Migrate flow-kernel to the Tiny Core Linux substrate

.github/workflows/ci.yml

@@ -2,7 +2,6 @@ name: Kernel CI
 
 on:
   push:
-    branches: [main]
   pull_request:
     branches: [main]
   workflow_dispatch:
@@ -15,87 +14,272 @@ permissions:
   contents: read
 
 jobs:
-  x86_64:
-    name: x86_64 freestanding boot
+  tinycore-x86_64:
+    name: Tiny Core CorePure64 system health
     runs-on: ubuntu-latest
     timeout-minutes: 15
 
     steps:
-      - name: Checkout kernel
-        uses: actions/checkout@v7
-
-      - name: Checkout Flow compiler
+      - name: Checkout Flow kernel integration
         uses: actions/checkout@v7
-        with:
-          repository: flooooooooooow/flow
-          path: flow
 
-      - name: Set up Flow Python environment
-        uses: ./flow/.github/actions/setup-python
+      - name: Validate diagnostic tooling
+        run: |
+          python3 -m py_compile diagnostics/check_boot.py diagnostics/compare_health.py
+          python3 - <<'PY'
+          import json
+          from pathlib import Path
+          contract = json.loads(Path('diagnostics/boot-sequence.json').read_text())
+          assert contract['schema'] == 2
+          ids = [s['id'] for s in contract['sequence']]
+          assert len(ids) == len(set(ids))
+          assert ids[0] == 'kernel'
+          assert ids[-1] == 'complete'
+          PY
 
-      - name: Install freestanding and boot-test toolchain
+      - name: Install build and boot-test tools
         run: |
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
+            binutils \
             clang \
+            cpio \
+            curl \
+            file \
             lld \
-            grub-common \
-            grub-pc-bin \
-            xorriso \
             qemu-system-x86
 
