G8l: bounded target witness ve GIC receipt source boundary

impl G8lTargetExecutionReceiptBoundary {
    /// Rebind S168 and S167 to the exact active S166 runtime.
    pub fn from_runtime(
        runtime: &G8lRuntimeAuthority,
        architecture: G8lArchInstructionSeam,
        wiring: G8lIrqTlbiWiring,
        ticket: MigrationTicket,
    ) -> Result<Self, G8lTargetExecutionReceiptError> {
        if runtime.phase() != RuntimePhase::Ttbr0Installed {
            return Err(G8lTargetExecutionReceiptError::RuntimePhaseMismatch);
        }
        if runtime.active_ticket() != Some(ticket) {
            return Err(G8lTargetExecutionReceiptError::TicketMismatch);
        }
        if architecture.phase() != ArchInstructionPhase::TlbiIssued {
            return Err(G8lTargetExecutionReceiptError::ArchitecturePhaseMismatch);
        }
        if wiring.phase() != WiringPhase::TlbiRequested {
            return Err(G8lTargetExecutionReceiptError::WiringPhaseMismatch);
        }
        if architecture.runtime_instance_id() != runtime.instance_id()
            || wiring.runtime_instance_id() != runtime.instance_id()
        {
            return Err(G8lTargetExecutionReceiptError::RuntimeInputMismatch);
        }
        let arch_receipt = architecture
            .receipt()
            .ok_or(G8lTargetExecutionReceiptError::ArchitecturePhaseMismatch)?;
        let request = wiring
            .request()
            .ok_or(G8lTargetExecutionReceiptError::WiringPhaseMismatch)?;
        if arch_receipt.task_id != ticket.task_id
            || arch_receipt.asid != ticket.asid
            || arch_receipt.generation != ticket.generation
            || arch_receipt.context_generation != runtime.context_generation()
            || arch_receipt.source_cpu != CPU0
            || arch_receipt.target_cpu != CPU1
            || arch_receipt.ttbr0_operand != ticket.ttbr0_operand
            || arch_receipt.ttbr0_write_order != 1
            || arch_receipt.tlbi_order != 2
            || !arch_receipt.dsb_before_ttbr0
            || !arch_receipt.dsb_after_tlbi
            || !arch_receipt.isb_after_tlbi
            || request.ticket != ticket
            || request.context_generation != runtime.context_generation()
            || request.target_cpu != CPU1
        {
            return Err(G8lTargetExecutionReceiptError::RuntimeInputMismatch);
        }
        let input = runtime.migration_input();
        if input.task_id != ticket.task_id
            || input.owner_cpu != ticket.source_cpu
            || input.asid != ticket.asid
            || input.root != ticket.root
            || input.address_space_generation != ticket.address_space_generation
            || input.user_progress != ticket.user_progress_before
        {
            return Err(G8lTargetExecutionReceiptError::RuntimeInputMismatch);
        }
        Ok(Self {
            ticket,
            runtime_instance_id: runtime.instance_id(),
            context_generation: runtime.context_generation(),
            architecture,
            wiring,
            phase: TargetExecutionReceiptPhase::ReadyForBoundedTargetWitness,
            receipt: None,
            bounded_witness: None,
        })
    }

    /// Admit exactly one explicitly bounded CPU1 witness. The S168 architecture
    /// seam deliberately remains `TlbiIssued`; only the real target-only
    /// method may transition it through `Executing` to `Executed`.
    pub fn accept_bounded_target_witness(
        &mut self,
        witness: BoundedTargetExecutionWitness,
    ) -> Result<ArchInstructionReceipt, G8lTargetExecutionReceiptError> {
        if witness.execution_cpu != CPU1 {
            return Err(G8lTargetExecutionReceiptError::InvalidCpu);
        }
        if self.phase != TargetExecutionReceiptPhase::ReadyForBoundedTargetWitness {
            return Err(G8lTargetExecutionReceiptError::TargetExecutionNotRecorded);
        }
        let receipt = self
            .architecture
            .receipt()
            .ok_or(G8lTargetExecutionReceiptError::ArchitecturePhaseMismatch)?;
        if witness.ticket != self.ticket
            || witness.context_generation != self.context_generation
            || witness.instruction_receipt != receipt
        {
            return Err(G8lTargetExecutionReceiptError::RuntimeInputMismatch);
        }
        self.bounded_witness = Some(witness);
        self.phase = TargetExecutionReceiptPhase::BoundedTargetWitnessAccepted;
        Ok(receipt)
    }

