Claim → code → test.
A versioned matrix checked by CI: cited files exist, defined tests are actually called, a broken link fails the build.
Safety case · the real state, unrounded
What is
proven. And what is not.
We work with IEC 61508 and ISO 26262 as the roadmap. This page exists so you never have to ask what has been done — and never find out later what has not.
Closed.
Phase 1 of the certification path is complete, with an automated gate in CI on every push. Nothing here depends on somebody remembering to run it.
Clean TCB.
clang-tidy (bugprone/analyzer/cert) over loader, capabilities, MMU, hypervisor, scheduler, IPC and SMMU. Any warning fails.
Untrusted input.
5M runs per push against the .japp validator and the EL0 pointer validators, under AddressSanitizer. Zero out-of-bounds reads.
Structural
coverage.
MC/DC is the criterion the standard demands at the higher levels. Where it is already at 100%, it is the same target code compiled on host — single source, no copy.
✅
Input validators
100% MC/DC and branches across the .japp, filesystem and CAN parsers, and the cognitive→critical boundary.
✅
Scheduler decisions
100% MC/DC on the scheduling functions, with the target object proven identical by hash.
✅
Capability mediation
100% of lines, branches and MC/DC — this is where the isolation claim rests.
✅
IPC and priority protocol
100% of lines and MC/DC, with inheritance and ceiling exercised both on and off.
✅
MMU
100% of lines, branches and MC/DC on mmu.cpp — with no justified deviation, the only Tier A file in that condition. A CI gate since 2026-08-09. This is where the spatial isolation claim rests.
What is still
missing.
None of these is done, and none is hidden from the customer. Three depend on a third party or on money; one depends on the pilot's target.
Pre-assessment.
Gap assessment with an independent certification body. Until then, the safety case is self-declared.
Commercial tooling.
Full MISRA and a qualified WCET tool (aiT/RVS), which would turn a measured maximum into a proven bound.
The pilot's silicon.
The whole campaign holds for the BCM2711. On the certifiable target it is redone from scratch — WCET is per-target.
Jidō OS is a working prototype validated on silicon, not a certified product. We hold no CC, IEC 61508 or ISO 26262 certificate, and we do not claim to. The critical domain is validated on the Raspberry Pi 4; the EL2 hypervisor and Linux guest are validated in QEMU.