-      - name: Build freestanding x86_64 ELF
+      - name: Cache Tiny Core base
+        uses: actions/cache@v4
+        with:
+          path: /tmp/tinycore
+          key: tinycore-corepure64-17.1-linux-6.18.35
+
+      - name: Fetch and verify Tiny Core Linux base
         env:
-          FLOW: ${{ github.workspace }}/flow/flow
+          TC_MAJOR: 17.x
+          TC_VERSION: '17.1'
+          TC_KERNEL: 6.18.35-tinycore64
+        run: |
+          bash tinycore/fetch.sh /tmp/tinycore
+          test -s /tmp/tinycore/vmlinuz64
+          test -s /tmp/tinycore/corepure64.gz
+          test -s /tmp/tinycore/manifest.txt
+          file /tmp/tinycore/vmlinuz64
+          gzip -t /tmp/tinycore/corepure64.gz
+          grep -Fx 'tinycore_version=17.1' /tmp/tinycore/manifest.txt
+          grep -Fx 'kernel_version=6.18.35-tinycore64' /tmp/tinycore/manifest.txt
+          cat /tmp/tinycore/manifest.txt
+
+      - name: Boot stock Tiny Core kernel under QEMU
+        run: |
+          set +e
+          timeout 20s qemu-system-x86_64 \
+            -machine accel=tcg \
+            -cpu max \
+            -m 256M \
+            -kernel /tmp/tinycore/vmlinuz64 \
+            -initrd /tmp/tinycore/corepure64.gz \
+            -append 'console=ttyS0' \
+            -serial file:/tmp/tinycore-serial.log \
+            -display none \
+            -no-reboot \
+            -no-shutdown
+          rc=$?
+          set -e
+
+          cat /tmp/tinycore-serial.log
+          if [[ "$rc" -ne 0 && "$rc" -ne 124 ]]; then
+            echo "QEMU exited unexpectedly with status $rc" >&2
+            exit "$rc"
+          fi
+          grep -F 'Linux version 6.18.35-tinycore64' /tmp/tinycore-serial.log
+          if grep -Eqi 'Kernel panic|not syncing|BUG:|Oops:|general protection fault|Unable to mount root fs|No working init found|Attempted to kill init' /tmp/tinycore-serial.log; then
+            echo 'fatal signature detected in stock Tiny Core boot' >&2
+            exit 1
+          fi
+
+      - name: Checkout Flow compiler externally
+        run: |
+          git clone --depth 1 https://github.com/flooooooooooow/flow.git /tmp/flow
+          test -x /tmp/flow/flow
+          test ! -e ./flow
+
+      - name: Build libc-free Flow hello service
+        env:
+          FLOW: /tmp/flow/flow
           FLOW_HOST: python
-          PYTHONPATH: ${{ github.workspace }}/flow/src
+          PYTHONPATH: /tmp/flow/src
         run: |
-          chmod +x "$FLOW" x86_64/build.sh
-          bash x86_64/build.sh /tmp/flow-kernel-build
-          test -s /tmp/flow-kernel-build/flow-kernel.elf
-          grub-file --is-x86-multiboot2 /tmp/flow-kernel-build/flow-kernel.elf
-          llvm-readelf -h /tmp/flow-kernel-build/flow-kernel.elf
-          llvm-nm /tmp/flow-kernel-build/flow-kernel.elf | grep -F 'flow_export_kernel_main'
-
-      - name: Build bootable GRUB image
+          chmod +x /tmp/flow/flow examples/build-hello.sh
+          bash examples/build-hello.sh /tmp/flow-hello-build
+          test -x /tmp/flow-hello-build/flow-hello
+          file /tmp/flow-hello-build/flow-hello
+          ! readelf -l /tmp/flow-hello-build/flow-hello | grep -F 'Requesting program interpreter'
+          ! nm -u /tmp/flow-hello-build/flow-hello | grep .
+
+      - name: Add diagnostics and Flow service to CorePure64
         run: |
-          mkdir -p /tmp/flow-kernel-iso/boot/grub
-          cp /tmp/flow-kernel-build/flow-kernel.elf /tmp/flow-kernel-iso/boot/flow-kernel.elf
-          cp x86_64/grub.cfg /tmp/flow-kernel-iso/boot/grub/grub.cfg
-          grub-mkrescue -o /tmp/flow-kernel.iso /tmp/flow-kernel-iso
-          test -s /tmp/flow-kernel.iso
+          mkdir -p /tmp/flow-overlay/opt
+          cp /tmp/flow-hello-build/flow-hello /tmp/flow-overlay/opt/flow-hello
+          cp diagnostics/init.sh /tmp/flow-overlay/opt/flow-diag-init
+          cp diagnostics/reboot_init.sh /tmp/flow-overlay/opt/flow-reboot-init
+          cp diagnostics/poweroff_init.sh /tmp/flow-overlay/opt/flow-poweroff-init
+          chmod 0755 \
+            /tmp/flow-overlay/opt/flow-hello \
+            /tmp/flow-overlay/opt/flow-diag-init \
+            /tmp/flow-overlay/opt/flow-reboot-init \
+            /tmp/flow-overlay/opt/flow-poweroff-init
+
+          gzip -dc /tmp/tinycore/corepure64.gz > /tmp/flow-corepure64.cpio
+          (
+            cd /tmp/flow-overlay
+            find . -print0 | cpio --null -o --format=newc --owner=0:0
+          ) >> /tmp/flow-corepure64.cpio
+          gzip -9 < /tmp/flow-corepure64.cpio > /tmp/flow-corepure64.gz
+          gzip -t /tmp/flow-corepure64.gz
 
-      - name: Boot smoke under QEMU
+      - name: Run ordered Linux system-health sequence
         run: |
           set +e
-          timeout 10s qemu-system-x86_64 \
+          timeout 30s qemu-system-x86_64 \
             -machine accel=tcg \
-            -m 128M \
-            -cdrom /tmp/flow-kernel.iso \
-            -serial file:/tmp/flow-kernel-serial.log \
+            -cpu max \
+            -m 256M \
+            -kernel /tmp/tinycore/vmlinuz64 \
+            -initrd /tmp/flow-corepure64.gz \
+            -append 'console=ttyS0 rdinit=/opt/flow-diag-init' \
+            -serial file:/tmp/flow-diagnostics-serial.log \
             -display none \
             -no-reboot \
             -no-shutdown
           rc=$?
           set -e
 
