver,
M27 approval, and
M27a approval retain their exact decisions, source
identities and historical dates. Those DD30 renewal conditions are superseded
by the retirement decision. Human Rust review remains
independent: due_diligence_gate.sh --check-rust-review 27|27a checks a selected
historical review against its source, without applying DD30 expiry. New code
still requires its own review through the normal contribution workflow.
The separate release Stage 01–04 carry-forward and M27 completion decision retain their original scopes and disclosed missing evidence. DD30 retirement grants no target PASS or broader release carry-forward.
Register
| Exception ID | Related Finding | Severity | Scope | Rationale | Compensating Controls | Risk Owner | Approved By | Decision Date | Expiration Date | Status |
|---|---|---|---|---|---|---|---|---|---|---|
EX-2026-0016 |
DD-2026-0016 |
P2 |
Pi 4 driver-task isolation substrate Rust risk-ratchet delta | seL4 object allocation and isolated driver-task setup required additional explicit unsafe syscall and pointer-boundary wrappers while strongest hardware-state migration remained in progress. | Verified remediation at 68dd774d6ceb0706e162877f74766dd324572425: lifecycle validation passed 19 tests and the exception-register gate passed. This is offline engineering and audit closure only, not live Pi or every-boot WiFi proof. |
driver-task-owner |
Lukas Bower |
2026-05-22 |
2026-06-19 |
CLOSED |
EX-2026-0017 |
DD-2026-0017 |
P2 |
Milestone 26c due-diligence Rust risk-ratchet baseline refresh | The 26c QEMU closure froze the path-filtered scanner counts before the cfg-test false-positive defect was identified. | Verified remediation at 68dd774d6ceb0706e162877f74766dd324572425: exact global, linked-runtime/HAL, and outside-component scanner contracts plus lifecycle and exception-register gates passed. This is offline engineering and audit closure only, not live Pi or every-boot WiFi proof. |
audit-owner |
Lukas Bower |
2026-06-28 |
2026-07-28 |
CLOSED |
EX-2026-0018 |
DD-2026-0018 |
P2 |
Linked-runtime CYW43/SDIO production unsafe delta | Linux-aligned CYW43/SDIO ownership required explicit volatile shared-ring, DPC, MMIO, and seL4 notification boundaries in the isolated runtime and HAL. | Verified remediation at 68dd774d6ceb0706e162877f74766dd324572425: current counts are global 691/38/240/96, linked-runtime/HAL 144/0/2/0, and outside-component 547/38/238/96; historical replay, 466 runtime tests, 1425 Pi-feature root tests, 25 ABI tests, packaging, QEMU Stages 01-05, and Pi offline Stages 01-02 passed. This is offline engineering and audit closure only, not live Pi or every-boot WiFi proof. |
driver-task-owner |
Lukas Bower |
2026-07-14 |
2026-07-28 |
CLOSED |
EX-2026-0020 |
DD-2026-0020 |
P2 |
Milestone 26e m26e-worker-abi-identity-notifications and m26e-worker-image-pipeline-loader Worker mapped-page and target entry boundaries; passive MCS additions remain cross-referenced to EX-2026-0024 |
The Worker must access its mapped ABI page, install its IPC buffer, enter fixed-capability MCS receive/reply syscalls, signal bounded READY/fault hints, and raise a standard fault. These kernel and shared-memory boundaries remain explicit unsafe operations. Normal work follows the current passive Call/Reply ABI, not the original notification-only design. | The 2026-08-11 approval expired on 2026-09-11. Current scope was inspected at clean 22e3d08ffb5d8ca2a5b3312ceb354f6395532219; this scope refresh is not approval or verified remediation. The original decision recorded twelve target-only blocks and 25 scoped host tests plus AArch64 build/Clippy and three Worker ELF/stripped-metadata checks; those are historical results. The current apps/worker-heart/src/target_runtime.rs still has twelve blocks with local SAFETY: invariants, but uses NBSendRecvWithMRs for READY-to-receive and ReplyRecvWithMRs for atomic reply-to-receive. Validate the sealed pointer-free role/generation/slot/call-label descriptor; retain single-producer sequence-last READY, control, receipt and completion records; accept only the exact next call sequence. The supervisor owns mapping lifetime and one Reply association; notifications grant no normal-work authority. Panic or invalid protocol state retains completion identity before standard-fault containment. worker-task-abi denies unsafe code. Preserve the later passive-Worker boundary and controls of EX-2026-0024 without conflating the original scope. Exact-source host contracts, selected-profile AArch64 builds and image bindings, independent unsafe-boundary review, and applicable QEMU/Pi lifecycle, fault, pressure and repeatability evidence remain mandatory. No P0/P1 finding or incomplete release gate is accepted by this P2 exception. Renewal was approved by Lukas Bower on 2026-09-13 through 2026-10-13; the unchanged validation and P0/P1 conditions remain mandatory. Decision evidence: out/release-qualification/1.0.0-beta-8bc556850-20260909/continuation-a45a3d9cc-20260910T083610Z/stage5-closure-20260910T124827Z/continuation-20260912T212227Z/exception-renewal-approval.json. |
