admin/LithosAnanake
1
0
Fork 0
Code Issues Pull Requests Actions 16 Packages Projects Releases Wiki Activity

Rename FABRIC series: FABRIC.md->0, FABRIC-2.md->1, FABRIC-3.md->2, FABRIC-4.md unchanged

Browse Source 
FABRIC.md -> FABRIC-0.md
FABRIC-2.md -> FABRIC-1.md
FABRIC-3.md -> FABRIC-2.md (the current/living document)
FABRIC-4.md unchanged (new #3 to follow separately)

Every cross-reference repo-wide updated to match, including doc-comment
citations inside kernel source (.c/.h) files -- done via an ordered
placeholder substitution (FABRIC-3.md->placeholder2, FABRIC-2.md->
placeholder1, FABRIC.md->placeholder0, then placeholders resolved to
final names) in a single pass per file to avoid double-shifting
already-renamed references.

One line in capsules/font.4th grew past the 64-char block-format limit
as a side effect of the longer filename; shortened it and reverified
with mkcapsule --lint (34/34 pass) before rebuilding.

Verified 3-arch boot to ok> (amd64/aarch64/riscv64, each in the
foreground) after the fix; logs and DoE CSVs from this session's
verification runs included per this repo's own audit-artifact
convention.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019YcT3H2PQeyujrzjqS3Var
This commit is contained in:
Robert Allan James
2026-09-04 11:22:51 -04:00
co-authored by Claude Sonnet 5
parent ff2941dfb9
commit b031b802e3
128 changed files with 37154 additions and 9572 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/block_subsystem.h
+10 -10
View File
@@ -167,7 +167,7 @@ typedef struct {
* graceful-default technique as reloc_devblocks itself: a
* pre-existing formatted volume's zeroed padding reads back here as
* meta_fence_blocks=0 ("no fence yet"), not a format-breaking
* change. See FABRIC-3.md's Phase 8 §C writeup for the full design. */
* change. See FABRIC-2.md's Phase 8 §C writeup for the full design. */
uint32_t meta_fence_blocks; /* current fence size, in 4 KiB devblocks (0 = none yet) */
/* Padding to keep header ≤ 4096 bytes */
@@ -199,7 +199,7 @@ typedef struct {
_Static_assert(sizeof(blk_volume_meta_t) == 4096,
"blk_volume_meta_t must be exactly one 4 KiB devblock");
/* blk_meta_t.flags bit values -- FABRIC-3.md §F.4/§H.6/§H.12 step 13,
/* blk_meta_t.flags bit values -- FABRIC-2.md §F.4/§H.6/§H.12 step 13,
* decided 2026-09-02/03. Orthogonal bits, not a mutually-exclusive enum:
* a block can be both CLAIMED and MIGRATING at once. Grounded in the only
* states §F.4 actually motivated by a real need (MIGSM/UNCLEAN, two
@@ -233,7 +233,7 @@ typedef struct {
uint64_t entropy[4]; /* 256-bit entropy/random seed */
uint64_t hash[4]; /* SHA-256 (optional) */
/* Security & ownership -- FABRIC-3.md §F.4/§H.6/§H.12 step 12, decided
/* Security & ownership -- FABRIC-2.md §F.4/§H.6/§H.12 step 12, decided
* 2026-08-27/2026-09-03: BMAPFMT repurposes this slot rather than
* building a separate on-drive block-map table (distributed
* ownership/ACL, travels with the block itself). Replaces the old
@@ -276,7 +276,7 @@ typedef struct {
uint8_t padding[5]; /* trailing slack, unrelated to any exact size target --
* the old "341-byte slice" comment here was already
* inaccurate before FABRIC-3.md §H.12 step 12's edit
* inaccurate before FABRIC-2.md §H.12 step 12's edit
* (sizeof(blk_meta_t) was 344, not 341, due to
* ordinary trailing struct-alignment padding after
* this array -- harmless since BLK_META_PER_BLOCK,
@@ -357,7 +357,7 @@ uint64_t blk_subsys_epoch(void);
* the caller's own identity already owns, on whichever device it's being
* relocated to; this function does not itself validate ownership, that's
* policy, left to the caller -- see this session's ACL-owns-policy
* direction in FABRIC-2.md), frees home_lbn's original BAM entry, records
* direction in FABRIC-1.md), frees home_lbn's original BAM entry, records
* an LBN->LBN redirect so every future access to home_lbn transparently
* resolves to target_lbn instead, and bumps blk_subsys_epoch() so any VM's
* cached block window correctly invalidates. Persisted immediately to the
@@ -376,7 +376,7 @@ uint64_t blk_subsys_epoch(void);
int blk_subsys_relocate_block(uint32_t home_lbn, uint32_t target_lbn);
/* blk_get_device_range - the LBN range (start_lbn, count of 1 KiB FORTH
* blocks) a specific already-attached device occupies (FABRIC-3.md §I.2,
* blocks) a specific already-attached device occupies (FABRIC-2.md §I.2,
* 2026-09-04). Mirrors blk_subsys_detach_device()'s own dev-pointer slot
* lookup, exposed publicly for the first time -- needed so a caller can
* scope a scan/query to exactly one attached device rather than the
@@ -404,7 +404,7 @@ int blk_get_device_free_blocks(struct blkio_dev *dev, uint64_t *out_free, uint64
*/
int blk_get_first_disk_range(uint32_t *out_start_lbn, uint32_t *out_count);
/* blk_firsttouch_claim - FABRIC-3.md §F.11, decisions 1-3, built exactly
/* blk_firsttouch_claim - FABRIC-2.md §F.11, decisions 1-3, built exactly
* as scoped 2026-08-27 (re-verified against current blk_meta_t 2026-09-04
* before building -- the chain fields below are real and untouched by
* BMAPFMT's unrelated owner_fp/acl_allow/acl_ttl/flags field addition).
@@ -444,7 +444,7 @@ int blk_get_first_disk_range(uint32_t *out_start_lbn, uint32_t *out_count);
*/
int blk_firsttouch_claim(const uint8_t owner_fp[8], uint32_t count, uint32_t *out_chain_head);
/* blk_meta_relocate_devblock - the real migration primitive (FABRIC-3.md
/* blk_meta_relocate_devblock - the real migration primitive (FABRIC-2.md
* §I.2, migration state machine, 2026-09-04): moves one devblock's full
* content and blk_meta_t ownership from home_devblock to target_devblock.
* BLK_FLAG_MIGRATING is set on home_devblock for the duration -- the
@@ -479,7 +479,7 @@ int blk_firsttouch_claim(const uint8_t owner_fp[8], uint32_t count, uint32_t *ou
int blk_meta_relocate_devblock(uint32_t home_devblock, uint32_t target_devblock);
/* blk_migration_idle_check - heat/wear-leveling migration trigger, meant
* to be called once per idle tick (FABRIC-3.md §I.2, 2026-09-04). See
* to be called once per idle tick (FABRIC-2.md §I.2, 2026-09-04). See
* block_subsystem.c's own doc comment for the full scan/threshold
* description and what's deliberately left open (overflow-triggered
* migration). */
@@ -524,7 +524,7 @@ int blk_get_meta(uint32_t block_num, blk_meta_t *meta);
int blk_set_meta(uint32_t block_num, const blk_meta_t *meta);
/* BMAPFMT field accessors -- FABRIC-3.md §F.4/§H.6/§H.12 step 14. Thin
/* BMAPFMT field accessors -- FABRIC-2.md §F.4/§H.6/§H.12 step 14. Thin
* read-modify-write wrappers over blk_get_meta()/blk_set_meta() (which
* already own the caching/dirty-tracking), one per new blk_meta_t field.
* FORTH wrappers (BLK-ACL-ALLOW@/! etc., §H.12 step 15) call these, not
include/q48_16.h
+2 -2
View File
@@ -256,7 +256,7 @@ q48_16_t q48_sqrt_approx(q48_16_t q);
/*
* @brief Approximate sin(q) in Q48.16 (integer-only, Taylor series)
*
* Purpose: Console drawing fabric's CIRCLE/ARC/ELLIPSE (FABRIC.md item 4.3.3b)
* Purpose: Console drawing fabric's CIRCLE/ARC/ELLIPSE (FABRIC-0.md item 4.3.3b)
* Method: Range-reduce into [-pi, pi], then Taylor series
*
* @param q Angle in Q48.16 format (radians, any magnitude)
@@ -267,7 +267,7 @@ q48_16_t q48_sin_approx(q48_16_t q);
/*
* @brief Approximate cos(q) in Q48.16 (integer-only, Taylor series)
*
* Purpose: Console drawing fabric's CIRCLE/ARC/ELLIPSE (FABRIC.md item 4.3.3b)
* Purpose: Console drawing fabric's CIRCLE/ARC/ELLIPSE (FABRIC-0.md item 4.3.3b)
* Method: Range-reduce into [-pi, pi], then Taylor series
*
* @param q Angle in Q48.16 format (radians, any magnitude)
include/starkernel/blkio_usb.h
+1 -1
View File
@@ -6,7 +6,7 @@
* driver's synchronous bridge (xhci_bot_wait_for_idle(), xhci_bot_get_capacity(),
* xhci_bot_read_block()) from Milestone 2h's foundational increment.
