G8l: first-ERET writer-authority audit

pub const S300_WRITER_BOUNDARY_SITES: usize = 1;
pub const S300_WRITER_AUTHORITY_SITES: usize = 0;
pub const S300_DIRECT_SCHEDULER_ACCESS_SITES: usize = S299_DIRECT_SCHEDULER_ACCESS_SITES;
pub const S300_IMMUTABLE_READ_SITES: usize = S299_IMMUTABLE_READ_SITES;
pub const S300_WHOLE_SCHEDULER_GUARDED_SITES: usize = S299_WHOLE_SCHEDULER_GUARDED_SITES;
pub const S300_WHOLE_SCHEDULER_UNROUTED_SITES: usize = S299_WHOLE_SCHEDULER_UNROUTED_SITES;
pub const S300_OPEN_WRITER_SITES: usize = S299_OPEN_WRITER_SITES;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS300SchedulerWriterAuthorityAuditOutcome {
    Idle,
    AwaitingWriterAuthority {
        request_id: u64,
        guarded_sites: usize,
        writer_sites: usize,
    },
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS300SchedulerWriterAuthorityAuditError {
    S299(G8lS299SchedulerWriterAuthorityAuditError),
    S245(G8lS245ExclusionAdmissionRequestError),
    PriorCoverageDrift {
        guarded_sites: usize,
        unrouted_sites: usize,
    },
}

/// Revalidate the prior fail-closed authority boundary without taking
/// admission or constructing a production exclusive wrapper.
pub fn preflight_s300_scheduler_writer_authority(
    caller_cpu: usize,
    request: Option<G8lS245WholeSchedulerExclusionAdmissionRequestView>,
) -> Result<G8lS300SchedulerWriterAuthorityAuditOutcome, G8lS300SchedulerWriterAuthorityAuditError>
{
    match preflight_s299_scheduler_writer_authority(caller_cpu, request)
        .map_err(G8lS300SchedulerWriterAuthorityAuditError::S299)?
    {
        G8lS299SchedulerWriterAuthorityAuditOutcome::Idle => {
            Ok(G8lS300SchedulerWriterAuthorityAuditOutcome::Idle)
        }
        G8lS299SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
            request_id,
            guarded_sites,
            writer_sites,
        } if guarded_sites == S300_WHOLE_SCHEDULER_GUARDED_SITES
            && writer_sites == S300_OPEN_WRITER_SITES =>
        {
            Ok(
                G8lS300SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
                    request_id,
                    guarded_sites,
                    writer_sites,
                },
            )
        }
        G8lS299SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
            guarded_sites,
            writer_sites: _,
            ..
        } => Err(
            G8lS300SchedulerWriterAuthorityAuditError::PriorCoverageDrift {
                guarded_sites,
                unrouted_sites: S300_DIRECT_SCHEDULER_ACCESS_SITES - guarded_sites,
            },
        ),
    }
}

#[test]
fn s300_non_user_current_task_panics_before_initial_eret() {
    let source = include_str!("../../kernel/src/task/scheduler.rs");
    let boundary = first_eret_boundary(source);
    for required in [
        "if !curr.is_user",
        "panic!(\"[SPIKE] first_eret_to_user_direct: current task is not user\")",
        "crate::arch::aarch64::initial_eret_to_user(",
    ] {
        assert!(
            boundary.contains(required),
            "missing S300 user gate token: {required}"
        );
    }
    let user_gate = boundary.find("if !curr.is_user").unwrap();
    let panic = boundary.find("current task is not user").unwrap();
    let eret = boundary.find("initial_eret_to_user(").unwrap();
    assert!(user_gate < panic && panic < eret);
}

