G8l: EL0 IPC call-timeout writer-authority audit

pub const S309_EXCEPTIONS_EXPLICIT_WRITER_SITES: usize = 8;
pub const S309_EXCEPTIONS_REMAINING_UNAUDITED_WRITER_SITES: usize = 0;
pub const S309_DIRECT_SCHEDULER_ACCESS_SITES: usize = S308_DIRECT_SCHEDULER_ACCESS_SITES;
pub const S309_IMMUTABLE_READ_SITES: usize = S308_IMMUTABLE_READ_SITES;
pub const S309_WHOLE_SCHEDULER_GUARDED_SITES: usize = S308_WHOLE_SCHEDULER_GUARDED_SITES;
pub const S309_WHOLE_SCHEDULER_UNROUTED_SITES: usize = S308_WHOLE_SCHEDULER_UNROUTED_SITES;
pub const S309_OPEN_WRITER_SITES: usize = S308_OPEN_WRITER_SITES;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS309SchedulerWriterAuthorityAuditOutcome {
    Idle,
    AwaitingWriterAuthority {
        request_id: u64,
        guarded_sites: usize,
        writer_sites: usize,
    },
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS309SchedulerWriterAuthorityAuditError {
    S308(G8lS308SchedulerWriterAuthorityAuditError),
    S245(G8lS245ExclusionAdmissionRequestError),
    PriorCoverageDrift {
        guarded_sites: usize,
        unrouted_sites: usize,
    },
}

/// Revalidate the prior fail-closed authority boundary without taking
/// admission or constructing a production exclusive wrapper.
pub fn preflight_s309_scheduler_writer_authority(
    caller_cpu: usize,
    request: Option<G8lS245WholeSchedulerExclusionAdmissionRequestView>,
) -> Result<G8lS309SchedulerWriterAuthorityAuditOutcome, G8lS309SchedulerWriterAuthorityAuditError>
{
    match preflight_s308_scheduler_writer_authority(caller_cpu, request)
        .map_err(G8lS309SchedulerWriterAuthorityAuditError::S308)?
    {
        G8lS308SchedulerWriterAuthorityAuditOutcome::Idle => {
            Ok(G8lS309SchedulerWriterAuthorityAuditOutcome::Idle)
        }
        G8lS308SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
            request_id,
            guarded_sites,
            writer_sites,
        } if guarded_sites == S309_WHOLE_SCHEDULER_GUARDED_SITES
            && writer_sites == S309_OPEN_WRITER_SITES =>
        {
            Ok(
                G8lS309SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
                    request_id,
                    guarded_sites,
                    writer_sites,
                },
            )
        }
        G8lS308SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
            guarded_sites,
            writer_sites: _,
            ..
        } => Err(
            G8lS309SchedulerWriterAuthorityAuditError::PriorCoverageDrift {
                guarded_sites,
                unrouted_sites: S309_DIRECT_SCHEDULER_ACCESS_SITES - guarded_sites,
            },
        ),
    }
}

#[test]
fn s309_commit_revalidates_caller_send_and_reply_authority_under_transaction() {
    let source = include_str!("../../kernel/src/task/scheduler.rs");
    let commit = ipc_call_timeout_commit_boundary(source);
    for required in [
        "IrqGuard::new()",
        "IPC_TRANSACTION_LOCK.lock()",
        ".current_task",
        ".filter(|task_id| *task_id != 0)",
        "current_endpoint_authority_is_live(",
        "CapabilityRights::ENDPOINT_SEND",
        "lookup_capability_by_id(reply_cap_id)",
        "capability.owner == caller_task",
        "capability.generation == reply_generation",
        "CapabilityKind::Endpoint",
        "capability.parent.is_none()",
        "if !reply_authority_is_live",
    ] {
        assert!(
            commit.contains(required),
            "missing S309 transaction/authority token: {required}"
        );
    }
    let irq = commit.find("IrqGuard::new()").unwrap();
    let transaction = commit.find("IPC_TRANSACTION_LOCK.lock()").unwrap();
    let caller = commit.find("let caller_task").unwrap();
    let send = commit.find("current_endpoint_authority_is_live(").unwrap();
    let reply = commit.find("let reply_authority_is_live").unwrap();
