What is proven

An honest inventory. Software that will run as PID 1 deserves a precise account of its own evidence.

Status: bootstrap logic tested; boot unverified. 141 tests pass. No one has booted this, on hardware or in emulation. The authors built it on a machine with no compiler, no container runtime, and no WSL — which is also why the bootstrap is zero-compile-first rather than the reverse.

Tested here

property	how
Architecture resolution across all nine targets	synthetic `uname -m` values through the generated table
Fail-closed hashing	corrupted artifact and state hashes each halt with the correct named reason
Phase ordering and DAG resolution	transitive chains and diamond shapes, asserted against a broken resolver
Failure policy	all three modes, including that `halt` genuinely prevents later phases running
Restart backoff	doubling to a ceiling; all three restart policies; return codes reflect real outcomes
Export determinism	byte-identical output across runs and across input ordering
Cycle and dangling-reference rejection	at export, and again at boot — `numinit` does not trust upstream validation
Verifier agreement	the Python and shell verifiers accept and reject the same files
Generated-table drift	a test regenerates the arch table and asserts byte-equality with the committed file

Not proven — the open gates

claim	what would close it
"it boots"	a Linux host with `qemu-system-*`, per architecture
true PID-1 semantics	the same
foreign-architecture execution	the same, per arch
static `numinit` size and correctness	a Zig toolchain
real hardware behavior	metal — firmware, device enumeration, and timing all differ from emulation

You can close the first three yourself. That is what the skills are for, and numericalos-verify-boot is the one that may make the claim — scoped to the artifact and architecture it actually watched.

Known residuals

Boot unverified from the development machine. Structural, not incidental.
PID-1 signal handling in ash is imperfect. The shell fallback reaps on wait but cannot match a static binary's signal discipline. The fallback trades rigor for reach, deliberately.
Derived unit sets drift with the ops registry. Mitigated by the content hash and refusal-on-mismatch, but a registry change still changes what a node runs on next reconcile.
Supervision is unwired. Implemented and tested; numos_main does not call it.
Boot-chain steps 3, 4, and 6 are unimplemented. No artifact fetch, no exec of numinit from the bootstrap.
Health predicates never execute. They round-trip through the state format; nothing runs them.
A backgrounded longrun failure is invisible to its phase's policy. Correct semantics, insufficiently documented until now.
Non-ASCII in a unit name raises a raw encoding error rather than a named halt.

Why this page exists

A project whose central promise is fail-closed behavior cannot be loose about its own claims. The same discipline that makes numinit halt on an unverified hash applies to the documentation: understating a limitation is as much a defect as overstating a capability.

Every gap above was found by review rather than volunteered by the code, and most of them were defects in the plan rather than in its implementation. The list is long because it is complete, not because the system is fragile.