G8l: EL0 IPC-call writer-authority audit

pub const S304_EXCEPTIONS_EXPLICIT_WRITER_SITES: usize = 8;
pub const S304_EXCEPTIONS_REMAINING_UNAUDITED_WRITER_SITES: usize = 5;
pub const S304_DIRECT_SCHEDULER_ACCESS_SITES: usize = S303_DIRECT_SCHEDULER_ACCESS_SITES;
pub const S304_IMMUTABLE_READ_SITES: usize = S303_IMMUTABLE_READ_SITES;
pub const S304_WHOLE_SCHEDULER_GUARDED_SITES: usize = S303_WHOLE_SCHEDULER_GUARDED_SITES;
pub const S304_WHOLE_SCHEDULER_UNROUTED_SITES: usize = S303_WHOLE_SCHEDULER_UNROUTED_SITES;
pub const S304_OPEN_WRITER_SITES: usize = S303_OPEN_WRITER_SITES;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS304SchedulerWriterAuthorityAuditOutcome {
    Idle,
    AwaitingWriterAuthority {
        request_id: u64,
        guarded_sites: usize,
        writer_sites: usize,
    },
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS304SchedulerWriterAuthorityAuditError {
    S303(G8lS303SchedulerWriterAuthorityAuditError),
    S245(G8lS245ExclusionAdmissionRequestError),
    PriorCoverageDrift {
        guarded_sites: usize,
        unrouted_sites: usize,
    },
}

/// Revalidate the prior fail-closed authority boundary without taking
/// admission or constructing a production exclusive wrapper.
pub fn preflight_s304_scheduler_writer_authority(
    caller_cpu: usize,
    request: Option<G8lS245WholeSchedulerExclusionAdmissionRequestView>,
) -> Result<G8lS304SchedulerWriterAuthorityAuditOutcome, G8lS304SchedulerWriterAuthorityAuditError>
{
    match preflight_s303_scheduler_writer_authority(caller_cpu, request)
        .map_err(G8lS304SchedulerWriterAuthorityAuditError::S303)?
    {
        G8lS303SchedulerWriterAuthorityAuditOutcome::Idle => {
            Ok(G8lS304SchedulerWriterAuthorityAuditOutcome::Idle)
        }
        G8lS303SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
            request_id,
            guarded_sites,
            writer_sites,
        } if guarded_sites == S304_WHOLE_SCHEDULER_GUARDED_SITES
            && writer_sites == S304_OPEN_WRITER_SITES =>
        {
            Ok(
                G8lS304SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
                    request_id,
                    guarded_sites,
                    writer_sites,
                },
            )
        }
        G8lS303SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
            guarded_sites,
            writer_sites: _,
            ..
        } => Err(
            G8lS304SchedulerWriterAuthorityAuditError::PriorCoverageDrift {
                guarded_sites,
                unrouted_sites: S304_DIRECT_SCHEDULER_ACCESS_SITES - guarded_sites,
            },
        ),
    }
}

#[test]
fn s304_commit_failure_retires_unpublished_reply_and_success_resumes_once() {
    let source = include_str!("../../kernel/src/arch/aarch64/exceptions.rs");
    let normal = normal_call_boundary(source);
    for required in [
        "if let Err(error) = commit",
        "discard_unpublished_reply_endpoint(",
        "reply_cap.id",
        "Some(current_id)",
        "if error == IpcError::QueueFull",
        "set_ipc_error(ctx, error)",
        "A parked CALL resumes this exact exception continuation",
        "scheduler copied the durable wake payload back into `ctx`",
    ] {
        assert!(
            normal.contains(required),
            "missing S304 commit terminal token: {required}"
        );
    }
    let writer = normal.find("scheduler.ipc_call_commit_and_park(").unwrap();
    let failure = normal.find("if let Err(error) = commit").unwrap();
    let discard = normal.find("discard_unpublished_reply_endpoint(").unwrap();
    let error = normal.find("set_ipc_error(ctx, error)").unwrap();
    let resume = normal
        .find("A parked CALL resumes this exact exception continuation")
        .unwrap();
    assert!(writer < failure && failure < discard && discard < error && error < resume);
}