  {
    id: "g8l-s300-first-eret-writer-authority-audit-partial",
    date: "2026-08-26",
    sequence: 300,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: first-ERET writer-authority audit",
    summary:
      "S300 focused 15/15 PASS ile first_eret_to_user_direct içindeki tek explicit mutable scheduler aliasını kaynakta doğrular. Current task zorunludur ve user task olmalıdır; no-current ile non-user yolları fail-closed panic eder. Saved ELR, SPSR, SP, GPR referansı ve LR slot 30 initial_eret_to_user'a exact sırada forward edilir; terminal initial ERET diverge eder. Context-save çiftiyle first-ERET kaynak/model audit coverage tamamlanır, user_first_kernel_entry writer'ı ayrıca açık tutulur. Writer authority yalnız model gate'inin exclusive lease'iyle mümkündür; reader lease'i writer'ı açmaz. Production inventory 113 direct / 44 immutable guarded / 69 open writer olarak değişmez ve production exclusive wrapper, provider authority, whole-scheduler exclusion veya scheduler mutation üretilmez.",
    evidence: [
      "S300 focused kaynak/model kapısı iki bağımsız koşuda 15/15 PASS verdi: 130 B / SHA-256 0447f2fe9dc6fdf30815a6962cf23d978425e51bef2acde1efb27e5da13a78b3.",
      "first_eret_to_user_direct içindeki tek addr_of_mut!(SCHEDULER) writer boundary'si audit edilir. Conditional current_task mutable selection sonrası missing-current ve non-user branch'leri panic eder; saved_user_elr, saved_user_spsr, user_sp, saved_user_gprs referansı ve saved_user_gprs[30] LR değeri initial_eret_to_user'a exact sırada forward edilir ve çağrı diverge eder. user_first_kernel_entry writer'ı ayrı açık kalır.",
      "Model gate reader membership exclusive writer authority'yi ExclusiveBusy ile bloklar; reader bırakıldıktan sonra non-zero token'lı exclusive lease alınır. Bu host/model evidence'tır.",
      "S299 authority preflight yeniden doğrulanır; pending S245 request korunur ve sonuç AwaitingWriterAuthority { guarded_sites: 44, writer_sites: 69 } olarak döner.",
      "Dört AArch64 profil derlemesi fresh byte-equal çiftlerde exit 0 verdi: QEMU 110871 B / e7a42c5f, RPi4 149596 B / 9fba8a81, RPi5 411153 B / f1a57ad4 ve RPi5+SMP 411095 B / 0c6657d2. Warning header'ları sırasıyla 292, 390, 846 ve 846'dır; ilk RPi4 çiftindeki yalnız Cargo süre gürültüsü reddedilmiştir ve zero-warning iddiası yoktur.",
      "Birleşik board-rpi5,board-qemu özellikleri iki koşuda beklenen exit 101, 18744 B / af30b4d1, 17 error ve 23 warning header ile fail-closed kaldı; S300 writer boundary'si iki board profilinin birlikte etkinleşmesini açmaz.",
      "S238–S300 dependency matrisi iki koşuda 64 grup / 884/884 PASS; ham loglar byte-equal 8242 B / 06a761e2cf22f0fc6ce6048b77cbc100c34eb85dd3d2ce99c71856827a040007, süre-normalize özetler byte-equal 8370 B / 22a2bec7db8dc3af3fa097232f4c53d8aa25145f7a0c7c3a0d57e4c65cb1ebb1. Bu production writer-authority invocation kanıtı değildir.",
      "Ortak make verify-qemu iki koşuda PASS verdi: 116222 B / 9fa64747 ve 116139 B / 6d8415c4; W^X 31/31, S271 GRAPH_ABSENT=YES, RuntimePmm baseline, EL0 x4096, IPC 20/20, tek beklenen S142 fatal containment ve SEC5 korunur. Bu ortak smoke S300 production writer invocation kanıtı değildir.",
      "Exact yedi tarihsel G8h assertion adıyla dışlandığında workspace iki koşuda 262 sonuç grubu / 2674 PASS / 7 filtered verdi: ham loglar 61542 B / 3807eb65 ve 9a48592f, süre-normalize 25295 B özet byte-equal / SHA-256 e368a9a2f797c7489034a78a51ae376b57c7bc07a66475e5943592b752c49725. Filtresiz koşu exit 101, 56764 B / 1a0c24df ile frozen S96 exceptions.S identity kapısında RED kaldı; full-workspace GREEN iddia edilmez.",
      "S300 production exclusive wrapper, provider authority, whole-scheduler exclusion, QEMU runtime fixture veya scheduler mutation iddiası eklemez; physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S300=NO.",
    ],
    commands: [
      "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s300_first_eret_writer_authority_audit -- --test-threads=1",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-qemu",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi4",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --features board-rpi5",
      "make verify-qemu",
    ],
    terminalSessions: [
      {
        id: "g8l-s300-first-eret-writer-authority-audit",
        title: "G8l S300 first-ERET writer-authority audit",
        commandLines: [
          "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s300_first_eret_writer_authority_audit -- --test-threads=1",
        ],
        outputLines: [
          "test result: ok; S300 focused 1 group / 15 passed; 0 failed",
          "repeat-stable quiet output: 130 B / 0447f2fe9dc6fdf30815a6962cf23d978425e51bef2acde1efb27e5da13a78b3",
          "first-ERET writer authority remains model-only: reader blocks exclusive lease; missing-current and non-user paths fail closed while saved ELR/SPSR/SP/GPR/LR forwarding is source-audited and user_first_kernel_entry plus 69 production writer sites remain open",
          "dependency: S238–S300 · 64 groups · 884/884 PASS; workspace: 262 groups · 2674 PASS · 7 historical filtered",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S300 kaynak/model fail-closed authority boundary'sidir; production writer guard/migration, QEMU fixture mutation ve fiziksel/device execution claim edilmez.",
    limitations: [
      "S300 first_eret_to_user_direct içindeki tek explicit mutable scheduler aliasını audit ederek context-save çiftiyle first-ERET kaynak/model coverage'ını tamamlar; user_first_kernel_entry writer'ı ve toplam 69 production writer site açık kalır.",
      "Exclusive lease yalnız host/model gate'inde test edilir; production exclusive wrapper, provider authority ve whole-scheduler exclusion açık kalır.",
      "S238–S300 dependency matrisi exact 64 grup / 884/884 PASS'tir; bu production writer authority invocation kanıtı değildir.",
      "Filtresiz workspace frozen S96 identity kapısında RED'dir; workspace umbrella GREEN iddia edilmez.",
      "Supported-profile runtime invocation, Generic SMP ve fiziksel RPi kabulü açık kalır; S300 physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S300=NO.",
    ],
  },