S429 · Software acceptance evidence publication

#![allow(unexpected_cfgs)]

//! S429 immutable software-acceptance evidence publication.
//!
//! S428's one-shot reconciliation is converted into a one-slot evidence
//! manifest. The manifest records source coverage only. It deliberately keeps
//! runbook execution, supported-profile runtime observation, physical evidence,
//! and deployment verification false so a source result cannot be promoted to
//! a field-acceptance claim.

use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s428_full_chain_reconciliation::{
    G8lS428FullChainReconciliationError, G8lS428FullChainReconciliationReceipt,
    S428_DIRECT_ACCESS_SITES, S428_FIRST_RECONCILED_GATE,
    S428_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES, S428_RECONCILED_GATE_COUNT,
    S428_SOURCE_AUDIT_UNITS, S428_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES,
    S428_UNROUTED_DIRECT_ACCESS_SITES,
};

pub const S429_SOURCE_AUDIT_UNITS: usize = S428_SOURCE_AUDIT_UNITS;
pub const S429_DIRECT_ACCESS_SITES: usize = S428_DIRECT_ACCESS_SITES;
pub const S429_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES: usize =
    S428_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES;
pub const S429_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES: usize =
    S428_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES;
pub const S429_UNROUTED_DIRECT_ACCESS_SITES: usize = S428_UNROUTED_DIRECT_ACCESS_SITES;
pub const S429_FIRST_EVIDENCED_GATE: usize = S428_FIRST_RECONCILED_GATE;
pub const S429_LAST_EVIDENCED_GATE: usize = 428;
pub const S429_EVIDENCED_GATE_COUNT: usize =
    S429_LAST_EVIDENCED_GATE - S429_FIRST_EVIDENCED_GATE + 1;
pub const S429_EVIDENCE_SLOT_CAPACITY: usize = 1;
pub const S429_PRODUCTION_PUBLICATION_CALLSITES: usize = 1;
pub const S429_RUNBOOK_EXECUTED: bool = false;
pub const RUNBOOK_EXECUTED_IN_S429: bool = S429_RUNBOOK_EXECUTED;
pub const S429_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS: usize = 0;
pub const S429_PHYSICAL_OBSERVATIONS: usize = 0;
pub const S429_VERIFIED_DEPLOYMENTS: usize = 0;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS429SoftwareAcceptanceEvidence {
    pub attempt_id: u64,
    pub provider_request_id: u64,
    pub exclusive_token: u64,
    pub evidenced_gate_count: usize,
    pub source_reconciliation_complete: bool,
    pub all_direct_access_guarded: bool,
    pub runbook_executed: bool,
    pub supported_profile_runtime_observations: usize,
    pub physical_observations: usize,
    pub deployment_verified: bool,
}

#[derive(Debug)]
pub struct G8lS429SoftwareAcceptanceEvidenceState {
    pending: Option<G8lS429SoftwareAcceptanceEvidence>,
}

impl G8lS429SoftwareAcceptanceEvidenceState {
    pub const fn new() -> Self {
        Self { pending: None }
    }

    pub const fn pending(&self) -> bool {
        self.pending.is_some()
    }

    pub fn pending_evidence(
        &self,
        caller_cpu: usize,
    ) -> Result<Option<G8lS429SoftwareAcceptanceEvidence>, G8lS429SoftwareAcceptanceEvidenceError>
    {
        if caller_cpu != 1 {
            return Err(G8lS429SoftwareAcceptanceEvidenceError::WrongCpu);
        }
        Ok(self.pending)
    }

    pub fn take(
        &mut self,
        caller_cpu: usize,
    ) -> Result<Option<G8lS429SoftwareAcceptanceEvidence>, G8lS429SoftwareAcceptanceEvidenceError>
    {
        if caller_cpu != 1 {
            return Err(G8lS429SoftwareAcceptanceEvidenceError::WrongCpu);
        }
        Ok(self.pending.take())
    }
}

