G8l: untrusted audit ayrımlı target-only execution receipt

impl G8lTargetDispatchExecutionReceipt {
    /// Consume S177, execute its retained S176 path, then validate the receipt
    /// returned by that exact call against the still-live runtime envelope.
    ///
    /// # Safety
    /// The caller must satisfy S177/S176's scheduler-exclusion and TTBR0-root
    /// lifetime requirements. S178 does not establish those global invariants.
    #[cfg(all(target_arch = "aarch64", target_os = "none"))]
    pub unsafe fn execute_target_aarch64(
        runtime: &G8lRuntimeAuthority,
        mut permit: G8lTargetDispatchExecutionPermit,
    ) -> Result<Self, G8lTargetDispatchExecutionReceiptError> {
        permit.revalidate_ready_runtime(runtime)?;
        let runtime_instance_id = permit.runtime_instance_id();
        let ticket = permit.ticket();
        let context_generation = permit.context_generation();
        let architecture = unsafe { permit.execute_target_aarch64(runtime)? };
        let audit =
            G8lTargetDispatchReceiptAudit::validate_untrusted(runtime, &permit, architecture)?;
        Ok(Self {
            runtime_instance_id,
            ticket,
            context_generation,
            architecture: audit.architecture(),
        })
    }

    pub const fn runtime_instance_id(&self) -> u64 {
        self.runtime_instance_id
    }

    pub const fn ticket(&self) -> MigrationTicket {
        self.ticket
    }

    pub const fn context_generation(&self) -> u64 {
        self.context_generation
    }

    pub const fn architecture(&self) -> ArchInstructionReceipt {
        self.architecture
    }
}

#[test]
fn execution_receipt_has_no_public_injected_receipt_constructor() {
    let source = include_str!("../../kernel/src/g8l_target_dispatch_execution_receipt.rs");
    let execution = source
        .split("pub struct G8lTargetDispatchExecutionReceipt")
        .nth(1)
        .unwrap();
    assert!(source.contains("pub struct G8lTargetDispatchReceiptAudit"));
    assert!(source.contains("pub fn validate_untrusted"));
    assert!(source.contains("pub unsafe fn execute_target_aarch64"));
    assert!(!execution.contains("pub fn from_permit"));
    assert!(!execution.contains("pub fn from_untrusted"));
    assert!(!source.contains("impl From<G8lTargetDispatchReceiptAudit"));
    assert!(!source.contains("#[derive(Clone, Copy, Debug, PartialEq, Eq)]\npub struct G8lTargetDispatchExecutionReceipt"));
}

  {
    id: "g8l-s178-target-dispatch-execution-receipt-partial",
    date: "2026-08-24",
    sequence: 178,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: untrusted audit ayrımlı target-only execution receipt",
    summary:
      "S178, caller-supplied ArchInstructionReceipt ile gerçek execution receipt'i 8/8 tip düzeyinde ayırdı. Caller girdisi yalnız execution_authority=false untrusted audit üretir ve execution receipt'e dönüşmez. Non-Copy execution receipt'in public injected constructor'ı yoktur; yalnız AArch64+none target factory S177'yi by-value tüketip exact S177 execute dönüşünü pre/post canlı runtime ve TTBR0/TLBI zarfında içeride doğrulayabilir. Yol bağlı/compile edilmiş, çalıştırılmamıştır.",
    evidence: [
      "g8l_target_dispatch_execution_receipt: 8/8 PASS; untrusted audit/execution authority ayrımı, no public injected constructor, non-Copy result ve by-value S177 target path source audit.",
      "Caller-supplied audit task/ASID/generation/context, source-target CPU, TTBR0 operand, instruction order 1→2 ve DSB/ISB zarfını fail-closed doğrular fakat execution_authority=false kalır.",
      "Target-only constructor sırası: S177 ready/runtime recheck → identity capture → permit.execute_target_aarch64(runtime) → returned receipt post-attempt runtime/envelope validation.",
      "hardware_mpidr_read_path_wired=true ve target_instruction_path_wired=true; hardware_execution_proven=false, global_scheduler_exclusion_proven=false, global_source_linearity_proven=false.",
      "Kalıcı kapsam: `docs/M8.1-RPi5-G8l-S178-Target-Dispatch-Execution-Receipt-Proof.md`.",
      "S178 fiziksel/device operasyonu yapmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S178=NO.",
    ],
    commands: [
      "cargo test --quiet --test g8l_target_dispatch_execution_receipt -- --test-threads=1",
      "cargo check --quiet --manifest-path kernel/Cargo.toml --target aarch64-unknown-none --no-default-features --features board-rpi5",
    ],
    terminalSessions: [
      {
        id: "s178-g8l-target-dispatch-execution-receipt",
        title: "G8l S178 target-only execution receipt / untrusted audit split",
        commandLines: [
          "cargo test --quiet --test g8l_target_dispatch_execution_receipt -- --test-threads=1",
        ],
        outputLines: ["running 8 tests", "test result: ok; 8 passed; 0 failed"],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S178 dar kaynak kabulü PASS'tir; caller receipt yalnız untrusted audit üretir, gerçek non-Copy receipt yalnız target-only S177 execute dönüşünden kurulabilir. Yolun QEMU/donanımda çalıştığı veya scheduler/GIC authority olduğu kanıtlanmadı.",
    limitations: [
      "S178 target-only execute-and-validate yolunu bağlar/AArch64-compile eder; QEMU veya fiziksel donanımda çalıştırmaz.",
      "Caller-supplied audit, execution authority değildir ve gerçek receipt'e dönüştürülemez.",
      "Kaynak yolu cross-CPU scheduler exclusion veya global source linearity'yi kanıtlamaz.",
      "Production caller, GIC/SGI delivery ve context-switch runtime bu sırada bağlı değildir.",
      "QEMU, fiziksel RPi, CPU2/CPU3, hotplug, soak ve generic SMP açık kalır.",
      "S178 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S178=NO.",
    ],
  },