G8l: target-dispatch callsite permit source boundary

use crate::g8l_target_aarch64_dispatch::G8lTargetAarch64DispatchRoute;
use crate::g8l_target_dispatch_admission::G8lTargetDispatchAdmissionToken;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lTargetDispatchCallsiteError {
    WrongExecutionCpu,
    RuntimeInstanceMismatch,
    RuntimePhaseMismatch,
    ActiveTicketMismatch,
    ContextGenerationMismatch,
    RouteRuntimeMismatch,
    RoutePhaseMismatch,
    RouteTicketMismatch,
    MissingArchitectureReceipt,
    ArchitectureReceiptMismatch,
    WiringRuntimeMismatch,
    WiringPhaseMismatch,
    MissingRequest,
    RequestMismatch,
}

#[derive(Debug, PartialEq, Eq)]
pub struct G8lTargetDispatchCallsitePermit {
    runtime_instance_id: u64,
    ticket: MigrationTicket,
    context_generation: u64,
    target_route: G8lTargetAarch64DispatchRoute,
    wiring: G8lIrqTlbiWiring,
    live_cpu1_callsite_wired: bool,
}

impl G8lTargetDispatchCallsitePermit {
    /// Consume S173 and revalidate every source authority immediately before
    /// a future callsite. This function performs no target delivery.
    pub fn from_admission(
        runtime: &G8lRuntimeAuthority,
        admission: G8lTargetDispatchAdmissionToken,
        execution_cpu: usize,
    ) -> Result<Self, G8lTargetDispatchCallsiteError> {
        if execution_cpu != CPU1 || admission.required_execution_cpu() != CPU1 {
            return Err(G8lTargetDispatchCallsiteError::WrongExecutionCpu);
        }
        let runtime_instance_id = admission.runtime_instance_id();
        let ticket = admission.ticket();
        let context_generation = admission.context_generation();
        if runtime.instance_id() != runtime_instance_id || runtime_instance_id == 0 {
            return Err(G8lTargetDispatchCallsiteError::RuntimeInstanceMismatch);
        }
        if runtime.phase() != RuntimePhase::Ttbr0Installed {
            return Err(G8lTargetDispatchCallsiteError::RuntimePhaseMismatch);
        }
        if runtime.active_ticket() != Some(ticket) {
            return Err(G8lTargetDispatchCallsiteError::ActiveTicketMismatch);
        }
        if runtime.context_generation() != context_generation {
            return Err(G8lTargetDispatchCallsiteError::ContextGenerationMismatch);
        }
        let (target_route, wiring) = admission.into_sources();
        if target_route.runtime_instance_id() != runtime_instance_id {
            return Err(G8lTargetDispatchCallsiteError::RouteRuntimeMismatch);
        }
        if target_route.architecture_phase() != ArchInstructionPhase::TlbiIssued {
            return Err(G8lTargetDispatchCallsiteError::RoutePhaseMismatch);
        }
        if target_route.ticket() != ticket {
            return Err(G8lTargetDispatchCallsiteError::RouteTicketMismatch);
        }
        let architecture_receipt = target_route
            .source_receipt()
            .ok_or(G8lTargetDispatchCallsiteError::MissingArchitectureReceipt)?;
        if architecture_receipt.task_id != ticket.task_id
            || architecture_receipt.asid != ticket.asid
            || architecture_receipt.generation != ticket.generation
            || architecture_receipt.context_generation != context_generation
            || architecture_receipt.source_cpu != CPU0
            || architecture_receipt.target_cpu != CPU1
            || architecture_receipt.ttbr0_operand != ticket.ttbr0_operand
            || architecture_receipt.ttbr0_write_order != 1
            || architecture_receipt.tlbi_order != 2
            || !architecture_receipt.dsb_before_ttbr0
            || !architecture_receipt.dsb_after_tlbi
            || !architecture_receipt.isb_after_tlbi
        {
            return Err(G8lTargetDispatchCallsiteError::ArchitectureReceiptMismatch);
        }
        if wiring.runtime_instance_id() != runtime_instance_id {
            return Err(G8lTargetDispatchCallsiteError::WiringRuntimeMismatch);
        }
        if wiring.phase() != WiringPhase::TlbiRequested {
            return Err(G8lTargetDispatchCallsiteError::WiringPhaseMismatch);
        }
        let request = wiring
            .request()
            .ok_or(G8lTargetDispatchCallsiteError::MissingRequest)?;
        if request.ticket != ticket
            || request.context_generation != context_generation
            || request.source_cpu != CPU0
            || request.target_cpu != CPU1
            || request.receipt_channel != G8L_TLBI_RECEIPT_CHANNEL
            || request.online_mask != ONLINE_MASK
        {
            return Err(G8lTargetDispatchCallsiteError::RequestMismatch);
        }
        Ok(Self {
            runtime_instance_id,
            ticket,
            context_generation,
            target_route,
            wiring,
            live_cpu1_callsite_wired: false,
        })
    }

    pub const fn runtime_instance_id(&self) -> u64 {
        self.runtime_instance_id
    }

    pub const fn ticket(&self) -> MigrationTicket {
        self.ticket
    }

    pub const fn context_generation(&self) -> u64 {
        self.context_generation
    }