impl Default for G8lS429SoftwareAcceptanceEvidenceState {
    fn default() -> Self {
        Self::new()
    }
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS429SoftwareAcceptanceEvidenceError {
    WrongCpu,
    S428(G8lS428FullChainReconciliationError),
    ReconciliationBindingDrift,
    SlotOccupied,
    ReconciliationDisappeared,
    ReconciliationDrift,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS429SoftwareAcceptanceEvidenceOutcome {
    Idle,
    EvidencePublished(G8lS429SoftwareAcceptanceEvidence),
    EvidencePending(G8lS429SoftwareAcceptanceEvidence),
}

pub fn service_s429_model_software_acceptance_evidence_publication(
    state: &mut G8lS429SoftwareAcceptanceEvidenceState,
    caller_cpu: usize,
    reconciliation: G8lS428FullChainReconciliationReceipt,
) -> Result<G8lS429SoftwareAcceptanceEvidenceOutcome, G8lS429SoftwareAcceptanceEvidenceError> {
    if caller_cpu != 1 {
        return Err(G8lS429SoftwareAcceptanceEvidenceError::WrongCpu);
    }
    if reconciliation.attempt_id == 0
        || reconciliation.provider_request_id == 0
        || reconciliation.exclusive_token == 0
        || reconciliation.reconciled_gate_count != S428_RECONCILED_GATE_COUNT
        || !reconciliation.all_source_gates_reconciled
        || !reconciliation.no_live_scheduler_access
        || reconciliation.runtime_observed
        || reconciliation.physical_observed
        || S429_DIRECT_ACCESS_SITES != 113
        || S429_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES != S429_DIRECT_ACCESS_SITES
        || S429_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES != S429_DIRECT_ACCESS_SITES
        || S429_UNROUTED_DIRECT_ACCESS_SITES != 0
    {
        return Err(G8lS429SoftwareAcceptanceEvidenceError::ReconciliationBindingDrift);
    }
    let evidence = G8lS429SoftwareAcceptanceEvidence {
        attempt_id: reconciliation.attempt_id,
        provider_request_id: reconciliation.provider_request_id,
        exclusive_token: reconciliation.exclusive_token,
        evidenced_gate_count: S429_EVIDENCED_GATE_COUNT,
        source_reconciliation_complete: true,
        all_direct_access_guarded: true,
        runbook_executed: S429_RUNBOOK_EXECUTED,
        supported_profile_runtime_observations: S429_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS,
        physical_observations: S429_PHYSICAL_OBSERVATIONS,
        deployment_verified: S429_VERIFIED_DEPLOYMENTS != 0,
    };
    if let Some(existing) = state.pending {
        return if existing == evidence {
            Ok(G8lS429SoftwareAcceptanceEvidenceOutcome::EvidencePending(
                existing,
            ))
        } else {
            Err(G8lS429SoftwareAcceptanceEvidenceError::SlotOccupied)
        };
    }
    state.pending = Some(evidence);
    Ok(G8lS429SoftwareAcceptanceEvidenceOutcome::EvidencePublished(
        evidence,
    ))
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
static S429_PRODUCTION_EVIDENCE: spin::Mutex<G8lS429SoftwareAcceptanceEvidenceState> =
    spin::Mutex::new(G8lS429SoftwareAcceptanceEvidenceState::new());

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn service_s429_software_acceptance_evidence_publication_on_cpu1(
) -> Result<G8lS429SoftwareAcceptanceEvidenceOutcome, G8lS429SoftwareAcceptanceEvidenceError> {
    use crate::g8l_runtime_contract::CPU1;