worker-runtime-owner |
Lukas Bower |
2026-09-13 |
2026-10-13 |
APPROVED_ACTIVE |
EX-2026-0021 |
DD-2026-0021 |
P2 |
Milestone 26e m26e-console-network-service-isolation base console and bounded publication boundaries; direct VirtIO and GENET additions remain separately governed by EX-2026-0024 and EX-2026-0025 |
The console service requires volatile bounded ABI-page access, one-time disjoint smoltcp storage, IPC-buffer setup, notification Poll/Wait/Signal, exported virtual-counter reads and standard-fault transfer. Device-specific extensions are distinct from these base entry and publication boundaries. | The 2026-08-11 approval expired on 2026-09-11. Current scope was inspected at clean 22e3d08ffb5d8ca2a5b3312ceb354f6395532219; this scope refresh is not approval or verified remediation. The original decision recorded twelve blocks plus an unsafe entry declaration, 13 host tests and three packaging tests; those counts and PASS statements describe the August snapshot. Current apps/console-network-runtime/src/kernel.rs has seventeen blocks plus its entry declaration: the original families, a same-page completion watermark, direct-VirtIO/GENET layout reads, direct IRQ acknowledgement and typed direct-fault transfer. Keep EX-2026-0024/EX-2026-0025 device scopes separate. The sealed descriptor fixes slots, directions, generated timer frequency and four 4096-byte normal pages; GENET uses its separate sealed 32-page CPU-only extension. Same-page watermarks do not replace the semantic event commit. Only bounded retained work or publication credit permits Poll; genuine idle blocks in Wait. Retain one listener, exact generation/sequence bounds, sequence-last publication, disjoint static storage, W^X/image-hash binding and standard-fault containment. ABI and transport libraries forbid unsafe code. Exact-source host contracts, selected-profile AArch64 builds and image bindings, independent unsafe-boundary review, and applicable QEMU/Pi lifecycle, fault, pressure and repeatability evidence remain mandatory. No P0/P1 finding or incomplete release gate is accepted by this P2 exception. Renewal was approved by Lukas Bower on 2026-09-13 through 2026-10-13; the unchanged validation and P0/P1 conditions remain mandatory. Decision evidence: out/release-qualification/1.0.0-beta-8bc556850-20260909/continuation-a45a3d9cc-20260910T083610Z/stage5-closure-20260910T124827Z/continuation-20260912T212227Z/exception-renewal-approval.json. |
console-network-owner |
Lukas Bower |
2026-09-13 |
2026-10-13 |
APPROVED_ACTIVE |
EX-2026-0022 |
DD-2026-0022 |
P2 |
Milestone 26e m26e-ninedoor-service-isolation passive target descriptor, frame and explicit MCS Reply boundary |
The passive NineDoor child reads a sealed descriptor and bounded shared request, writes its exclusive response frame, installs its IPC buffer, receives and replies with an explicit MCS Reply, and enters standard-fault containment. These raw memory and kernel boundaries remain despite consolidation of the original implementation. | The 2026-08-11 approval expired on 2026-09-11. Current scope was inspected at clean 22e3d08ffb5d8ca2a5b3312ceb354f6395532219; this scope refresh is not approval or verified remediation. The August decision recorded nine blocks plus an unsafe entry declaration and scoped transport/runtime, packaging and selected QEMU MCS target checks. Current apps/nine-door-runtime/src/kernel.rs has six blocks plus the entry declaration after explicit-MR and atomic ReplyRecv consolidation; the reduction is not complete remediation. Validate descriptor alignment, exact layout, cap rights and fixed slots, distinct bounded request/response mappings, exact badge, generation, request sequence, message label/length and absence of extra caps. Install the mapped IPC buffer in