admin/LithosAnanake
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Phase 8: zuse cert storage moved out of the dictionary (fuse-blow install)

Browse Source 
Found that a pinned CONSTANT is not actually tamper-proof: ACL-PIN only
blocks redefinition, not a >BODY-then-store on the word's existing data
field. Moves the Zuse cert value into C-only VM struct fields
(zuse_cert_lo/hi + zuse_cert_installed fuse bit) with a one-time
vm_zuse_cert_install() and read-only ZUSE-CERT-LO@/HI@/INSTALLED? FORTH
accessors, closing the tamper path structurally instead of by convention.
Deletes the now-insecure ZUSE-CERT-LO/HI CONSTANT words from zuse.4th.

vm_zuse_cert_install() has no caller yet -- the real mint flow (Milestone
6 CA, the MINT word) is still open; this is storage + accessors only, not
a stand-in mint. Documented in FABRIC-3.md. Verified: hosted build clean,
mkcapsule --lint clean (31/31), clean boot to ok> on amd64/aarch64/riscv64
with Stadium conservation intact and no panics.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U14ET9CWAtbQMbYqomKgXd
This commit is contained in:
Robert Allan James
2026-08-26 13:58:22 -04:00
co-authored by Claude Sonnet 5
parent 4dd1321ea4
commit 6f5605d479
14 changed files with 27217 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
capsules/zuse.4th
+6 -5
View File
@@ -5,19 +5,20 @@ Block 4016
( Loaded by ACL.4th; must not load before ACL.4th. )
( FUTURE: Replace with thumbdrive Ed25519 PKI. )
( HUMAN-REVIEW: capsule hash = root of superuser trust. )
0 CONSTANT ZUSE-CERT-LO
0 CONSTANT ZUSE-CERT-HI
( Cert value lives in C-only VM fields (vm_zuse_cert_install),
( NOT a dictionary CONSTANT: ACL-PIN only blocks redefinition,
( not a >BODY-then-store, so a pinned CONSTANT is not actually
( tamper-proof. Read with ZUSE-CERT-LO@ / ZUSE-CERT-HI@ / )
( ZUSE-CERT-INSTALLED? -- all C primitives, all read-only. )
Block 4017
( ACL-ZUSE-BOOT ( -- ) )
( Authenticates zuse session (sets vm->zuse_session=1)
( via C primitive) and pins zuse capsule words. )
( via C primitive) and pins itself against redefinition.)
( ZUSE-AUTHENTICATE is C-only; no FORTH word grants )
( god-mode except through this boot sequence. )
: ACL-ZUSE-BOOT ( -- )
ZUSE-AUTHENTICATE
['] ZUSE-CERT-LO ACL-PIN
['] ZUSE-CERT-HI ACL-PIN
LOG-INFO" zuse: activated"
['] ACL-ZUSE-BOOT ACL-PIN ;