G8h reproducibility GREEN; S100 immutable package sırada

#!/bin/sh
# Sıra 99: mevcut workspace deploy payloadı ile aynı manifestten üretilen temiz
# reference-main ve A/B/C replikalarının deploy-relevant eşdeğerliği.
# Bu kapı workspace ELF'ini yeniden üretmez; image/package/device/evidence
# yüzeylerine yazmaz ve audit kökünü bağımsız inceleme için bilerek saklar.
# S99 predecessor script=36168 B sha256=ed1e813202a90d2efb40619224b3834c3b25747dd3a72a1d79a9c15053449f78
set -eu

if [ "$#" -ne 8 ]; then
    echo "kullanım: $0 <make> <cargo> <llvm-readobj> <llvm-objdump> <llvm-objcopy> <main-elf> <dtb> <config>" >&2
    exit 2
fi

make_bin=$1
cargo_bin=$2
readobj=$3
objdump=$4
objcopy=$5
workspace_elf=$6
dtb=$7
config=$8

script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
repo_root=$(CDPATH= cd -- "$script_dir/.." && pwd)
target_triple=aarch64-unknown-none
expected_raw_bytes=316864
expected_raw_sha=7e4b713a4ba4f45d572b61ca170cf7f5c89f9a4485f839dc12cc5a8c23570de1
expected_source_files=183
expected_source_paths_sha=f54f583bb9370a735d51c8c25fb5f085255c40c0a2e25adb77eaf346b73246be

die() {
    echo "S99 HATA: $*" >&2
    if [ -n "${audit_root:-}" ]; then
        echo "AUDIT_ROOT=$audit_root RETAINED=YES" >&2
    fi
    exit 1
}

sha256_file() {
    shasum -a 256 "$1" | awk '{print $1}'
}

file_bytes() {
    wc -c < "$1" | tr -d '[:space:]'
}

file_mode() {
    if stat -f '%Lp' "$1" >/dev/null 2>&1; then
        stat -f '%Lp' "$1"
    else
        stat -c '%a' "$1"
    fi
}

file_mtime() {
    if stat -f '%m' "$1" >/dev/null 2>&1; then
        stat -f '%m' "$1"
    else
        stat -c '%Y' "$1"
    fi
}

file_identity() {
    path=$1
    printf '%s %s %s %s\n' \
        "$(file_mode "$path")" \
        "$(file_bytes "$path")" \
        "$(file_mtime "$path")" \
        "$(sha256_file "$path")"
}

file_dev_inode() {
    if stat -f '%d:%i' "$1" >/dev/null 2>&1; then
        stat -f '%d:%i' "$1"
    else
        stat -c '%d:%i' "$1"
    fi
}

resolve_tool() {
    tool=$1
    case "$tool" in
        */*) [ -x "$tool" ] || die "araç executable değil: $tool"; (CDPATH= cd -- "$(dirname -- "$tool")" && printf '%s/%s\n' "$PWD" "$(basename -- "$tool")") ;;
        *) command -v "$tool" || die "araç PATH içinde yok: $tool" ;;
    esac
}

require_regular() {
    [ -f "$1" ] || die "regular dosya yok: $1"
    [ ! -L "$1" ] || die "symlink kabul edilmez: $1"
}

file_nlink() {
    if stat -f '%l' "$1" >/dev/null 2>&1; then
        stat -f '%l' "$1"
    else
        stat -c '%h' "$1"
    fi
}

make_bin=$(resolve_tool "$make_bin")
cargo_bin=$(resolve_tool "$cargo_bin")
readobj=$(resolve_tool "$readobj")
objdump=$(resolve_tool "$objdump")
objcopy=$(resolve_tool "$objcopy")
rustc_bin=$(resolve_tool rustc)

