SHINESEA

A verified contiguous-extent filesystem image core for boot media, small operating systems, recovery environments, and deterministic test images.

SHINESEA is written in Rust. The parser, verifier, block-device interfaces, boot contract, executable envelope, and handoff structures support no_std with alloc. Host tools and evidence runners use the optional std feature.

CURRENT STATE

FORMAT V2 MIRRORED CATALOG IMPLEMENTED TRUE
CROSS PLATFORM CLOSURE GATE PENDING
FORMAT V2 RETAINED EVIDENCE PENDING
V1.0.0 RELEASED FALSE
REAL OPPONENT EVIDENCE AVAILABLE FALSE
MEASURED FILESYSTEM DEFEAT CLAIM NONE

The repository is under a hard feature freeze tracked by issue #68. Only defect repair, verification, release engineering, documentation, and cleanup are allowed before v1.0.0.

DESIGN

block size                 4096 bytes
block 0                    boot descriptor area
block 1                    superblock A
block 2                    superblock B
format v2 catalog A        catalog_start
format v2 catalog B        catalog_start + catalog_blocks
data                         after both catalog copies
allocation                  contiguous extents
mutation                    append-only catalog records
replacement                 copy-on-replace
payload integrity           CRC32C
metadata recovery           redundant superblocks and mirrored catalogs

Format v1 remains verifier-readable and writer-read-only. Writers emit format v2. No implicit migration is performed.

CATALOG TRUTH LAW

Each format-v2 catalog copy is decoded and semantically validated independently.

Accepted states:

one valid copy and one invalid copy
byte-identical valid copies
one exact whole-record append extension of the other

Rejected states:

both copies invalid
valid non-prefix divergence
nonzero bytes after the first empty record slot
invalid namespace or extent semantics
unsupported version, flags, or geometry

PORTING SURFACE

For BONEBOX or another operating system:

1. Build the library without default features.
2. Provide an allocator.
3. Implement BlockDevice for read-only access.
4. Implement WritableBlockDevice only when durable writes and flush barriers are real and tested.
5. Use read_verified_image or check_image before trusting namespace data.
6. Use plan_device_commit and execute_device_commit for replacement commits.
7. Use the boot, executable, handoff, UEFI, and x86_64 transfer modules only at the boundaries documented in PORTING.TXT.

cargo check --no-default-features --lib

HOST BUILD

cargo fmt --all -- --check
cargo check --no-default-features --lib
cargo clippy --all-targets --all-features -- -D warnings
cargo test --all-features
cargo build --release --all-features

PRIMARY CLI

shinesea version
shinesea mkfs IMAGE BLOCKS
shinesea mkdir SOURCE OUTPUT /PATH
shinesea put SOURCE OUTPUT HOST_FILE /PATH
shinesea replace SOURCE OUTPUT HOST_FILE /PATH
shinesea replace-in-place IMAGE HOST_FILE /PATH
shinesea compact SOURCE OUTPUT
shinesea check IMAGE
shinesea map IMAGE
shinesea boot-seal SOURCE OUTPUT /KERNEL
shinesea boot-check IMAGE

Additional binaries implement deterministic corpus generation, native evidence, corruption matrices, power-cut matrices, generic filesystem judgment, hardware image staging, QEMU proof, and compatibility research.

SAFETY BOUNDARY

SHINESEA never treats a human report as proof. Retained bytes, hashes, exact source identity, compiler results, verifier replay, and durable snapshots are the evidence.

A successful SHINESEA safety record does not prove another filesystem lost. Matched real opponent evidence is required for any comparison verdict.

REPOSITORY CLOSURE

The final repository state will contain a frozen v1.0.0 core suitable for a hash-pinned dependency or vendored source snapshot. New BONEBOX-specific and OS-specific adapters belong in their consuming repositories unless they repair a defect in the frozen core.

See:

PORTING.TXT
STABILITY.TXT
RELEASE.TXT
CHANGELOG.TXT
FILESYSTEMWAR.TXT

LICENSE

GPL-2.0-or-later. Copyright 2026 DEADBYTE.

REPORTS ARE CLAIMS, NOT EVIDENCE.
NO COSTUME RIGOR.