    /// Accept one exact ACK input only after target execution was consumed.
    /// The ACK is validated by the S167 production-tree adapter.
    pub fn accept_gic_receipt(
        &mut self,
        ack: TlbiAck,
    ) -> Result<ShootdownReceipt, G8lTargetExecutionReceiptError> {
        if self.phase != TargetExecutionReceiptPhase::BoundedTargetWitnessAccepted {
            return Err(G8lTargetExecutionReceiptError::TargetExecutionNotRecorded);
        }
        let receipt = self.wiring.receive_ack(ack)?;
        self.receipt = Some(receipt);
        self.phase = TargetExecutionReceiptPhase::BoundedAckAccepted;
        Ok(receipt)
    }

    /// Complete the same S166 runtime with the validated receipt.
    pub fn complete_runtime(
        &self,
        runtime: &mut G8lRuntimeAuthority,
        caller_cpu: usize,
    ) -> Result<(), G8lTargetExecutionReceiptError> {
        if caller_cpu != CPU0 {
            return Err(G8lTargetExecutionReceiptError::InvalidCpu);
        }
        if runtime.instance_id() != self.runtime_instance_id {
            return Err(G8lTargetExecutionReceiptError::RuntimeInputMismatch);
        }
        if self.phase != TargetExecutionReceiptPhase::BoundedAckAccepted
            || self.receipt.is_none()
            || self.bounded_witness.is_none()
        {
            return Err(G8lTargetExecutionReceiptError::TargetExecutionNotRecorded);
        }
        self.wiring.complete_runtime(runtime, CPU0, self.ticket)?;
        Ok(())
    }

    pub const fn phase(&self) -> TargetExecutionReceiptPhase {
        self.phase
    }

    pub const fn request(&self) -> Option<TlbiRequest> {
        self.wiring.request()
    }

    pub const fn receipt(&self) -> Option<ShootdownReceipt> {
        self.receipt
    }

    pub const fn instruction_receipt(&self) -> Option<ArchInstructionReceipt> {
        self.architecture.receipt()
    }

    pub const fn context_generation(&self) -> u64 {
        self.context_generation
    }

    pub const fn architecture_phase(&self) -> ArchInstructionPhase {
        self.architecture.phase()
    }

    pub const fn runtime_instance_id(&self) -> u64 {
        self.runtime_instance_id
    }

    pub const fn bounded_witness_is_hardware_derived(&self) -> bool {
        false
    }

    /// S170 remains a source boundary until real target/GIC wiring is audited.
    pub const fn target_instruction_wired(&self) -> bool {
        false
    }

    pub const fn live_gic_delivery_wired(&self) -> bool {
        false
    }
}

#[test]
fn target_execution_requires_cpu1_and_is_exact_once() {
    let (_runtime, mut boundary) = boundary();
    let request = boundary.request().unwrap();
    assert_eq!(
        boundary.accept_bounded_target_witness(bounded_witness(&boundary, CPU0)),
        Err(G8lTargetExecutionReceiptError::InvalidCpu)
    );
    assert_eq!(
        boundary.accept_bounded_target_witness(BoundedTargetExecutionWitness::for_source_contract(
            aselsan_microkernel_simulation::g8l_authority_contract::MigrationTicket {
                generation: request.ticket.generation + 1,
                ..request.ticket
            },
            boundary.context_generation(),
            CPU1,
            boundary.instruction_receipt().unwrap(),
        ),),
        Err(G8lTargetExecutionReceiptError::RuntimeInputMismatch)
    );
    assert_eq!(
        boundary.architecture_phase(),
        ArchInstructionPhase::TlbiIssued
    );
    boundary
        .accept_bounded_target_witness(bounded_witness(&boundary, CPU1))
        .unwrap();
    assert_eq!(
        boundary.accept_bounded_target_witness(bounded_witness(&boundary, CPU1)),
        Err(G8lTargetExecutionReceiptError::TargetExecutionNotRecorded)
    );
    assert_eq!(
        boundary.architecture_phase(),
        ArchInstructionPhase::TlbiIssued
    );
}