case "$workspace_elf" in /*) ;; *) workspace_elf="$repo_root/$workspace_elf" ;; esac
case "$dtb" in /*) ;; *) dtb="$repo_root/$dtb" ;; esac
case "$config" in /*) ;; *) config="$repo_root/$config" ;; esac
[ "$workspace_elf" = "$repo_root/target/rpi5/$target_triple/debug/aselsan_kernel" ] || \
    die "workspace ELF canonical target/rpi5 production path değil"
[ "$dtb" = "$repo_root/firmware/bcm2712-rpi-5-b.dtb" ] || die "DTB canonical source path değil"
[ "$config" = "$repo_root/firmware/config.txt" ] || die "config canonical source path değil"

require_regular "$workspace_elf"
require_regular "$dtb"
require_regular "$config"

audit_root_created=$(mktemp -d "${TMPDIR:-/tmp}/aselsanos-g8h-repro.XXXXXX")
audit_root=$(CDPATH= cd -- "$audit_root_created" && pwd -P)
mkdir -p "$audit_root/manifests" "$audit_root/artifacts" "$audit_root/tools"
audit_ok=0
report_retained_root() {
    status=$?
    if [ "$status" -ne 0 ] && [ "$audit_ok" -ne 1 ]; then
        echo "S99_EXIT=FAIL AUDIT_ROOT=$audit_root RETAINED=YES" >&2
    fi
}
trap report_retained_root 0
trap 'exit 129' HUP
trap 'exit 130' INT
trap 'exit 143' TERM
echo "AUDIT_ROOT=$audit_root RETAINED=YES"
workspace_raw="$audit_root/artifacts/workspace-preflight.raw"
"$objcopy" -O binary "$workspace_elf" "$workspace_raw"
[ "$(file_bytes "$workspace_raw")" = "$expected_raw_bytes" ] || \
    die "workspace deploy raw byte identity frozen S97/S98 payloadı değil"
[ "$(sha256_file "$workspace_raw")" = "$expected_raw_sha" ] || \
    die "workspace deploy raw SHA-256 frozen S97/S98 payloadı değil"
echo "WORKSPACE_PREFLIGHT=DEPLOY_PAYLOAD_ACCEPTED RAW=$expected_raw_bytes/$expected_raw_sha"
echo "FRESH_CHECKOUT_WITHOUT_WORKSPACE_ELF=STOP"

emit_snapshot_paths() {
    printf '%s\n' \
        Cargo.lock \
        Cargo.toml \
        Makefile \
        kernel/.cargo/config.toml \
        kernel/Cargo.toml \
        kernel/build.rs \
        kernel/linker.ld \
        kernel/linker-rpi4.ld \
        kernel/linker-rpi5.ld \
        kernel/rust-toolchain.toml \
        simulation/Cargo.toml \
        userspace/hello/.cargo/config.toml \
        userspace/hello/Cargo.lock \
        userspace/hello/Cargo.toml \
        userspace/hello/linker.ld \
        userspace/hello/rust-toolchain.toml \
        userspace/ipc_demo/.cargo/config.toml \
        userspace/ipc_demo/Cargo.lock \
        userspace/ipc_demo/Cargo.toml \
        userspace/ipc_demo/linker.ld \
        userspace/ipc_demo/rust-toolchain.toml \
        userspace/mod.rs \
        firmware/bcm2712-rpi-5-b.dtb \
        firmware/config.txt \
        scripts/stage-rpi5-g8h-package.sh \
        scripts/verify-rpi5-pre-mmu-atomics.sh \
        scripts/verify-rpi5-g7c-layout.sh \
        scripts/verify-rpi5-g7d-layout.sh \
        scripts/verify-rpi5-g8-layout.sh \
        scripts/verify-rpi5-g8b-layout.sh \
        scripts/verify-rpi5-g8c-layout.sh \
        scripts/verify-rpi5-g8d-layout.sh \
        scripts/verify-rpi5-g8e-layout.sh \
        scripts/verify-rpi5-g8f-layout.sh \
        scripts/verify-rpi5-g8g-layout.sh \
        scripts/verify-rpi5-g8h-layout.sh \
        scripts/verify-rpi5-g8h-matrix.sh \
        scripts/verify-rpi5-g8h-reproducible.sh
    find kernel/src simulation/src simulation/examples simulation/tests \
        userspace/hello/src userspace/ipc_demo/src \
        -type f ! -name '*.bak' -print
}

