S430 · Final software boundary

#![allow(unexpected_cfgs)]

//! S430 retained final software boundary for the S401-S430 chain.
//!
//! The exact S429 evidence is consumed once and converted into a retained,
//! inspect-only status. Source integration and whole-scheduler handshake
//! reachability are complete. No supported-profile runtime run, physical run,
//! runbook execution, deployment proof, or R2 product acceptance is inferred.

use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s429_software_acceptance_evidence_publication::{
    G8lS429SoftwareAcceptanceEvidence, G8lS429SoftwareAcceptanceEvidenceError,
    S429_DIRECT_ACCESS_SITES, S429_EVIDENCED_GATE_COUNT, S429_FIRST_EVIDENCED_GATE,
    S429_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES, S429_SOURCE_AUDIT_UNITS,
    S429_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES, S429_UNROUTED_DIRECT_ACCESS_SITES,
};

pub const S430_SOURCE_AUDIT_UNITS: usize = S429_SOURCE_AUDIT_UNITS;
pub const S430_DIRECT_ACCESS_SITES: usize = S429_DIRECT_ACCESS_SITES;
pub const S430_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES: usize =
    S429_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES;
pub const S430_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES: usize =
    S429_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES;
pub const S430_UNROUTED_DIRECT_ACCESS_SITES: usize = S429_UNROUTED_DIRECT_ACCESS_SITES;
pub const S430_FIRST_COMPLETED_GATE: usize = S429_FIRST_EVIDENCED_GATE;
pub const S430_LAST_COMPLETED_GATE: usize = 430;
pub const S430_COMPLETED_GATE_COUNT: usize =
    S430_LAST_COMPLETED_GATE - S430_FIRST_COMPLETED_GATE + 1;
pub const S430_FINAL_BOUNDARY_SLOT_CAPACITY: usize = 1;
pub const S430_PRODUCTION_PUBLICATION_CALLSITES: usize = 1;
pub const S430_SOFTWARE_SOURCE_PATH_COMPLETE: bool = true;
pub const S430_WHOLE_SCHEDULER_EXCLUSION_SOURCE_HANDSHAKE_COMPLETE: bool = true;
pub const S430_MAIN_MIGRATION_LIFECYCLE_SOURCE_PATH_COMPLETE: bool = true;
pub const RUNBOOK_EXECUTED_IN_S430: bool = false;
pub const S430_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS: usize = 0;
pub const S430_PHYSICAL_OBSERVATIONS: usize = 0;
pub const S430_SUPPORTED_PROFILE_RUNTIME_ACCEPTANCE_COMPLETE: bool = false;
pub const S430_PHYSICAL_ACCEPTANCE_COMPLETE: bool = false;
pub const S430_R2_PRODUCT_ACCEPTANCE_COMPLETE: bool = false;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS430FinalSoftwareBoundaryStatus {
    pub attempt_id: u64,
    pub provider_request_id: u64,
    pub exclusive_token: u64,
    pub completed_gate_count: usize,
    pub software_source_path_complete: bool,
    pub whole_scheduler_exclusion_source_handshake_complete: bool,
    pub main_migration_lifecycle_source_path_complete: bool,
    pub supported_profile_runtime_acceptance_complete: bool,
    pub physical_acceptance_complete: bool,
    pub r2_product_acceptance_complete: bool,
    pub runbook_executed: bool,
}

#[derive(Debug)]
pub struct G8lS430FinalSoftwareBoundaryState {
    final_status: Option<G8lS430FinalSoftwareBoundaryStatus>,
}

impl G8lS430FinalSoftwareBoundaryState {
    pub const fn new() -> Self {
        Self { final_status: None }
    }

    pub fn final_status(
        &self,
        caller_cpu: usize,
    ) -> Result<Option<G8lS430FinalSoftwareBoundaryStatus>, G8lS430FinalSoftwareBoundaryError> {
        if caller_cpu != 1 {
            return Err(G8lS430FinalSoftwareBoundaryError::WrongCpu);
        }
        Ok(self.final_status)
    }
}

