STATUS.md

EoS — Feature Maturity

§25 of the platform architecture document requires every significant feature to carry a maturity state with the evidence that state demands. This file records them for eos.

Measured on 29 Aug 2026 against this branch. Every row below cites a command that was run, or says plainly that it was not.

States and the evidence each requires (§25)

State	Definition	Required evidence
Planned	Design intent; not yet available	Roadmap / issue / design spec
Experimental	Working prototype; API/behaviour may change	Tests + known limitations
Implemented	Feature exists and is usable	Code + functional tests
Validated	Verified on named targets/use cases	Test reports / CI / hardware matrix / benchmarks
Certified	Formally certified to a named standard	Certificate / audit reference

Unknown appears below where evidence was not collected. It is not a §25 state — it is an admission of an unmeasured claim, and should be driven to zero.

Repository-level

Overall	Experimental
Host evidence	CMake 4.2.3 / GCC 15.2.0; ctest 28/28 pass
Cross evidence	toolchains/arm-cortex-m4.cmake builds 23 static libraries; artifacts report architecture: armv7e-m. Footprint 15.8 KB flash, 26 KB RAM (arm-none-eabi-size -t)
Blocking Implemented	No board-level or on-hardware evidence. Nothing has been observed to boot.

Subsystem detail

Subsystem	Builds as	State	Evidence / gap
Kernel (task, sync, ipc, multicore, heap)	libeos_kernel.a	Experimental	Builds host and Cortex-M4; test_kernel passes. Mutex priority inheritance is transitive and recomputed from an invariant. No preemption or latency measurement.
HAL — dispatch layer	libeos_hal.a	Experimental	hal_common.c dispatches to a registered backend; test_drivers passes.
HAL — host backend	(in libeos_hal.a)	Planned	hal_linux.c implements a Linux backend, but eos_hal_linux_register() is never called and is declared in no public header. On a host build no backend registers, eos_hal_init() returns -1, and every HAL call silently no-ops.
HAL — extended peripherals (ADC, PWM, I²C, SPI, …)	(in libeos_hal.a)	Planned	hal_extended_stubs.c is 740 of the HAL's 3,185 lines and contains 144 (void)param; casts. The API exists; the peripherals do not.
Architecture — ARM Cortex-M4 / R5	23 .a targets	Experimental	Cross-compiles clean via arm-cortex-m4, arm-none-eabi-stm32f4 and arm-none-eabi-r5; artifacts verified armv7e-m / armv7 with objdump -f. Never executed — no board, no QEMU.
Architecture — RISC-V, Cortex-A/AArch64	—	Unknown	Toolchain files exist (riscv64-linux-gnu.cmake, aarch64-linux-gnu.cmake). Neither toolchain was installed, so neither was built. NOT RUN.
Boards	boards/*.yaml	Planned	84 descriptors, of which 71 are named generic-*. A descriptor is not a port; none has been validated on hardware.
Drivers + devicetree	libeos_drivers.a, libeos_devicetree.a	Experimental	Build; test_drivers and test_devicetree pass. The DTB parser is bounds-checked against untrusted input and has a fuzz target. Per-driver status unassessed.
Networking (eNet)	libeos_net.a	Planned	Per ADR-014. net/src/net.c is 190 lines carrying 20 (void)param; casts; eos_net_connect() is return -1. There is no protocol implementation of any kind. test_net passes because it tests the facade's argument validation, not a connection. §12 names TCP/IP, UDP, DHCP, DNS, MQTT, CoAP, HTTP and WebSocket — none exist.
Security (eSec) — keystore, ACL	libeos_security.a	Experimental	Builds; test_security passes.
Security (eSec) — RSA / ECC signatures	(in libeos_crypto.a)	Planned	Per ADR-011 / ADR-012. The RSA and ECC routines are stubs: eos_ecc_verify() accepted any 64-byte signature and eos_rsa_verify_sha256() compared only the trailing 32 bytes. They now refuse to run unless a build defines EOS_ALLOW_STUB_CRYPTO, and test_crypto_failclosed asserts that refusal. No signature verification exists.
Security (eSec) — AES, SHA-256, SHA-512	(in libeos_crypto.a)	Experimental	Build; test_crypto, test_crypto_aes, test_crypto_sha512 and test_crypto_vectors pass, including NIST vectors. Hand-written; not independently audited, which §4 discourages. ADR-012 selects Mbed TLS to replace them.
Power management	libeos_power.a	Experimental	Builds; test_power passes. Peripheral IDs are bounds-checked against negative values.
Filesystem	libeos_filesystem.a	Experimental	Builds; test_filesystem passes. No power-loss or wear-levelling evidence — the properties that matter most, and the ones unit tests cannot establish.
OTA	libeos_ota.a	Experimental	Builds; test_ota passes. eos_ota_apply() refuses without a registered authenticator, so an image's own declared hash is no longer treated as proof of origin. Not validated end-to-end against eBoot.
Packaging	libeos_pkg.a, libeos_systems.a	Experimental	Build; test_package and test_config pass. The config parser is bounds-checked against a package count exceeding EOS_MAX_PACKAGES (AddressSanitizer clean on the input that previously overflowed).
Debug (GDB stub, core dump)	libeos_debug.a	Experimental	Builds; test_debug passes. M-packet payloads are length- and charset-validated. eos_gdb_read_mem/write_mem still cast a uint32_t to a pointer, so the accept path is untested on 64-bit hosts.
POSIX compat adapter	libeos_compat.a	Experimental	Builds; test_os_adapter passes.
Examples (13 apps)	not in the root build	Experimental	examples/blink-gpio builds standalone and runs on the host. The remaining twelve are unverified.

Claims that must not be made until evidence exists

• That any board or architecture is supported beyond a boards/ descriptor and a clean cross-compile. Nothing here has been observed to boot.
• Any latency, throughput, power or boot-time figure. §25 requires a link to a reproducible benchmark; no benchmark methodology is published. The footprint numbers above are the one exception — arm-none-eabi-size -t is reproducible and the command is given.
• Any comparison against another OS.
• Real-time or deterministic guarantees — no scheduling latency measurement exists.
• That EoS has networking or signature verification. Both are Planned.