*
* Read-write since 2026-08-28 (FABRIC-3.md §F.1): SCSI WRITE(10) is real
* Read-write since 2026-08-28 (FABRIC-2.md §F.1): SCSI WRITE(10) is real
* (xhci_bot_send_write10()/xhci_bot_write_block()/xhci_bot_write_data_out(),
* xhci.c), mirroring READ(10)'s existing CBW/data-stage/CSW machinery with
* the data direction flipped. Verified live on amd64: BLK-CONFIRM-FORMAT's
include/starkernel/capsule.h
+1 -1
View File
@@ -87,7 +87,7 @@ typedef enum {
/** Mama init flag (exactly one capsule must have this) */
#define CAPSULE_FLAG_MAMA_INIT 0x00000040 /* (m) Mama's init */
/** Contributor capsule flag (FABRIC-3.md §I.5, 2026-09-04) -- path-match
/** Contributor capsule flag (FABRIC-2.md §I.5, 2026-09-04) -- path-match
* on capsules/contrib/, mirrors FLAG_MAMA_INIT's own exact-match pattern
* in mkcapsule.c's flags_from_name(). Trust-tier enforcement (QEMU-vs-
* real-hardware, decided in conversation) is a runtime check in
include/starkernel/capsule_birth.h
+3 -3
View File
@@ -127,7 +127,7 @@ CapsuleRunResult capsule_birth_mama(
* @param descs Capsule descriptor array
* @param names Capsule name entry array (parallel to descs)
* @param arena Capsule payload arena
* @param parent Who is birthing this VM (FABRIC-3.md §H.12 step 7) --
* @param parent Who is birthing this VM (FABRIC-2.md §H.12 step 7) --
* the caller's own VMUuid (e.g. vm->stadium_vm_id for
* a FORTH word handler), recorded on the new VM's
* Session.parent. Every current call site has one in
@@ -138,7 +138,7 @@ CapsuleRunResult capsule_birth_mama(
* @param skip_pki_sig 0 for every build-time capsule (the normal case --
* checked against the compile-time-baked signature
* array via capsule_get_signatures()). Non-zero only
* for RUNCAP (FABRIC-3.md §F.6/F.18): a heap-built,
* for RUNCAP (FABRIC-2.md §F.6/F.18): a heap-built,
* single-entry directory sourced from a user's own
* thumbdrive has no entry in that array at all --
* index 0 would silently compare against whatever
@@ -254,7 +254,7 @@ uint32_t capsule_vm_registry_count(void);
* capsule_vm_registry_get_by_index - Get registry entry by list position
* (birth order, stable within a boot session -- the registry is
* append-only). For enumeration (e.g. the idle-loop messaging pump,
* FABRIC-3.md Phase C, 2026-08-28), where no vm_id is known up front.
* FABRIC-2.md Phase C, 2026-08-28), where no vm_id is known up front.
* Index range is [0, capsule_vm_registry_count()).
*
* @param index Zero-based position in birth order
include/starkernel/capsule_console.h
+2 -2
View File
@@ -8,7 +8,7 @@
*/
/**
* capsule_console.h - Bare console-VM birth (FABRIC-3.md Phase F,
* capsule_console.h - Bare console-VM birth (FABRIC-2.md Phase F,
* 2026-08-28): a minimal VM whose only job is loading
* common:messaging.4th and being the physical REPL's relay target
* (sk_repl_dispatch_line(), repl.c) for a paired user VM
@@ -35,7 +35,7 @@
* "CaptBob"); sk_repl_dispatch_line() looks for a
* live "<name>~user" counterpart to decide
* whether a given active VM is a console.
* @param parent Who is birthing this VM (FABRIC-3.md §H.12 step 7)
* @param parent Who is birthing this VM (FABRIC-2.md §H.12 step 7)
* -- passed straight through to capsule_birth_baby().
* @param out_vm_id Output: assigned VM ID.
* @param out_vm_ctx Output: new VM context (may be NULL).
include/starkernel/capsule_mint.h
+2 -2
View File
@@ -9,7 +9,7 @@
/**
* capsule_mint.h - MINT: mint a fresh identity onto a blank thumbdrive
* (FABRIC-3.md §F.8/§F.19), the last piece of the original Tripod
* (FABRIC-2.md §F.8/§F.19), the last piece of the original Tripod
* vision. Writes a real keypair, a Zuse-signed cert, and a minimal
* working default personality -- everything RUNCAP (capsule_runcap.h)
* and CERTVERIFY need at a later attach.
@@ -87,7 +87,7 @@ typedef enum {
* internal "refuse to overwrite" re-check, which
* otherwise repeats the exact same full BOT read
* sequence a second time for no reason (found live,
* FABRIC-3.md §F.25/§F.26: the redundant check was
* FABRIC-2.md §F.25/§F.26: the redundant check was
* mistaken for a hang before the real cause -- leaked
* `tail -f` processes from repeated hard kills during
* the same debugging session -- was found). Pass 0 from
include/starkernel/capsule_run.h
+3 -3
View File
@@ -32,7 +32,7 @@
#include <stddef.h>
#include <stdint.h>
#include "starkernel/vm_uuid.h" /* VMUuid -- FABRIC.md item 3.8 */
#include "starkernel/vm_uuid.h" /* VMUuid -- FABRIC-0.md item 3.8 */
#ifdef __cplusplus
extern "C" {
@@ -56,7 +56,7 @@ typedef enum {
CAPSULE_RUN_ERR_EXEC_FAIL, /* Execution failed */
CAPSULE_RUN_ERR_HASH_MISMATCH, /* Post-run hash mismatch */
CAPSULE_RUN_ERR_STILLBORN, /* VM birth failed */
CAPSULE_RUN_ERR_FLEET_FULL, /* Outer Stadium at stadium_max_vm_count() (FABRIC.md item 1.5/2.2) */
CAPSULE_RUN_ERR_FLEET_FULL, /* Outer Stadium at stadium_max_vm_count() (FABRIC-0.md item 1.5/2.2) */
} CapsuleRunResult;
/*===========================================================================
@@ -107,7 +107,7 @@ typedef struct {
* parent chain stops at. */
void *vm_ptr; /* Pointer to live VM object; NULL when dead */
char name[VM_NAME_MAX]; /* Symbolic name, e.g. "Hera", "Hermes" */
size_t stadium_patron_cell; /* FABRIC-3.md SS B, VM-COOL: this VM's own
size_t stadium_patron_cell; /* FABRIC-2.md SS B, VM-COOL: this VM's own
* Stadium cell index (STADIUM_CELL_NONE,
* i.e. (size_t)-1, if never admitted or
* already reaped) -- admitted into the VM's
include/starkernel/capsule_runcap.h
+2 -2
View File
@@ -9,7 +9,7 @@
/**
* capsule_runcap.h - RUNCAP: runtime capsule construction from thumbdrive
* content (FABRIC-3.md §F.6/§F.18).
* content (FABRIC-2.md §F.6/§F.18).
*
* A user's identity source (raw FORTH init/personality text, minted by
* MINT into a home-blocks drive's identity_src region) never exists at
@@ -58,7 +58,7 @@ struct blkio_dev;
* @param vm_name Symbolic name for the new VM (becomes both the
* capsule's own single directory entry name and the
* VM registry name).
* @param parent Who is birthing this VM (FABRIC-3.md §H.12 step 7) --
* @param parent Who is birthing this VM (FABRIC-2.md §H.12 step 7) --
* passed straight through to capsule_birth_baby().
* @param out_vm_id Output: assigned VM ID.