impl Default for G8lS430FinalSoftwareBoundaryState {
    fn default() -> Self {
        Self::new()
    }
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS430FinalSoftwareBoundaryError {
    WrongCpu,
    S429(G8lS429SoftwareAcceptanceEvidenceError),
    EvidenceBindingDrift,
    FinalBoundaryOccupied,
    EvidenceDisappeared,
    EvidenceDrift,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS430FinalSoftwareBoundaryOutcome {
    Idle,
    FinalBoundaryPublished(G8lS430FinalSoftwareBoundaryStatus),
    FinalBoundaryRetained(G8lS430FinalSoftwareBoundaryStatus),
}

pub fn service_s430_model_final_software_boundary(
    state: &mut G8lS430FinalSoftwareBoundaryState,
    caller_cpu: usize,
    evidence: G8lS429SoftwareAcceptanceEvidence,
) -> Result<G8lS430FinalSoftwareBoundaryOutcome, G8lS430FinalSoftwareBoundaryError> {
    if caller_cpu != 1 {
        return Err(G8lS430FinalSoftwareBoundaryError::WrongCpu);
    }
    if evidence.attempt_id == 0
        || evidence.provider_request_id == 0
        || evidence.exclusive_token == 0
        || evidence.evidenced_gate_count != S429_EVIDENCED_GATE_COUNT
        || !evidence.source_reconciliation_complete
        || !evidence.all_direct_access_guarded
        || evidence.runbook_executed
        || evidence.supported_profile_runtime_observations != 0
        || evidence.physical_observations != 0
        || evidence.deployment_verified
        || S430_DIRECT_ACCESS_SITES != 113
        || S430_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES != S430_DIRECT_ACCESS_SITES
        || S430_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES != S430_DIRECT_ACCESS_SITES
        || S430_UNROUTED_DIRECT_ACCESS_SITES != 0
    {
        return Err(G8lS430FinalSoftwareBoundaryError::EvidenceBindingDrift);
    }
    let status = G8lS430FinalSoftwareBoundaryStatus {
        attempt_id: evidence.attempt_id,
        provider_request_id: evidence.provider_request_id,
        exclusive_token: evidence.exclusive_token,
        completed_gate_count: S430_COMPLETED_GATE_COUNT,
        software_source_path_complete: S430_SOFTWARE_SOURCE_PATH_COMPLETE,
        whole_scheduler_exclusion_source_handshake_complete:
            S430_WHOLE_SCHEDULER_EXCLUSION_SOURCE_HANDSHAKE_COMPLETE,
        main_migration_lifecycle_source_path_complete:
            S430_MAIN_MIGRATION_LIFECYCLE_SOURCE_PATH_COMPLETE,
        supported_profile_runtime_acceptance_complete:
            S430_SUPPORTED_PROFILE_RUNTIME_ACCEPTANCE_COMPLETE,
        physical_acceptance_complete: S430_PHYSICAL_ACCEPTANCE_COMPLETE,
        r2_product_acceptance_complete: S430_R2_PRODUCT_ACCEPTANCE_COMPLETE,
        runbook_executed: RUNBOOK_EXECUTED_IN_S430,
    };
    if let Some(existing) = state.final_status {
        return if existing == status {
            Ok(G8lS430FinalSoftwareBoundaryOutcome::FinalBoundaryRetained(
                existing,
            ))
        } else {
            Err(G8lS430FinalSoftwareBoundaryError::FinalBoundaryOccupied)
        };
    }
    state.final_status = Some(status);
    Ok(G8lS430FinalSoftwareBoundaryOutcome::FinalBoundaryPublished(
        status,
    ))
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
static S430_PRODUCTION_FINAL_BOUNDARY: spin::Mutex<G8lS430FinalSoftwareBoundaryState> =
    spin::Mutex::new(G8lS430FinalSoftwareBoundaryState::new());

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn service_s430_final_software_boundary_on_cpu1(
) -> Result<G8lS430FinalSoftwareBoundaryOutcome, G8lS430FinalSoftwareBoundaryError> {
    use crate::g8l_runtime_contract::CPU1;

