Add SECURITY.md, CI workflow, and build badge

SECURITY.md documents responsible disclosure policy and lists the
two security bugs found via internal fuzzing.

GitHub Actions CI builds the full system (supervisor, all shards)
and boots in QEMU, verifying the supervisor completes without panic
and the fuzz shard passes all tests.

Author: raffaelschneider

.github/workflows/ci.yml

@@ -0,0 +1,64 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  build-and-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust nightly
+        uses: dtolnay/rust-toolchain@nightly
+        with:
+          components: rust-src
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y qemu-system-x86 mtools ovmf clang lld
+
+      - name: Build and boot
+        run: |
+          # Run QEMU with a 30-second timeout — the OS boots, runs all shards
+          # (including fuzz-syscall), prints profiling summary, and halts.
+          timeout 30 ./scripts/qemu-run.sh -no-reboot 2>&1 | tee boot.log || true
+
+      - name: Verify boot succeeded
+        run: |
+          echo "==> Checking boot log..."
+
+          # Must reach the halt message
+          if ! grep -q "all shards completed" boot.log; then
+            echo "FAIL: supervisor did not complete"
+            cat boot.log
+            exit 1
+          fi
+
+          # Must not have a kernel panic
+          if grep -q "KERNEL PANIC" boot.log; then
+            echo "FAIL: kernel panic detected"
+            cat boot.log
+            exit 1
+          fi
+
+          # Fuzz shard must pass all tests
+          if grep -q "FAILURES DETECTED" boot.log; then
+            echo "FAIL: fuzz shard reported failures"
+            grep "FAIL:" boot.log
+            exit 1
+          fi
+
+          if grep -q "ALL TESTS PASSED" boot.log; then
+            echo "OK: fuzz shard passed all tests"
+          else
+            echo "WARN: fuzz shard output not found (may not have run)"
+          fi
+
+          echo "==> Boot log summary:"
+          grep -E "(booting|completed|PASS:|FAIL:|Fuzz Summary|Profiling)" boot.log || true
+          echo "==> CI passed"

README.md

@@ -1,5 +1,7 @@
 # coconutOS
 
+[![CI](https://github.com/coconut-os/coconutOS/actions/workflows/ci.yml/badge.svg)](https://github.com/coconut-os/coconutOS/actions/workflows/ci.yml)
+
 A Rust microkernel for GPU-isolated AI inference.
 
 > **Status:** GPU isolation and inference stack complete — runs a transformer forward pass end-to-end with per-token benchmarking.

SECURITY.md

@@ -0,0 +1,44 @@
+# Security Policy
+
+coconutOS is a security-focused microkernel. Isolation guarantees are a core design goal, not a feature — bugs in the syscall boundary, capability system, or GPU isolation are treated with the same severity as data loss.
+
+## Reporting a Vulnerability
+
+If you find a security issue in coconutOS, please report it privately:
+
+1. **Email:** security@raskell.io
+2. **GitHub:** Use [Security Advisories](https://github.com/coconut-os/coconutOS/security/advisories/new) to report privately.
+
+Please include:
+- Which syscall, capability, or isolation boundary is affected
+- A minimal reproduction (a shard binary or syscall sequence that triggers the issue)
+- Whether it causes a kernel panic, information leak, privilege escalation, or isolation bypass
+
+## Response
+
+- Acknowledgment within 48 hours
+- Fix or mitigation within 7 days for confirmed issues
+- Credit in the commit message unless you prefer anonymity
+
+## Scope
+
+The following are in scope:
+
+- **Syscall boundary:** Buffer validation bypass, missing bounds checks, panics from user input
+- **Capability system:** Forgery, escalation, revocation bypass
+- **GPU isolation:** IOMMU bypass, cross-partition VRAM access, DMA without capability
+- **Shard isolation:** Page table escapes, kernel memory reads, side-channel leaks
+- **Scheduler:** Priority inversion, starvation, state corruption
+
+Out of scope:
+
+- Denial of service via excessive syscalls (shards are preemptively scheduled)
+- Issues in the QEMU emulation layer
+- Build system or tooling bugs
+
+## Track Record
+
+coconutOS includes a built-in [fuzz shard](shards/fuzz-syscall/) that exercises all syscall handlers with adversarial inputs on every boot. Two security bugs have been found and fixed through internal fuzzing:
+
+- **User-mode page fault kernel panic** — #PF handler did not check CS RPL, allowing a malicious shard to crash the supervisor by accessing unmapped memory. Fixed in `c4915f1`.
+- **mmap gap validation bypass** — Non-contiguous mmap calls created gaps in the data region where buffer validation passed but pages were absent. Fixed in `c4915f1`.