-          cat /tmp/flow-kernel-serial.log
+          cat /tmp/flow-diagnostics-serial.log
           if [[ "$rc" -ne 0 && "$rc" -ne 124 ]]; then
             echo "QEMU exited unexpectedly with status $rc" >&2
             exit "$rc"
           fi
 
-          grep -F 'Flow kernel: entry' /tmp/flow-kernel-serial.log
-          grep -F 'Flow kernel: boot contract accepted' /tmp/flow-kernel-serial.log
+          python3 diagnostics/check_boot.py \
+            /tmp/flow-diagnostics-serial.log \
+            --report /tmp/boot-health.json
+          cp /tmp/boot-health.json /tmp/boot-health-baseline-candidate.json
+
+      - name: Compare health with committed baseline
+        run: |
+          python3 diagnostics/compare_health.py \
+            /tmp/boot-health.json \
+            diagnostics/baseline-health.json \
+            --report /tmp/boot-health-regression.json
+
+      - name: Verify reboot lifecycle path
+        run: |
+          set +e
+          timeout 20s qemu-system-x86_64 \
+            -machine accel=tcg \
+            -cpu max \
+            -m 256M \
+            -kernel /tmp/tinycore/vmlinuz64 \
+            -initrd /tmp/flow-corepure64.gz \
+            -append 'console=ttyS0 rdinit=/opt/flow-reboot-init' \
+            -serial file:/tmp/flow-reboot-serial.log \
+            -display none \
+            -no-reboot
+          rc=$?
+          set -e
+
+          cat /tmp/flow-reboot-serial.log
+          grep -F 'FLOW_LIFECYCLE REBOOT_START' /tmp/flow-reboot-serial.log
+          grep -F 'FLOW_LIFECYCLE REBOOT_REQUESTED' /tmp/flow-reboot-serial.log
+          if grep -Fq 'FLOW_LIFECYCLE REBOOT_FAILED' /tmp/flow-reboot-serial.log; then
+            echo 'guest reboot syscall returned unexpectedly' >&2
+            exit 1
+          fi
+          if [[ "$rc" -ne 0 ]]; then
+            echo "reboot lifecycle QEMU exited with unexpected status $rc" >&2
+            exit "$rc"
+          fi
+
+      - name: Verify poweroff lifecycle path
+        run: |
+          set +e
+          timeout 20s qemu-system-x86_64 \
+            -machine accel=tcg \
+            -cpu max \
+            -m 256M \
+            -kernel /tmp/tinycore/vmlinuz64 \
+            -initrd /tmp/flow-corepure64.gz \
+            -append 'console=ttyS0 rdinit=/opt/flow-poweroff-init' \
+            -serial file:/tmp/flow-poweroff-serial.log \
+            -display none \
+            -no-reboot
+          rc=$?
+          set -e
+
+          cat /tmp/flow-poweroff-serial.log
+          grep -F 'FLOW_LIFECYCLE POWEROFF_START' /tmp/flow-poweroff-serial.log
+          grep -F 'FLOW_LIFECYCLE POWEROFF_REQUESTED' /tmp/flow-poweroff-serial.log
+          if grep -Fq 'FLOW_LIFECYCLE POWEROFF_FAILED' /tmp/flow-poweroff-serial.log; then
+            echo 'guest poweroff syscall returned unexpectedly' >&2
+            exit 1
+          fi
+          if [[ "$rc" -ne 0 ]]; then
+            echo "poweroff lifecycle QEMU exited with unexpected status $rc" >&2
+            exit "$rc"
+          fi
+
+      - name: Probe upstream eBPF and BTF kernel configuration metadata
+        continue-on-error: true
+        run: |
+          CONFIG=/tmp/tinycore/config-6.18.35-tinycore64
+          urls=(
+            'https://repo.tinycorelinux.net/17.x/x86_64/release/src/kernel/config-6.18.35-tinycore64'
+            'https://www.tinycorelinux.net/17.x/x86_64/release/src/kernel/config-6.18.35-tinycore64'
+            'https://ftp.icm.edu.pl/packages/linux-tinycorelinux/17.x/x86_64/release/src/kernel/config-6.18.35-tinycore64'
+          )
+          found=0
+          for url in "${urls[@]}"; do
+            if curl --fail --location --connect-timeout 8 --max-time 30 --output "$CONFIG.part" "$url"; then
+              mv "$CONFIG.part" "$CONFIG"
+              echo "kernel_config_source=$url" | tee /tmp/tinycore/config-source.txt
+              found=1
+              break
+            fi
+            rm -f "$CONFIG.part"
+          done
+          if [[ "$found" -ne 1 ]]; then
+            echo 'Kernel config metadata unavailable; live boot/system-health validation remains authoritative.' >&2
+            exit 1
+          fi
+
+          grep -E '^(CONFIG_BPF|CONFIG_BPF_SYSCALL|CONFIG_BPF_JIT|CONFIG_KPROBES|CONFIG_BPF_EVENTS|CONFIG_DEBUG_INFO_BTF)=' \
+            "$CONFIG" | tee /tmp/tinycore/bpf-config.txt
+          grep -Fx 'CONFIG_BPF=y' /tmp/tinycore/bpf-config.txt
+          grep -Fx 'CONFIG_BPF_SYSCALL=y' /tmp/tinycore/bpf-config.txt
+          grep -Fx 'CONFIG_BPF_JIT=y' /tmp/tinycore/bpf-config.txt
+          grep -Fx 'CONFIG_KPROBES=y' /tmp/tinycore/bpf-config.txt
+          grep -Fx 'CONFIG_BPF_EVENTS=y' /tmp/tinycore/bpf-config.txt
+          grep -Fx 'CONFIG_DEBUG_INFO_BTF=y' /tmp/tinycore/bpf-config.txt
 
