From ad79caeeeb1c64401be1265dbad4961096d87f3d Mon Sep 17 00:00:00 2001 From: Robert Allan James Date: Fri, 28 Aug 2026 08:20:12 -0400 Subject: [PATCH] FABRIC-3.md: capture birth-by-message-only vision (D.7), universal to Zuse+user VMs Direct instruction while planning the next goal (mint zuse.img thumbdrive -> (Zuse)ok>): Hera must give birth only by message request, no coupling outside messages, applying universally to user VMs too, not just Zuse -- a sharper commitment to the standing "nothing is done until it's messaging" criterion (D.1) for this specific next flow, since messaging and storage are both genuinely live now. Traced before capturing anything further: detection ownership moving to a running Artemis VM instance is confirmed a real architecture change from what HOTPLUG/WIREBIND already built/scoped (both currently have Hera deciding and acting directly, not just detecting). Found a real, load-bearing prerequisite this direction depends on: Artemis is not persistently alive today -- every boot log this session confirms she's birthed for her own migration self-test then explicitly killed before the REPL reaches ok>. Capture only, no design commitments yet -- WIREBIND/MSGMIGRATE both need their own reconciliation pass against this. --- FABRIC-3.md | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) diff --git a/FABRIC-3.md b/FABRIC-3.md index e271541..970fd57 100644 --- a/FABRIC-3.md +++ b/FABRIC-3.md @@ -2497,3 +2497,54 @@ QMP used instead to force a fresh device read, which is non-destructive). all three are now genuinely unblocked, not just scoped. Nothing about their own design changes; they can now actually be built and tested rather than only designed. Real hardware (Milestone 8) remains untested — this verification is QEMU-only, per `F.1`'s own acknowledged scope. + +### D.7 — Birth-by-message-only, universal to Zuse and user VMs (vision, 2026-08-28) + +Stated directly, prompted by planning the freshly-minted-`zuse.img`-thumbdrive-to-`(Zuse)ok>` +flow: **"Hera gives birth only by request once messaging and storage are functional and +should display no coupling outside of messages. This will include 'user' VMs too."** A +sharper, universal restatement of the standing "nothing is done until it's messaging" +completion criterion (D.1) — not a new principle, but a concrete commitment that this +specific, next flow should go straight to the message-only shape rather than pass through +a hardwired interim first, since messaging (`Hermes`) and storage (`Artemis`) are both now +genuinely live. + +**Concretely, for the mint-`zuse.img`-thumbdrive-to-`(Zuse)ok>` flow:** +1. Hera's own hardware polling (`sk_repl_idle()`/`xhci_poll_events()`) is unavoidable — + she's the only VM whose C code has xHCI MMIO access. This stays. +2. But Hera must not *decide or act* on what she detects. Per direct instruction: **detection + ownership moves to a running Artemis VM instance** — a real change from what `HOTPLUG` + (closed) and `WIREBIND` (§F.5, still just a breadcrumb) already built/scoped, both of which + currently have Hera deciding and acting directly. Hera's role narrows to relaying the raw + hardware event; Artemis owns the identity-verification decision and the birth *request*. +3. Grounded, not assumed: block LBN space is one flat, global address space + (`block_subsystem.c`'s `g.total_user_lbn`), not per-VM — any VM's dictionary can already + read any LBN once told which one, no new C-level read plumbing needed for the + identity-check content itself. The gap is coordination (when, which LBN), not capability. + +**Real, load-bearing prerequisite surfaced by tracing, not assumed:** Artemis is not +persistently alive today. Every boot this session confirms she's birthed for her own 4.6 +migration self-test, then explicitly killed (`KILL: Artemis dead`) before the REPL ever +reaches `ok>`. For any message to reach a running Artemis instance, she has to actually stay +born — a real, new requirement this direction depends on, not something `HOTPLUG`/`WIREBIND` +ever needed before. + +**What this reshapes, not yet re-scoped:** +- `WIREBIND` (§F.5) was deliberately left a breadcrumb, not fully designed, specifically + because "wire hotplug → `capsule_birth_baby()` directly" is exactly the hardwired coupling + this principle now rules out — this direction is the real answer that breadcrumb was + waiting for, not a contradiction of it. +- `MSGMIGRATE` (§F.15) scoped a two-hop Hera↔Console flow (Hera reports attach, Console + requests the privileged operation). Artemis is a **new participant**, not a replacement — + identity verification/storage (Artemis's role) and human-facing onboarding UX (Console's + role, §D.6) are both real and distinct; the full flow likely needs both, reconciled together + rather than re-litigated as either/or. +- Applies universally, per direct instruction — the same message-only shape governs ordinary + user-VM birth too, not a Zuse-specific carve-out. + +**Not yet scoped:** whether Artemis becoming persistent changes her own self-test's shape or +timing; the exact message types/payloads for Hera→Artemis (raw attach event) and +Artemis→Hera (birth request); how/whether Console fits into this specific flow versus the +already-scoped `MSGMIGRATE` two-hop; whether `CERTVERIFY` (§F.7) itself should now run as +Artemis-mediated logic rather than a bare function call. Capture only, per this arc's own +established discipline — design happens in its own pass.