for tree in kernel/src simulation/src simulation/examples simulation/tests \
    userspace/hello/src userspace/ipc_demo/src; do
    [ -d "$repo_root/$tree" ] || die "snapshot ağacı yok: $tree"
    if find "$repo_root/$tree" -type l -print | grep -q .; then
        die "snapshot ağacında symlink var: $tree"
    fi
    if find "$repo_root/$tree" ! -type d ! -type f -print | grep -q .; then
        die "snapshot ağacında regular olmayan girdi var: $tree"
    fi
done

raw_paths="$audit_root/manifests/source-paths.raw"
sorted_paths="$audit_root/manifests/source-paths.sorted"
(cd "$repo_root" && emit_snapshot_paths) > "$raw_paths"
[ -s "$raw_paths" ] || die "source path listesi boş"
duplicate_paths=$(LC_ALL=C sort "$raw_paths" | uniq -d)
[ -z "$duplicate_paths" ] || die "duplicate source path: $duplicate_paths"
LC_ALL=C sort "$raw_paths" > "$sorted_paths"
[ "$(wc -l < "$sorted_paths" | tr -d '[:space:]')" -eq "$expected_source_files" ] || \
    die "source path count versionlenmemiş biçimde değişti"
[ "$(sha256_file "$sorted_paths")" = "$expected_source_paths_sha" ] || \
    die "source path set versionlenmemiş biçimde değişti"

source_sha="$audit_root/manifests/source-manifest.sha256"
source_mode="$audit_root/manifests/source-manifest.mode"
source_inode="$audit_root/manifests/source-manifest.inode"
: > "$source_sha"
: > "$source_mode"
: > "$source_inode"
while IFS= read -r relative; do
    case "$relative" in
        ''|/*|./*|*/./*|../*|*/../*|*//*|*'/target/'*|target/*|build/rpi5/*|docs/*|website/*|evidence/*|.git/*|.env*|*.bak)
            die "manifest dışı/yasak yol: $relative" ;;
    esac
    source="$repo_root/$relative"
    require_regular "$source"
    [ "$(file_nlink "$source")" -eq 1 ] || die "source hardlink count bir değil: $relative"
    printf '%s %s %s\n' "$(sha256_file "$source")" "$(file_bytes "$source")" "$relative" >> "$source_sha"
    printf '%s %s\n' "$(file_mode "$source")" "$relative" >> "$source_mode"
    printf '%s %s\n' "$(file_dev_inode "$source")" "$relative" >> "$source_inode"
done < "$sorted_paths"

duplicate_inode=$(awk '{print $1}' "$source_inode" | LC_ALL=C sort | uniq -d)
[ -z "$duplicate_inode" ] || die "hardlink/duplicate inode snapshot içinde: $duplicate_inode"
source_count=$(wc -l < "$sorted_paths" | tr -d '[:space:]')
source_total_bytes=$(awk '{sum += $2} END {print sum + 0}' "$source_sha")
source_manifest_sha=$(sha256_file "$source_sha")
source_modes_sha=$(sha256_file "$source_mode")
echo "SOURCE_MANIFEST=EXACT SOURCE_MODES=EXACT SOURCE_FILES=$source_count SOURCE_BYTES=$source_total_bytes SOURCE_MANIFEST_SHA256=$source_manifest_sha SOURCE_MODES_SHA256=$source_modes_sha"
echo "SOURCE_PATHS=CANONICAL_SORTED_UNIQUE COUNT=$expected_source_files SHA256=$expected_source_paths_sha"