* @param out_vm_ctx Output: new VM context (may be NULL if not needed).
include/starkernel/capsule_sig.h
+1 -1
View File
@@ -7,7 +7,7 @@
*
* Enforced ONLY on CAPSULE_SIG_INVALID (2026-08-26, after landing
* WARN-only and proving correct on all three architectures against both
* a valid and a deliberately-corrupted capsule -- see FABRIC-3.md's
* a valid and a deliberately-corrupted capsule -- see FABRIC-2.md's
* Milestone 6 writeup). CAPSULE_SIG_MISSING and CAPSULE_SIG_NO_ROOT_KEY
* stay WARN-only, deliberately: MISSING is the normal state on every
* machine without access to the offline signing key (CI, any other
include/starkernel/capsule_vm_physics.h
+2 -2
View File
@@ -41,7 +41,7 @@
#define STARKERNEL_CAPSULE_VM_PHYSICS_H
#include <stdint.h>
#include "starkernel/vm_uuid.h" /* VMUuid -- FABRIC.md item 3.8 */
#include "starkernel/vm_uuid.h" /* VMUuid -- FABRIC-0.md item 3.8 */
#ifdef __cplusplus
extern "C" {
@@ -82,7 +82,7 @@ void vm_physics_retire(VMUuid vm_id);
* (amount = elapsed_ticks * fleet_transfer_slope_q48 >> 16) and appends
* vm_id to the fleet's rolling touch-history window.
*
* Restated on the virtual tick (FABRIC.md item 2.1, 2026-08-04): no
* Restated on the virtual tick (FABRIC-0.md item 2.1, 2026-08-04): no
* longer takes a wall-clock timestamp. Reads fleet_heartbeat_tick_count
* internally, which is execution-paced (advanced once per vm_tick()
* call, see vm_physics_heartbeat_tick), so the transfer this produces is
include/starkernel/capsule_wirebind.h
+5 -5
View File
@@ -9,7 +9,7 @@
/**
* capsule_wirebind.h - WIREBIND: the real thumbdrive-attach call site
* (FABRIC-3.md §F.5/§F.23). Assembles pieces already built and
* (FABRIC-2.md §F.5/§F.23). Assembles pieces already built and
* individually verified this session -- CERTVERIFY (vm_identity.h's
* vm_identity_from_cert()), RUNCAP (capsule_runcap.h), the console-VM +
* user-VM pair (capsule_console.h, sk_repl_dispatch_line() in repl.c) --
@@ -33,7 +33,7 @@ struct blkio_dev;
* it against mama_vm's own Zuse identity. Shared by both
* capsule_wirebind_try_attach() (the original attach) and BINDSTEP
* (mama_word_use(), mama_forth_words.c -- re-verifies live on every USE
* of an identity-locked VM, per FABRIC-3.md §F.9 decision 1) so both
* of an identity-locked VM, per FABRIC-2.md §F.9 decision 1) so both
* call sites check the exact same thing the exact same way.
*
* No-op-and-fail (-1) if sig->cert_offset is 0 (no cert region -- a
@@ -80,7 +80,7 @@ void capsule_wirebind_try_attach(struct blkio_dev *dev,
/**
* capsule_wirebind_eject - Graceful detach of whatever VM is currently
* attached via the home-blocks USB path (FABRIC-3.md §F.10, decision 1).
* attached via the home-blocks USB path (FABRIC-2.md §F.10, decision 1).
* The drive is still physically present when this runs.
*
* Sequence: resolve the tracked attached-VM id to a live registry entry
@@ -102,7 +102,7 @@ int capsule_wirebind_eject(void);
/**
* capsule_wirebind_unclean_detach - Abrupt-path counterpart to
* capsule_wirebind_eject() (FABRIC-3.md §F.10, decision 2 -- the UNCLEAN
* capsule_wirebind_eject() (FABRIC-2.md §F.10, decision 2 -- the UNCLEAN
* node, closed alongside EJECT). Called from the existing
* bot_msc_detach_pending hot-unplug signal (repl.c) -- the device is
* already gone by the time this runs, so no flush is attempted; data
@@ -115,7 +115,7 @@ void capsule_wirebind_unclean_detach(void);
/**
* capsule_wirebind_attached_username - The plain username (no "~user"
* registry-name suffix) of whichever identity is currently tracked as
* attached, or NULL if none is (FABRIC-3.md §I.1/4.4s -- the `(user)`
* attached, or NULL if none is (FABRIC-2.md §I.1/4.4s -- the `(user)`
* console prompt segment reads this). Points into WIREBIND's own
* internal storage; valid only until the next attach/eject/detach, same
* caveat as console_get_vm_name().
include/starkernel/capsule_zuse_boot.h
+2 -2
View File
@@ -9,7 +9,7 @@
/**
* capsule_zuse_boot.h - Thumbdrive-resident Zuse genesis/attach
* (FABRIC-3.md §F.20/§F.21). Replaces kernel_main.c's old one-shot
* (FABRIC-2.md §F.20/§F.21). Replaces kernel_main.c's old one-shot
* block-fence mint-or-load: Zuse's own identity now lives only on her
* own minted thumbdrive, never system-resident. Since USB attach
* detection only happens inside the idle loop (sk_repl_idle(), not at
@@ -60,7 +60,7 @@ void capsule_zuse_boot_try_attach(struct blkio_dev *dev,
/**
* capsule_zuse_boot_logout - End Zuse's session when her own attached
* drive detaches (FABRIC-3.md §I.8, re-scoped 2026-09-04: no identity is
* drive detaches (FABRIC-2.md §I.8, re-scoped 2026-09-04: no identity is
* different here -- Zuse logs out on device removal exactly like a
* WIREBIND user does, not via a Stadium-patron TTL. She has no separate
* VM or blocks of her own, so unlike capsule_wirebind_eject()/
include/starkernel/console.h
+4 -4
View File
@@ -73,7 +73,7 @@ void console_init(void);
void console_fb_init(const FramebufferInfo *info, FbPixelFormat fmt);
/**
* FABRIC.md item 4.4j: switch the framebuffer console's glyph backend from
* FABRIC-0.md item 4.4j: switch the framebuffer console's glyph backend from
* font_8x16.c to TTF-TEXT's rasterizer. Thin wrapper over
* vt100_enable_ttf() -- see that function's doc comment for the full
* contract (lazy font load, cell-geometry/cols/rows recompute, screen
@@ -84,7 +84,7 @@ void console_fb_init(const FramebufferInfo *info, FbPixelFormat fmt);
void console_fb_enable_ttf(void);
/**
* FABRIC.md item 4.4q: thin wrappers over vt100_scroll_back()/
* FABRIC-0.md item 4.4q: thin wrappers over vt100_scroll_back()/
* vt100_scroll_fwd() -- see those functions' doc comments for the full
* contract. No-op if the framebuffer console was never initialized.
*/
@@ -92,7 +92,7 @@ void console_fb_scroll_back(uint32_t n);
void console_fb_scroll_fwd(uint32_t n);
/**
* FABRIC.md item 4.4y-revised: thin wrapper over vt100_toggle_graphics()
* FABRIC-0.md item 4.4y-revised: thin wrapper over vt100_toggle_graphics()
* -- see that function's doc comment for the full contract (the
* Alt+TAB graphics/text state machine). No-op if the framebuffer console
* was never initialized.
@@ -160,7 +160,7 @@ int console_poll(void);
/**
* Set the active VM name shown as [Name] prefix on each output line.
* Pass NULL to suppress the prefix (kernel-only output before any VM).
* Copies into internal storage (FABRIC-3.md Phase F, 2026-08-28) -- the
* Copies into internal storage (FABRIC-2.md Phase F, 2026-08-28) -- the
* caller's own pointer does not need to remain valid afterward.
*/
void console_set_vm_name(const char *name);
include/starkernel/framebuffer.h
+2 -2
View File
@@ -89,7 +89,7 @@ void fb_draw_glyph(uint32_t px, uint32_t py, uint8_t ch,
* --------------------------------------------------------------------- */
/**
* One-time boot diagnostic (FABRIC.md item 4.3.1): fills each raster corner
* One-time boot diagnostic (FABRIC-0.md item 4.3.1): fills each raster corner
* with a distinct solid color so a screendump reveals orientation. Not part
* of the Console drawing fabric -- diagnostic-only.