    if crate::percpu::try_current_cpu_id() != Some(CPU1) {
        return Err(G8lS429SoftwareAcceptanceEvidenceError::WrongCpu);
    }
    if let Some(existing) = S429_PRODUCTION_EVIDENCE.lock().pending_evidence(CPU1)? {
        return Ok(G8lS429SoftwareAcceptanceEvidenceOutcome::EvidencePending(
            existing,
        ));
    }
    let Some(reconciliation) = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s428_full_chain_reconciliation::inspect_s428_full_chain_reconciliation_on_cpu1()
        .map_err(G8lS429SoftwareAcceptanceEvidenceError::S428)? else {
        return Ok(G8lS429SoftwareAcceptanceEvidenceOutcome::Idle);
    };
    let taken = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s428_full_chain_reconciliation::take_s428_full_chain_reconciliation_on_cpu1()
        .map_err(G8lS429SoftwareAcceptanceEvidenceError::S428)?
        .ok_or(G8lS429SoftwareAcceptanceEvidenceError::ReconciliationDisappeared)?;
    if taken != reconciliation {
        return Err(G8lS429SoftwareAcceptanceEvidenceError::ReconciliationDrift);
    }
    service_s429_model_software_acceptance_evidence_publication(
        &mut S429_PRODUCTION_EVIDENCE.lock(),
        CPU1,
        taken,
    )
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn inspect_s429_software_acceptance_evidence_on_cpu1(
) -> Result<Option<G8lS429SoftwareAcceptanceEvidence>, G8lS429SoftwareAcceptanceEvidenceError> {
    S429_PRODUCTION_EVIDENCE.lock().pending_evidence(1)
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn take_s429_software_acceptance_evidence_on_cpu1(
) -> Result<Option<G8lS429SoftwareAcceptanceEvidence>, G8lS429SoftwareAcceptanceEvidenceError> {
    S429_PRODUCTION_EVIDENCE.lock().take(1)
}

use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s428_full_chain_reconciliation::G8lS428FullChainReconciliationReceipt;
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s429_software_acceptance_evidence_publication::*;

fn reconciliation() -> G8lS428FullChainReconciliationReceipt {
    G8lS428FullChainReconciliationReceipt {
        attempt_id: 27,
        provider_request_id: 28,
        exclusive_token: 29,
        reconciled_gate_count: 27,
        all_source_gates_reconciled: true,
        no_live_scheduler_access: true,
        runtime_observed: false,
        physical_observed: false,
    }
}

#[test]
fn constants_define_s401_through_s428_evidence_without_runtime_claims() {
    assert_eq!(S429_FIRST_EVIDENCED_GATE, 401);
    assert_eq!(S429_LAST_EVIDENCED_GATE, 428);
    assert_eq!(S429_EVIDENCED_GATE_COUNT, 28);
    assert_eq!(S429_DIRECT_ACCESS_SITES, 113);
    assert_eq!(S429_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES, 113);
    assert_eq!(S429_UNROUTED_DIRECT_ACCESS_SITES, 0);
    assert!(!S429_RUNBOOK_EXECUTED);
    assert_eq!(S429_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS, 0);
    assert_eq!(S429_PHYSICAL_OBSERVATIONS, 0);
    assert_eq!(S429_VERIFIED_DEPLOYMENTS, 0);
}

#[test]
fn exact_reconciliation_publishes_immutable_software_evidence() {
    let mut state = G8lS429SoftwareAcceptanceEvidenceState::new();
    let outcome = service_s429_model_software_acceptance_evidence_publication(
        &mut state,
        1,
        reconciliation(),
    )
    .unwrap();
    let G8lS429SoftwareAcceptanceEvidenceOutcome::EvidencePublished(evidence) = outcome else {
        panic!("evidence")
    };
    assert_eq!(
        (
            evidence.attempt_id,
            evidence.provider_request_id,
            evidence.exclusive_token
        ),
        (27, 28, 29)
    );
    assert_eq!(evidence.evidenced_gate_count, 28);
    assert!(evidence.source_reconciliation_complete && evidence.all_direct_access_guarded);
    assert!(!evidence.runbook_executed);
    assert_eq!(evidence.supported_profile_runtime_observations, 0);
    assert_eq!(evidence.physical_observations, 0);
    assert!(!evidence.deployment_verified);
}

#[test]
fn incomplete_live_or_runtime_claiming_reconciliation_is_rejected() {
    let mut state = G8lS429SoftwareAcceptanceEvidenceState::new();
    let mut drift = reconciliation();
    drift.no_live_scheduler_access = false;
    assert_eq!(
        service_s429_model_software_acceptance_evidence_publication(&mut state, 1, drift),
        Err(G8lS429SoftwareAcceptanceEvidenceError::ReconciliationBindingDrift)
    );
    let mut drift = reconciliation();
    drift.runtime_observed = true;
    assert_eq!(
        service_s429_model_software_acceptance_evidence_publication(&mut state, 1, drift),
        Err(G8lS429SoftwareAcceptanceEvidenceError::ReconciliationBindingDrift)
    );
}