assert_artifact_free() {
    replica=$1
    for forbidden in .git target build docs website evidence .env .env.local; do
        [ ! -e "$replica/$forbidden" ] && [ ! -L "$replica/$forbidden" ] || \
            die "artifact-free replica içinde yasak yol: $forbidden"
    done
    [ ! -e "$replica/userspace/hello/target" ] || die "hello target temiz değil"
    [ ! -e "$replica/userspace/ipc_demo/target" ] || die "ipc_demo target temiz değil"
    [ ! -e "$replica/.cargo/config.toml" ] && [ ! -L "$replica/.cargo/config.toml" ] || \
        die "root Cargo config production contexti gölgeliyor"
    [ ! -e "$replica/.cargo/config" ] && [ ! -L "$replica/.cargo/config" ] || \
        die "legacy root Cargo config production contexti gölgeliyor"
}

manifest_replica() {
    replica=$1
    out_dir=$2
    : > "$out_dir/source-manifest.sha256"
    : > "$out_dir/source-manifest.mode"
    while IFS= read -r relative; do
        file="$replica/$relative"
        require_regular "$file"
        [ "$(file_nlink "$file")" -eq 1 ] || die "replica hardlink count bir değil: $relative"
        [ "$(file_dev_inode "$file")" != "$(file_dev_inode "$repo_root/$relative")" ] || \
            die "replica/source inode bağımsız değil: $relative"
        printf '%s %s %s\n' "$(sha256_file "$file")" "$(file_bytes "$file")" "$relative" >> "$out_dir/source-manifest.sha256"
        printf '%s %s\n' "$(file_mode "$file")" "$relative" >> "$out_dir/source-manifest.mode"
    done < "$sorted_paths"
    cmp -s "$source_sha" "$out_dir/source-manifest.sha256" || die "replica source manifest farklı"
    cmp -s "$source_mode" "$out_dir/source-manifest.mode" || die "replica mode manifest farklı"
    if grep -F "$repo_root" "$out_dir/source-manifest.sha256" "$out_dir/source-manifest.mode" >/dev/null 2>&1; then
        die "replica manifest absolute source prefix taşıyor"
    fi
}

replica_path() {
    case "$1" in
        main) printf '%s\n' "$audit_root/replica-M" ;;
        A|B|C) printf '%s\n' "$audit_root/replica-$1" ;;
        *) die "bilinmeyen replica id: $1" ;;
    esac
}

for replica_id in main A B C; do
    replica=$(replica_path "$replica_id")
    replica_manifest="$audit_root/manifests/replica-$replica_id"
    mkdir -p "$replica" "$replica_manifest"
    while IFS= read -r relative; do
        mkdir -p "$replica/$(dirname -- "$relative")"
        cp -p "$repo_root/$relative" "$replica/$relative"
    done < "$sorted_paths"
    assert_artifact_free "$replica"
    manifest_replica "$replica" "$replica_manifest"
done

while IFS= read -r relative; do
    main_inode=$(file_dev_inode "$(replica_path main)/$relative")
    a_inode=$(file_dev_inode "$(replica_path A)/$relative")
    b_inode=$(file_dev_inode "$(replica_path B)/$relative")
    c_inode=$(file_dev_inode "$(replica_path C)/$relative")
    [ "$main_inode" != "$a_inode" ] && [ "$main_inode" != "$b_inode" ] && \
        [ "$main_inode" != "$c_inode" ] && [ "$a_inode" != "$b_inode" ] && \
        [ "$a_inode" != "$c_inode" ] && [ "$b_inode" != "$c_inode" ] || \
        die "replica inode bağımsızlığı yok: $relative"
done < "$sorted_paths"