*/
@@ -113,7 +113,7 @@ void fb_scroll_rows(uint32_t pixel_rows, uint32_t bg);
/**
* Scroll a sub-rectangle of the framebuffer up by `pixel_rows` pixel rows
* (FABRIC.md item 4.4t: box-confined REPL scrolling). Unlike fb_scroll_rows()
* (FABRIC-0.md item 4.4t: box-confined REPL scrolling). Unlike fb_scroll_rows()
* (whole-framebuffer), this is bounded to
* [x, x+w) x [y, y+h). Both take an explicit pixel-row count so callers with
* a non-8x16 cell height (e.g. TTF mode) pass their own cell height directly.
include/starkernel/homeblocks_sig.h
+4 -4
View File
@@ -21,7 +21,7 @@
*/
/**
* homeblocks_sig.h - Home-blocks drive signature format (FABRIC-3.md,
* homeblocks_sig.h - Home-blocks drive signature format (FABRIC-2.md,
* Milestone 4, Phase 8 kickoff; relocated + GPT dropped §F.13/§F.8,
* 2026-08-28)
*
@@ -74,7 +74,7 @@ extern "C" {
#define HOMEBLOCKS_SIG_GET_VERSION(m) ((uint8_t)(((m) >> 32) & 0xFF))
/* Where this header actually lives on a home-blocks drive: forth-block 4
* (devblock 1), NOT devblock 0 -- FABRIC-3.md §F.13, decided 2026-08-28.
* (devblock 1), NOT devblock 0 -- FABRIC-2.md §F.13, decided 2026-08-28.
* Devblock 0 is reserved for the block-subsystem's own generic 'STFR'/v2
* volume header (block_subsystem.c); the two formats collide if both try
* to occupy devblock 0 of the same raw device. GPT is permanently dropped
@@ -103,7 +103,7 @@ typedef struct {
uint32_t cert_devblocks; /* Size reserved for the cert blob, in devblocks. */
uint32_t identity_src_offset; /* Devblock offset where this identity's own record
* starts (RUNCAP/MINT, FABRIC-3.md §F.6/§F.8): first
* starts (RUNCAP/MINT, FABRIC-2.md §F.6/§F.8): first
* devblock is a user_identity_seed_t, remainder is raw
* FORTH personality/init source. Renamed from
* blockmap_offset -- BMAPFMT (§F.4) repurposed blk_meta_t
@@ -137,7 +137,7 @@ typedef struct {
typedef char homeblocks_sig_size_check[(sizeof(homeblocks_sig_t) == 4096) ? 1 : -1];
/*===========================================================================
* Signature check (FABRIC-3.md, Milestone 4)
* Signature check (FABRIC-2.md, Milestone 4)
*===========================================================================*/
typedef enum {
include/starkernel/i8042.h
+2 -2
View File
@@ -24,10 +24,10 @@
/**
* i8042.h - PS/2 keyboard controller interface (amd64 only)
*
* Item 4.3.5 (FABRIC.md §27.5). Interrupt-driven only — no polling of the
* Item 4.3.5 (FABRIC-0.md §27.5). Interrupt-driven only — no polling of the
* status port (0x64) anywhere in this path. Groundwork only: this captures
* and prints raw scancodes. Scancode-to-keycode translation and a consumer
* API belong to the REPL keyboard-input work noted in FABRIC.md, not here.
* API belong to the REPL keyboard-input work noted in FABRIC-0.md, not here.
*/
#ifndef STARKERNEL_I8042_H
include/starkernel/ioapic.h
+1 -1
View File
@@ -24,7 +24,7 @@
/**
* ioapic.h - I/O APIC interface (amd64 only)
*
* Item 4.3.5 (FABRIC.md §27.5): no I/O APIC driver existed anywhere in this
* Item 4.3.5 (FABRIC-0.md §27.5): no I/O APIC driver existed anywhere in this
* tree before this item. The Local APIC (apic.h) self-interrupts for the
* timer and needs no routing; any *legacy* IRQ (i8042 keyboard's IRQ1
* included) requires the I/O APIC to redirect it to a Local APIC vector.
include/starkernel/plic.h
+1 -1
View File
@@ -7,7 +7,7 @@
/**
* plic.h - Platform-Level Interrupt Controller interface (riscv64 only)
*
* Item 4.3.5a (FABRIC.md §27.5): Phase 0 (0.2/0.3) only ever enabled the
* Item 4.3.5a (FABRIC-0.md §27.5): Phase 0 (0.2/0.3) only ever enabled the
* S-mode *timer* interrupt (sie.STIE). External interrupts (sie.SEIE) were
* never touched, and the PLIC -- the only external-interrupt path on
* RISC-V, there is no legacy PIC or I/O APIC equivalent -- had no driver
include/starkernel/repl.h
+2 -2
View File
@@ -74,7 +74,7 @@ VM *sk_repl_get_active_vm(void);
/**
* sk_repl_get_homeblocks_dev / sk_repl_get_homeblocks_sig - The currently
* attached home-blocks USB drive, or NULL if none is attached / the
* attached drive didn't check out as HOMEBLOCKS_SIG_OK (FABRIC-3.md
* attached drive didn't check out as HOMEBLOCKS_SIG_OK (FABRIC-2.md
* §F.6/§F.9/§F.18). Both return NULL together; never one without the
* other.
*/
@@ -83,7 +83,7 @@ const homeblocks_sig_t *sk_repl_get_homeblocks_sig(void);
/**
* sk_repl_get_attached_blk_dev - The currently attached USB block
* device, regardless of home-blocks recognition (FABRIC-3.md
* device, regardless of home-blocks recognition (FABRIC-2.md
* §F.8/§F.19) -- MINT's own target, since a blank/unminted drive never
* sets sk_repl_get_homeblocks_dev() above. NULL if nothing is attached.
*/
include/starkernel/session.h
+5 -5
View File
@@ -22,9 +22,9 @@
*/
/**
* session.h - Per-VM session (FABRIC-3.md §H, decided 2026-09-02/03)
* session.h - Per-VM session (FABRIC-2.md §H, decided 2026-09-02/03)
*
* A session is a Stadium patron (FABRIC-3.md §H.1) -- registering a session
* A session is a Stadium patron (FABRIC-2.md §H.1) -- registering a session
* IS admitting a patron to the Stadium, not a new parallel bookkeeping
* structure. This struct is the piece that sits ALONGSIDE the patron,
* referencing it by VMUuid rather than being indexed by Stadium cell index
@@ -33,7 +33,7 @@
* instruction: give real-shaped data its own header and integrate as a
* field, don't grow existing structs ad hoc).
*
* Fields (FABRIC-3.md §H.2, all five confirmed 2026-09-02/03):
* Fields (FABRIC-2.md §H.2, all five confirmed 2026-09-02/03):
* vm_id -- the patron this session references.
* pinned -- session is AUTHORITATIVE over Stadium's STADIUM_FLAG_PIN
* bit (§H.10): the sole read/write path for pin state is
@@ -44,7 +44,7 @@
* name -- canonical human-readable name; feeds console.c's
* g_active_vm_name prefix, does not replace the
* console-binding mechanism itself.
* identity -- embedded VMIdentity (FABRIC-3.md §H.4's VM card is
* identity -- embedded VMIdentity (FABRIC-2.md §H.4's VM card is
* effectively VMIdentity's existing ownership check; reused
* directly here, not reinvented).
*
@@ -143,7 +143,7 @@ Session *session_register(VMUuid vm_id, VMUuid parent, const char *name);
/*
* session_set_pinned / session_is_pinned - The pin-authority choke point
* (FABRIC-3.md §H.2/§H.10, decided 2026-09-02: "full choke point at the
* (FABRIC-2.md §H.2/§H.10, decided 2026-09-02: "full choke point at the
* session level, both directions"). Session is authoritative for every
* EXTERNAL reader -- nothing else, including existing Stadium code, reads
* or writes STADIUM_FLAG_PIN on a patron header directly anymore.
include/starkernel/timer.h
+2 -2
View File
@@ -93,7 +93,7 @@ typedef struct time_trust_state {
* read directly by mainline
* (heartbeat_ticks()); genuinely
* concurrent, unlike every other field in
* this struct (FABRIC.md item 4.5a/4.5b,
* this struct (FABRIC-0.md item 4.5a/4.5b,
* 2026-08-11). */
uint64_t last_tsc; /* TSC at last heartbeat */
uint64_t expected_delta; /* Expected TSC ticks per heartbeat */
@@ -209,7 +209,7 @@ const TimeTrustState *heartbeat_state(void);
/**
* Set the adaptive re-arm period, in nanoseconds (punch-list item 0.8,
* FABRIC.md §26). Called from the mainline execution path only (Loop #7's
* FABRIC-0.md §26). Called from the mainline execution path only (Loop #7's
* site in vm_runtime.c) -- never from interrupt context. Clamped to
* [1/4x, 4x] of the kernel's base period internally; a caller need not
* pre-clamp.
include/starkernel/ttf.h
+7 -7
View File
@@ -23,12 +23,12 @@
/**
* ttf.h - TrueType font parser core (Freestanding)
*
* FABRIC.md item 4.3.7. Reads a TTF's sfnt directory plus head/maxp/loca/
* FABRIC-0.md item 4.3.7. Reads a TTF's sfnt directory plus head/maxp/loca/
* glyf/cmap tables, resolving a Unicode codepoint to a glyph index and its
* outline header (contour count, bounding box). Does NOT extract outline
* points or rasterize — that is 4.3.7a/4.3.7c. No floating point; all
* fields read here are raw integers straight from the font's own
* big-endian on-disk format (see FABRIC.md §27.7 decision #2 for why the
* big-endian on-disk format (see FABRIC-0.md §27.7 decision #2 for why the
* Q48.16-vs-float call was made, and why it doesn't bind this file, which
* never scales anything).