the sole initial RecvWithMRs boundary; ReplyRecvWithMRs consumes the outstanding Reply association and queues the same child atomically. Only the child writes its response and root reads after reply. Retain release/acquire publication, typed parser errors and generated passive standard-fault recovery; no operational classic-scheduler branch is admitted. The safe parser/transport layers forbid unsafe code. Exact-source host contracts, selected-profile AArch64 builds and image bindings, independent unsafe-boundary review, and applicable QEMU/Pi lifecycle, fault, pressure and repeatability evidence remain mandatory. No P0/P1 finding or incomplete release gate is accepted by this P2 exception. Renewal was approved by Lukas Bower on 2026-09-13 through 2026-10-13; the unchanged validation and P0/P1 conditions remain mandatory. Decision evidence: out/release-qualification/1.0.0-beta-8bc556850-20260909/continuation-a45a3d9cc-20260910T083610Z/stage5-closure-20260910T124827Z/continuation-20260912T212227Z/exception-renewal-approval.json. |
ninedoor-service-owner |
Lukas Bower |
2026-09-13 |
2026-10-13 |
APPROVED_ACTIVE |
EX-2026-0023 |
DD-2026-0023 |
P2 |
Milestone 26e MCS ABI, critical TCB, service/Worker constructors and linked-driver standard-fault boundary; historical deltas are distinct from later EX-2026-0024/EX-2026-0025 additions |
seL4 SC/SchedControl, explicit Reply, timeout, receive, retype, mapping, IPC-buffer and child-page operations cross raw kernel or pointer boundaries. Existing safe adapters constrain callers but do not remove those operations. Impossible MCS misuse must fail closed rather than continue with ambiguous authority. | The 2026-08-11 approval expired on 2026-09-11. Current scope was inspected at clean 22e3d08ffb5d8ca2a5b3312ceb354f6395532219; this scope refresh is not approval or verified remediation. The original decision recorded a measured addition of 71 production unsafe constructs, three precise expects and six fail-closed panics; these are historical deltas, not current whole-file totals. The frozen Rust snapshot committed as 22e3d08ff passed the canonical scanner at global unsafe/unwrap/expect/panic 827/38/242/102, linked HAL 173/0/2/0, and outside 654/38/240/102, within the unchanged baseline. That establishes count consistency only. Retain local SAFETY: invariants and typed capability/error adapters; validate selected seL4 16 headers, invocation shapes, object/refill sizes and per-core admission. Keep children suspended through exact registry/receiver admission, W^X image binding, single-owner HAL access, generation-bound publication, one Reply association and complete teardown before reuse. Panic and impossible host/MCS syscall states remain fail-closed. Later device/passive additions remain scoped by EX-2026-0024/EX-2026-0025; separately reviewed TLS, PCIe and ordered-timer fixes are not blanket clearance for this historical delta. Exact-source host contracts, selected-profile AArch64 builds and image bindings, independent unsafe-boundary review, and applicable QEMU/Pi lifecycle, fault, pressure and repeatability evidence remain mandatory. No P0/P1 finding or incomplete release gate is accepted by this P2 exception. Renewal was approved by Lukas Bower on 2026-09-13 through 2026-10-13; the unchanged validation and P0/P1 conditions remain mandatory. Decision evidence: out/release-qualification/1.0.0-beta-8bc556850-20260909/continuation-a45a3d9cc-20260910T083610Z/stage5-closure-20260910T124827Z/continuation-20260912T212227Z/exception-renewal-approval.json. |
mcs-runtime-owner |
Lukas Bower |
2026-09-13 |
2026-10-13 |
APPROVED_ACTIVE |
EX-2026-0024 |
DD-2026-0024 |
P2 |
Milestone 26e QEMU child-owned VirtIO data plane and passive-Worker kernel boundary | Exclusive VirtIO MMIO, coherent DMA descriptors, seL4 IRQ acknowledgement, standard-fault transfer, and passive MCS ReplyRecv cannot be expressed in safe Rust. | Thirteen measured net production unsafe constructs are restricted to fixed QEMU VirtIO MMIO/DMA/IRQ access, root’s terminal device reset, and the shared passive-Worker Call/Reply boundary. Every block has a local SAFETY: invariant. Compiler admission fixes the single device owner, MMIO/IRQ cap, two queues, and 16 RX plus 16 TX pages; ABI validation, exact Reply ownership, typed terminal faults, focused tests, the full workspace gate, and clean Mac HVF plus Jetson KVM medium/high pressure are mandatory. This does not qualify any Pi physical network driver or Pi hardware behavior. Renewal: 2026-09-27 decision. |
