FABRIC-3.md §I.5: Milestone 7 trust tiers (QEMU-vs-real-hardware), closing it

Closes the contributor-capsule/trust-tier punch-list item. Decided
direction: QEMU-vs-real-hardware conditional enforcement.

Found before building on that decision: the obvious mechanism (expose
TimerInfo.vm_mode) only works on amd64 -- aarch64 and riscv64 both had
vm_mode hardcoded to 1 unconditionally, meaning they'd always report
"running under QEMU" even on real hardware. Built real detection for
both instead of shipping that: aarch64 checks the ACPI RSDP's OEM ID
for QEMU's "BOCHS " SeaBIOS-heritage signature; riscv64 checks the
devicetree root compatible property for "qemu". Confirmed vm_mode was
otherwise unread anywhere else in either file first -- zero risk to
existing timing behavior.

CAPSULE_FLAG_CONTRIB (mkcapsule.c: FLAG_CONTRIB) path-matches on
capsules/contrib/, mirroring FLAG_MAMA_INIT's exact-match pattern.
contrib_capsule_refused() (capsule_birth.c) enforces: no additional
check under QEMU (same WARN-only as everything else); on real hardware,
a contrib capsule additionally requires CAPSULE_SIG_OK, since it has no
other provenance to fall back on. Wired into capsule_birth_baby() and
capsule_run_experiment().

Also updates §I.7 (Milestone 9): its stated precondition (Milestone 7
closing) is now met, flagged as stale rather than treated as a green
light to design networking from nothing.

Verified 3-arch boot to ok> (amd64/aarch64/riscv64, each in the
foreground) -- compile/boot verification only; the real-hardware
enforcement branch is unverifiable from this environment, same as all
of §I.6. logs and DoE CSVs from this session's verification runs
included per this repo's own audit-artifact convention.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019YcT3H2PQeyujrzjqS3Var

FABRIC-3.md

@@ -990,20 +990,23 @@ decisions get added here, not to `FABRIC-2.md`. Follow the same discipline `FABR
 
 ### From FABRIC-2.md §X, Milestone 7 — Contributor capsules / trust tiers
 
-- [ ] Create the `capsules/contrib/` directory (mechanically trivial, matches existing
-  subdirectory convention — the directory itself is not the work).
+- [x] Create the `capsules/contrib/` directory (mechanically trivial, matches existing
+  subdirectory convention — the directory itself is not the work). **DONE 2026-09-04.**
 
-- [ ] Add a `FLAG_CONTRIB` bit to `mkcapsule.c`'s flag system, assigned by path match
-  (`contrib/` prefix), same pattern as how `init.4th` already gets `FLAG_MAMA_INIT`.
+- [x] Add a `FLAG_CONTRIB` bit to `mkcapsule.c`'s flag system, assigned by path match
+  (`contrib/` prefix), same pattern as how `init.4th` already gets `FLAG_MAMA_INIT`. **DONE
+  2026-09-04.**
 
-- [ ] Decide and implement one of the four spitballed trust-tier directions (signature-
+- [x] Decide and implement one of the four spitballed trust-tier directions (signature-
   authority tiers / block-namespace sandboxing / QEMU-vs-real-hardware conditional
   enforcement) — none chosen yet, this is a real decision point, not just an implementation
-  task.
+  task. **DECIDED + BUILT 2026-09-04: QEMU-vs-real-hardware conditional enforcement.** Required
+  building real hypervisor detection for aarch64/riscv64 first (both had it hardcoded to
+  "always QEMU"). See §I.5 for the full build note.
 
 - [ ] If block-namespace sandboxing is chosen: extend `mkcapsule`'s existing conflict-
   detection logic to also reject a `contrib/`-path capsule claiming blocks outside its
-  reserved range.
+  reserved range. **N/A 2026-09-04** — a different direction was chosen.
 
 ### From FABRIC-2.md §X, Milestone 8 — Bare-metal boot from physical USB
 
@@ -4467,15 +4470,64 @@ stale the way the original carry-forwards did.
   structural check, so not itself a new consumer) and Milestone 7's contrib-capsule validation
   (§I.5, next) can reuse. *(Same location as above.)*
 
-### I.5 — Milestone 7 (contributor capsules / trust tiers) — nothing started
+### I.5 — Milestone 7 (contributor capsules / trust tiers) — CLOSED 2026-09-04
 