*
@@ -95,7 +95,7 @@ typedef struct {
int has_cmap;
/* hhea/hmtx, for ttf_glyph_advance_width() -- proportional spacing
* (FABRIC.md item 4.3.7e). Mandatory tables per the TrueType spec,
* (FABRIC-0.md item 4.3.7e). Mandatory tables per the TrueType spec,
* so their absence fails ttf_parse() same as head/maxp/loca/glyf. */
uint32_t hmtx_off;
uint16_t num_h_metrics;
@@ -215,7 +215,7 @@ typedef struct {
/**
* ttf_rasterize_glyph - Flatten a glyph's outline (quadratic Bezier
* contours, fixed segment count per curve — see ttf.c's file header
* comment) and fill it into `out` using the even-odd rule (FABRIC.md item
* comment) and fill it into `out` using the even-odd rule (FABRIC-0.md item
* 4.3.7c; see that item's completion note for why even-odd rather than
* nonzero winding — correct for the v1 glyph repertoire's non-self-
* intersecting nested contours, not necessarily for an arbitrary font).
@@ -237,7 +237,7 @@ int ttf_rasterize_glyph(const ttf_font_t *font, uint32_t glyph_index,
q48_16_t scale, q48_16_t origin_x, q48_16_t origin_y,
uint8_t fill_value, ttf_bitmap_t *out);
/* Glyph raster cache (FABRIC.md item 4.3.7d). Fixed-size, caller-owned
/* Glyph raster cache (FABRIC-0.md item 4.3.7d). Fixed-size, caller-owned
* slot array -- no allocation, same convention as the rest of this
* module. Every cached bitmap is a fixed TTF_CACHE_BITMAP_DIM square,
* rasterized with the fixed origin (TTF_CACHE_MARGIN,
@@ -293,10 +293,10 @@ int ttf_raster_cache_get(ttf_raster_cache_t *cache, const ttf_font_t *font,
/**
* ttf_load_from_capsule - Resolve a font capsule by name and parse it,
* zero-copy (FABRIC.md item 4.3.7b). `out` borrows the capsule payload
* zero-copy (FABRIC-0.md item 4.3.7b). `out` borrows the capsule payload
* directly from `arena` — no kmalloc, no decode step, since the capsule
* is already a raw-byte match of the source `.ttf` (see
* capsules/fonts/README.md and FABRIC.md §27.7's 2026-08-10 correction:
* capsules/fonts/README.md and FABRIC-0.md §27.7's 2026-08-10 correction:
* capsule storage needs no hex/base64 text-encoding, `tools/mkcapsule.c`
* already embeds arbitrary files as raw bytes). Validates the capsule's
* content hash (`capsule_validate(..., verify_hash=1)`) before parsing.
include/starkernel/uefi.h
+1 -1
View File
@@ -628,7 +628,7 @@ typedef void (EFIAPI *EFI_RESET_SYSTEM)(
* seed || 32-byte pubkey.
* Written exactly once
* (Phase 8 first-boot mint,
* see FABRIC-3.md) --
* see FABRIC-2.md) --
* presence means the fuse
* is already blown. */
include/starkernel/user_identity_seed.h
+1 -1
View File
@@ -1,6 +1,6 @@
/*
* user_identity_seed.h -- on-disk record format for a minted user
* identity's own keypair and profile (FABRIC-3.md §F.8/§F.20), stored in
* identity's own keypair and profile (FABRIC-2.md §F.8/§F.20), stored in
* the first devblock of a home-blocks drive's identity_src region
* (homeblocks_sig_t.identity_src_offset). The devblocks that follow it
* (identity_src_offset+1 .. identity_src_offset+identity_src_devblocks-1)
include/starkernel/virtio_input.h
+1 -1
View File
@@ -38,7 +38,7 @@ typedef struct {
* virtio_input_find_keyboard — locate a virtio-keyboard-pci device on the
* PCI bus, initialise the driver, compute and
* enable its PLIC interrupt source (item
* 4.3.5c's own derivation, FABRIC.md §27.5.2),
* 4.3.5c's own derivation, FABRIC-0.md §27.5.2),
* and pre-post the eventq's receive buffers.
*
* Returns 0 on success.
include/starkernel/vm/stadium.h
+22 -22
View File
@@ -22,11 +22,11 @@
*/
/**
* stadium.h - The Stadium cell and header (FABRIC.md §3, punch list item 3.1)
* stadium.h - The Stadium cell and header (FABRIC-0.md §3, punch list item 3.1)
*
* A cell is one of exactly two things: a patron header, or a continuation
* cell owned by exactly one patron. The union is closed, two-valued, and
* fixed at build time -- not a type field. See FABRIC.md §3.
* fixed at build time -- not a type field. See FABRIC-0.md §3.
*/
#ifndef STARKERNEL_VM_STADIUM_H
@@ -37,7 +37,7 @@
#include <stddef.h>
#include <stdint.h>
#include "starforth_config.h" /* STADIUM_CONTAINS_DEPTH_MAX, STADIUM_CAPACITY_TICK, STADIUM_MEMORY_PERCENT */
#include "starkernel/vm_uuid.h" /* VMUuid -- FABRIC.md item 3.8 */
#include "starkernel/vm_uuid.h" /* VMUuid -- FABRIC-0.md item 3.8 */
#define STADIUM_CELL_BYTES 64
@@ -47,10 +47,10 @@
#define STADIUM_CONTAINS_NONE ((uint32_t)-1)
/* `flags` bit 0 -- pinned, exempt from eviction/reap. Moved here from a
* stadium.c-private #define (FABRIC-3.md §H.12 step 3) so session.c's pin-
* stadium.c-private #define (FABRIC-2.md §H.12 step 3) so session.c's pin-
* authority choke point (session_set_pinned()/session_is_pinned()) can
* write/read this same bit without a duplicate definition. Session is
* authoritative for every EXTERNAL reader (FABRIC-3.md §H.10) -- this bit
* authoritative for every EXTERNAL reader (FABRIC-2.md §H.10) -- this bit
* on the raw patron header stays a mirrored copy purely for the Stadium
* engine's own internal eviction/admission logic (stadium.c), which must
* stay self-contained and not call back into session.c. */
@@ -58,7 +58,7 @@
/*
* StadiumPatronHeader - one member of the closed two-valued cell union
* (FABRIC.md §3). Nine wires: identity, heat, TTL, pin (a bit in `flags`),
* (FABRIC-0.md §3). Nine wires: identity, heat, TTL, pin (a bit in `flags`),
* link, code field (`behaviour`), mass, payload, contains. `flags` bit 0 is
* `pin`; the remaining bits are reserved. `behaviour` is the closed code-field
* enumeration (§18.3) -- not yet defined, item 3.3's scope.
@@ -102,7 +102,7 @@ typedef struct {
/*
* StadiumCell - the closed two-valued union itself (§3). Which member is
* valid for a given array slot is NOT stored in the cell -- FABRIC.md's item
* valid for a given array slot is NOT stored in the cell -- FABRIC-0.md's item
* 3.1 amendment to §3 rules this an external side bitmap, one bit per cell,
* kept outside the cell array. Declared here as the indexing contract this
* type expects; item 3.2 (boot-time allocation) allocates the bitmap itself.
