G8l: target-dispatch MPIDR preflight source boundary

use crate::g8l_runtime_contract::{G8lRuntimeAuthority, RuntimePhase};
use crate::g8l_target_dispatch_callsite::G8lTargetDispatchCallsitePermit;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lTargetDispatchPreflightError {
    WrongExecutionCpu,
    RuntimeInstanceMismatch,
    RuntimePhaseMismatch,
    ActiveTicketMismatch,
    ContextGenerationMismatch,
    InvalidMpidrAffinity,
    WrongMpidrTarget,
    LogicalCpuMismatch,
}

#[derive(Debug, PartialEq, Eq)]
pub struct G8lTargetDispatchPreflight {
    permit: G8lTargetDispatchCallsitePermit,
    mpidr_affinity: u64,
    logical_cpu: usize,
    mpidr_contract_validated: bool,
}

impl G8lTargetDispatchPreflight {
    /// Consume the S174 permit and bind it to the production CPU1 MPIDR
    /// contract after revalidating the live runtime, without invoking the
    /// future target-only callsite.
    pub fn from_permit(
        runtime: &G8lRuntimeAuthority,
        permit: G8lTargetDispatchCallsitePermit,
        execution_cpu: usize,
        mpidr_el1: u64,
    ) -> Result<Self, G8lTargetDispatchPreflightError> {
        if execution_cpu != CPU1 {
            return Err(G8lTargetDispatchPreflightError::WrongExecutionCpu);
        }
        if permit.runtime_instance_id() == 0
            || runtime.instance_id() != permit.runtime_instance_id()
        {
            return Err(G8lTargetDispatchPreflightError::RuntimeInstanceMismatch);
        }
        if runtime.phase() != RuntimePhase::Ttbr0Installed {
            return Err(G8lTargetDispatchPreflightError::RuntimePhaseMismatch);
        }
        if runtime.active_ticket() != Some(permit.ticket()) {
            return Err(G8lTargetDispatchPreflightError::ActiveTicketMismatch);
        }
        if runtime.context_generation() != permit.context_generation() {
            return Err(G8lTargetDispatchPreflightError::ContextGenerationMismatch);
        }
        let mpidr_affinity = mpidr_el1 & MPIDR_AFFINITY_MASK;
        let logical_cpu = logical_cpu_index(mpidr_el1)
            .ok_or(G8lTargetDispatchPreflightError::InvalidMpidrAffinity)?;
        if mpidr_affinity != TARGET_MPIDR {
            return Err(G8lTargetDispatchPreflightError::WrongMpidrTarget);
        }
        if logical_cpu != CPU1 {
            return Err(G8lTargetDispatchPreflightError::LogicalCpuMismatch);
        }
        Ok(Self {
            permit,
            mpidr_affinity,
            logical_cpu,
            mpidr_contract_validated: true,
        })
    }

    pub const fn mpidr_affinity(&self) -> u64 {
        self.mpidr_affinity
    }

    pub const fn logical_cpu(&self) -> usize {
        self.logical_cpu
    }

    /// True only for the caller-supplied source-contract value. This does not
    /// claim that S175 executed `mrs mpidr_el1` on production hardware.
    pub const fn mpidr_contract_validated(&self) -> bool {
        self.mpidr_contract_validated
    }

    /// Consume the preflight and return the permit for a future callsite.
    /// This remains source-only and does not dispatch or acknowledge.
    pub fn into_permit(self) -> G8lTargetDispatchCallsitePermit {
        self.permit
    }

    /// The retained S171/S167 records inside the permit are still `Copy`
    /// bounded model values, so S175 cannot claim globally linear authority.
    pub const fn global_source_linearity_proven(&self) -> bool {
        false
    }

    pub const fn hardware_mpidr_read_proven(&self) -> bool {
        false
    }

    pub const fn live_cpu1_callsite_wired(&self) -> bool {
        false
    }

    pub const fn gic_delivery_wired(&self) -> bool {
        false
    }

    pub const fn scheduler_runtime_wired(&self) -> bool {
        false
    }

    pub const fn hardware_execution_proven(&self) -> bool {
        false
    }
}

#[test]
fn preflight_rejects_cpu0_execution_before_mpidr_acceptance() {
    let (runtime, permit) = permit();
    assert_eq!(
        G8lTargetDispatchPreflight::from_permit(&runtime, permit, CPU0, TARGET_MPIDR),
        Err(G8lTargetDispatchPreflightError::WrongExecutionCpu)
    );
}