    if crate::percpu::try_current_cpu_id() != Some(CPU1) {
        return Err(G8lS430FinalSoftwareBoundaryError::WrongCpu);
    }
    if let Some(existing) = S430_PRODUCTION_FINAL_BOUNDARY.lock().final_status(CPU1)? {
        return Ok(G8lS430FinalSoftwareBoundaryOutcome::FinalBoundaryRetained(
            existing,
        ));
    }
    let Some(evidence) = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s429_software_acceptance_evidence_publication::inspect_s429_software_acceptance_evidence_on_cpu1()
        .map_err(G8lS430FinalSoftwareBoundaryError::S429)? else {
        return Ok(G8lS430FinalSoftwareBoundaryOutcome::Idle);
    };
    let taken = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s429_software_acceptance_evidence_publication::take_s429_software_acceptance_evidence_on_cpu1()
        .map_err(G8lS430FinalSoftwareBoundaryError::S429)?
        .ok_or(G8lS430FinalSoftwareBoundaryError::EvidenceDisappeared)?;
    if taken != evidence {
        return Err(G8lS430FinalSoftwareBoundaryError::EvidenceDrift);
    }
    service_s430_model_final_software_boundary(
        &mut S430_PRODUCTION_FINAL_BOUNDARY.lock(),
        CPU1,
        taken,
    )
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn inspect_s430_final_software_boundary_on_cpu1(
) -> Result<Option<G8lS430FinalSoftwareBoundaryStatus>, G8lS430FinalSoftwareBoundaryError> {
    S430_PRODUCTION_FINAL_BOUNDARY.lock().final_status(1)
}

/// Flat hand-off surface for post-S430 consumers.
///
/// The regular inspector preserves the historical, recursively nested S401-S430
/// error type.  A later production caller only needs the retained status and
/// has already verified CPU1, so exporting the snapshot directly avoids
/// embedding that entire error chain in every post-S430 return type.
#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn inspect_s430_final_software_boundary_for_post_s430_on_cpu1(
) -> Option<G8lS430FinalSoftwareBoundaryStatus> {
    if crate::percpu::try_current_cpu_id() != Some(1) {
        return None;
    }
    S430_PRODUCTION_FINAL_BOUNDARY.lock().final_status
}

use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s429_software_acceptance_evidence_publication::G8lS429SoftwareAcceptanceEvidence;
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s430_final_software_boundary::*;

fn evidence() -> G8lS429SoftwareAcceptanceEvidence {
    G8lS429SoftwareAcceptanceEvidence {
        attempt_id: 37,
        provider_request_id: 38,
        exclusive_token: 39,
        evidenced_gate_count: 28,
        source_reconciliation_complete: true,
        all_direct_access_guarded: true,
        runbook_executed: false,
        supported_profile_runtime_observations: 0,
        physical_observations: 0,
        deployment_verified: false,
    }
}

#[test]
fn constants_close_thirty_individual_gates_without_product_acceptance() {
    assert_eq!(S430_FIRST_COMPLETED_GATE, 401);
    assert_eq!(S430_LAST_COMPLETED_GATE, 430);
    assert_eq!(S430_COMPLETED_GATE_COUNT, 30);
    assert_eq!(S430_DIRECT_ACCESS_SITES, 113);
    assert_eq!(S430_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES, 113);
    assert_eq!(S430_UNROUTED_DIRECT_ACCESS_SITES, 0);
    assert!(!RUNBOOK_EXECUTED_IN_S430);
    assert_eq!(S430_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS, 0);
    assert_eq!(S430_PHYSICAL_OBSERVATIONS, 0);
    assert!(!S430_R2_PRODUCT_ACCEPTANCE_COMPLETE);
}

#[test]
fn exact_s429_evidence_publishes_retained_final_boundary() {
    let mut state = G8lS430FinalSoftwareBoundaryState::new();
    let outcome = service_s430_model_final_software_boundary(&mut state, 1, evidence()).unwrap();
    let G8lS430FinalSoftwareBoundaryOutcome::FinalBoundaryPublished(status) = outcome else {
        panic!("final boundary")
    };
    assert_eq!(
        (
            status.attempt_id,
            status.provider_request_id,
            status.exclusive_token
        ),
        (37, 38, 39)
    );
    assert_eq!(status.completed_gate_count, 30);
    assert!(status.software_source_path_complete);
    assert!(status.whole_scheduler_exclusion_source_handshake_complete);
    assert!(status.main_migration_lifecycle_source_path_complete);
    assert!(!status.supported_profile_runtime_acceptance_complete);
    assert!(!status.physical_acceptance_complete);
    assert!(!status.r2_product_acceptance_complete);
    assert!(!status.runbook_executed);
}

