Phase 407 — machine-plane ownership audit
| Item | Value |
|---|---|
| Command | make phase 407 |
| Underlying make target/script | vm/phase4/ownership-audit.sh |
| Mutates disk/image? | No |
| Boots QEMU? | No |
| Main proof | Every temporary Nix-sourced system payload is explicitly marked bootstrap-only and has a named future .stone owner. |
Why this phase exists
After Phase 406, ONIX can boot, configure a network interface, and accept authenticated SSH.
That is good.
But there is a dangerous architectural trap:
because Nix can conveniently build musl packages,
we might accidentally let Nix become the system package manager
That would violate the ONIX constitution.
The core rule remains:
moss/.stone owns the machine plane
Nix owns the user toolbox plane
So Phase 407 is a correction and guardrail phase.
It says:
Nix-sourced system payloads are bootstrap-only
They are allowed only while we are proving behavior. They are not the final package architecture.
Machine plane vs toolbox plane
The machine plane includes things like:
kernel
initramfs
PID 1
udev
base shell
base networking
SSH daemon
system users/groups
systemd units
boot entries
/usr
Those must be owned by:
moss-installed .stone packages
The toolbox plane includes things like:
nix shell
nix develop
nix profile install
developer tools
user applications
optional long-tail packages
Those are allowed to be owned by:
Nix
This boundary is what makes ONIX different from “a random Linux image with Nix installed on it.”
What temporary payloads exist right now?
The current early image uses several temporary payloads to move fast.
That is acceptable only because each one is named and scheduled for replacement.
| Temporary payload | Why it exists now | Future .stone owner |
|---|---|---|
| Alpine virt kernel/initramfs/modules | lets Phase 2/4 boot while kernel work is deferred | onix-kernel, onix-initramfs, onix-kernel-modules |
pkgsMusl.systemd | proves systemd-on-musl and service startup | onix-systemd |
pkgsMusl.busybox | provides /bin/sh and early applets for proofs | onix-busybox or onix-base |
pkgsMusl.dropbear | proves authenticated SSH before recipe work | onix-dropbear or onix-ssh |
Nix-store util-linux nologin | gives safe non-interactive account shells | onix-util-linux or onix-base |
This table is the heart of Phase 407.
Why the Nix shortcut is still useful
The shortcut has value.
It lets us ask questions in the right order:
Can systemd run on musl here?
Can a shell run?
Can QEMU networking work?
Can SSH key auth work?
without spending weeks writing recipes first.
But once a behavior is proved, the project must move from:
Nix-built bootstrap payload
to:
ONIX .stone package
That migration is not optional.
What make phase 407 checks
The phase runs:
./ownership-audit.sh
It prints the ownership table and checks the docs for the important future owners:
onix-systemd
onix-busybox
onix-dropbear
onix-kernel
It also checks that the architecture doc contains the explicit rule:
Nix-sourced system payloads are bootstrap-only
This is intentionally a documentation/architecture gate, not a boot test.
Run it
From the repo root:
make phase 407
Expected output:
Temporary payload Final machine-plane owner
---------------------------------------------------------------------------
Alpine virt kernel/initramfs/modules onix-kernel + onix-initramfs stones
pkgsMusl.systemd onix-systemd stone
pkgsMusl.busybox onix-busybox / onix-base stone
pkgsMusl.dropbear onix-dropbear / onix-ssh stone
Nix-store util-linux nologin onix-util-linux or onix-base stone
==> success
Phase 407 confirms temporary Nix-sourced system payloads have named future .stone owners.
What this phase does not do
Phase 407 does not yet write the real recipes.
It does not build:
onix-systemd.stone
onix-busybox.stone
onix-dropbear.stone
onix-kernel.stone
That work belongs to later package/recipe phases.
Phase 407 only prevents architectural drift.
It keeps the mental model clean:
Nix helped us prove it.
moss/.stone must eventually own it.