G8l: EL0 notification-signal writer-authority audit

pub const S306_EXCEPTIONS_EXPLICIT_WRITER_SITES: usize = 8;
pub const S306_EXCEPTIONS_REMAINING_UNAUDITED_WRITER_SITES: usize = 3;
pub const S306_DIRECT_SCHEDULER_ACCESS_SITES: usize = S305_DIRECT_SCHEDULER_ACCESS_SITES;
pub const S306_IMMUTABLE_READ_SITES: usize = S305_IMMUTABLE_READ_SITES;
pub const S306_WHOLE_SCHEDULER_GUARDED_SITES: usize = S305_WHOLE_SCHEDULER_GUARDED_SITES;
pub const S306_WHOLE_SCHEDULER_UNROUTED_SITES: usize = S305_WHOLE_SCHEDULER_UNROUTED_SITES;
pub const S306_OPEN_WRITER_SITES: usize = S305_OPEN_WRITER_SITES;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS306SchedulerWriterAuthorityAuditOutcome {
    Idle,
    AwaitingWriterAuthority {
        request_id: u64,
        guarded_sites: usize,
        writer_sites: usize,
    },
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS306SchedulerWriterAuthorityAuditError {
    S305(G8lS305SchedulerWriterAuthorityAuditError),
    S245(G8lS245ExclusionAdmissionRequestError),
    PriorCoverageDrift {
        guarded_sites: usize,
        unrouted_sites: usize,
    },
}

/// Revalidate the prior fail-closed authority boundary without taking
/// admission or constructing a production exclusive wrapper.
pub fn preflight_s306_scheduler_writer_authority(
    caller_cpu: usize,
    request: Option<G8lS245WholeSchedulerExclusionAdmissionRequestView>,
) -> Result<G8lS306SchedulerWriterAuthorityAuditOutcome, G8lS306SchedulerWriterAuthorityAuditError>
{
    match preflight_s305_scheduler_writer_authority(caller_cpu, request)
        .map_err(G8lS306SchedulerWriterAuthorityAuditError::S305)?
    {
        G8lS305SchedulerWriterAuthorityAuditOutcome::Idle => {
            Ok(G8lS306SchedulerWriterAuthorityAuditOutcome::Idle)
        }
        G8lS305SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
            request_id,
            guarded_sites,
            writer_sites,
        } if guarded_sites == S306_WHOLE_SCHEDULER_GUARDED_SITES
            && writer_sites == S306_OPEN_WRITER_SITES =>
        {
            Ok(
                G8lS306SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
                    request_id,
                    guarded_sites,
                    writer_sites,
                },
            )
        }
        G8lS305SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
            guarded_sites,
            writer_sites: _,
            ..
        } => Err(
            G8lS306SchedulerWriterAuthorityAuditError::PriorCoverageDrift {
                guarded_sites,
                unrouted_sites: S306_DIRECT_SCHEDULER_ACCESS_SITES - guarded_sites,
            },
        ),
    }
}

#[test]
fn s306_notification_signal_revalidates_live_signaler_under_transaction() {
    let source = include_str!("../../kernel/src/task/scheduler.rs");
    let commit = notification_signal_commit_boundary(source);
    for required in [
        "IrqGuard::new()",
        "IPC_TRANSACTION_LOCK.lock()",
        ".current_task",
        ".filter(|task_id| *task_id != 0)",
        "bits == 0",
        "current_notification_authority_is_live(",
        "CapabilityRights::NOTIFICATION_SIGNAL",
        "IPC_CALL_DEADLINES.lock()",
        "NOTIFICATION_REGISTRY.lock()",
        "object.id() == notification_id",
    ] {
        assert!(
            commit.contains(required),
            "missing S306 transaction token: {required}"
        );
    }
    let irq = commit.find("IrqGuard::new()").unwrap();
    let transaction = commit.find("IPC_TRANSACTION_LOCK.lock()").unwrap();
    let signaler = commit.find(".current_task").unwrap();
    let live = commit
        .find("current_notification_authority_is_live(")
        .unwrap();
    let deadlines = commit.find("IPC_CALL_DEADLINES.lock()").unwrap();
    let registry = commit.find("NOTIFICATION_REGISTRY.lock()").unwrap();