  {
    id: "g8l-s170-target-execution-receipt-boundary-partial",
    date: "2026-08-24",
    sequence: 170,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: bounded target witness ve GIC receipt source boundary",
    summary:
      "S170, S168 `TlbiIssued` mimari seam'ini açıkça bounded CPU1 target witness'ı ve S167 exact ACK/online-mask sınırına 4/4 allocation-free source-contract ile bağladı. Aynı aktif S166 runtime-instance/ticket/context, CPU1 target, exact full architecture receipt envelope, TLBI request ve bounded witness sonrası tek ACK sırası korunuyor. Bounded witness sonrası S168 mimari fazı `TlbiIssued` kalır; byte-equal yabancı runtime replay'i reddedilir. Witness hardware-derived execution değildir ve gerçek GIC/SGI, target assembly, scheduler/context-switch runtime, QEMU veya fiziksel cihaz sonucu iddia edilmez.",
    evidence: [
      "g8l_target_execution_receipt: 4/4 PASS; S168 fazı TlbiIssued kalırken bounded target witness → S167 exact ACK → S166 ShootdownComplete bounded source chain.",
      "CPU1 dışı witness, witness öncesi ACK, duplicate witness, wrong ACK CPU, wrong request, stale runtime ve byte-equal yabancı runtime yolları fail-closed.",
      "Task/ASID/generation/context/source/target/operand/order/barrier alanlarının full architecture receipt envelope'i yeniden doğrulanır.",
      "Bounded target witness yalnız source-contract state tüketir; gerçek AArch64 instruction ve GIC erişimi yapmaz.",
      "Kanonik focused log: 117 B / 07f03d79a6354db1f9ee01d187631b80b38ff7853618dee4cf2f6b5cbdd19a64.",
      "Production board-rpi5 source check başarıyla tamamlandı; yalnız mevcut workspace warning'leri kaldı.",
      "Kalıcı kapsam: `docs/M8.1-RPi5-G8l-S170-Target-Execution-Receipt-Boundary-Proof.md`.",
      "S170 fiziksel/device operasyonu yapmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S170=NO.",
    ],
    commands: [
      "cargo test --quiet --test g8l_target_execution_receipt -- --test-threads=1",
      "cargo check -p aselsan_kernel --no-default-features --features board-rpi5 --target aarch64-unknown-none",
    ],
    terminalSessions: [
      {
        id: "s170-g8l-target-execution-receipt",
        title: "G8l S170 target execution and receipt source boundary",
        commandLines: [
          "cargo test --quiet --test g8l_target_execution_receipt -- --test-threads=1",
        ],
        outputLines: ["running 4 tests", "test result: ok; 4 passed; 0 failed"],
        exitCode: 0,
        outputMode: "selected",
      },
      {
        id: "s170-g8l-target-execution-board-check",
        title: "G8l S170 board-rpi5 source check",
        commandLines: [
          "cargo check -p aselsan_kernel --no-default-features --features board-rpi5 --target aarch64-unknown-none",
        ],
        outputLines: ["Finished successfully; existing warnings only"],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S170 source boundary PASS'tir; bounded target witness ve GIC/CPU1 receipt validated inputs'tur, hardware-derived runtime evidence değildir.",
    limitations: [
      "S170 gerçek target-only AArch64 çağrısını, SGI/GIC delivery'yi veya context-switch assembly'i çalıştırmaz.",
      "S166 runtime geçişi source contract düzeyinde ShootdownComplete'e kadar doğrulanır; scheduler-owned persistent migration, QEMU, fiziksel RPi, CPU2/CPU3, hotplug, soak ve generic SMP açık kalır.",
      "S170 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S170=NO.",
    ],
  },