for cargo_config in \
    "$repo_root/.cargo/config" "$repo_root/.cargo/config.toml" \
    "${CARGO_HOME:-$HOME/.cargo}/config" "${CARGO_HOME:-$HOME/.cargo}/config.toml"; do
    [ ! -e "$cargo_config" ] && [ ! -L "$cargo_config" ] || \
        die "production contexti gölgeleyen Cargo config: $cargo_config"
done

config_ancestor=$audit_root
while :; do
    for ancestor_config in "$config_ancestor/.cargo/config" "$config_ancestor/.cargo/config.toml"; do
        [ ! -e "$ancestor_config" ] && [ ! -L "$ancestor_config" ] || \
            die "replica ancestor Cargo config kabul edilmez: $ancestor_config"
    done
    [ "$config_ancestor" = / ] && break
    config_ancestor=$(dirname -- "$config_ancestor")
done

for legacy_input in \
    "$repo_root/kernel/.cargo/config" \
    "$repo_root/userspace/hello/.cargo/config" \
    "$repo_root/userspace/ipc_demo/.cargo/config" \
    "$repo_root/rust-toolchain" "$repo_root/rust-toolchain.toml" \
    "$repo_root/kernel/rust-toolchain" \
    "$repo_root/userspace/hello/rust-toolchain" \
    "$repo_root/userspace/ipc_demo/rust-toolchain"; do
    [ ! -e "$legacy_input" ] && [ ! -L "$legacy_input" ] || \
        die "manifest dışı effective Cargo/rustup input: $legacy_input"
done
for config_dir in kernel/.cargo userspace/hello/.cargo userspace/ipc_demo/.cargo; do
    actual_config_entries=$(find "$repo_root/$config_dir" -mindepth 1 -maxdepth 1 -print | LC_ALL=C sort)
    [ "$actual_config_entries" = "$repo_root/$config_dir/config.toml" ] || \
        die "unexpected Cargo config sibling: $config_dir"
done
for override in RUSTFLAGS CARGO_ENCODED_RUSTFLAGS RUSTC RUSTC_WRAPPER \
    RUSTC_WORKSPACE_WRAPPER RUSTDOCFLAGS RUSTUP_TOOLCHAIN CARGO_BUILD_TARGET \
    CARGO_BUILD_RUSTC CARGO_BUILD_RUSTFLAGS CARGO_TARGET_DIR; do
    eval "override_value=\${$override-}"
    [ -z "$override_value" ] || die "build override environment kabul edilmez: $override"
done

tool_identity() {
    label=$1
    tool=$2
    version_arg=$3
    [ -x "$tool" ] || die "$label wrapper executable değil"
    target=$(realpath "$tool")
    require_regular "$target"
    if [ -L "$tool" ]; then wrapper_kind=SYMLINK; else wrapper_kind=REGULAR; fi
    printf 'TOOL=%s WRAPPER_PATH=%s WRAPPER_KIND=%s TARGET_PATH=%s MODE=%s BYTES=%s SHA256=%s\n' \
        "$label" "$tool" "$wrapper_kind" "$target" "$(file_mode "$target")" "$(file_bytes "$target")" "$(sha256_file "$target")" \
        >> "$audit_root/tools/identities.txt"
    "$tool" "$version_arg" > "$audit_root/tools/$label.version.txt" 2>&1 || die "$label version alınamadı"
}