@@ -122,7 +122,7 @@ typedef char stadium_cell_size_check[(sizeof(StadiumCell) == STADIUM_CELL_BYTES)
* implemented. STADIUM_CONTAINS_DEPTH_MAX still has no consumer (item 3.5
* for the depth cap, not yet implemented). STADIUM_CAPACITY_TICK was wired
* in 2026-08-15 (capsule_vm_physics.c's vm_physics_heartbeat_tick(), see
* FABRIC-2.md F.2/§12 Q5) -- this check now proves a real, live constant
* FABRIC-1.md F.2/§12 Q5) -- this check now proves a real, live constant
* is sane, not just a placeholder, same discipline already applied to the
* byte-count checks above.
*/
@@ -139,7 +139,7 @@ typedef char stadium_capacity_tick_configured_check[(STADIUM_CAPACITY_TICK > 0)
*/
/*
* stadium_boot_init - Boot-time allocation (FABRIC.md item 3.2, §17.6 position
* stadium_boot_init - Boot-time allocation (FABRIC-0.md item 3.2, §17.6 position
* (b)). Sizes the global cell array from the memory budget actually observed
* at boot -- STADIUM_MEMORY_PERCENT of kmalloc_get_stats().free_bytes at the
* point of the call, rounded down to whole STADIUM_CELL_BYTES cells -- rather
@@ -205,7 +205,7 @@ StadiumCell *stadium_cells(void);
uint8_t *stadium_header_bitmap(void);
/*
* StadiumBehaviour - the closed code-field enumeration (FABRIC.md §13, §18.3).
* StadiumBehaviour - the closed code-field enumeration (FABRIC-0.md §13, §18.3).
* The engine dispatches on this tag and never asks a patron what kind it is
* -- §3's entire point. Two patrons may share a tag: a VM's tag is COOL, the
* same tag a word carries (§18.3). Mapped from §17.1's patron table:
@@ -241,7 +241,7 @@ typedef enum {
void stadium_dispatch(size_t cell_index, StadiumBehaviour behaviour);
/*
* stadium_density - Heat / mass for the patron header at cell_index (FABRIC.md
* stadium_density - Heat / mass for the patron header at cell_index (FABRIC-0.md
* §19.2, §19.3). Read, not computed by a scheduler: both operands already
* live in the header, so this is a division on demand, not maintained
* bookkeeping. Result stays valid Q48.16, since heat is already Q48.16 and
@@ -276,7 +276,7 @@ uint64_t stadium_density(size_t cell_index);
#define STADIUM_HERA_CELL_INDEX ((size_t)0)
/*
* stadium_birth_hera - Admits Hera as a real resident of cell 0 (FABRIC.md
* stadium_birth_hera - Admits Hera as a real resident of cell 0 (FABRIC-0.md
* item 3.6's invariant, actually enforced -- item 4.1 found that nothing had
* ever called this until a word patron was about to become the first-ever
* occupant of cell 0 by accident via the free list). Candidate: identity 0,
@@ -300,7 +300,7 @@ int stadium_birth_hera(void);
/*
* stadium_reservoir_pull - Transfers up to `amount` (Q48.16) out of vm_id's
* reservoir (FABRIC.md §17.7's reservoir mechanism). Clamped to what the
* reservoir (FABRIC-0.md §17.7's reservoir mechanism). Clamped to what the
* reservoir actually holds -- never goes negative, never invents heat.
* Returns the amount actually pulled, which may be less than requested (or
* 0, e.g. a drained reservoir or an unknown vm_id). Callers that go on to
@@ -345,7 +345,7 @@ uint64_t stadium_reservoir_peek(VMUuid vm_id);
* stadium_quota_slot_for_vm - Read-only: vm_id's quota slot index (0 to
* stadium_max_vm_count()-1), for callers outside stadium.c that need to key
* their own per-VM state the same way stadium.c's internal arrays already
* do (FABRIC.md §25.5 item 4.2 -- stadium_words.c's word_id -> cell_index
* do (FABRIC-0.md §25.5 item 4.2 -- stadium_words.c's word_id -> cell_index
* map needs this to stop colliding across VMs; word_id is scoped per-VM,
* not globally unique, so a single shared map aliases different VMs' words
* onto each other's Stadium cells and reservoirs).
@@ -357,7 +357,7 @@ int stadium_quota_slot_for_vm(VMUuid vm_id);
/*
* stadium_resident_sum - Read-only: sum of heat across every cell currently
* resident AND owned by vm_id's own quota (FABRIC.md §25.5 item 4.2 --
* resident AND owned by vm_id's own quota (FABRIC-0.md §25.5 item 4.2 --
* boot diagnostics need this filtered per-VM once a second VM holds a
* quota; summing every resident cell regardless of owner, as the pre-4.2
* diagnostic did, mixes two VMs' conservation totals together).
@@ -369,7 +369,7 @@ int stadium_quota_slot_for_vm(VMUuid vm_id);
uint64_t stadium_resident_sum(VMUuid vm_id);
/*
* stadium_evict - Reap the patron header at cell_index (FABRIC.md §17.2:
* stadium_evict - Reap the patron header at cell_index (FABRIC-0.md §17.2:
* "reap means leaves the floor, not destroyed"). Dispatches its behaviour
* (§18.3), clears its item-3.1 discriminator bit, zeroes its header, and
* (item 3.7) returns the freed cell to the free list of whichever VM's
@@ -377,7 +377,7 @@ uint64_t stadium_resident_sum(VMUuid vm_id);
* record, not passed by the caller.
*
* PANICS (does not return) if cell_index == STADIUM_HERA_CELL_INDEX and the
* cell is actually resident -- FABRIC.md §20.5 #3: Hera is pinned (§3), but
* cell is actually resident -- FABRIC-0.md §20.5 #3: Hera is pinned (§3), but
* pinning alone is a silent guarantee, and item 3.6 requires a hard
* assertion at the eviction site rather than relying on pin holding. This
* check runs BEFORE the pin/contains checks below, deliberately: if pin were
@@ -399,7 +399,7 @@ int stadium_evict(size_t cell_index);
/*
* StadiumVMQuota - per-VM ownership of a subset of the global cell array
* (FABRIC.md §22.3, item 3.7: "each VM holds its own free-list head index
* (FABRIC-0.md §22.3, item 3.7: "each VM holds its own free-list head index
* into the global array"). Linearly searched by vm_id -- a VMUuid (item 3.8)
* can't be used as a direct array index anyway. Was a small, compile-time-
* bounded table (linear scan "costs nothing" at the old default of 4);
@@ -415,7 +415,7 @@ int stadium_evict(size_t cell_index);
/*
* stadium_admit - Place a candidate patron header into the Stadium, scoped
* to vm_id's quota (FABRIC.md §19.3, §22.3, item 3.7).
* to vm_id's quota (FABRIC-0.md §19.3, §22.3, item 3.7).
*
* Pops vm_id's free-list head first (O(1)) if non-empty. Only if that VM's
* free list is exhausted does this fall back to eviction -- scoped to that
@@ -468,7 +468,7 @@ size_t stadium_admit(VMUuid vm_id, const StadiumPatronHeader *candidate);
/*
* stadium_grant_quota - One-time initial quota grant for a newly born VM
* (FABRIC.md item 4.1a). NOT item 1.3's recurring capacity-transfer
* (FABRIC-0.md item 4.1a). NOT item 1.3's recurring capacity-transfer
* arbitration -- that mechanism (density-gradient-driven, per capacity-tick)
* stays unbuilt and its "how much moves" question stays open. This is the
* narrower, one-time event: the same shape as Hera's own whole-pool grant at
@@ -496,7 +496,7 @@ size_t stadium_admit(VMUuid vm_id, const StadiumPatronHeader *candidate);
int stadium_grant_quota(VMUuid new_vm_id, VMUuid from_vm_id);
/*
* stadium_cell_heat_get - Read a resident cell's own heat (FABRIC.md item
* stadium_cell_heat_get - Read a resident cell's own heat (FABRIC-0.md item
* 4.2's fourth ruling). Requires cell_index to be resident AND owned by
* vm_id's quota -- returns 0 otherwise (out of range, not resident, or
* belongs to a different VM), same ambiguity-with-a-genuine-zero already
@@ -513,7 +513,7 @@ uint64_t stadium_cell_heat_get(VMUuid vm_id, size_t cell_index);
/*
* stadium_cell_heat_set - Write a resident cell's own heat, reconciling the
* reservoir delta atomically (FABRIC.md item 4.2's fourth ruling). Same
* reservoir delta atomically (FABRIC-0.md item 4.2's fourth ruling). Same
* ownership requirement as stadium_cell_heat_get(). If new_heat is higher
* than the cell's current heat, pulls the exact difference from vm_id's own
* reservoir first -- refuses (returns -1, no mutation) if the reservoir
include/starkernel/vm/stadium_blocks.h
+1 -1
View File
@@ -22,7 +22,7 @@
*/
/**
* stadium_blocks.h - Block patrons on the Stadium (FABRIC-3.md §B/§D,
* stadium_blocks.h - Block patrons on the Stadium (FABRIC-2.md §B/§D,
* MIGRATE punch-list item)
*
* The block-specific layer on top of the generic L0 engine (stadium.h), same
include/starkernel/vm/stadium_words.h
+8 -8
View File
@@ -22,7 +22,7 @@
*/
/**
* stadium_words.h - Word patrons on the Stadium (FABRIC.md §17.3/§17.7,
* stadium_words.h - Word patrons on the Stadium (FABRIC-0.md §17.3/§17.7,
* punch list item 4.1)
*
* The word-specific layer on top of the generic L0 engine (stadium.h).