  {
    id: "g8l-s175-target-dispatch-preflight-partial",
    date: "2026-08-24",
    sequence: 175,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: target-dispatch MPIDR preflight source boundary",
    summary:
      "S175, exact S174 callsite permit'ini tüketip canlı S166 runtime instance/Ttbr0Installed/active-ticket/context bağını ve production BCM2712 MPIDR affinity TARGET_MPIDR=0x100, logical_cpu_index=1 contract'ını 9/9 yeniden doğruladı. Execution CPU=CPU1 zorunlu; CPU0, foreign/stale runtime, CPU0 MPIDR ve nonzero Aff0/Aff2/Aff3 fail-closed reddedilir. Supplied MPIDR source input'tur; preflight hardware MPIDR okumaz, target instruction/GIC/SGI/scheduler/QEMU veya fiziksel runtime çalıştırmaz.",
    evidence: [
      "g8l_target_dispatch_preflight: 9/9 PASS; exact S174 permit consumption, live runtime instance/phase/ticket/context revalidation, TARGET_MPIDR=0x100, logical_cpu_index=1 and CPU0/foreign/stale/wrong-target/Aff0/Aff2/Aff3 rejection.",
      "Production BCM2712 affinity contract is reused; mpidr_contract_validated=true only describes the supplied source value, while hardware_mpidr_read_proven=false.",
      "Preflight `into_permit` consumes the source boundary; retained S171/S167 values remain Copy, so global_source_linearity_proven=false. Live CPU1 callsite, GIC delivery, scheduler runtime and hardware execution remain false.",
      "Kalıcı kapsam: `docs/M8.1-RPi5-G8l-S175-Target-Dispatch-Preflight-Proof.md`.",
      "S175 fiziksel/device operasyonu yapmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S175=NO.",
    ],
    commands: [
      "cargo test --quiet --test g8l_target_dispatch_preflight -- --test-threads=1",
      "cargo check -p aselsan_kernel --no-default-features --features board-rpi5 --target aarch64-unknown-none",
    ],
    terminalSessions: [
      {
        id: "s175-g8l-target-dispatch-preflight",
        title: "G8l S175 target-dispatch MPIDR preflight source boundary",
        commandLines: [
          "cargo test --quiet --test g8l_target_dispatch_preflight -- --test-threads=1",
        ],
        outputLines: ["running 9 tests", "test result: ok; 9 passed; 0 failed"],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S175 MPIDR preflight dar kabulü PASS'tir; canlı runtime bağı ile supplied affinity source input'ını production BCM2712 CPU1 contract'ına bağlar fakat hardware MPIDR read, execution, GIC/SGI veya scheduler runtime kanıtı değildir.",
    limitations: [
      "S175 host'ta hardware MPIDR_EL1 okunmaz ve target-only unsafe AArch64 instruction çalıştırılmaz.",
      "Preflight execution CPU=CPU1 ve TARGET_MPIDR=0x100 kaynak contract'ını doğrular; production hardware derivation eventual callsite'ta ayrıca kanıtlanmalıdır.",
      "Returned preflight ile gerçek instruction arasındaki pencere kapanmış değildir; final callsite runtime ve hardware MPIDR'ı aynı IRQ-masked sınırda yeniden doğrulamalıdır.",
      "Retained S171/S167 records Copy kaldığı için global source linearity kanıtı yoktur.",
      "Preflight SGI/GIC'e dokunmaz, scheduler ownership/context-switch assembly mutasyonu yapmaz.",
      "S175 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S175=NO.",
    ],
  },