    let object = commit.find("object.id() == notification_id").unwrap();
    assert!(
        irq < transaction
            && transaction < signaler
            && signaler < live
            && live < deadlines
            && deadlines < registry
            && registry < object
    );
}

  {
    id: "g8l-s306-el0-notification-signal-writer-authority-audit-partial",
    date: "2026-08-26",
    sequence: 306,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: EL0 notification-signal writer-authority audit",
    summary:
      "S306 focused 15/15 PASS ile arch/aarch64/exceptions.rs içindeki kaynak sırasına göre sondan beşinci explicit mutable scheduler aliasını doğrular: handle_notification_signal içindeki notification_signal sınırı. Current-task CNode exact Notification capability generation ve NOTIFICATION_SIGNAL hakkını writer'dan önce doğrular; notification id, generation ve bits exact forward edilir. Scheduler helper existing transaction altında canlı signaler/object'i yeniden doğrular; non-wake yolu bits'i coalesce eder, wake yolu exact deadline, blocked waiter, waiter-CNode generation/NOTIFICATION_WAIT authority ve ready capacity'yi commit'ten önce kanıtlar. Writer authority yalnız model gate'inin exclusive lease'iyle mümkündür; reader lease'i writer'ı açmaz. Production inventory 113 direct / 44 immutable guarded / 69 open writer olarak değişmez; exceptions.rs içindeki 8 explicit aliasın 3'ü ayrıca açık kalır ve production exclusive wrapper, provider authority, whole-scheduler exclusion veya scheduler mutation üretilmez.",
    evidence: [
      "S306 focused kaynak/model kapısı iki bağımsız koşuda 15/15 PASS verdi: 130 B / SHA-256 0447f2fe9dc6fdf30815a6962cf23d978425e51bef2acde1efb27e5da13a78b3.",
      "handle_notification_signal içindeki tek addr_of_mut!(crate::task::scheduler::SCHEDULER) writer boundary'si audit edilir. ctx.gpr[0]/ctx.gpr[1] notification id/bits olur; current_task_cnode exact Notification lookup/generation ve NOTIFICATION_SIGNAL hakkı writer'dan önce gelir, eksik authority InvalidCapability ile terminal kapanır. notification_signal(notification_id, authority.generation, bits) exact ve tek kez forward edilir. exceptions.rs 8 explicit writer / 3 remaining unaudited'dır.",
      "notification_signal existing IRQ/IPC transaction altında nonzero current signaler, nonzero bits, canlı signal authority/generation ve exact NOTIFICATION_REGISTRY object'ini yeniden doğrular. Non-wake path waiter snapshot ve pending|bits/mask hesabıyla yalnız signal(bits) coalescing'i yapar. Wake path exact Notification deadline tag/object/generation/mask, BlockedOnNotification task, waiter-CNode matching generation/NOTIFICATION_WAIT authority ve ready capacity'yi commit öncesi kanıtlar; exact signal, saved result, Ready enqueue ve deadline retirement sırası korunur.",
      "Handler Coalesced, Wake ve Err sonuçlarını ayrık yayınlar; iki success dalı exact pending bits'i set_notification_result ile döndürür.",
      "Model gate reader membership exclusive writer authority'yi ExclusiveBusy ile bloklar; reader bırakıldıktan sonra non-zero token'lı exclusive lease alınır. Bu host/model evidence'tır.",
      "S305 authority preflight yeniden doğrulanır; pending S245 request korunur ve sonuç AwaitingWriterAuthority { guarded_sites: 44, writer_sites: 69 } olarak döner.",
      "Dört AArch64 profil derlemesi iki koşuda byte-equal exit 0 verdi: QEMU 110646 B / fc34a94f, RPi4 149371 B / 409c65fa, RPi5 424948 B / 468c2621 ve RPi5+SMP 424890 B / 61b23c45. Warning header'ları sırasıyla 291, 389, 885 ve 885'tir; zero-warning iddiası değildir.",
      "Birleşik board-rpi5,board-qemu özellikleri iki koşuda beklenen exit 101, 18590 B / 5757038b, 17 error ve 22 warning header ile fail-closed kaldı; S306 writer boundary'si iki board profilinin birlikte etkinleşmesini açmaz.",