@@ -57,7 +57,7 @@
* first; guarded internally as a no-op if already initialized. Nothing
* calls it twice today.
*
* item 4.2 (FABRIC.md §25.5): the map is keyed by quota slot, not just
* item 4.2 (FABRIC-0.md §25.5): the map is keyed by quota slot, not just
* word_id -- word_id is assigned per-VM (vm->next_word_id), not globally
* unique, so a single shared word_id -> cell_index map aliased different
* VMs' words onto each other's Stadium cells and reservoirs the moment a
@@ -67,7 +67,7 @@
void stadium_words_init(void);
/*
* stadium_word_dispatch - The per-dispatch entry point (FABRIC.md §17.7),
* stadium_word_dispatch - The per-dispatch entry point (FABRIC-0.md §17.7),
* called once per DictEntry touched at each of vm_core.c's three
* physics_execution_heat_increment() call sites -- deliberately mirroring
* that function's existing call pattern 1:1, including the entry != canon
@@ -80,7 +80,7 @@ void stadium_words_init(void);
* STADIUM_WORD_HEAT_QUANTUM from the reservoir into the cell -- clamped to
* what the reservoir actually holds AND to a floor of Q48_ONE / 3 that
* word-execution admission alone may never dip the reservoir below
* (FABRIC.md §25.7, Captain Bob's ruling 2026-08-06: this pull fires on
* (FABRIC-0.md §25.7, Captain Bob's ruling 2026-08-06: this pull fires on
* EVERY dispatch, not just first admission, and without a floor exhausts a
* VM's entire reservoir in ~32 dispatches, starving any application-level
* economy -- e.g. item 4.2's Hermes -- sharing the same VM's reservoir).
@@ -102,7 +102,7 @@ void stadium_words_init(void);
*
* @param vm_id Owning VM -- vm->stadium_vm_id at every call site.
* Scopes the word_id -> cell_index lookup to this
* VM's own quota slot (item 4.2, FABRIC.md §25.5) so
* VM's own quota slot (item 4.2, FABRIC-0.md §25.5) so
* two VMs' independently-numbered word_ids cannot
* alias onto each other's cells/reservoirs.
* @param word_id The dispatching DictEntry's stable word_id.
@@ -123,7 +123,7 @@ void stadium_word_dispatch(VMUuid vm_id, uint32_t word_id, uint64_t heartbeat_ti
* the map entry. No-op if word_id is not resident, out of range, or vm_id
* holds no Stadium quota.
*
* @param vm_id Owning VM -- vm->stadium_vm_id (item 4.2, FABRIC.md §25.5:
* @param vm_id Owning VM -- vm->stadium_vm_id (item 4.2, FABRIC-0.md §25.5:
* scopes the lookup to this VM's own word_slots, same
* reason stadium_word_dispatch() takes it).
* @param word_id The DictEntry's word_id, about to be recycled.
@@ -136,7 +136,7 @@ void stadium_word_forget(VMUuid vm_id, uint32_t word_id);
* own word_slots map) -- NOT messages/channels/other application residents,
* which stadium_resident_sum() (stadium.h, item 4.2) mixes in alongside
* everything else a VM owns. Exists so a VM's own application-level
* conservation check (e.g. Hermes's HERMES-K, FABRIC.md §25.7, Captain
* conservation check (e.g. Hermes's HERMES-K, FABRIC-0.md §25.7, Captain
* Bob's ruling 2026-08-06) can add this as an explicit term instead of
* silently omitting word-execution heat it has no other way to see.
*
@@ -168,7 +168,7 @@ void stadium_words_stats(VMUuid vm_id, uint64_t *promotions, uint64_t *evictions
* Σ(resident heat) + reservoir against Q48_ONE as a conservation check --
* not required by the acceptance text, but the mechanism proves nothing if
* this silently doesn't hold. The heat sum is scoped to vm_id's own quota
* (stadium_resident_sum(), item 4.2, FABRIC.md §25.5) so two VMs' checks
* (stadium_resident_sum(), item 4.2, FABRIC-0.md §25.5) so two VMs' checks
* close independently instead of mixing both VMs' resident heat together.
*
* @param vm_id The VM whose reservoir to read (vm_uuid_hera() today).
include/starkernel/vm_identity.h
+3 -3
View File
@@ -21,7 +21,7 @@
*/
/**
* vm_identity.h - Per-VM owner identity + ACL capabilities (FABRIC-3.md
* vm_identity.h - Per-VM owner identity + ACL capabilities (FABRIC-2.md
* §F.2/§F.16, decided 2026-08-27/28)
*
* Holds only what a VM needs to prove *who owns it* and *what that owner
@@ -38,7 +38,7 @@
* is not a structurally special VM: her identity just has every bit set.
* No bit values are assigned yet -- deliberate slack, per this project's
* "flexibility until we understand the recipe" precedent (see
* blk_meta_t's own acl_reserved bytes, FABRIC-3.md §F.4) -- real bits get
* blk_meta_t's own acl_reserved bytes, FABRIC-2.md §F.4) -- real bits get
* names only once the operation they gate actually gets built (BINDSTEP,
* MINT, ...), not speculatively here.
*/
@@ -87,7 +87,7 @@ typedef struct {
int vm_identity_has_cap(const VMIdentity *id, uint32_t cap);
/**
* vm_identity_from_cert - CERTVERIFY (FABRIC-3.md §F.7/§F.17): verify a
* vm_identity_from_cert - CERTVERIFY (FABRIC-2.md §F.7/§F.17): verify a
* DER-encoded, Zuse-signed X.509 cert and populate a VMIdentity from it.
*
* Three checks, all must pass: the cert's own signature verifies against
include/starkernel/vm_uuid.h
+1 -1
View File
@@ -22,7 +22,7 @@
*/
/**
* vm_uuid.h - 128-bit VM identifiers (FABRIC.md punch list item 3.8)
* vm_uuid.h - 128-bit VM identifiers (FABRIC-0.md punch list item 3.8)
*
* Replaces capsule_birth.c's monotonic uint32_t vm_id with a wider,
* RFC-4122-shaped identifier. NOT real randomness: this kernel has no RNG
include/starkernel/vt100.h
+4 -4
View File
@@ -61,20 +61,20 @@
void vt100_init(void);
/**
* FABRIC.md item 4.4j: switch the glyph-draw backend from font_8x16.c to
* FABRIC-0.md item 4.4j: switch the glyph-draw backend from font_8x16.c to
* TTF-TEXT's rasterizer for everything drawn from this call onward --
* boot/POST output before this call stays font_8x16.c, unaffected.
* Lazily loads the font capsule and its raster cache on first call
* (no-op on later calls). Recomputes cols/rows for the new cell size and
* clears the screen, since the two glyph backends use different cell
* dimensions. TTF point size/cell dimensions decided final by FABRIC.md
* dimensions. TTF point size/cell dimensions decided final by FABRIC-0.md
* item 4.4m (20px text, 96px REPL strip). No-op if the font capsule
* fails to load (stays on font_8x16.c; logged, not fatal).