    assert!(irq < transaction && transaction < caller && caller < send && send < reply);
}

  {
    id: "g8l-s309-el0-ipc-call-timeout-writer-authority-audit-partial",
    date: "2026-08-27",
    sequence: 309,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: EL0 IPC call-timeout writer-authority audit",
    summary:
      "S309 focused 15/15 PASS ile arch/aarch64/exceptions.rs içindeki kaynak sırasına göre son açık explicit mutable scheduler aliasını doğrular: handle_ipc_call_timeout içindeki ipc_call_timeout_commit_and_park sınırı. Valid relative deadline, normal non-reply endpoint, current-task CNode exact Endpoint generation/ENDPOINT_SEND authority, exact message ve linked reply-cap mint writer'dan önce gelir. Helper existing IRQ/IPC transaction altında caller SEND authority, reply authority/linkage, endpoint ve varsa waiting receiver authority/deadline'ını yeniden doğrular; exact call deadline'ı rendezvous publication'dan önce kurar, publication hatasında rollback eder, caller'ı reply endpoint üzerinde BlockedOnIpc olarak park eder ve optional receiver delivery/switch continuation sırasını korur. Writer authority yalnız model gate'inin exclusive lease'iyle mümkündür; reader lease'i writer'ı açmaz. exceptions.rs içindeki 8 explicit aliasın 8'i source/model audit kapsamındadır, fakat production inventory 113 direct / 44 immutable guarded / 69 open writer olarak değişmez; production exclusive wrapper, provider authority, whole-scheduler exclusion veya scheduler mutation üretilmez.",
    evidence: [
      "S309 focused kaynak/model kapısı iki bağımsız koşuda 15/15 PASS verdi: 130 B / SHA-256 0447f2fe9dc6fdf30815a6962cf23d978425e51bef2acde1efb27e5da13a78b3.",
      "handle_ipc_call_timeout içindeki tek addr_of_mut!(crate::task::scheduler::SCHEDULER) writer boundary'si audit edilir. target/label/MR0–MR3/timeout register'ları, TICKS Acquire snapshot, valid TickDeadline ve immutable registry'deki normal non-reply endpoint writer'dan önce gelir. exceptions.rs 8 explicit writer / 0 remaining unaudited'dır.",
      "Current-task CNode exact Endpoint id/generation ve ENDPOINT_SEND authority, exact IpcMessage ve mint_reply_endpoint_for_call writer'dan önce doğrulanır. ipc_call_timeout_commit_and_park(ctx, user_sp, target_id, endpoint_cap.generation, reply_cap.id, reply_cap.generation, msg, now_tick, timeout_ticks) exact ve tek kez forward edilir; commit hatası unpublished reply endpoint'i terminal error yayınından önce discard eder.",
      "Scheduler helper IrqGuard/IPC_TRANSACTION_LOCK altında nonzero caller, canlı SEND authority, exact owned reply CNode authority, normal target endpoint, linked reply object, waiting receiver state/RECV authority/generation, deadline ve ready/blocked capacity'yi yeniden doğrular.",
      "Exact CALL deadline rendezvous call publication'dan önce register edilir; publication error exact cancel_exact rollback yapar. finish_call_park exact Park sonucu sonrasında caller BlockedOnIpc { endpoint_id: reply_cap_id, is_call: true } olarak blocked listeye alınır; queued veya receiver-delivery dalı, receive-deadline retirement, delivery, Ready enqueue, lock drop, switch ve context restore sırasını korur.",
      "Model gate reader membership exclusive writer authority'yi ExclusiveBusy ile bloklar; reader bırakıldıktan sonra non-zero token'lı exclusive lease alınır. Bu host/model evidence'tır.",
      "S308 authority preflight yeniden doğrulanır; pending S245 request korunur ve sonuç AwaitingWriterAuthority { guarded_sites: 44, writer_sites: 69 } olarak döner.",
      "Dört AArch64 profil derlemesi iki koşuda byte-equal exit 0 verdi: QEMU 110646 B / 72e2261f, RPi4 149371 B / 408bb554, RPi5 432466 B / 43a6d362 ve RPi5+SMP 432408 B / 71a5058e. Warning header'ları sırasıyla 291, 389, 906 ve 906'dır; zero-warning iddiası değildir.",
      "Birleşik board-rpi5,board-qemu özellikleri iki koşuda beklenen exit 101, 18590 B / 16df0d7e, 17 error ve 22 warning header ile fail-closed kaldı; S309 writer boundary'si iki board profilinin birlikte etkinleşmesini açmaz.",