      "S238–S306 dependency matrisi iki koşuda 70 grup / 974/974 PASS; ham loglar byte-equal 9022 B / 2c8f557e90aff449379b58e58c2a30b273e02c64de17cba4746c6dc226ccbadb, süre-normalize özetler byte-equal 9162 B / f3de0d65724e5ae89e5bdbba0a8d00a6d37557f58eb93d8bad60977b4d8475f5. Bu production writer-authority invocation kanıtı değildir.",
      "Ortak make verify-qemu iki koşuda PASS verdi: 116222 B / 3e40a416 ve 116139 B / 29c4fab2; W^X 31/31, S271 GRAPH_ABSENT=YES, RuntimePmm baseline, EL0 x4096, IPC 20/20, tek S142 containment ve SEC5 korunur. Bu ortak smoke S306 production writer invocation kanıtı değildir.",
      "Exact yedi tarihsel G8h assertion adıyla dışlandığında workspace iki koşuda 268 sonuç grubu / 2769 PASS / 7 filtered verdi: ham loglar 62327 B / 20b1ed28 ve a9448ecd, süre-normalize 25877 B özet byte-equal / SHA-256 c5d1d86b6b18519049a779341ef19a1b5bb3568939e0acc225a08ac9f29d5623. Filtresiz koşu exit 101, 57549 B / 90aa5c33 ile frozen S96 exceptions.S identity kapısında RED kaldı; full-workspace GREEN iddia edilmez.",
      "S306 production exclusive wrapper, provider authority, whole-scheduler exclusion, QEMU runtime fixture veya scheduler mutation iddiası eklemez; physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S306=NO.",
    ],
    commands: [
      "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s306_el0_notification_signal_writer_authority_audit -- --test-threads=1",
      "cargo build --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-qemu",
      "cargo build --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi4",
      "cargo build --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo build --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
      "cargo build --quiet -p aselsan_kernel --target aarch64-unknown-none --features board-rpi5",
      "make verify-qemu",
    ],
    terminalSessions: [
      {
        id: "g8l-s306-el0-notification-signal-writer-authority-audit",
        title: "G8l S306 EL0 notification-signal writer-authority audit",
        commandLines: [
          "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s306_el0_notification_signal_writer_authority_audit -- --test-threads=1",
        ],
        outputLines: [
          "test result: ok; S306 focused 1 group / 15 passed; 0 failed",
          "repeat-stable quiet output: 130 B / 0447f2fe9dc6fdf30815a6962cf23d978425e51bef2acde1efb27e5da13a78b3",
          "EL0 notification-signal writer authority remains model-only: reader blocks exclusive lease; CNode signal authority, exact generation/bits forwarding, coalesced path and exact waiter-wake graph are source-audited while exceptions.rs retains 3 unaudited aliases and all 69 production writer sites remain open",
          "dependency: S238–S306 · 70 groups · 974/974 PASS; workspace: 268 groups · 2769 PASS · 7 historical filtered",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S306 kaynak/model fail-closed authority boundary'sidir; production writer guard/migration, QEMU fixture mutation ve fiziksel/device execution claim edilmez.",
    limitations: [
      "S306 exceptions.rs içindeki kaynak sırasına göre sondan beşinci explicit mutable scheduler aliasını audit eder; aynı source unit'te 3 alias ve toplam 69 production writer site authority wrapper dışında açık kalır.",
      "Exclusive lease yalnız host/model gate'inde test edilir; production exclusive wrapper, provider authority ve whole-scheduler exclusion açık kalır.",
      "S238–S306 dependency matrisi exact 70 grup / 974/974 PASS'tir; bu production writer authority invocation kanıtı değildir.",
      "Filtresiz workspace frozen S96 identity kapısında RED'dir; workspace umbrella GREEN iddia edilmez.",
      "Supported-profile runtime invocation, Generic SMP ve fiziksel RPi kabulü açık kalır; S306 physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S306=NO.",
    ],
  },