G8l: target-dispatch typed execution permit source boundary

use crate::g8l_target_dispatch_final_callsite::{
    G8lTargetDispatchFinalCallsite, G8lTargetDispatchFinalCallsiteError,
    G8lTargetDispatchFinalCallsitePhase,
};

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lTargetDispatchExecutionPermitError {
    InvalidPhase,
    Consumed,
    FinalCallsite(G8lTargetDispatchFinalCallsiteError),
}

impl From<G8lTargetDispatchFinalCallsiteError> for G8lTargetDispatchExecutionPermitError {
    fn from(error: G8lTargetDispatchFinalCallsiteError) -> Self {
        Self::FinalCallsite(error)
    }
}

#[derive(Debug, PartialEq, Eq)]
pub struct G8lTargetDispatchExecutionPermit {
    runtime_instance_id: u64,
    ticket: MigrationTicket,
    context_generation: u64,
    final_callsite: Option<G8lTargetDispatchFinalCallsite>,
}

impl G8lTargetDispatchExecutionPermit {
    /// Consume the S176 final callsite without executing the target seam.
    pub fn from_final_callsite(
        runtime: &G8lRuntimeAuthority,
        final_callsite: G8lTargetDispatchFinalCallsite,
    ) -> Result<Self, G8lTargetDispatchExecutionPermitError> {
        if final_callsite.phase() != G8lTargetDispatchFinalCallsitePhase::Ready {
            return Err(G8lTargetDispatchExecutionPermitError::InvalidPhase);
        }
        final_callsite.revalidate_ready_runtime(runtime)?;
        Ok(Self {
            runtime_instance_id: final_callsite.runtime_instance_id(),
            ticket: final_callsite.ticket(),
            context_generation: final_callsite.context_generation(),
            final_callsite: Some(final_callsite),
        })
    }

    /// Revalidate the live S166 runtime while the execution permit remains
    /// unconsumed. This returns no source authority and performs no hardware
    /// operation on host builds.
    pub fn revalidate_ready_runtime(
        &self,
        runtime: &G8lRuntimeAuthority,
    ) -> Result<(), G8lTargetDispatchExecutionPermitError> {
        let final_callsite = self
            .final_callsite
            .as_ref()
            .ok_or(G8lTargetDispatchExecutionPermitError::Consumed)?;
        if final_callsite.phase() != G8lTargetDispatchFinalCallsitePhase::Ready {
            return Err(G8lTargetDispatchExecutionPermitError::InvalidPhase);
        }
        final_callsite.revalidate_ready_runtime(runtime)?;
        Ok(())
    }

    /// Revalidate the runtime envelope for a receipt returned by the
    /// target-only attempt. Unlike the construction check, this remains
    /// available after `final_callsite` has been consumed: the permit retains
    /// only the bounded identity fields needed for this post-attempt check.
    pub fn revalidate_execution_runtime(
        &self,
        runtime: &G8lRuntimeAuthority,
    ) -> Result<(), G8lTargetDispatchExecutionPermitError> {
        if self.runtime_instance_id == 0 || runtime.instance_id() != self.runtime_instance_id {
            return Err(G8lTargetDispatchExecutionPermitError::FinalCallsite(
                G8lTargetDispatchFinalCallsiteError::RuntimeInstanceMismatch,
            ));
        }
        if runtime.phase() != RuntimePhase::Ttbr0Installed {
            return Err(G8lTargetDispatchExecutionPermitError::FinalCallsite(
                G8lTargetDispatchFinalCallsiteError::RuntimePhaseMismatch,
            ));
        }
        if runtime.active_ticket() != Some(self.ticket) {
            return Err(G8lTargetDispatchExecutionPermitError::FinalCallsite(
                G8lTargetDispatchFinalCallsiteError::ActiveTicketMismatch,
            ));
        }
        if runtime.context_generation() != self.context_generation {
            return Err(G8lTargetDispatchExecutionPermitError::FinalCallsite(
                G8lTargetDispatchFinalCallsiteError::ContextGenerationMismatch,
            ));
        }
        let input = runtime.migration_input();
        if input.task_id != self.ticket.task_id
            || input.owner_cpu != CPU0
            || input.asid != self.ticket.asid
            || input.root != self.ticket.root
            || input.address_space_generation != self.ticket.address_space_generation
            || input.user_progress != self.ticket.user_progress_before
        {
            return Err(G8lTargetDispatchExecutionPermitError::FinalCallsite(
                G8lTargetDispatchFinalCallsiteError::RuntimeInputMismatch,
            ));
        }
        if self.ticket.source_cpu != CPU0 || self.ticket.target_cpu != CPU1 {
            return Err(G8lTargetDispatchExecutionPermitError::FinalCallsite(
                G8lTargetDispatchFinalCallsiteError::RuntimeInputMismatch,
            ));
        }
        Ok(())
    }