-      - name: Upload kernel artifacts
+      - name: Upload system-health evidence
         if: always()
         uses: actions/upload-artifact@v4
         with:
-          name: flow-kernel-x86_64
+          name: tinycore-x86_64-system-health
           path: |
-            /tmp/flow-kernel-build/flow-kernel.elf
-            /tmp/flow-kernel.iso
-            /tmp/flow-kernel-serial.log
+            /tmp/tinycore-serial.log
+            /tmp/flow-diagnostics-serial.log
+            /tmp/flow-reboot-serial.log
+            /tmp/flow-poweroff-serial.log
+            /tmp/boot-health.json
+            /tmp/boot-health-baseline-candidate.json
+            /tmp/boot-health-regression.json
+            /tmp/tinycore/manifest.txt
+            /tmp/tinycore/config-6.18.35-tinycore64
+            /tmp/tinycore/config-source.txt
+            /tmp/tinycore/bpf-config.txt
+            /tmp/flow-hello-build/flow-hello
           if-no-files-found: warn
-          retention-days: 7
+          retention-days: 14

.github/workflows/diagnostics.yml

@@ -0,0 +1,25 @@
+name: Diagnostics Unit Tests
+
+on:
+  push:
+    paths:
+      - 'diagnostics/**'
+      - '.github/workflows/diagnostics.yml'
+  pull_request:
+    paths:
+      - 'diagnostics/**'
+      - '.github/workflows/diagnostics.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  diagnostics:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: Compile diagnostics tooling
+        run: python3 -m py_compile diagnostics/check_boot.py diagnostics/compare_health.py diagnostics/test_health.py
+      - name: Validate health protocol
+        run: python3 -m unittest diagnostics.test_health -v

.github/workflows/pages.yml

@@ -0,0 +1,40 @@
+name: Pages
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'site/**'
+      - '.github/workflows/pages.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Configure Pages
+        uses: actions/configure-pages@v5
+
+      - name: Upload site
+        uses: actions/upload-pages-artifact@v3
+        with:
+          path: site
+
+      - name: Deploy
+        id: deployment
+        uses: actions/deploy-pages@v4