G8l: QEMU S148 post-arbitration signal writer-authority audit

pub const S312_WRITER_BOUNDARY_SITES: usize = 1;
pub const S312_WRITER_AUTHORITY_SITES: usize = 0;
pub const S312_MAIN_EXPLICIT_WRITER_SITES: usize = 17;
pub const S312_MAIN_PREVIOUSLY_AUDITED_WRITER_SITES: usize = 2;
pub const S312_MAIN_REMAINING_UNAUDITED_WRITER_SITES: usize = 14;
pub const S312_S148_EXPLICIT_WRITER_SITES: usize = 2;
pub const S312_S148_REMAINING_UNAUDITED_WRITER_SITES: usize = 1;
pub const S312_DIRECT_SCHEDULER_ACCESS_SITES: usize = S311_DIRECT_SCHEDULER_ACCESS_SITES;
pub const S312_IMMUTABLE_READ_SITES: usize = S311_IMMUTABLE_READ_SITES;
pub const S312_WHOLE_SCHEDULER_GUARDED_SITES: usize = S311_WHOLE_SCHEDULER_GUARDED_SITES;
pub const S312_WHOLE_SCHEDULER_UNROUTED_SITES: usize = S311_WHOLE_SCHEDULER_UNROUTED_SITES;
pub const S312_OPEN_WRITER_SITES: usize = S311_OPEN_WRITER_SITES;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS312SchedulerWriterAuthorityAuditOutcome {
    Idle,
    AwaitingWriterAuthority {
        request_id: u64,
        guarded_sites: usize,
        writer_sites: usize,
    },
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS312SchedulerWriterAuthorityAuditError {
    S311(G8lS311SchedulerWriterAuthorityAuditError),
    S245(G8lS245ExclusionAdmissionRequestError),
    PriorCoverageDrift {
        guarded_sites: usize,
        unrouted_sites: usize,
    },
}

/// Revalidate the prior fail-closed authority boundary without taking
/// admission or constructing a production exclusive wrapper.
pub fn preflight_s312_scheduler_writer_authority(
    caller_cpu: usize,
    request: Option<G8lS245WholeSchedulerExclusionAdmissionRequestView>,
) -> Result<G8lS312SchedulerWriterAuthorityAuditOutcome, G8lS312SchedulerWriterAuthorityAuditError>
{
    match preflight_s311_scheduler_writer_authority(caller_cpu, request)
        .map_err(G8lS312SchedulerWriterAuthorityAuditError::S311)?
    {
        G8lS311SchedulerWriterAuthorityAuditOutcome::Idle => {
            Ok(G8lS312SchedulerWriterAuthorityAuditOutcome::Idle)
        }
        G8lS311SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
            request_id,
            guarded_sites,
            writer_sites,
        } if guarded_sites == S312_WHOLE_SCHEDULER_GUARDED_SITES
            && writer_sites == S312_OPEN_WRITER_SITES =>
        {
            Ok(
                G8lS312SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
                    request_id,
                    guarded_sites,
                    writer_sites,
                },
            )
        }
        G8lS311SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
            guarded_sites,
            writer_sites: _,
            ..
        } => Err(
            G8lS312SchedulerWriterAuthorityAuditError::PriorCoverageDrift {
                guarded_sites,
                unrouted_sites: S312_DIRECT_SCHEDULER_ACCESS_SITES - guarded_sites,
            },
        ),
    }
}

#[test]
fn s312_helper_revalidates_signaler_authority_and_exact_object_under_transaction() {
    let source = include_str!("../../kernel/src/task/scheduler.rs");
    let helper = notification_signal_boundary(source);
    for required in [
        "IrqGuard::new()",
        "IPC_TRANSACTION_LOCK.lock()",
        ".current_task",
        ".filter(|task_id| *task_id != 0)",
        "bits == 0",
        "current_notification_authority_is_live(",
        "CapabilityRights::NOTIFICATION_SIGNAL",
        "IPC_CALL_DEADLINES.lock()",
        "NOTIFICATION_REGISTRY.lock()",
        ".position(|object| object.id() == notification_id)",
        "waiter_snapshot()",
    ] {
        assert!(
            helper.contains(required),
            "missing S312 helper preflight token: {required}"
        );
    }
    let transaction = helper.find("IPC_TRANSACTION_LOCK.lock()").unwrap();
    let signaler = helper.find("let signaler_task").unwrap();
    let authority = helper
        .find("current_notification_authority_is_live(")
        .unwrap();
    let registry = helper.find("NOTIFICATION_REGISTRY.lock()").unwrap();