  {
    id: "g8l-s304-el0-ipc-call-writer-authority-audit-partial",
    date: "2026-08-26",
    sequence: 304,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: EL0 IPC-call writer-authority audit",
    summary:
      "S304 focused 15/15 PASS ile arch/aarch64/exceptions.rs içindeki kaynak sırasına göre sondan üçüncü explicit mutable scheduler aliasını doğrular: SYS_IPC_CALL dalındaki iki aliasın kaynakta daha sonra gelen normal non-reply ipc_call_commit_and_park sınırı. Legacy reply-alias yolu terminal return ile önce kapanır. Canlı Endpoint CNode authority/generation, ENDPOINT_SEND, message ve reply-cap mint writer'dan önce; commit failure unpublished reply cleanup'tan sonra terminal error yayınlar. Writer authority yalnız model gate'inin exclusive lease'iyle mümkündür; reader lease'i writer'ı açmaz. Production inventory 113 direct / 44 immutable guarded / 69 open writer olarak değişmez; exceptions.rs içindeki 8 explicit aliasın 5'i ayrıca açık kalır ve production exclusive wrapper, provider authority, whole-scheduler exclusion veya scheduler mutation üretilmez.",
    evidence: [
      "S304 focused kaynak/model kapısı iki bağımsız koşuda 15/15 PASS verdi: 130 B / SHA-256 0447f2fe9dc6fdf30815a6962cf23d978425e51bef2acde1efb27e5da13a78b3.",
      "SYS_IPC_CALL dalında iki explicit mutable alias vardır; normal SEND/CALL alt-sınırındaki tek hedef writer audit edilir. Reply-alias yolu ipc_reply_commit sonrası return ile önce kapanır. current_task_cnode Endpoint lookup/generation, ENDPOINT_SEND, IpcMessage ve mint_reply_endpoint_for_call writer'dan önce gelir; scheduler.ipc_call_commit_and_park(ctx, user_sp, target_id, endpoint_generation, reply_cap.id, msg) exact forward edilir. Commit error yolunda discard_unpublished_reply_endpoint cleanup'ı terminal set_ipc_error'dan önce kalır. exceptions.rs 8 explicit writer / 5 remaining unaudited'dır.",
      "Model gate reader membership exclusive writer authority'yi ExclusiveBusy ile bloklar; reader bırakıldıktan sonra non-zero token'lı exclusive lease alınır. Bu host/model evidence'tır.",
      "S303 authority preflight yeniden doğrulanır; pending S245 request korunur ve sonuç AwaitingWriterAuthority { guarded_sites: 44, writer_sites: 69 } olarak döner.",
      "Dört AArch64 profil derlemesi iki koşuda byte-equal exit 0 verdi: QEMU 110646 B / 481e28c3, RPi4 149371 B / a3c54fca, RPi5 419948 B / 97d831be ve RPi5+SMP 419890 B / bf9ba671. Warning header'ları sırasıyla 291, 389, 871 ve 871'dir; zero-warning iddiası değildir.",
      "Birleşik board-rpi5,board-qemu özellikleri iki koşuda beklenen exit 101, 18590 B / a0e6f7e8, 17 error ve 22 warning header ile fail-closed kaldı; S304 writer boundary'si iki board profilinin birlikte etkinleşmesini açmaz.",
      "S238–S304 dependency matrisi iki koşuda 68 grup / 944/944 PASS; ham loglar byte-equal 8762 B / c0e609228b0c49e0aab494df28cf9e34b43102aed5ea48326edacdbfbbec0340, süre-normalize özetler byte-equal 8898 B / 7395fda025f6d2abbb48ec93b949c0a88d04b672e08902248a2113ff5d80f24c. Bu production writer-authority invocation kanıtı değildir.",
      "Ortak make verify-qemu iki koşuda PASS verdi: 116222 B / 25e5bafb ve 116139 B / 79806a35; W^X 31/31, S271 GRAPH_ABSENT=YES, RuntimePmm baseline, EL0 x4096, IPC 20/20, tek S142 containment ve SEC5 korunur. Bu ortak smoke S304 production writer invocation kanıtı değildir.",
      "Exact yedi tarihsel G8h assertion adıyla dışlandığında workspace iki koşuda 266 sonuç grubu / 2738 PASS / 7 filtered verdi: ham loglar 62066 B / 5ae8fa2a ve 5ba46ed2, süre-normalize 25683 B özet byte-equal / SHA-256 7cbedcf67e11f6cb3ea7313e3d3cfbdd4209ffb6b259548c195e8b08a2d4dd43. Filtresiz koşu exit 101, 57288 B / ddfd7faf ile frozen S96 exceptions.S identity kapısında RED kaldı; full-workspace GREEN iddia edilmez.",
      "S304 production exclusive wrapper, provider authority, whole-scheduler exclusion, QEMU runtime fixture veya scheduler mutation iddiası eklemez; physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S304=NO.",
    ],
    commands: [
      "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s304_el0_ipc_call_writer_authority_audit -- --test-threads=1",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi4",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --features board-rpi5",
      "make verify-qemu",
    ],
    terminalSessions: [
      {
        id: "g8l-s304-el0-ipc-call-writer-authority-audit",
        title: "G8l S304 EL0 IPC-call writer-authority audit",
        commandLines: [
          "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s304_el0_ipc_call_writer_authority_audit -- --test-threads=1",
        ],
        outputLines: [
          "test result: ok; S304 focused 1 group / 15 passed; 0 failed",
          "repeat-stable quiet output: 130 B / 0447f2fe9dc6fdf30815a6962cf23d978425e51bef2acde1efb27e5da13a78b3",
          "EL0 IPC-call writer authority remains model-only: reader blocks exclusive lease; reply-alias termination, live Endpoint/generation/SEND authority, exact normal call commit-and-park and failure cleanup are source-audited while exceptions.rs retains 5 unaudited aliases and all 69 production writer sites remain open",
          "dependency: S238–S304 · 68 groups · 944/944 PASS; workspace: 266 groups · 2738 PASS · 7 historical filtered",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S304 kaynak/model fail-closed authority boundary'sidir; production writer guard/migration, QEMU fixture mutation ve fiziksel/device execution claim edilmez.",
    limitations: [
      "S304 exceptions.rs içindeki kaynak sırasına göre sondan üçüncü explicit mutable scheduler aliasını audit eder; aynı source unit'te 5 alias ve toplam 69 production writer site authority wrapper dışında açık kalır.",
      "Exclusive lease yalnız host/model gate'inde test edilir; production exclusive wrapper, provider authority ve whole-scheduler exclusion açık kalır.",
      "S238–S304 dependency matrisi exact 68 grup / 944/944 PASS'tir; bu production writer authority invocation kanıtı değildir.",
      "Filtresiz workspace frozen S96 identity kapısında RED'dir; workspace umbrella GREEN iddia edilmez.",
      "Supported-profile runtime invocation, Generic SMP ve fiziksel RPi kabulü açık kalır; S304 physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S304=NO.",
    ],
  },