#[test]
fn unsupported_claims_or_incomplete_evidence_fail_closed() {
    let mut state = G8lS430FinalSoftwareBoundaryState::new();
    let mut drift = evidence();
    drift.all_direct_access_guarded = false;
    assert_eq!(
        service_s430_model_final_software_boundary(&mut state, 1, drift),
        Err(G8lS430FinalSoftwareBoundaryError::EvidenceBindingDrift)
    );
    let mut drift = evidence();
    drift.physical_observations = 1;
    assert_eq!(
        service_s430_model_final_software_boundary(&mut state, 1, drift),
        Err(G8lS430FinalSoftwareBoundaryError::EvidenceBindingDrift)
    );
    let mut drift = evidence();
    drift.deployment_verified = true;
    assert_eq!(
        service_s430_model_final_software_boundary(&mut state, 1, drift),
        Err(G8lS430FinalSoftwareBoundaryError::EvidenceBindingDrift)
    );
}

#[test]
fn exact_replay_returns_same_retained_status_and_drift_backpressures() {
    let mut state = G8lS430FinalSoftwareBoundaryState::new();
    service_s430_model_final_software_boundary(&mut state, 1, evidence()).unwrap();
    let status = state.final_status(1).unwrap().unwrap();
    assert_eq!(
        service_s430_model_final_software_boundary(&mut state, 1, evidence()),
        Ok(G8lS430FinalSoftwareBoundaryOutcome::FinalBoundaryRetained(
            status
        ))
    );
    let mut next = evidence();
    next.attempt_id += 1;
    assert_eq!(
        service_s430_model_final_software_boundary(&mut state, 1, next),
        Err(G8lS430FinalSoftwareBoundaryError::FinalBoundaryOccupied)
    );
}

#[test]
fn retained_status_is_cpu1_scoped_and_has_no_consumer() {
    let mut state = G8lS430FinalSoftwareBoundaryState::new();
    service_s430_model_final_software_boundary(&mut state, 1, evidence()).unwrap();
    assert_eq!(
        state.final_status(0),
        Err(G8lS430FinalSoftwareBoundaryError::WrongCpu)
    );
    assert!(state.final_status(1).unwrap().is_some());
    assert!(state.final_status(1).unwrap().is_some());
}

#[test]
fn production_backpressures_before_consuming_s429() {
    let source = include_str!("../../kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s430_final_software_boundary.rs");
    let start = source
        .find("service_s430_final_software_boundary_on_cpu1")
        .unwrap();
    let body = &source[start..];
    let retained = body.find("final_status(CPU1)").unwrap();
    let inspect = body
        .find("inspect_s429_software_acceptance_evidence_on_cpu1")
        .unwrap();
    let take = body
        .find("take_s429_software_acceptance_evidence_on_cpu1")
        .unwrap();
    let publish = body
        .find("service_s430_model_final_software_boundary")
        .unwrap();
    assert!(retained < inspect && inspect < take && take < publish);
}

#[test]
fn timer_runs_s430_after_s429_before_scheduler_dispatch_and_modules_are_separate() {
    let source = include_str!("../../kernel/src/arch/aarch64/exceptions.rs");
    let s429 = source
        .find("service_s429_software_acceptance_evidence_publication_on_cpu1")
        .unwrap();
    let s430 = source
        .find("service_s430_final_software_boundary_on_cpu1")
        .unwrap();
    let scheduler = source.rfind("rpi5_g7d::on_timer_irq").unwrap();
    assert!(s429 < s430 && s430 < scheduler);
    let name = "g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s430_final_software_boundary";
    assert!(include_str!("../../kernel/src/main.rs").contains(&format!("mod {name};")));
    assert!(include_str!("../src/lib.rs").contains(&format!("pub mod {name};")));
}

  {
    id: "g8l-s430-final-software-boundary-partial",
    sequence: 430,
    slug: "final_software_boundary",
    title: "Final software boundary",
    focusedTests: 7,
    sourceBytes: 9274,
    sourceSha256:
      "bbfb8b43016069cb49142375e0c27afcdcd26c7af6212019452e31f1fcbc0f9c",
    testBytes: 6034,
    testSha256:
      "0abe6e80fb5016693b09aef374dd24b6f15d658efd071a7231fa925975726e46",
    acceptance:
      "S401–S430 30 ayrı kapı olarak final typed boundary'de kapanır; exclusion handshake ve ana migration-lifecycle source path complete bitleri birlikte doğrulanır.",
    retainedBoundary:
      "Supported-profile runtime acceptance, fiziksel acceptance ve R2 product acceptance bilinçli olarak false kalır.",
  },