    assert!(transaction < signaler && signaler < authority && authority < registry);
}

  {
    id: "g8l-s312-qemu-s148-post-arbitration-signal-writer-authority-audit-partial",
    date: "2026-08-27",
    sequence: 312,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: QEMU S148 post-arbitration signal writer-authority audit",
    summary:
      "S312 focused 15/15 PASS ile main.rs içindeki kaynak sırasına göre S139 caller'ın iki aliasından sonraki sıradaki explicit mutable scheduler sınırını doğrular: run_qemu_s148_notification_race_arbitration post-arbitration loop içindeki notification_signal writer'ı. Nonzero controller task'ın exact üç Notification root'u ve WAIT grant'leri writer'dan önce kurulur. SIGNAL_FIRST=DELIVERED, REVOKE_FIRST=CANCELLED ve TIMEOUT_FIRST=TIMED_OUT exact terminal sonuçları ile stale deadline/grant loser retry retleri loop öncesindedir. Surviving signal/revoke/timeout notification root'ları exact id/generation ve 0x8 bits ile birer kez forward edilir; caller yalnız Coalesced { pending: 0x8 } kabul edip her object'i exact owner ile destroy eder. Helper IRQ/IPC transaction altında nonzero current signaler, canlı NOTIFICATION_SIGNAL authority ve exact registry object'ini yeniden doğrular; waiter kalmadığında coalescing return blocked-task/wake-capacity/ready-queue/deadline commit yolundan önce terminaldir. Writer authority yalnız model gate'inin exclusive lease'iyle mümkündür; reader lease'i writer'ı açmaz. main.rs 17 explicit writer / 2 previously audited / 14 remaining unaudited, S148 işlevi 2 explicit / 1 remaining; production inventory 113 direct / 44 immutable guarded / 69 open writer olarak değişmez ve production exclusive wrapper, provider authority, whole-scheduler exclusion veya scheduler mutation üretilmez.",
    evidence: [
      "S312 focused kaynak/model kapısı iki bağımsız koşuda 15/15 PASS verdi: 130 B / SHA-256 0447f2fe9dc6fdf30815a6962cf23d978425e51bef2acde1efb27e5da13a78b3.",
      "main.rs içindeki 17 explicit addr_of_mut!(crate::task::scheduler::SCHEDULER) sitesinin iki S139 aliasından hemen önceki sınırı audit edilir. run_qemu_s148_notification_race_arbitration 2 explicit alias taşır; post-arbitration loop aliası kapanır, işlevde 1 ve main.rs genelinde 14 alias ayrıca açık kalır.",
      "Exact controller task, controller-owned signal/revoke/timeout Notification root'ları ve her strict waiter'a NOTIFICATION_WAIT grant'i writer'dan önce gelir.",
      "İlk arbitration sonuçları exact Wake observed=0x2, revoke Ok(true) ve Notification timeout'tur. Üç stale deadline retry Ok(None), signal/timeout grant loser retry Ok(false) ve revoke retry StaleAuthority sonucu post-arbitration signal loop'undan önce doğrulanır.",
      "Loop exact [signal_notification, revoke_notification, timeout_notification] kümesini notification.id, notification.generation ve 0x8 ile helper'a forward eder; yalnız Ok(NotificationSignalOutcome::Coalesced { pending: 0x8 }) kabul edilir ve ardından destroy_notification_object(notification, controller_task) exact Ok(1) olmalıdır.",
      "Scheduler helper IrqGuard/IPC_TRANSACTION_LOCK altında nonzero current signaler, bits != 0, canlı NOTIFICATION_SIGNAL authority, deadline table ve exact Notification registry object'ini yeniden doğrular.",
      "waiter_snapshot boş olduğunda will_wake false kalır ve signal(bits) coalescing dönüşü blocked-task lookup, wake capacity, ready enqueue ve complete_delivery_exact yolundan önce gerçekleşir.",
      "Post-loop deadline snapshot active=0 ve registered/delivered/cancelled/timed_out delta'ları 3/1/1/1'dir; final RuntimePmm baseline'a döner ve üç Notification object registry'de bulunmaz.",
      "Model gate reader membership exclusive writer authority'yi ExclusiveBusy ile bloklar; reader bırakıldıktan sonra non-zero token'lı exclusive lease alınır. Bu host/model evidence'tır.",
      "S311 authority preflight yeniden doğrulanır; pending S245 request korunur ve sonuç AwaitingWriterAuthority { guarded_sites: 44, writer_sites: 69 } olarak döner.",
