Robert Allan JamesandClaude Sonnet 5
6fc0ee33a9
Assembles pieces already built and individually verified this session -- CERTVERIFY (vm_identity_from_cert(), Phase A/B), RUNCAP, the console-VM + user-VM pair (§F.22) -- into one automatic sequence, replacing the RUNCAP-TEST/PAIR-TEST diagnostic words that exercised each piece by hand. New capsule_wirebind_try_attach() (capsule_wirebind.h/.c), called from sk_repl_idle() alongside capsule_zuse_boot_try_attach() on every HOMEBLOCKS_SIG_OK attach: sig->cert_offset==0 means this is Zuse's own genesis-mode drive (no cert region) -- that's already capsule_zuse_boot_try_attach()'s job, skip. Otherwise, with Zuse already authenticated this boot (nothing to verify a regular cert against otherwise), reads the cert devblock(s) and calls vm_identity_from_cert() against mama_vm's own zuse_cert_pubkey and the drive's own drive_uuid. On success: reads the drive's own user_identity_seed_t for its username, births a console VM + RUNCAP-born user VM pair (idempotent -- no-ops if that username is already live this session), installs the verified VMIdentity onto the user VM, and registers the "<username>~user" pairing sk_repl_dispatch_line() (repl.c, §F.22) looks for. Deliberately does NOT auto-USE the new console -- that stays an explicit, ACL-gated step (BINDSTEP, §F.9), not something a bare attach should trigger silently. Verified end-to-end live in QEMU, including a genuine negative case: attached disk/user1.img (signed by a different, earlier-session Zuse instance) and got a correct "cert verification FAILED -- drive refused" -- proof the check is real, not a rubber stamp. Minted a fresh identity with this boot's own Zuse, reattached, and got "WIREBIND: SamS attached and ready" printed with zero manual commands, followed by a working USE + async WELCOME relay end to end (queued, no UNKNOWN WORD, delivered and executed in the paired user VM on the next idle tick). Clean 3-architecture regression: Hermes/Artemis both birth live, no unexpected ACL denials or UNKNOWN WORD. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019ZGkimpfyh63EZyRkNbkPD
61 lines
2.3 KiB
C
61 lines
2.3 KiB
C
/*
|
||
StarForth — Steady-State Virtual Machine Runtime
|
||
|
||
Copyright (c) 2023–2025 Robert A. James
|
||
All rights reserved.
|
||
|
||
Licensed under the StarForth License, Version 1.0
|
||
*/
|
||
|
||
/**
|
||
* capsule_wirebind.h - WIREBIND: the real thumbdrive-attach call site
|
||
* (FABRIC-3.md §F.5/§F.23). Assembles pieces already built and
|
||
* individually verified this session -- CERTVERIFY (vm_identity.h's
|
||
* vm_identity_from_cert()), RUNCAP (capsule_runcap.h), the console-VM +
|
||
* user-VM pair (capsule_console.h, sk_repl_dispatch_line() in repl.c) --
|
||
* into one automatic sequence, replacing the RUNCAP-TEST/PAIR-TEST
|
||
* diagnostic words that exercised each piece by hand.
|
||
*/
|
||
|
||
#ifndef STARKERNEL_CAPSULE_WIREBIND_H
|
||
#define STARKERNEL_CAPSULE_WIREBIND_H
|
||
|
||
#ifdef __STARKERNEL__
|
||
|
||
#include "starkernel/homeblocks_sig.h"
|
||
#include "vm.h"
|
||
|
||
struct blkio_dev;
|
||
|
||
/**
|
||
* capsule_wirebind_try_attach - Try to verify and bind a just-attached
|
||
* regular (non-Zuse) identity drive.
|
||
*
|
||
* No-op if sig->cert_offset is 0 (a genesis-mode Zuse drive has no cert
|
||
* region -- that's capsule_zuse_boot_try_attach()'s own job, not this
|
||
* one's) or if mama_vm has no installed Zuse cert yet (nothing to verify
|
||
* the attached cert against). Otherwise: reads the cert devblock(s),
|
||
* calls vm_identity_from_cert() against mama_vm's own zuse_cert_pubkey
|
||
* and sig->drive_uuid. On success, reads the drive's own
|
||
* user_identity_seed_t for its username and births a console VM +
|
||
* RUNCAP-born user VM pair (idempotent -- no-ops if that username is
|
||
* already live this session), installs the verified VMIdentity onto the
|
||
* user VM, and registers the "<username>~user" pairing
|
||
* (sk_repl_dispatch_line(), repl.c, looks for this). Does NOT USE the
|
||
* new console automatically -- that stays an explicit, later,
|
||
* ACL-gated step (BINDSTEP, §F.9), not something a bare attach should
|
||
* trigger silently.
|
||
*
|
||
* @param dev The just-attached, already-open block device.
|
||
* @param sig Its already-checked homeblocks_sig_t.
|
||
* @param mama_vm Hera's own VM (the verifier -- her zuse_cert_pubkey is
|
||
* the trust root regular user certs are checked against).
|
||
*/
|
||
void capsule_wirebind_try_attach(struct blkio_dev *dev,
|
||
const homeblocks_sig_t *sig,
|
||
VM *mama_vm);
|
||
|
||
#endif /* __STARKERNEL__ */
|
||
|
||
#endif /* STARKERNEL_CAPSULE_WIREBIND_H */
|