*/
void vt100_enable_ttf(void);
/**
* FABRIC.md item 4.4q: move the REPL scrollback view back/forward by
* FABRIC-0.md item 4.4q: move the REPL scrollback view back/forward by
* @p n lines and redraw. Offset 0 (the default, and where every call
* eventually returns to) is the live view -- the same content already on
* screen. Clamped at both ends: back cannot pass the oldest stored line,
@@ -101,7 +101,7 @@ void vt100_putc(char c);
void vt100_puts(const char *s);
/**
* FABRIC.md item 4.4y-revised: toggle the full-screen vt100 terminal
* FABRIC-0.md item 4.4y-revised: toggle the full-screen vt100 terminal
* between visible (normal operation) and hidden (graphics mode -- the
* terminal stops drawing, letting direct framebuffer/TTF-TEXT calls show
* through undisturbed). Toggling back to visible does a full redraw of
include/starkernel/x509_ed25519.h
+3 -3
View File
@@ -1,7 +1,7 @@
/*
* x509_ed25519.h -- minimal, targeted DER walkers for Ed25519-signed X.509
* certificates (RFC 8410). Deliberately NOT a general ASN.1/X.509 parser
* (Milestone 6 decision, FABRIC-2.md): each function walks exactly as far
* (Milestone 6 decision, FABRIC-1.md): each function walks exactly as far
* into the DER structure as its own job needs, nothing more.
*
* x509_extract_ed25519_pubkey() only ever reads SubjectPublicKeyInfo --
@@ -11,7 +11,7 @@
* never re-verified against the offline root CA at boot.
*
* x509_verify_signature()/x509_extract_serial() (added 2026-08-28,
* FABRIC-3.md §F.7/§F.17) are for CERTVERIFY -- a regular user's cert,
* FABRIC-2.md §F.7/§F.17) are for CERTVERIFY -- a regular user's cert,
* which unlike the capsule-PKI chain is signed by Zuse's own on-device
* key and genuinely needs its signature checked at attach time, not just
* trusted by embedding. Two separate trust roots, two separate reasons
@@ -62,7 +62,7 @@ int x509_extract_serial(const uint8_t *der, size_t der_len,
size_t *serial_len_out);
/*
* x509_build_user_cert (added 2026-08-28, FABRIC-3.md §F.8/§F.19, MINT):
* x509_build_user_cert (added 2026-08-28, FABRIC-2.md §F.8/§F.19, MINT):
* the encode-side counterpart to x509_verify_signature()/x509_extract_*
* above. Builds a minimal DER-encoded X.509 certificate exercising
* exactly the fields those functions read -- serialNumber, an Ed25519
include/starkernel/xhci_driver.h
+1 -1
View File
@@ -233,7 +233,7 @@ typedef struct {
uint32_t bot_read10_block_size;
/* WRITE(10) mirror of bot_read10_* above -- kept as separate fields
* rather than renaming/reusing the read ones, so the already-tested
* READ10 path is never touched by this addition (FABRIC-3.md §F.1). */
* READ10 path is never touched by this addition (FABRIC-2.md §F.1). */
uint32_t bot_write10_lba;
uint16_t bot_write10_num_blocks;
uint32_t bot_write10_block_size;
include/starkernel/zuse_cert_devblock.h
+4 -4
View File
@@ -1,5 +1,5 @@
/*
* zuse_cert_devblock.h -- SUPERSEDED 2026-08-28 (FABRIC-3.md §F.20/§F.21).
* zuse_cert_devblock.h -- SUPERSEDED 2026-08-28 (FABRIC-2.md §F.20/§F.21).
* Zuse is now thumbdrive-resident, not system-resident: her seed lives
* only on her own minted thumbdrive, never written to the fence. The
* fence's devblock_from_top=0 slot this type used to occupy now holds
@@ -14,7 +14,7 @@
*
* on-disk record format for Zuse's cert, stored
* in devblock_from_top=0 of the top-of-device system-metadata fence
* (block_subsystem.h's blk_meta_zone_read()/write(), Phase 8, FABRIC-3.md
* (block_subsystem.h's blk_meta_zone_read()/write(), Phase 8, FABRIC-2.md
* §C). Raw, unpacked 4 KiB devblock -- same convention as the volume
* header itself (magic + version + fields + pad-to-4096, real CRC from
* day one, matching homeblocks_sig_t's own precedent for exactly this
@@ -22,7 +22,7 @@
*
* Deliberately its own header, not inlined at the one call site that
* uses it today (kernel_main.c's first-boot mint-or-load): the ongoing
* `MINT` word (still open, FABRIC-3.md) will be a second consumer of
* `MINT` word (still open, FABRIC-2.md) will be a second consumer of
* this exact format later, and the format should be stable and
* documented once rather than ad-hoc.
*/
@@ -33,7 +33,7 @@
/* Packed via shifts, not a hand-computed hex literal -- this project's
* own standing lesson about hand-derived numeric constants in this
* class of code (see FABRIC-3.md's Ed25519/scalar25519 writeups). */
* class of code (see FABRIC-2.md's Ed25519/scalar25519 writeups). */
#define ZUSE_CERT_DEVBLOCK_MAGIC \
((uint32_t)'Z' | ((uint32_t)'U' << 8) | ((uint32_t)'S' << 16) | ((uint32_t)'E' << 24))
include/starkernel/zuse_eligibility.h
+1 -1
View File
@@ -9,7 +9,7 @@
/**
* zuse_eligibility.h - Read/add/membership-check over the on-disk
* elevation eligibility list (FABRIC-3.md §H.5/§H.12 Phase 6,
* elevation eligibility list (FABRIC-2.md §H.5/§H.12 Phase 6,
* zuse_eligibility_list.h's zuse_eligibility_devblock_t chain). Zuse
* checks zuse_eligibility_is_member() before honoring any
* ELEVATE-REQUEST (§H.7/§H.8) -- a gating layer on top of the
include/starkernel/zuse_eligibility_list.h
+1 -1
View File
@@ -1,6 +1,6 @@
/*
* zuse_eligibility_list.h -- on-disk record format for Zuse's word/block
* elevation eligibility list (FABRIC-3.md §H.5/§H.12 Phase 6): a simple
* elevation eligibility list (FABRIC-2.md §H.5/§H.12 Phase 6): a simple
* growable list of owner_pubkey[32] entries, no extra per-entry metadata
* ("simple list, no extra metadata, unless we find a reason this won't
* work"). Zuse checks this list before honoring any ELEVATE-REQUEST
include/starkernel/zuse_genesis_marker.h
+1 -1
View File
@@ -1,6 +1,6 @@
/*
* zuse_genesis_marker.h -- on-disk record format for the system-resident
* "a root Zuse identity already exists" marker (FABRIC-3.md §F.21),
* "a root Zuse identity already exists" marker (FABRIC-2.md §F.21),
* stored in devblock_from_top=0 of the top-of-device system-metadata
* fence (block_subsystem.h's blk_meta_zone_read()/write(), same location
* zuse_cert_devblock_t used to occupy).
include/vm.h
+4 -4
View File
@@ -359,7 +359,7 @@ typedef enum
#ifdef __STARKERNEL__
#include "starkernel/vm_uuid.h" /* VMUuid -- item 4.2, VM.stadium_vm_id */
#include "starkernel/vm_identity.h" /* VMIdentity -- FABRIC-3.md §F.2/§F.16 */
#include "starkernel/vm_identity.h" /* VMIdentity -- FABRIC-2.md §F.2/§F.16 */
/* Saved interpreter state for VM lifecycle calls (BIRTH, VM-EXEC, START).
* Dynamically allocated; grows on demand via sf_realloc. */
@@ -401,7 +401,7 @@ typedef struct VM
* here so callers don't need to re-derive it. No FORTH word can
* write it -- deliberately kept out of the dictionary so ACL-PIN's
* redefinition-only guarantee can't be bypassed via >BODY on a
* CONSTANT (see FABRIC-3.md). Read-only FORTH access via
* CONSTANT (see FABRIC-2.md). Read-only FORTH access via
* ZUSE-PUBKEY@. */
/** @} */
@@ -545,7 +545,7 @@ typedef struct VM
int call_stack_max; /**< High-water mark depth (DoE metric) */
/** @} */
/** @name Stadium Identity (item 4.2, FABRIC.md §25.5)
/** @name Stadium Identity (item 4.2, FABRIC-0.md §25.5)
* @{
*/
VMUuid stadium_vm_id; /**< This VM's own identity, set once at birth from
@@ -556,7 +556,7 @@ typedef struct VM
* vm_uuid_hera(). */
/** @} */
/** @name Owner identity + ACL capabilities (FABRIC-3.md §F.2/§F.16)
/** @name Owner identity + ACL capabilities (FABRIC-2.md §F.2/§F.16)
* @{
*/
VMIdentity identity; /**< This VM's owning identity. installed=0 (the