patina_boot OEM assurance and upstream readiness

[kat-perez]

Goal

Shape patina_boot into an upstream-ready Patina component, then re-propose the RFC with evidence that the generic mechanism is correct, secure, portable, and measurable.

Current position

Stage 3 of 5: upstream hardening.

The crate is ready for upstream architecture and design review. It is not yet ready to claim complete BDS replacement, final upstream acceptance, or OEM production qualification.

Evidence already available:

• generic BootOrchestrator / BootDispatcher architecture
• host-tested orchestration and failure behavior
• a working Maa hardware consumer
• clean whole-firmware C BDS versus patina_boot comparison
• an evidence-based progress review and bounded claim language

Upstream acceptance gates

1. Define the supported contract

• Build a UEFI BDS semantic parity matrix for patina_boot #196 documents semantic parity with EDK2 BDS.
• Migrate patina_boot to Patina UEFI Services #202 migrates the component API to Patina UEFI Services after Patina #1743 stabilizes.
• Implement the upstream patina_boot semantic baseline #199 implements the agreed upstream semantic baseline and links each supported behavior to tests.
• Explicitly classify remaining behavior as platform policy, planned, or intentionally unsupported.

2. Make security boundaries enforceable

• Make the BDS security transition fail closed #191 makes EndOfDxe and ReadyToLock fail closed before image launch.
• Harden patina_boot device-path and boot-source selection #192 makes boot-source selection and fallback explicit OEM policy.
• Differentially fuzz EFI load options and device paths #193 differentially fuzzes EFI load options and device paths.
• Validate patina_boot against an adversarial Secure Boot matrix #194 validates the resulting behavior against an adversarial Secure Boot matrix.

3. Prove portability

• Make patina_boot and patina_sre platform-neutral for vendor reuse #158 removes vendor-specific assumptions from the reusable crates.
• QEMU + OVMF + minimal patina_boot bringup #118 supplies a second, minimal QEMU + OVMF consumer.
• Re-integrate patina_boot and patina_sre on Maa after repository publication #157 remains the Maa product integration proving the platform-policy boundary.

4. Produce reproducible performance evidence

• patina_boot Measurement Harness #108 owns the measurement program.
• Microbench BootOrchestrator::execute() end-to-end (mocked) #124 supplies the mocked orchestrator benchmark.
• FPDT capture script for QEMU runs #119 and docs/measurement-methodology.md write-up #121 capture and document the measurement method.
• CI integration #120, Workflow that runs benches + posts results as PR comment #122, and Regression gate at > 10% #123 make regressions continuously visible.
• Run matched-policy randomized C BDS vs patina_boot A/B #195 bounds C-versus-Rust implementation cost with a matched-policy randomized A/B.

5. Re-propose upstream and package OEM evidence

• Prepare the patina_boot upstream RFC re-proposal #200 prepares a revised Patina RFC that limits the upstream ask to generic mechanism and documented semantics.
• OEM Adoption Materials #114 packages the separate OEM decision case only after the supporting gates have evidence.

Delivery sequence

Iteration 10 - define the contract and close current evidence gaps

• Finish Build a UEFI BDS semantic parity matrix for patina_boot #196 and convert every planned semantic gap into an implementation or policy decision.
• Finish the platform-neutrality audit in Make patina_boot and patina_sre platform-neutral for vendor reuse #158.
• Continue patina_boot Measurement Harness #108 only for the shared-marker and matched-policy prerequisites.
• Publish the progress review as the current program status.

Exit: maintainers can review a precise supported contract and a bounded upstream ask.

Iteration 11 - implement the upstream-critical baseline

• Complete Make the BDS security transition fail closed #191 and Harden patina_boot device-path and boot-source selection #192.
• Complete Implement the upstream patina_boot semantic baseline #199 for the semantic baseline selected from Build a UEFI BDS semantic parity matrix for patina_boot #196.
• Add ordering, failure-injection, and source-policy tests.

Exit: the core launch path is fail closed and the accepted semantic surface is test-backed.

Iteration 12 - independent and adversarial evidence

• Complete QEMU + OVMF + minimal patina_boot bringup #118 as the second consumer.
• Complete Differentially fuzz EFI load options and device paths #193 differential fuzzing.
• Complete Run matched-policy randomized C BDS vs patina_boot A/B #195 matched-policy A/B measurement.
• Land the minimum CI and methodology pieces from FPDT capture script for QEMU runs #119-Regression gate at > 10% #123 needed to reproduce results.

Exit: portability, parser robustness, and performance claims are independently reproducible.

After Patina #1743 stabilizes

• Complete Migrate patina_boot to Patina UEFI Services #202 against the final Patina UEFI Services API before submitting the RFC.
• Rebuild the final Microbench BootOrchestrator::execute() end-to-end (mocked) #124 orchestrator benchmark with generated service mocks.

Iteration 13 - qualification and RFC re-proposal

• Complete Validate patina_boot against an adversarial Secure Boot matrix #194 Secure Boot matrix.
• Complete Prepare the patina_boot upstream RFC re-proposal #200 and submit the revised upstream RFC.
• Refresh OEM Adoption Materials #114 with links to reproducible evidence and explicit OEM pilot gates.

Exit: the upstream proposal and OEM package contain no unsupported security, compatibility, or performance claims.

Definition of upstream-ready

• supported UEFI BDS semantics are explicit and test-backed
• security transition and boot-source policy fail closed
• malformed-input behavior has differential fuzz evidence
• a second consumer proves platform neutrality
• matched-policy performance has a published statistical bound
• the revised RFC separates generic mechanism from platform and OEM policy
• all claims link to reproducible artifacts

[kat-perez]

Created a standalone 11-slide Boot Manager Modernization deck at uefi/crates/patina_boot/docs/boot-manager-modernization-presentation-2026-08.html in the presentation worktree. It consolidates the target architecture, verified whole-firmware parity, bug-prevention design, objective claim boundary, semantic-parity gaps, security and performance workstreams, iteration roadmap, and separate upstream/OEM decision gates.

[kat-perez]

Added the evidence-based upstream-readiness progress review to PR #184: uefi/crates/patina_boot/docs/boot-manager-modernization-progress-review-2026-08.html. It gives the bounded conclusion (ready for upstream design review, not yet complete BDS replacement), a ten-gate scorecard with five complete/two active/three open, and places the program at Stage 3 of 5.

[kat-perez]

Roadmap update: added #202 for the upstream-critical migration to Patina UEFI Services from OpenDevicePartnership/patina#1743. This should precede #199 and the final #124 benchmark form; the current PR #201 raw-table benchmark is now explicitly retained only as a v22 spike.