G8l: production migration-lifecycle S177 execution-permit target boundary

/// Consume one exact S177 permit as a terminal target attempt and produce the
/// S178 receipt through its existing target-only constructor.
///
/// A wrong hardware CPU consumes this outer attempt and returns fail-closed;
/// no replacement or retry authority is returned. The nested S178/S177/S176
/// path revalidates the live runtime, masks local IRQs, reads the hardware CPU
/// identity again and executes the retained AArch64 instruction route.
///
/// # Safety
/// The caller must own scheduler-mutation exclusion for the exact ticket and
/// keep the retained TTBR0 root valid. S233 establishes neither invariant and
/// does not transport the returned receipt to CPU0.
#[cfg(all(target_arch = "aarch64", target_os = "none"))]
pub unsafe fn produce_production_s178_receipt_from_production_s177_execution_permit(
    runtime: &G8lRuntimeAuthority,
    execution_permit: G8lTargetDispatchExecutionPermit,
) -> Result<
    G8lTargetDispatchExecutionReceipt,
    G8lProductionMigrationLifecycleS177ExecutionPermitError,
> {
    if crate::percpu::try_current_cpu_id() != Some(CPU1) {
        return Err(G8lProductionMigrationLifecycleS177ExecutionPermitError::WrongTargetCpu);
    }
    unsafe { G8lTargetDispatchExecutionReceipt::execute_target_aarch64(runtime, execution_permit) }
        .map_err(G8lProductionMigrationLifecycleS177ExecutionPermitError::ExecutionReceipt)
}

#[test]
fn s233_keeps_scheduler_gic_eret_and_physical_boundaries_closed() {
    let source = include_str!("../../kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s177_execution_permit.rs");
    for forbidden in [
        "task::scheduler",
        "SCHEDULER",
        "gic::",
        "send_sgi",
        "runtime.context_switch(",
        "write_ttbr0",
        "eret()",
        "power_on",
    ] {
        assert!(
            !source.contains(forbidden),
            "forbidden S233 marker: {forbidden}"
        );
    }
}