#[test]
fn exact_replay_is_pending_and_different_binding_backpressures() {
    let mut state = G8lS429SoftwareAcceptanceEvidenceState::new();
    service_s429_model_software_acceptance_evidence_publication(&mut state, 1, reconciliation())
        .unwrap();
    let evidence = state.pending_evidence(1).unwrap().unwrap();
    assert_eq!(
        service_s429_model_software_acceptance_evidence_publication(
            &mut state,
            1,
            reconciliation()
        ),
        Ok(G8lS429SoftwareAcceptanceEvidenceOutcome::EvidencePending(
            evidence
        ))
    );
    let mut next = reconciliation();
    next.provider_request_id += 1;
    assert_eq!(
        service_s429_model_software_acceptance_evidence_publication(&mut state, 1, next),
        Err(G8lS429SoftwareAcceptanceEvidenceError::SlotOccupied)
    );
}

#[test]
fn evidence_take_is_cpu1_only_and_one_shot() {
    let mut state = G8lS429SoftwareAcceptanceEvidenceState::new();
    service_s429_model_software_acceptance_evidence_publication(&mut state, 1, reconciliation())
        .unwrap();
    assert_eq!(
        state.take(0),
        Err(G8lS429SoftwareAcceptanceEvidenceError::WrongCpu)
    );
    assert!(state.take(1).unwrap().is_some());
    assert!(state.take(1).unwrap().is_none());
}

#[test]
fn production_backpressures_before_consuming_s428() {
    let source = include_str!("../../kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s429_software_acceptance_evidence_publication.rs");
    let start = source
        .find("service_s429_software_acceptance_evidence_publication_on_cpu1")
        .unwrap();
    let body = &source[start..];
    let pending = body.find("pending_evidence(CPU1)").unwrap();
    let inspect = body
        .find("inspect_s428_full_chain_reconciliation_on_cpu1")
        .unwrap();
    let take = body
        .find("take_s428_full_chain_reconciliation_on_cpu1")
        .unwrap();
    let publish = body
        .find("service_s429_model_software_acceptance_evidence_publication")
        .unwrap();
    assert!(pending < inspect && inspect < take && take < publish);
}

#[test]
fn timer_runs_s429_after_s428_before_scheduler_dispatch_and_modules_are_separate() {
    let source = include_str!("../../kernel/src/arch/aarch64/exceptions.rs");
    let s428 = source
        .find("service_s428_full_chain_reconciliation_on_cpu1")
        .unwrap();
    let s429 = source
        .find("service_s429_software_acceptance_evidence_publication_on_cpu1")
        .unwrap();
    let scheduler = source.rfind("rpi5_g7d::on_timer_irq").unwrap();
    assert!(s428 < s429 && s429 < scheduler);
    let name = "g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s429_software_acceptance_evidence_publication";
    assert!(include_str!("../../kernel/src/main.rs").contains(&format!("mod {name};")));
    assert!(include_str!("../src/lib.rs").contains(&format!("pub mod {name};")));
}

  {
    id: "g8l-s429-software-acceptance-evidence-publication-partial",
    sequence: 429,
    slug: "software_acceptance_evidence_publication",
    title: "Software acceptance evidence publication",
    focusedTests: 7,
    sourceBytes: 8650,
    sourceSha256:
      "ac6d9992be49d39118b1ad6d1b0c575ae48a49b6bf73222739668501e0d2b1f1",
    testBytes: 5974,
    testSha256:
      "9d94774d44cc4ad11b8fb231c81c79bbb68b204f4d440409e561c8acc4431792",
    acceptance:
      "S401–S428 kapsamındaki 28 kapının reconciliation sonucu immutable software-acceptance evidence slot'una exact coverage ve sınır bitleriyle yayımlanır.",
    retainedBoundary:
      "RUNBOOK=false, runtime=0, physical=0 ve verified deployment=0 ürün-source sabitleridir.",
  },