    /// Delegate the single target-only execution path to S176. The callsite
    /// is consumed before delegation, so success and failure are both
    /// non-replayable at the S177 boundary.
    #[cfg(all(target_arch = "aarch64", target_os = "none"))]
    pub unsafe fn execute_target_aarch64(
        &mut self,
        runtime: &G8lRuntimeAuthority,
    ) -> Result<ArchInstructionReceipt, G8lTargetDispatchExecutionPermitError> {
        let mut final_callsite = self
            .final_callsite
            .take()
            .ok_or(G8lTargetDispatchExecutionPermitError::Consumed)?;
        if final_callsite.phase() != G8lTargetDispatchFinalCallsitePhase::Ready {
            return Err(G8lTargetDispatchExecutionPermitError::InvalidPhase);
        }
        let receipt = unsafe { final_callsite.execute_target_aarch64(runtime)? };
        Ok(receipt)
    }

    pub const fn runtime_instance_id(&self) -> u64 {
        self.runtime_instance_id
    }

    pub const fn ticket(&self) -> MigrationTicket {
        self.ticket
    }

    pub const fn context_generation(&self) -> u64 {
        self.context_generation
    }

    pub const fn target_execution_path_wired(&self) -> bool {
        true
    }

    pub const fn execution_attempt_consumed_before_delegate(&self) -> bool {
        true
    }

    pub const fn hardware_mpidr_read_path_wired(&self) -> bool {
        true
    }

    pub const fn target_instruction_path_wired(&self) -> bool {
        true
    }

    pub const fn hardware_execution_proven(&self) -> bool {
        false
    }

    pub const fn global_scheduler_exclusion_proven(&self) -> bool {
        false
    }

    pub const fn global_source_linearity_proven(&self) -> bool {
        false
    }

    pub const fn gic_delivery_wired(&self) -> bool {
        false
    }

    pub const fn scheduler_runtime_callsite_wired(&self) -> bool {
        false
    }

    pub const fn consumed(&self) -> bool {
        self.final_callsite.is_none()
    }
}

#[test]
fn execution_permit_target_method_delegates_only_on_bare_metal() {
    let source = include_str!("../../kernel/src/g8l_target_dispatch_execution_permit.rs");
    let target = source
        .split("pub unsafe fn execute_target_aarch64")
        .nth(1)
        .unwrap();
    let consume = target.find(".take()").unwrap();
    let delegate = target
        .find("final_callsite.execute_target_aarch64(runtime)")
        .unwrap();
    assert!(consume < delegate);
    assert!(target.contains("final_callsite.execute_target_aarch64(runtime)"));
    assert!(!target.contains(".as_mut()"));
    assert!(!target.contains("self.final_callsite = None"));
    assert!(target.contains("G8lTargetDispatchExecutionPermitError::Consumed"));
}

  {
    id: "g8l-s177-target-dispatch-execution-permit-partial",
    date: "2026-08-24",
    sequence: 177,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: target-dispatch typed execution permit source boundary",
    summary:
      "S177, S176 final callsite nesnesini tüketen non-Copy typed execution permit'i 8/8 doğruladı. Full canlı S166 runtime zarfı yeniden doğrulanır; stale/foreign runtime fail-closed reddedilir. Target-only deneme, retained S176 callsite'ı delegasyondan önce tükettiği için başarı, wrong-CPU ve instruction hatası replay edilebilir yetki bırakmaz. Inherited MPIDR_EL1 ve S171→S168 TTBR0/TLBI yolu bağlı/AArch64-compile edilmiş, çalıştırılmamıştır.",
    evidence: [
      "g8l_target_dispatch_execution_permit: 8/8 PASS; exact S176 final-callsite consumption, full runtime revalidation, typed single-owner retention and stale/foreign rejection.",
      "Target method cfg(all(target_arch=aarch64,target_os=none)) altında `Option::take` ile callsite'ı önce tüketir, sonra S176'ya delege eder; başarısız attempt de S177 sınırında non-replayable'dır.",
      "hardware_mpidr_read_path_wired=true ve target_instruction_path_wired=true; hardware_execution_proven=false, global_scheduler_exclusion_proven=false, global_source_linearity_proven=false ve production_caller_wired=false.",
      "Kalıcı kapsam: `docs/M8.1-RPi5-G8l-S177-Target-Dispatch-Execution-Permit-Proof.md`.",
      "S177 fiziksel/device operasyonu yapmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S177=NO.",
    ],
    commands: [
      "cargo test --quiet --test g8l_target_dispatch_execution_permit -- --test-threads=1",
      "cargo check -p aselsan_kernel --no-default-features --features board-rpi5 --target aarch64-unknown-none",
    ],
    terminalSessions: [
      {
        id: "s177-g8l-target-dispatch-execution-permit",
        title: "G8l S177 typed target-dispatch execution permit",
        commandLines: [
          "cargo test --quiet --test g8l_target_dispatch_execution_permit -- --test-threads=1",
        ],
        outputLines: ["running 8 tests", "test result: ok; 8 passed; 0 failed"],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S177 dar kaynak kabulü PASS'tir; S176 için attempt-before-delegate tüketilen typed single-owner execution handoff kurar. Target yol bağlı/AArch64-compile edilmiş fakat çalıştırılmamıştır; global scheduler exclusion/source linearity ve production caller kanıtı değildir.",
    limitations: [
      "S177 inherited MPIDR_EL1 ve TTBR0/TLBI yolunu bağlar/AArch64-compile eder; QEMU veya fiziksel donanımda çalıştırmaz.",
      "Local single-owner permit, underlying global source linearity'yi kanıtlamaz.",
      "Permit cross-CPU scheduler mutation exclusion veya production scheduler caller wiring kanıtlamaz.",
      "Permit bu sırada SGI/GIC'e dokunmaz ve context-switch assembly çalıştırmaz.",
      "QEMU, fiziksel RPi, CPU2/CPU3, hotplug, soak ve generic SMP açık kalır.",
      "S177 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S177=NO.",
    ],
  },