: > "$audit_root/tools/identities.txt"
tool_identity make "$make_bin" --version
tool_identity cargo "$cargo_bin" --version
tool_identity rustc "$rustc_bin" -vV
tool_identity llvm-readobj "$readobj" --version
tool_identity llvm-objdump "$objdump" --version
tool_identity llvm-objcopy "$objcopy" --version
(cd "$repo_root/kernel" && "$cargo_bin" --version && "$rustc_bin" -vV) > "$audit_root/tools/kernel-context.txt"
rustup_bin=$(resolve_tool rustup)
for context in root kernel hello ipc_demo; do
    case "$context" in
        root) context_dir=$repo_root ;;
        kernel) context_dir=$repo_root/kernel ;;
        hello) context_dir=$repo_root/userspace/hello ;;
        ipc_demo) context_dir=$repo_root/userspace/ipc_demo ;;
    esac
    actual_cargo=$(cd "$context_dir" && "$rustup_bin" which cargo)
    actual_rustc=$(cd "$context_dir" && "$rustup_bin" which rustc)
    require_regular "$actual_cargo"
    require_regular "$actual_rustc"
    {
        printf 'CONTEXT=%s CARGO=%s CARGO_SHA256=%s RUSTC=%s RUSTC_SHA256=%s\n' \
            "$context" "$actual_cargo" "$(sha256_file "$actual_cargo")" \
            "$actual_rustc" "$(sha256_file "$actual_rustc")"
        (cd "$context_dir" && "$cargo_bin" -Vv)
        (cd "$context_dir" && "$rustc_bin" -vV)
    } > "$audit_root/tools/$context.resolved-toolchain.txt"
    case "$context" in
        root) root_actual_cargo=$actual_cargo; root_actual_rustc=$actual_rustc ;;
        kernel) kernel_actual_cargo=$actual_cargo; kernel_actual_rustc=$actual_rustc ;;
        hello) hello_actual_cargo=$actual_cargo; hello_actual_rustc=$actual_rustc ;;
        ipc_demo) ipc_actual_cargo=$actual_cargo; ipc_actual_rustc=$actual_rustc ;;
    esac
done

tool_state() {
    output=$1
    : > "$output"
    for tool in "$make_bin" "$cargo_bin" "$rustc_bin" "$rustup_bin" \
        "$readobj" "$objdump" "$objcopy" "$root_actual_cargo" \
        "$root_actual_rustc" "$kernel_actual_cargo" "$kernel_actual_rustc" \
        "$hello_actual_cargo" "$hello_actual_rustc" "$ipc_actual_cargo" \
        "$ipc_actual_rustc"; do
        target=$(realpath "$tool")
        printf '%s %s %s %s %s\n' "$tool" "$target" "$(file_mode "$target")" \
            "$(file_bytes "$target")" "$(sha256_file "$target")" >> "$output"
    done
}

tools_before="$audit_root/manifests/tools.before"
tool_state "$tools_before"
echo "TOOLCHAIN_IDENTITIES=PATH+MODE+SHA256+VERSION"

snapshot_tree() {
    tree=$1
    output=$2
    : > "$output"
    if [ ! -e "$tree" ] && [ ! -L "$tree" ]; then
        printf 'STATE=ABSENT\n' > "$output"
        return
    fi
    [ -d "$tree" ] && [ ! -L "$tree" ] || die "snapshot tree directory değil: $tree"
    if find "$tree" ! -type d ! -type f -print | grep -q .; then
        die "snapshot tree symlink/nonregular içeriyor: $tree"
    fi
    printf 'STATE=DIRECTORY MODE=%s MTIME=%s PATH=.\n' "$(file_mode "$tree")" "$(file_mtime "$tree")" >> "$output"
    find "$tree" -mindepth 1 -print | LC_ALL=C sort | while IFS= read -r entry; do
        relative=${entry#"$tree"/}
        if [ -d "$entry" ]; then
            printf 'D %s %s %s\n' "$(file_mode "$entry")" "$(file_mtime "$entry")" "$relative"
        elif [ -f "$entry" ] && [ ! -L "$entry" ]; then
            printf 'F %s %s %s %s %s\n' \
                "$(file_mode "$entry")" "$(file_bytes "$entry")" "$(file_mtime "$entry")" \
                "$(sha256_file "$entry")" "$relative"
        else
            die "snapshot tree entry regular değil: $entry"
        fi
    done >> "$output"
}