      "Dört AArch64 profil derlemesi iki koşuda byte-equal exit 0 verdi: QEMU 110646 B / e961822f, RPi4 149371 B / b7c549d3, RPi5 443042 B / 83d83b19 ve RPi5+SMP 442984 B / cbb23372. Warning header'ları sırasıyla 291, 389, 935 ve 935'tir; zero-warning iddiası değildir.",
      "Birleşik board-rpi5,board-qemu özellikleri iki koşuda beklenen exit 101, 18590 B / 5681f668, 17 error ve 22 warning header ile fail-closed kaldı.",
      "S238–S312 dependency matrisi iki koşuda 76 grup / 1064/1064 PASS; ham loglar 9802 B / 0f145a81 ve cefc80ee, süre-normalize özetler byte-equal 9954 B / 6b381216c0103cf5b5b9a762e3f91cf65ee629bf148891ab25f694d99c2e26a6. Bu production writer-authority invocation kanıtı değildir.",
      "Ortak make verify-qemu iki koşuda PASS verdi: 116222 B / f9146d1f ve 116139 B / cf671f92; guest logları 2128226 B / ece3e2a4 ve 2127734 B / 1cc50be2. W^X 31/31, S271 GRAPH_ABSENT=YES, RuntimePmm baseline, EL0 x4096, IPC 20/20, koşu başına tek S142 containment, SEC5 ve 13 KERNEL_FAULTS=0 marker'ı korunur. Bu ortak smoke S312 production writer-authority invocation kanıtı değildir.",
      "Exact yedi tarihsel G8h assertion adıyla dışlandığında workspace iki koşuda 274 sonuç grubu / 2865 PASS / 7 filtered verdi: ham loglar 63113 B / 59603f0a ve e2341b0d, sonuç özetleri 25913 B / 6ccb7828 ve 628c27ae, süre-normalize 26459 B özet byte-equal / SHA-256 61def6f4af7ab49d5e5fe548656dd774dc53c5ff2f2167afa236cf7bd404afd2. Filtresiz koşu exit 101, 58335 B / 8522ca74 ile frozen S96 exceptions.S identity kapısında RED kaldı; full-workspace GREEN iddia edilmez.",
      "S312 production exclusive wrapper, provider authority, whole-scheduler exclusion, QEMU fixture mutation veya scheduler mutation iddiası eklemez; physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S312=NO.",
    ],
    commands: [
      "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s312_qemu_s148_post_arbitration_signal_writer_authority_audit -- --test-threads=1",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-qemu",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi4",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --features board-rpi5",
      "make verify-qemu",
    ],
    terminalSessions: [
      {
        id: "g8l-s312-qemu-s148-post-arbitration-signal-writer-authority-audit",
        title:
          "G8l S312 QEMU S148 post-arbitration signal writer-authority audit",
        commandLines: [
          "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s312_qemu_s148_post_arbitration_signal_writer_authority_audit -- --test-threads=1",
        ],
        outputLines: [
          "test result: ok; S312 focused 1 group / 15 passed; 0 failed",
          "repeat-stable quiet output: 130 B / 0447f2fe9dc6fdf30815a6962cf23d978425e51bef2acde1efb27e5da13a78b3",
          "QEMU S148 post-arbitration signal writer authority remains model-only: exact terminal-first-winner/stale-loser/coalescing/destroy/accounting paths are source-audited; S148 retains 1 unaudited alias, main.rs retains 14 and all 69 production writer sites remain open",
          "dependency: S238–S312 · 76 groups · 1064/1064 PASS; workspace: 274 groups · 2865 PASS · 7 historical filtered",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S312 kaynak/model fail-closed authority boundary'sidir; production writer guard/migration, QEMU fixture mutation ve fiziksel/device execution claim edilmez.",
    limitations: [
      "S312 run_qemu_s148_notification_race_arbitration post-arbitration notification_signal mutable aliasını audit eder; bu işlevde 1, main.rs genelinde 14 ve toplam 69 production writer site authority wrapper dışında açık kalır.",
      "Exclusive lease yalnız host/model gate'inde test edilir; production exclusive wrapper, provider authority ve whole-scheduler exclusion açık kalır.",
      "S238–S312 dependency matrisi exact 76 grup / 1064/1064 PASS'tir; bu production writer authority invocation kanıtı değildir.",
      "Filtresiz workspace frozen S96 identity kapısında RED'dir; workspace umbrella GREEN iddia edilmez.",
      "Supported-profile writer-authority runtime invocation, Generic SMP ve fiziksel RPi kabulü açık kalır; S312 physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S312=NO.",
    ],
  },