G8l: execution caller receipt boundary source contract

impl G8lTargetDispatchExecutionCaller {
    pub fn from_execution_receipt(
        runtime: &G8lRuntimeAuthority,
        receipt: G8lTargetDispatchExecutionReceipt,
    ) -> Result<Self, G8lTargetDispatchExecutionCallerError> {
        Self::validate_receipt_runtime(runtime, &receipt)?;
        Ok(Self {
            receipt: Some(receipt),
        })
    }

    fn validate_receipt_runtime(
        runtime: &G8lRuntimeAuthority,
        receipt: &G8lTargetDispatchExecutionReceipt,
    ) -> Result<(), G8lTargetDispatchExecutionCallerError> {
        if runtime.instance_id() != receipt.runtime_instance_id() {
            return Err(G8lTargetDispatchExecutionCallerError::RuntimeInstanceMismatch);
        }
        if runtime.phase() != RuntimePhase::Ttbr0Installed {
            return Err(G8lTargetDispatchExecutionCallerError::RuntimePhaseMismatch);
        }
        let ticket = receipt.ticket();
        if runtime.active_ticket() != Some(ticket) {
            return Err(G8lTargetDispatchExecutionCallerError::ActiveTicketMismatch);
        }
        if runtime.context_generation() != receipt.context_generation() {
            return Err(G8lTargetDispatchExecutionCallerError::ContextGenerationMismatch);
        }
        let input = runtime.migration_input();
        if input.task_id != ticket.task_id {
            return Err(G8lTargetDispatchExecutionCallerError::TaskMismatch);
        }
        if input.asid != ticket.asid {
            return Err(G8lTargetDispatchExecutionCallerError::AsidMismatch);
        }
        if input.address_space_generation != ticket.address_space_generation {
            return Err(G8lTargetDispatchExecutionCallerError::GenerationMismatch);
        }
        let architecture = receipt.architecture();
        if architecture.task_id != ticket.task_id {
            return Err(G8lTargetDispatchExecutionCallerError::TaskMismatch);
        }
        if architecture.asid != ticket.asid {
            return Err(G8lTargetDispatchExecutionCallerError::AsidMismatch);
        }
        if architecture.generation != ticket.generation {
            return Err(G8lTargetDispatchExecutionCallerError::GenerationMismatch);
        }
        if architecture.context_generation != receipt.context_generation() {
            return Err(G8lTargetDispatchExecutionCallerError::ContextGenerationMismatch);
        }
        if architecture.source_cpu != ticket.source_cpu {
            return Err(G8lTargetDispatchExecutionCallerError::SourceCpuMismatch);
        }
        if architecture.target_cpu != ticket.target_cpu {
            return Err(G8lTargetDispatchExecutionCallerError::TargetCpuMismatch);
        }
        if architecture.ttbr0_operand != ticket.ttbr0_operand {
            return Err(G8lTargetDispatchExecutionCallerError::Ttbr0OperandMismatch);
        }
        if architecture.ttbr0_write_order != 1 || architecture.tlbi_order != 2 {
            return Err(G8lTargetDispatchExecutionCallerError::InstructionOrderMismatch);
        }
        if !architecture.dsb_before_ttbr0
            || !architecture.dsb_after_tlbi
            || !architecture.isb_after_tlbi
        {
            return Err(G8lTargetDispatchExecutionCallerError::BarrierContractMismatch);
        }
        Ok(())
    }

    pub fn revalidate_runtime(
        &self,
        runtime: &G8lRuntimeAuthority,
    ) -> Result<(), G8lTargetDispatchExecutionCallerError> {
        let receipt = self
            .receipt
            .as_ref()
            .ok_or(G8lTargetDispatchExecutionCallerError::Consumed)?;
        Self::validate_receipt_runtime(runtime, receipt)
    }

    pub const fn consumed(&self) -> bool {
        self.receipt.is_none()
    }

    pub const fn production_caller_wired(&self) -> bool {
        false
    }

    pub const fn scheduler_runtime_callsite_wired(&self) -> bool {
        false
    }

    pub const fn gic_delivery_wired(&self) -> bool {
        false
    }

    pub const fn hardware_execution_proven(&self) -> bool {
        false
    }

    pub const fn source_contract_only(&self) -> bool {
        true
    }
}

#[test]
fn caller_checks_exact_task_asid_generation_and_cpu_envelope() {
    let source = include_str!("../../kernel/src/g8l_target_dispatch_execution_caller.rs");
    for marker in [
        "TaskMismatch",
        "AsidMismatch",
        "GenerationMismatch",
        "SourceCpuMismatch",
        "TargetCpuMismatch",
        "architecture.task_id",
        "architecture.asid",
        "architecture.generation",
        "architecture.source_cpu",
        "architecture.target_cpu",
    ] {
        assert!(source.contains(marker), "missing caller marker: {marker}");
    }
}

  {
    id: "g8l-s179-target-dispatch-execution-caller-partial",
    date: "2026-08-24",
    sequence: 179,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: execution caller receipt boundary source contract",
    summary:
      "S179, S178'in non-Copy G8lTargetDispatchExecutionReceipt değerini bir sonraki caller sınırında by-value tüketen 8/8 source contract kurdu. Runtime instance, Ttbr0Installed, active ticket/context ve task/ASID/generation/source-target CPU/TTBR0/order/barrier zarfı retain öncesi exact doğrulanır; caller-supplied architecture receipt bu sınırı kuramaz.",
    evidence: [
      "g8l_target_dispatch_execution_caller: 8/8 PASS; exact S178 non-Copy receipt by-value consumption, single-owner Option boundary and full runtime/architecture envelope revalidation.",
      "Caller boundary stale/foreign runtime, wrong task/ASID/generation/CPU, TTBR0 operand, instruction order and DSB/ISB barrier contract için fail-closed source checks içerir.",
      "Production caller/scheduler/GIC/hardware wiring closed: production_caller_wired=false, scheduler_runtime_callsite_wired=false, gic_delivery_wired=false, hardware_execution_proven=false.",
      "Kalıcı kapsam: `docs/M8.1-RPi5-G8l-S179-Execution-Caller-Boundary-Proof.md`.",
      "S179 fiziksel/device operasyonu yapmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S179=NO.",
    ],
    commands: [
      "cargo test --quiet --test g8l_target_dispatch_execution_caller -- --test-threads=1",
      "cargo check --quiet --manifest-path kernel/Cargo.toml --target aarch64-unknown-none --no-default-features --features board-rpi5",
    ],
    terminalSessions: [
      {
        id: "s179-g8l-target-dispatch-execution-caller",
        title: "G8l S179 execution caller receipt boundary",
        commandLines: [
          "cargo test --quiet --test g8l_target_dispatch_execution_caller -- --test-threads=1",
        ],
        outputLines: ["running 8 tests", "test result: ok; 8 passed; 0 failed"],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S179 dar kaynak kabulü PASS'tir; typed S178 receipt caller sınırına alınır fakat production scheduler/GIC/hardware authority açılmaz.",
    limitations: [
      "S179 source-only caller boundary'dir; production scheduler mutation ve gerçek caller wiring yapmaz.",
      "GIC/SGI delivery, context-switch assembly, QEMU ve fiziksel RPi execution kapsam dışıdır.",
      "Kaynak yol cross-CPU scheduler exclusion veya global source linearity kanıtı değildir.",
      "S179 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S179=NO.",
    ],
  },