main_before="$audit_root/manifests/workspace-elf.before"
build_before="$audit_root/manifests/build-rpi5.before"
dtb_before="$audit_root/manifests/dtb.before"
config_before="$audit_root/manifests/config.before"
file_identity "$workspace_elf" > "$main_before"
snapshot_tree "$repo_root/build/rpi5" "$build_before"
file_identity "$dtb" > "$dtb_before"
file_identity "$config" > "$config_before"

layout_gates='verify-rpi5-g8-layout.sh verify-rpi5-g8b-layout.sh verify-rpi5-g8c-layout.sh verify-rpi5-g8d-layout.sh verify-rpi5-g8e-layout.sh verify-rpi5-g8f-layout.sh verify-rpi5-g8g-layout.sh verify-rpi5-g8h-layout.sh'

for gate in $layout_gates; do
    case "$gate" in
        verify-rpi5-g8-layout.sh)
            sh "$repo_root/scripts/$gate" "$readobj" "$objdump" "$workspace_elf" ;;
        *)
            sh "$repo_root/scripts/$gate" "$objdump" "$workspace_elf" ;;
    esac
done > "$audit_root/workspace.layouts.log" 2>&1 || die "workspace semantic reference G8-G8h layout zinciri başarısız"
echo "WORKSPACE_LAYOUT=G8-G8h LAYOUT_GATES=8/8"

build_replica() {
    replica_id=$1
    replica=$(replica_path "$replica_id")
    [ ! -e "$replica/userspace/hello/target/aarch64-unknown-none/release/hello" ] || die "replica $replica_id hello fresh değil"
    [ ! -e "$replica/userspace/ipc_demo/target/aarch64-unknown-none/release/ipc_demo" ] || die "replica $replica_id ipc fresh değil"
    [ ! -e "$replica/target/rpi5/$target_triple/debug/aselsan_kernel" ] || die "replica $replica_id kernel fresh değil"

    (
        unset MAKEFILES MAKEFLAGS MFLAGS GNUMAKEFLAGS
        cd "$replica"
        CARGO_NET_OFFLINE=true "$make_bin" CARGO="$cargo_bin" BOARD=rpi5 kernel
    ) \
        > "$audit_root/replica-$replica_id.build.log" 2>&1 || die "replica $replica_id production build başarısız"

    hello="$replica/userspace/hello/target/$target_triple/release/hello"
    ipc="$replica/userspace/ipc_demo/target/$target_triple/release/ipc_demo"
    elf="$replica/target/rpi5/$target_triple/debug/aselsan_kernel"
    require_regular "$hello"
    require_regular "$ipc"
    require_regular "$elf"

    for gate in $layout_gates; do
        case "$gate" in
            verify-rpi5-g8-layout.sh)
                sh "$replica/scripts/$gate" "$readobj" "$objdump" "$elf" ;;
            *)
                sh "$replica/scripts/$gate" "$objdump" "$elf" ;;
        esac
    done > "$audit_root/replica-$replica_id.layouts.log" 2>&1 || die "replica $replica_id G8-G8h layout zinciri başarısız"
    manifest_replica "$replica" "$audit_root/manifests/replica-$replica_id"
    echo "REPLICA=$replica_id USERSPACE_PREREQUISITE=PASS KERNEL_CONFIG=kernel/.cargo/config.toml LAYOUT=G8-G8h LAYOUT_GATES=8/8"
}

for replica_id in main A B C; do
    build_replica "$replica_id"
done

for replica_id in main A B C; do
    replica=$(replica_path "$replica_id")
    reference_replica=$(replica_path main)
    cmp -s "$reference_replica/userspace/hello/target/$target_triple/release/hello" \
        "$replica/userspace/hello/target/$target_triple/release/hello" || die "hello $replica_id main ile farklı"
    cmp -s "$reference_replica/userspace/ipc_demo/target/$target_triple/release/ipc_demo" \
        "$replica/userspace/ipc_demo/target/$target_triple/release/ipc_demo" || die "ipc_demo $replica_id main ile farklı"
done
echo "USERSPACE_MAIN_A_B_C=EXACT"