    /// Consume the permit and return the revalidated source records. This is
    /// still a source-only transfer; it does not dispatch or acknowledge.
    /// The permit offers no pre-consumption by-value source getters.
    ///
    /// The returned S171/S167 records remain `Copy` bounded source-model
    /// values, so this does not prove globally linear or unforgeable runtime
    /// authority.
    pub fn into_sources(self) -> (G8lTargetAarch64DispatchRoute, G8lIrqTlbiWiring) {
        (self.target_route, self.wiring)
    }

    pub const fn global_source_linearity_proven(&self) -> bool {
        false
    }

    pub const fn live_cpu1_callsite_wired(&self) -> bool {
        self.live_cpu1_callsite_wired
    }

    pub const fn gic_delivery_wired(&self) -> bool {
        false
    }

    pub const fn scheduler_runtime_wired(&self) -> bool {
        false
    }

    pub const fn hardware_execution_proven(&self) -> bool {
        false
    }
}

#[test]
fn permit_rejects_cpu0_before_source_consumption() {
    let (runtime, token) = admission();
    assert_eq!(
        G8lTargetDispatchCallsitePermit::from_admission(&runtime, token, CPU0),
        Err(G8lTargetDispatchCallsiteError::WrongExecutionCpu)
    );
}

  {
    id: "g8l-s174-target-dispatch-callsite-permit-partial",
    date: "2026-08-24",
    sequence: 174,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: target-dispatch callsite permit source boundary",
    summary:
      "S174, S173 typed CPU1 admission token'ını gelecekteki target-only callsite öncesinde tüketip S166 runtime, S171 TlbiIssued route ve S167 TlbiRequested wiring source kayıtlarını yeniden doğruladı. Runtime phase Ttbr0Installed ve active ticket/context generation exact kalır; route ticket ile full architecture receipt task/ASID/generation/context/CPU/TTBR0/order/barrier zarfı, ayrıca request ticket/context/CPU/channel/online-mask alanları yeniden eşleşir. CPU0, foreign runtime ve S173 sonrası stale-advanced runtime fail-closed reddedilir. Permit pre-consumption by-value source getter sunmaz; underlying S171/S167 records Copy kaldığı için global lineer veya unforgeable authority kanıtı yoktur. Permit source-only'dir: target instruction, live CPU1 callsite, GIC/SGI, scheduler ownership, QEMU veya fiziksel runtime açılmadı.",
    evidence: [
      "g8l_target_dispatch_callsite: 6/6 PASS; exact S173 token consumption, full runtime/route/architecture-receipt/wiring/request revalidation, CPU0/foreign/stale-advanced reject, Copy-linearity limitation ve source audit.",
      "Runtime Ttbr0Installed, active ticket ve context generation; route TlbiIssued + ticket + full architecture receipt; wiring TlbiRequested; request ticket/context/CPU0→CPU1/channel=1/online-mask=0b0011 exact olarak yeniden doğrulanır.",
      "Permit `into_sources` ile source kayıtlarını token tüketerek verir ve pre-consumption public by-value getter sunmaz; underlying records Copy olduğundan global_source_linearity_proven=false kalır.",
      "Kalıcı kapsam: `docs/M8.1-RPi5-G8l-S174-Target-Dispatch-Callsite-Permit-Proof.md`.",
      "S174 fiziksel/device operasyonu yapmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S174=NO.",
    ],
    commands: [
      "cargo test --quiet --test g8l_target_dispatch_callsite -- --test-threads=1",
      "cargo check -p aselsan_kernel --no-default-features --features board-rpi5 --target aarch64-unknown-none",
    ],
    terminalSessions: [
      {
        id: "s174-g8l-target-dispatch-callsite",
        title: "G8l S174 target-dispatch callsite permit source boundary",
        commandLines: [
          "cargo test --quiet --test g8l_target_dispatch_callsite -- --test-threads=1",
        ],
        outputLines: ["running 6 tests", "test result: ok; 6 passed; 0 failed"],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S174 permit PASS'tir; source authority'lerini future callsite için yeniden doğrular fakat execution, GIC/SGI veya scheduler-owned migration runtime kanıtı değildir.",
    limitations: [
      "S174 host'ta target-only unsafe AArch64 instruction veya live CPU1 delivery callsite çalıştırmaz.",
      "Permit CPU1 admission'ı bounded source input olarak yeniden kullanır; eventual S171 callsite production MPIDR kimliğini yeniden doğrulamalıdır.",
      "Permit public by-value source getter sunmaz; fakat alttaki S171/S167 source record'ları Copy olduğu için global lineer/unforgeable authority kanıtlanmış değildir.",
      "Permit SGI/GIC'e dokunmaz, scheduler ownership/context-switch assembly mutasyonu yapmaz.",
      "S174 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S174=NO.",
    ],
  },