-- [ ] Create `capsules/contrib/` (mechanically trivial once the real decision below is made).
-- [ ] Add a `FLAG_CONTRIB` bit to `mkcapsule.c` (path-match, mirrors `FLAG_MAMA_INIT`).
-- [ ] **Real open decision, not just an implementation gap**: which of the four spitballed
+- [x] Create `capsules/contrib/` (mechanically trivial once the real decision below is made).
+  **DONE**: exists with a `README.md` (recording the direction/enforcement rule below;
+  also a live test capsule — `contrib:README.md` registers with `FLAG_CONTRIB` set, confirmed
+  via a standalone `mkcapsule` run, no content-type mismatch).
+- [x] Add a `FLAG_CONTRIB` bit to `mkcapsule.c` (path-match, mirrors `FLAG_MAMA_INIT`). **DONE**:
+  `CAPSULE_FLAG_CONTRIB` (`0x00000080`, `include/starkernel/capsule.h`) and mirrored `FLAG_CONTRIB`
+  in `mkcapsule.c`; `flags_from_name()` sets it on any name starting with `contrib:`.
+- [x] **Real open decision, not just an implementation gap**: which of the four spitballed
   trust-tier directions (signature-authority tiers / block-namespace sandboxing / QEMU-vs-
-  real-hardware conditional enforcement) — none chosen.
-- [ ] If block-namespace sandboxing is the choice: extend `mkcapsule`'s conflict-detection to
-  reject a `contrib/` capsule claiming blocks outside its reserved range.
+  real-hardware conditional enforcement) — none chosen. **DECIDED (asked directly): QEMU-vs-
+  real-hardware conditional enforcement.**
+
+  **Real, load-bearing gap found before building on this decision**: the obvious mechanism
+  (expose `TimerInfo.vm_mode`, already existing "per-arch") turned out to only be a real signal
+  on amd64. `s_cal.vm_mode = 1;` was **hardcoded, unconditional**, on both aarch64 and riscv64
+  — using it as-is would mean those two architectures always report "running under QEMU" even
+  on real hardware, defeating the entire point of the tier. Asked directly how to handle it;
+  told to build real detection for both rather than ship amd64-only or swap mechanisms.
+
+  **Built 2026-09-04, real hypervisor-vs-hardware detection on all three architectures:**
+  - **amd64**: already real (`running_under_hypervisor()`, `CPUID.1:ECX[31]`) — unchanged.
+  - **aarch64**: new `running_under_hypervisor(boot_info)` (`arch/aarch64/timer.c`) reads the
+    ACPI RSDP's `oem_id` field via `boot_info->acpi_table`, checks for `"BOCHS "` — QEMU's
+    SeaBIOS-heritage ACPI signature on every machine type it emulates, aarch64 virt included;
+    real hardware vendors set their own OEMID. Confirmed `vm_mode` is otherwise unread anywhere
+    else in this file before changing its computed value (purely informational there, unlike
+    amd64 where it gates a real calibration-path choice) — zero risk of regressing aarch64's
+    own timing behavior.
+  - **riscv64**: new `running_under_hypervisor(boot_info)` (`arch/riscv64/timer.c`) reads the
+    devicetree root `compatible` property (`fdt_find_prop()`, already used one property over
+    for `timebase-frequency`) and substring-searches for `"qemu"` — QEMU's own virt-board
+    machine-model string; real hardware sets vendor-specific compatible strings. Same
+    "confirmed unread elsewhere first" safety check as aarch64.
+
+  Both now exposed identically via the pre-existing `timer_calibration_record()->vm_mode`
+  public accessor (all three architectures implement it; no new plumbing needed there).
+
+  **Enforcement rule, built the same pass**: `contrib_capsule_refused(flags, sr)`
+  (`capsule_birth.c`), called from `capsule_birth_baby()` and `capsule_run_experiment()`
+  (never `capsule_birth_mama()` — `FLAG_MAMA_INIT`/`FLAG_CONTRIB` are mutually exclusive by
+  construction). Under QEMU: no additional check — same WARN-only treatment every capsule
+  already gets. On real hardware: a `FLAG_CONTRIB` capsule additionally requires
+  `CAPSULE_SIG_OK` — `MISSING`/`NO_ROOT_KEY` (permanently WARN-only for every other capsule,
+  most machines lack the offline signing key) are refused here specifically, since a
+  contributor's capsule has no other provenance to fall back on. Additive to, never replacing,
+  the existing `CAPSULE_SIG_INVALID` refusal already enforced on every capsule.
+
+  Verified 3-arch boot to `ok>` (amd64/aarch64/riscv64, each in the foreground) — compile/boot
+  verification only; the real-hardware enforcement branch is, like all of §I.6, unverifiable
+  from this environment (no physical machine to actually trigger `vm_mode == 0` against), and
+  the `contrib:README.md` test capsule was never actually birthed this pass (registers at
+  build time; nothing calls `BIRTH`/experiment-run on it), so `contrib_capsule_refused()`
+  itself never executed live either way.
+- [x] If block-namespace sandboxing is the choice: extend `mkcapsule`'s conflict-detection to
+  reject a `contrib/` capsule claiming blocks outside its reserved range. **N/A** — a different
+  direction was chosen; block-namespace sandboxing's own extension isn't needed.
   *(Full entries: §A, "From FABRIC-2.md §X, Milestone 7 — Contributor capsules / trust
   tiers.")*
 
@@ -4490,10 +4542,15 @@ serial-socket log available, confirm POST reaches the same 1012/0/0 result, conf
 a basic command work identically to QEMU, and document the outcome. *(Full entries: §A, "From
 FABRIC-2.md §X, Milestone 8 — Bare-metal boot from physical USB.")*
 
-### I.7 — Milestone 9 (networking / capsule distribution) — correctly still deferred
+### I.7 — Milestone 9 (networking / capsule distribution) — precondition now met, still no work done
 
 - [ ] Explicitly deferred until Milestone 7 closes — its own precondition isn't met, nothing
-  to do here yet. *(Full entry: §A, "From FABRIC-2.md §X, Milestone 9.")*
+  to do here yet. **Precondition met 2026-09-04**: §I.5 (Milestone 7) closed. This does **not**
+  mean Milestone 9 is ready to build in the sense of "go" — no network stack exists in any
+  form (confirmed absent, `FABRIC-2.md` §G), and Milestone 9 was never otherwise scoped beyond
+  "serve signed capsules, check against manifest metadata" as a rough concept. Flagging the
+  stale blocker only, same discipline §I.8 got in the 2026-09-03 sweep — not a design pass.
+  *(Full entry: §A, "From FABRIC-2.md §X, Milestone 9.")*
 
 ### I.8 — `EXPIRE` (ACL) — CLOSED 2026-09-04, re-scoped away from the Stadium-patron model