      "S238–S309 dependency matrisi iki koşuda 73 grup / 1019/1019 PASS; ham loglar byte-equal 9412 B / cfccf171cb0026dead97f020daaa7fbc589707be7a3e0785b11994b4ed876e42, süre-normalize özetler byte-equal 9558 B / ef2eb179b217b70c0cc5b8655989bf68de71e2dd10a9ef8f7e0aeeb52ffd8ab9. Bu production writer-authority invocation kanıtı değildir.",
      "Ortak make verify-qemu iki koşuda PASS verdi: 116222 B / c7db4c98 ve 116139 B / 14e0f0c1; guest logları 2153454 B / 309d915e ve 2084472 B / c411ed7c. W^X 31/31, S271 GRAPH_ABSENT=YES, RuntimePmm baseline, EL0 x4096, IPC 20/20, koşu başına tek S142 containment, SEC5 ve 13 KERNEL_FAULTS=0 marker'ı korunur. Bu ortak smoke S309 production writer invocation kanıtı değildir.",
      "Exact yedi tarihsel G8h assertion adıyla dışlandığında workspace iki koşuda 271 sonuç grubu / 2817 PASS / 7 filtered verdi: ham loglar 321990 B / b078aff9 ve 321885 B / f072cf3e, sonuç özetleri 25628 B / 8aa34fde ve 93452219, süre-normalize 26168 B özet byte-equal / SHA-256 ff733c03f14adbab652935e89ac5494e3f2afb3327e9a688967a874fa1ff0bbc. Filtresiz koşu exit 101, 290311 B / a1aa7c79 ile frozen S96 exceptions.S identity kapısında RED kaldı; full-workspace GREEN iddia edilmez.",
      "S309 production exclusive wrapper, provider authority, whole-scheduler exclusion, QEMU runtime fixture veya scheduler mutation iddiası eklemez; physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S309=NO.",
    ],
    commands: [
      "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s309_el0_ipc_call_timeout_writer_authority_audit -- --test-threads=1",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-qemu",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi4",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --features board-rpi5",
      "make verify-qemu",
    ],
    terminalSessions: [
      {
        id: "g8l-s309-el0-ipc-call-timeout-writer-authority-audit",
        title: "G8l S309 EL0 IPC call-timeout writer-authority audit",
        commandLines: [
          "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s309_el0_ipc_call_timeout_writer_authority_audit -- --test-threads=1",
        ],
        outputLines: [
          "test result: ok; S309 focused 1 group / 15 passed; 0 failed",
          "repeat-stable quiet output: 130 B / 0447f2fe9dc6fdf30815a6962cf23d978425e51bef2acde1efb27e5da13a78b3",
          "EL0 IPC call-timeout writer authority remains model-only: reader blocks exclusive lease; exact SEND/reply/deadline/rendezvous park-and-delivery paths are source-audited, all 8 exceptions aliases have source/model coverage, and all 69 production writer sites remain open",
          "dependency: S238–S309 · 73 groups · 1019/1019 PASS; workspace: 271 groups · 2817 PASS · 7 historical filtered",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S309 kaynak/model fail-closed authority boundary'sidir; production writer guard/migration, QEMU fixture mutation ve fiziksel/device execution claim edilmez.",
    limitations: [
      "S309 exceptions.rs içindeki son açık handle_ipc_call_timeout explicit mutable scheduler aliasını audit eder; bu source unit'teki 8/8 alias source/model covered olsa da toplam 69 production writer site authority wrapper dışında açık kalır.",
      "Exclusive lease yalnız host/model gate'inde test edilir; production exclusive wrapper, provider authority ve whole-scheduler exclusion açık kalır.",
      "S238–S309 dependency matrisi exact 73 grup / 1019/1019 PASS'tir; bu production writer authority invocation kanıtı değildir.",
      "Filtresiz workspace frozen S96 identity kapısında RED'dir; workspace umbrella GREEN iddia edilmez.",
      "Supported-profile runtime invocation, Generic SMP ve fiziksel RPi kabulü açık kalır; S309 physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S309=NO.",
    ],
  },