S330 · Capability-revoke production writer guard integration

/// Generic id-only CNode revoke for non-endpoint resources. Endpoint ids are
/// rejected: grants require `revoke_endpoint_grant(Capability, actor)`, while
/// object destruction requires its distinct typed authority API.
pub fn revoke_cap_for_task(task_id: u64, cap_id: crate::ui::capability::CapId) -> Option<usize> {
    let irq_guard = crate::arch::aarch64::IrqGuard::new();
    let transaction = IPC_TRANSACTION_LOCK.lock();

    let typed_registry_identity = crate::ui::capability::ENDPOINT_REGISTRY
        .lock()
        .iter()
        .any(|endpoint| endpoint.id == cap_id)
        || crate::ui::capability::NOTIFICATION_REGISTRY
            .lock()
            .iter()
            .any(|notification| notification.id() == cap_id);
    if typed_registry_identity {
        drop(transaction);
        drop(irq_guard);
        return None;
    }

    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s330_writer_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s330_capability_revoke_writer_guard_integration::acquire_s330_production_scheduler_writer_access()
        .unwrap_or_else(|error| panic!("S330 capability-revoke scheduler writer guard failed closed: {:?}", error));
    let result = unsafe {
        let sched = &mut *core::ptr::addr_of_mut!(SCHEDULER);
        sched.revoke_cap_for_task(task_id, cap_id)
    };
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s330_writer_access);
    drop(transaction);
    drop(irq_guard);
    result
}

/// Acquire from the exact static gate used by routed readers and prior writers.
/// The caller must already mask local IRQs; real per-CPU identity is derived
/// here and never accepted from an untrusted scalar argument.
#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn acquire_s330_production_scheduler_writer_access(
) -> Result<G8lS330ProductionSchedulerWriterAccess, G8lS247WholeSchedulerAccessError> {
    let caller_cpu =
        crate::percpu::try_current_cpu_id().ok_or(G8lS247WholeSchedulerAccessError::InvalidCpu)?;
    let access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s246_whole_scheduler_read_access_guard::S247_PRODUCTION_WHOLE_SCHEDULER_ACCESS_GATE
        .try_acquire_exclusive_for_valid_cpu(caller_cpu)?;
    Ok(G8lS330ProductionSchedulerWriterAccess { _access: access })
}

#[test]
fn target_function_contains_one_exact_scheduler_writer() {
    let target = revoke_boundary();
    assert_eq!(target.matches("addr_of_mut!(SCHEDULER)").count(), 1);
    assert_eq!(
        target
            .matches("acquire_s330_production_scheduler_writer_access()")
            .count(),
        1
    );
    assert_eq!(
        target
            .matches("sched.revoke_cap_for_task(task_id, cap_id)")
            .count(),
        1
    );
}

  {
    id: "g8l-s330-capability-revoke-writer-guard-integration-partial",
    date: "2026-08-27",
    sequence: 330,
    status: "passed",
    umbrella_status: "partial",
    title: "S330 · Capability-revoke production writer guard integration",
    summary:
      "S330, generic id-only revoke_cap_for_task içindeki gerçek mutable SCHEDULER yolunu RPi5 kaynağında local IRQ ve IPC transaction altında 44 production reader ile S328–S329 writer'larının kullandığı aynı statik S247 gate'e bağlar. Endpoint/notification typed identity reddi writer membership'ten önce tamamlanır; gerçek revoke writer lease içinde commit edilir. Guarded writer 3/69, açık writer 66 ve provider authority 0'dır. S245 request tüketilmez, S244 admission üretilmez.",
    evidence: [
      "Focused capability-revoke writer-integration kapısı iki bağımsız koşuda 22/22 PASS: 137 B / SHA-256 4ab22a54b548bb2ea63bc6bcd37322b805a2b858520fdf9f28d6b2cc9f60d06d.",
      "Aynı S247 state word üzerinde CPU0–CPU3 writer membership, reader→writer ve writer→reader exclusion, invalid-CPU pre-callback rejection, exact-once commit-error release ve S329→S330 token monotonluğu doğrulandı; tarihsel S328 girişi CPU1-only kaldı.",
      "Production kaynak sırası IRQ guard → IPC transaction → endpoint/notification registry revalidation → acquire_s330 writer → mutable alias → real revoke → writer drop → transaction drop → IRQ restore olarak kilitlendi. Typed registry reddi writer acquire öncesinde outer guard'ları bırakır.",
      "QEMU, RPi4, RPi5 ve RPi5+SMP AArch64 compile profilleri exit 0 verdi; warning header'ları 292/390/1104/1104, zero-warning iddiası yoktur.",
      "Operations komut haritasından türetilen S238–S330 matrisi iki bağımsız koşuda 94 grup / 1350/1350 PASS; süre-normalize çıktılar 12346 B / SHA-256 6b5149cf2fd453804d9323e52702855bbfbaafe39e1d1f1d23472725c721a3ca ile byte-eşittir.",
      "Exact yedi tarihsel G8h assertion adı dışlandığında tam workspace iki koşuda 292 sonuç grubu / 3168 PASS / 0 fail / 7 filtered verdi; süre-normalize sonuç özetleri 28205 B / SHA-256 e536e537a28196a6a1cf1798a96f3d2c3b16a2a8d166a5dc8b88d1f383643b23 ile byte-eşittir. Filtresiz audit yalnız frozen S96 exceptions.S identity kapısında RED kaldığı için global workspace GREEN iddia edilmez.",
      "make verify-qemu iki bağımsız PASS verdi: strict ELF W^X 31/31 ve aynı 1551 B / SHA-256 527ef12c2bc56140e14e13be445f78c8e38872febc9849afcfacd499238ff966 smoke özeti korundu. Bu ortak regresyon board-rpi5-only S330 writer invocation kanıtı değildir.",
      "Yerel website 506/506 test ile PASS; lint, TypeScript ve static build ayrıca doğrulanır. S330 kaydı yereldir, deployment yapılmadı.",
      "S245 request ve S244 admission dokunulmadan kalır; production provider authority=0, whole-scheduler exclusion=false ve 66 production writer açık kalır.",
      "Fiziksel/device işlem yapılmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S330=NO.",
    ],
    commands: [
      "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s330_capability_revoke_writer_guard_integration -- --test-threads=1",
      "cargo check -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
    ],
    terminalSessions: [
      {
        id: "g8l-s330-capability-revoke-writer-guard-integration",
        title: "G8l S330 capability-revoke writer guard integration",
        commandLines: [
          "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s330_capability_revoke_writer_guard_integration -- --test-threads=1",
        ],
        outputLines: [
          "test result: ok; S330 focused 1 group / 22 passed; 0 failed",
          "shared S247 gate: 44 guarded readers + 3/69 guarded writers; 66 writers open",
          "typed registry reject before writer; provider authority=0; S245 not taken; S244 not published",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
    ],
    terminalSessionsNote:
      "S330 üçüncü production writer'ın kaynak entegrasyonudur; desteklenen RPi5 üzerinde runtime/cihaz gözlemi yapılmadı ve global exclusion oluşmadı.",
    limitations: [
      "66 production writer aynı shared gate dışında kaldığı için whole-scheduler exclusion ve provider authority açık kalır.",
      "Geçici reader/writer çakışması fail-closed reddedilir; ürün liveness, saturation/soak ve latency kabulü henüz kanıtlanmamıştır.",
      "Supported-profile runtime gözlemi, Generic SMP ve fiziksel RPi kabulü açık kalır.",
      "Yerel kayıt henüz deployment değildir; canlı site bu değişiklikle güncellenmemiştir.",
    ],
  },