Kernel
Core kernel internals: init sequencing, configuration, libraries, logging, the Object Manager, the executive runtime, IRQL and DPCs, time, CPU features, security hardening, the user-mode ABI, the Native API, atoms and locales, the Registry, security, notifications, binary loading, code integrity, process extensions, environment variables, exception dispatch and ALPC.
Roadmap Overviews
One page per kernel-core roadmap file, each following the page contract.
| Document | Topics |
|---|---|
| Kernel Init Sequencing | Boot phases, readiness oracle, recovery screen, deferred init |
| Kernel Configuration and Policy Plane | Boot arguments, safe mode, tunables, feature flags, policy locks |
| Kernel Embedded Libraries | snprintf, math, LZ4, Monocypher, CSPRNG, cJSON, CRC, SHA-3 |
| System Logging (klog) | Ring buffer, log files, rotation, crash persistence, ETW |
| Object Manager | Object headers, handle tables, namespace, callbacks |
| Executive Support Runtime | SLIST, rundown, callbacks, lookaside, fast refs, containers |
| IRQL, DPCs and APCs | IRQL levels, DPC queues, threaded DPCs, APCs, kworker |
| Time and FILETIME | Monotonic clock, wall clock, shared time page, timer resolution |
| x86-64 Architecture Features | XSAVE, SIMD memops, MSRs, topology, PMCs, boot benchmark |
| Kernel Security Hardening | NX, SMEP/SMAP status, Spectre, heap and stack, W^X, KPTI |
| PEB, TEB and the User-Mode ABI | PEB, TEB, swapgs, TLS, KUSER_SHARED_DATA, auxiliary vector |
| Native API and the SSDT | SSDT dispatch, NTSTATUS, ZwXxx, audit, system-call filters |
| Atom, NLS and Locale Subsystem | Case folding, atom tables, code pages, locales, sort keys |
| Registry | Keys and values, hives, journaling, NT registry syscalls |
| Security Reference Monitor | SIDs, tokens, ACLs, privileges, integrity levels |
| Kernel Notification Facility | Named state, sequence numbers, publish and subscribe |
| Binary Format System | exec_load dispatch, ELF, PE32+ and EIF loaders, module list |
| Kernel Image and Module Registry | KIMAGE_ENTRY data model, planned image registries |
| Code Integrity and Trust Policy | CI verdicts, enforcement modes, signature verification |
| EIF Executable Format | EIF header, SSDT imports, LZ4 segments, validation |
| Process Model Extensions | Working directory, pledge and unveil, process groups, rlimits, exec commit |
| Environment Variables | Per-task environment, argv, expansion, SearchPath |
| Exception Dispatch and SEH | CONTEXT capture, fault triage, unwinding, kernel __try/__except |
| ALPC and Message Ports | Ports, connect and accept, send-wait-receive, impersonation |
| Kernel Resource Accounting and Quotas | Quota types, chain charging, ledger, pressure and stall telemetry |
| Power Management | Sleep states, C1 idle, buttons, PCI D-states, stop-the-world rendezvous |
| Crash Dump Generation | KeBugCheckEx, CONTEXT capture, module list, MDMP format |
| Panic Screen and Crash Experience | Blue screen, panic evidence, stack trace, auto-restart |
| Kernel Debugger (KD Protocol) | Serial transport, debugger dispatch hook, planned WinDbg stub |
| System Health and Recovery Orchestrator | Planned health registry, failure buckets, recovery actions |
| Kernel Bulletproofing | Five-layer invariant defense, static asserts, guard pages |
| Kernel Logging v2 | Planned per-CPU lockless rings, priority lanes, fatal path |
| Higher-Half Kernel Relocation | Canonical layout, direct map, parked relocation, low ceiling |
| Serial Log Cleanliness | Log badges, smoke patterns, DPC overrun roll-up |
| Unblocked-Deferral Backfill | 2026-07-27 cohort of reopened deferred work |
| SSDT Master Table | Service-number ledger, Done column, /audit-ssdt |