Imported from c4x64/memd (AGENTS.md). Install upstream with npx skills add c4x64/memd. Copyright stays with the author.

AGENTS.md — hard rules for memd/rwbridge

1. UNIVERSALITY

One build loads on any 5.10+ arm64 kernel. Everything kernel-specific is resolved at runtime; nothing is baked per-KMI:

• Runtime resolution only. Struct layouts arrive via the kopts channel or init-time self-derivation. Vermagic is patched by run.sh to the running kernel (dmesg-feedback retry learns extras). No hardcoded kernel addresses — KASLR kills them on reboot; resolve at init from live registers/scans, or refuse loudly (never operate on a garbage address — a bad TTBR0 write is a panic, not a graceful fail).
• Import surface: module_layout + compiler mem* ONLY. enforced by the check-universal Makefile gate, which must FAIL on anything else:
  • No printk family (zero-import logging: in-module ring + log param; run.sh persists to /sdcard/MemoryD/N.log). A kernel exporting no printk still loads.
  • No kallsyms_lookup_name import (unexported post-5.7; kprobe/filp/ prologue-scan fallbacks all have config dependencies we refuse). Userspace /proc/kallsyms grep is informational only, never load- bearing.
  • No CR0/WP manipulation (we never touch CR0 — TTBR0 switch + tlbi/dsb/isb only, no CET exposure, no asm-CR0 bypasses).
  • No procfs file operations (sysfs module params only — immune to the 5.6 proc_ops break by construction).
  • No renamed-API version macros — instead use NO renamed APIs at all. get_kernel_nofault (5.8+) sets the API floor; CI builds against 5.10 headers to prove it. If a future need requires a post-5.10 API, that need is rejected, not macro'd.
• Explicit refusal beats silent wrong behavior. 16K-page kernels refuse init cleanly (4K-only walker). CFI-enforcing kernels get a warn-and-continue (single-reboot worst case, dmesg signature documented). BTI landing pads are mandatory in the build (bti, never none — pads are NOPs elsewhere): a BTI kernel faults on entry into pad-less code, which looks exactly like a scan panic. The gate enforces their presence.
• Every guessed-memory deref is fault-safe. Any read of an address the module did not itself validate goes through SAFE_READ64 (own __ex_table fixups — wrong guess is a miss, never an oops). Raw derefs are allowed only on own-task memory. New scan/walk code that touches guessed addresses without the macro fails review. The documented NO-GO list (CONFIG_MODULES=n, module-sig enforcement, MODVERSIONS-enforcing kernels, 16K pages) is load-bearing documentation: a new NO-GO must be explicit, never silent.

2. SINGLE ARTIFACT

Exactly one rwbridge.ko + run.sh. No per-KMI build matrix, ever:

• Vermagic template strategy. Bake the 63-char max placeholder (UTS cap) so every real target vermagic fits the in-place patch; patch DOWN only — assert-fail the build/install if a target is ever longer (that means rewriting ELF section headers, a different problem, not a quiet truncation). No --force, no vermagic patching of anything but our own temp copy.
• CI builds once, against the OLDEST supported headers (5.10). A green build proves no newer-only API is used, which is what makes the single artifact valid forward. The gate checks: no __versions section, import allowlist, vermagic placeholder present, patch self-test (mirrors run.sh logic).
• Distribution is manifest + hosted files (the CI rwbridge-universal artifact); local installs are for TESTING a staged build only.