console-network-owner |
Lukas Bower |
2026-09-27 |
2026-10-27 |
APPROVED_ACTIVE |
EX-2026-0025 |
DD-2026-0025 |
P2 |
Milestone 26e Pi 4 child-owned direct GENET CPU data plane | Cacheable cross-address-space atomic shared pages, root-only initialization and stable observation, sealed descriptor reads, and terminal fault transfer cannot be expressed in safe Rust. | Twenty measured net production unsafe constructs are restricted to seven console shared-page atomic sites, one sealed-layout volatile read, nine GENET driver access/fault sites, two root-only suspended-child initialization aliases, and one root stable diagnostic view over the already-declared CPU-only control page. Every block has a local SAFETY: invariant. The compiler derives this mode only for exact bcmgenet-v5; the 32 pages carry no physical or device authority; fixed SPSC roles use generation-bound sequence-last Acquire/Release publication and bounded cursor validation; the diagnostic reader requires two equal nonzero commits and the exact generation and grants no packet or IRQ authority; legacy root mediation remains until exact READY and cannot reopen afterward; reciprocal notifications and paired containment fence both children. Focused ABI/runtime/root tests, workspace and Rust-risk gates, the selected Pi AArch64 build, exact clean-image verification, and fresh Pi correctness/performance evidence remain mandatory. Build or host evidence is not Pi acceptance. Renewal: 2026-09-28 decision. |
console-network-owner |
Lukas Bower |
2026-09-28 |
2026-10-31 |
APPROVED_ACTIVE |
EX-2026-0030 |
DD-2026-0030 |
P1 |
dd30-restricted-ipc-dynamic-fault-wake | Lukas Bower permanently accepts the remaining dynamic fault/wake verification gap after the recorded IPC repair and source/ABI/pure/emitted review; see DD30 retirement decision. | Preserve the repair and regression coverage; dynamic fault/wake remains UNEXECUTED; ordinary IPC review and new-defect lifecycle still apply; no other finding or target proof is waived. | Lukas Bower | Lukas Bower | 2026-09-14 | N/A | RETIRED |
EX-2026-0024 renewal on 2026-09-27
Lukas Bower, the named approver, stated in the active M28g task conversation:
“I re-approve it unless there is a fix.” The preceding request proposed renewal
through 2026-10-27; this records that bounded term for the existing P2 scope.
The scoped VirtIO and passive-Worker source has not changed between tested
checkpoint 020a516300b75e55f91606a77106c76ef74f665c and this decision.
No verified safe replacement removes the raw MMIO, DMA, IRQ, fault-transfer and
seL4 ReplyRecv boundaries while preserving the selected behavior. This is risk
acceptance for those explicit unsafe sites, not verified remediation or a
finding closure.
All existing controls remain mandatory. The current checkpoint has passing Mac HVF medium/high pressure, but the selected Jetson KVM medium/high pressure lane is unexecuted. The earlier QEMU and Pi Stage 05 attempts failed before this decision and retain that result. Renewal does not convert them to PASS, accept a Pi network driver, approve Release B publication, or waive a new correctness finding. Revalidate the register and run the outstanding evidence on the exact candidate before release qualification.
EX-2026-0025 renewal on 2026-09-28
Lukas Bower, the named approver, directed in the active M28g task conversation:
“Fix EX-2026-0025 or extend it through 31 October.” The selected direct-GENET
boundary still needs fixed mapped-page atomics, sealed descriptor reads,
root-only initialization aliases and terminal fault transfer. No verified safe
replacement preserves those operations on the selected Pi profile. The owner
therefore renews the existing P2 scope through 2026-10-31; this is bounded risk
acceptance, not verified remediation.
All existing controls and independent review remain mandatory. The earlier Pi Stage 05 attempt failed on the expired exception and keeps that result. Renewal does not promote its prior stages, the RAM boot, physical media, performance or the overall 1.2.0 release. Revalidate the register and rerun affected gates on the exact candidate.
Lifecycle States
PROPOSED: Captured but not approved.APPROVED_ACTIVE: Approved and not expired.EXPIRED: Past expiration date; invalid for release.REVOKED: Withdrawn before expiration.CLOSED: No longer needed due to verified remediation.