admin/LithosAnanake
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Phase 8: zuse cert storage moved out of the dictionary (fuse-blow install)

Browse Source 
Found that a pinned CONSTANT is not actually tamper-proof: ACL-PIN only
blocks redefinition, not a >BODY-then-store on the word's existing data
field. Moves the Zuse cert value into C-only VM struct fields
(zuse_cert_lo/hi + zuse_cert_installed fuse bit) with a one-time
vm_zuse_cert_install() and read-only ZUSE-CERT-LO@/HI@/INSTALLED? FORTH
accessors, closing the tamper path structurally instead of by convention.
Deletes the now-insecure ZUSE-CERT-LO/HI CONSTANT words from zuse.4th.

vm_zuse_cert_install() has no caller yet -- the real mint flow (Milestone
6 CA, the MINT word) is still open; this is storage + accessors only, not
a stand-in mint. Documented in FABRIC-3.md. Verified: hosted build clean,
mkcapsule --lint clean (31/31), clean boot to ok> on amd64/aarch64/riscv64
with Stadium conservation intact and no panics.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U14ET9CWAtbQMbYqomKgXd
This commit is contained in:
Robert Allan James
2026-08-26 13:58:22 -04:00
co-authored by Claude Sonnet 5
parent 4dd1321ea4
commit 6f5605d479
14 changed files with 27217 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
capsules/BLOCK_MAP.md
+5 -5
View File
@@ -1,5 +1,5 @@
# Capsule Block Manifest — Auto-generated
<!-- Generated by mkcapsule --manifest 2026-08-26T12:02:09Z -->
<!-- Generated by mkcapsule --manifest 2026-08-26T17:54:43Z -->
<!-- DO NOT EDIT — re-run mkcapsule --manifest to refresh. -->
<!-- Hand-written justifications and immutability notes live -->
<!-- in MANIFEST.md alongside this auto-generated index. -->
@@ -38,7 +38,7 @@
| `sdk.4th` | 5109, 5110, 5111, 5112, 5113, 5114, 5115 | `0x008fdbbb62c94a3a` |
| `turtle.4th` | 5100, 5101, 5102, 5103, 5104, 5105, 5106, 5107, 5108 | `0x4d470418ca543365` |
| `user-font-demo.4th` | 4200, 4201, 4202 | `0xce1fd7d1b581a56d` |
| `zuse.4th` | 4016, 4017, 4018 | `0x12f38ec782434a77` |
| `zuse.4th` | 4016, 4017, 4018 | `0x097456615c8d9173` |
## Block Map (sorted by LBN)
@@ -103,9 +103,9 @@
| 4006 | `ACL.4th` | `0xd781d22148ff171d` | ok |
| 4007 | `ACL.4th` | `0xd781d22148ff171d` | ok |
| 4015 | `ACL.4th` | `0xd781d22148ff171d` | ok |
| 4016 | `zuse.4th` | `0x12f38ec782434a77` | ok |
| 4017 | `zuse.4th` | `0x12f38ec782434a77` | ok |
| 4018 | `zuse.4th` | `0x12f38ec782434a77` | ok |
| 4016 | `zuse.4th` | `0x097456615c8d9173` | ok |
| 4017 | `zuse.4th` | `0x097456615c8d9173` | ok |
| 4018 | `zuse.4th` | `0x097456615c8d9173` | ok |
| 4050 | `lib.4th` | `0x1c77d7c9562a5b62` | ok |
| 4055 | `common:msg.4th` | `0x850a0382344ea6c4` | ok |
| 4060 | `doe-campaign.4th` | `0x3d4549142d91ec20` | ok |
capsules/zuse.4th
+6 -5
View File
@@ -5,19 +5,20 @@ Block 4016
( Loaded by ACL.4th; must not load before ACL.4th. )
( FUTURE: Replace with thumbdrive Ed25519 PKI. )
( HUMAN-REVIEW: capsule hash = root of superuser trust. )
0 CONSTANT ZUSE-CERT-LO
0 CONSTANT ZUSE-CERT-HI
( Cert value lives in C-only VM fields (vm_zuse_cert_install),
( NOT a dictionary CONSTANT: ACL-PIN only blocks redefinition,
( not a >BODY-then-store, so a pinned CONSTANT is not actually
( tamper-proof. Read with ZUSE-CERT-LO@ / ZUSE-CERT-HI@ / )
( ZUSE-CERT-INSTALLED? -- all C primitives, all read-only. )
Block 4017
( ACL-ZUSE-BOOT ( -- ) )
( Authenticates zuse session (sets vm->zuse_session=1)
( via C primitive) and pins zuse capsule words. )
( via C primitive) and pins itself against redefinition.)
( ZUSE-AUTHENTICATE is C-only; no FORTH word grants )
( god-mode except through this boot sequence. )
: ACL-ZUSE-BOOT ( -- )
ZUSE-AUTHENTICATE
['] ZUSE-CERT-LO ACL-PIN
['] ZUSE-CERT-HI ACL-PIN
LOG-INFO" zuse: activated"
['] ACL-ZUSE-BOOT ACL-PIN ;