  {
    id: "g8l-s233-production-migration-lifecycle-s177-execution-permit-partial",
    date: "2026-08-25",
    sequence: 233,
    status: "passed",
    umbrella_status: "partial",
    title:
      "G8l: production migration-lifecycle S177 execution-permit target boundary",
    summary:
      "S233 13/13 PASS ile exact non-Copy S177 execution permit'inin target-only adapter'a by-value aktarılmasını ve live CPU1 kapısından sonra mevcut S178 execution-receipt constructor'ına tek kez delege edilmesini source/ABI olarak sabitledi. Yanlış CPU dış çağrıdaki permit denemesini terminal olarak düşürüp fail-closed döner; S178 receipt CPU0'a taşınmaz, S232 invoke edilmez, untrusted/bounded authority upgrade ve replacement/retry yoktur. Scheduler mutation, GIC/SGI, ERET ve fiziksel runtime bağlı değildir.",
    evidence: [
      "S233 focused grubu iki bağımsız koşuda 13/13 PASS: S177 non-Copy by-value ABI, target CPU1 gate, exact S178 constructor reuse, error surface, receipt ownership ve S232/CPU0 delivery sınırları doğrulandı.",
      "Focused koşular byte-eşit kaldı: 128 B / SHA-256 02983f1a7d644519bfddb0884a6cd0ce69f40c4b845eb54b71ecdc6e19a8ff09.",
      "S166–S178 target execution bağımlılıkları + S233 target callsite matrisi iki byte-equal koşuda 14 grup / 116/116 PASS verdi: 1706 B / SHA-256 74a53cbe8dde72398513a1457ecbb80c84bdd4359e6083ff881ed90dd7892174. Bu matris CPU0 producer zinciri veya cross-CPU delivery kanıtı değildir.",
      "S155–S233 explicit sequence-ordered kaynak/regresyon envanteri iki byte-equal koşuda 82 grup / 851/851 PASS ve 10227 B / SHA-256 291d09d5648cb3f8573167380426ab69048d02c61d59772eace378cb45c615ee verdi; ilk 10099 B exact S232 prefix'idir ve SHA-256 f61c7c69af8d0ddd33634ffebbfce652cb05f47ea0abe6a28b306d3555235f66 olarak korundu.",
      "RPi5 AArch64 compile PASS: 616 warning envanterlendi; 304283 B / SHA-256 d35fd380e778175698d3752c0fe41bbf229fafaac795aa25066e2e6a22c1017c. smp: 616 warning, 304225 B / SHA-256 aaa49eaa8689ec2ea2aa350886d3e385e539766d957731bdc8624974e9d01323. Zero-warning iddiası yoktur.",
      "Kalıcı kapsam: docs/M8.1-RPi5-G8l-S233-Migration-Lifecycle-S177-Execution-Permit-Proof.md.",
      "S233 target-only terminal attempt'tir: by-value ownership outer fonksiyon girişinde aktarılır; CPU1 gate nested S178 architecture denemesinden önce çalışır ve mevcut execute_target_aarch64 yolu exact S178 receipt üretir. Yanlış CPU'da replacement authority dönmez. Receipt CPU0'a teslim edilmedi; S232 ve downstream invoke edilmedi.",
      "S233 fiziksel/device operasyonu yapmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S233=NO.",
      "Canlı marker: S233_13_OF_13_MIGRATION_LIFECYCLE_S177_EXECUTION_PERMIT_TARGET_CPU1_GATE_S177_NONCOPY_BY_VALUE_EXACT_S178_EXECUTION_RECEIPT_CONSTRUCTED_S232_NOT_INVOKED_CPU0_DELIVERY_NOT_WIRED_NO_UNTRUSTED_OR_BOUNDED_UPGRADE_NO_REPLACEMENT_NO_RETRY_AARCH64_COMPILED_PRESENT_REQUEST_NOT_OBSERVED_LEGACY_SCHEDULER_ACCESSES_UNCOVERED_WHOLE_SCHEDULER_GIC_HARDWARE_QEMU_PHYSICAL_CPU0_CPU1_CPU2_CPU3_HOTPLUG_SOAK_GENERIC_SMP_OPEN_FULL_PHYSICAL_RUNBOOK_VISIBLE_S393_TO_S443_S418_NO_RUNBOOK_EXECUTED_IN_S233_VERIFIED; deployment-specific route/hash evidence is recorded in the project-status manifest.",
    ],
    commands: [
      "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s177_execution_permit -- --test-threads=1",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
    ],
    terminalSessions: [
      {
        id: "s233-g8l-production-migration-lifecycle-s177-execution-permit",
        title:
          "G8l S233 migration-lifecycle S177 execution-permit target boundary",
        commandLines: [
          "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s177_execution_permit -- --test-threads=1",
        ],
        outputLines: [
          "test result: ok; 13 passed; 0 failed",
          "exact non-Copy S177 ownership transfers by value at entry; target CPU1 gate precedes the nested architecture attempt",
          "existing S178 target-only constructor produces the exact non-Copy S178 execution receipt",
          "CPU0 delivery and S232 invocation are not wired; untrusted/bounded upgrades are absent",
          "scheduler mutation, GIC/SGI, ERET, exact production runtime and physical operation are not invoked",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "Terminal özeti S233 exact target CPU1 S177→S178 source/ABI sınırını gösterir; CPU0 delivery, exact production scheduler runtime, QEMU veya fiziksel cihaz çalıştırması değildir.",
    limitations: [
      "S233 S177 permit'i target CPU1 üzerinde mevcut S178 receipt constructor'ına bağlar; receipt CPU0'a taşınmaz ve S232/downstream invoke edilmez.",
      "Production scheduler mutation, whole-scheduler exclusion, GIC/SGI delivery, ERET/context-switch assembly, QEMU present-tuple yolu, fiziksel RPi, CPU2/CPU3, hotplug, soak ve Generic SMP açıktır.",
      "S233 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S233=NO.",
    ],
  },