artifact_elf() {
    replica=$(replica_path "$1")
    printf '%s\n' "$replica/target/rpi5/$target_triple/debug/aselsan_kernel"
}

for id in main A B C; do
    elf=$(artifact_elf "$id")
    out="$audit_root/artifacts/$id"
    mkdir -p "$out"
    cp -p "$elf" "$out/kernel.full.elf"
    "$objcopy" -O binary "$elf" "$out/kernel.raw"
    "$objcopy" --strip-all "$elf" "$out/kernel.strip-all.elf"
    "$objcopy" --strip-debug "$elf" "$out/kernel.strip-debug.elf"
    for artifact in "$out/kernel.full.elf" "$out/kernel.raw" "$out/kernel.strip-all.elf" "$out/kernel.strip-debug.elf"; do
        require_regular "$artifact"
        [ "$(file_nlink "$artifact")" -eq 1 ] || die "$id artifact hardlink: $artifact"
        [ "$(file_mode "$artifact")" = 755 ] || die "$id artifact mode exact 0755 değil: $artifact"
    done
done
mkdir -p "$audit_root/artifacts/workspace"
cp -p "$workspace_elf" "$audit_root/artifacts/workspace/kernel.full.elf"
cp -p "$workspace_raw" "$audit_root/artifacts/workspace/kernel.raw"
"$objcopy" --strip-all "$workspace_elf" "$audit_root/artifacts/workspace/kernel.strip-all.elf"
"$objcopy" --strip-debug "$workspace_elf" "$audit_root/artifacts/workspace/kernel.strip-debug.elf"
for artifact in \
    "$audit_root/artifacts/workspace/kernel.full.elf" \
    "$audit_root/artifacts/workspace/kernel.raw" \
    "$audit_root/artifacts/workspace/kernel.strip-all.elf" \
    "$audit_root/artifacts/workspace/kernel.strip-debug.elf"; do
    require_regular "$artifact"
    [ "$(file_nlink "$artifact")" -eq 1 ] || die "workspace artifact hardlink: $artifact"
    [ "$(file_mode "$artifact")" = 755 ] || die "workspace artifact mode exact 0755 değil: $artifact"
done

require_equal_artifact_set() {
    kind=$1
    suffix=$2
    reference="$audit_root/artifacts/main/$suffix"
    for id in A B C; do
        cmp -s "$reference" "$audit_root/artifacts/$id/$suffix" || die "$kind main/$id farklı"
        [ "$(file_mode "$reference")" = "$(file_mode "$audit_root/artifacts/$id/$suffix")" ] || \
            die "$kind main/$id mode farklı"
    done
    cmp -s "$reference" "$audit_root/artifacts/workspace/$suffix" || die "$kind main/workspace farklı"
    [ "$(file_mode "$reference")" = "$(file_mode "$audit_root/artifacts/workspace/$suffix")" ] || \
        die "$kind main/workspace mode farklı"
    printf '%s_BYTES=%s %s_SHA256=%s\n' \
        "$kind" "$(file_bytes "$reference")" "$kind" "$(sha256_file "$reference")"
}

require_equal_artifact_set raw kernel.raw
require_equal_artifact_set strip-all kernel.strip-all.elf
echo "RAW_PAYLOAD=EXACT STRIP_ALL=EXACT"

section_names() {
    "$readobj" --sections "$1" | awk '/^[[:space:]]*Name: \./ {print $2}'
}

section_block() {
    elf=$1
    wanted=$2
    "$readobj" --sections "$elf" | awk -v wanted="$wanted" '
        /^[[:space:]]*Section \{/ {block=$0 "\n"; keep=0; next}
        block != "" {block=block $0 "\n"}
        /^[[:space:]]*Name: / {name=$2; if (name == wanted) keep=1}
        /^[[:space:]]*\}/ {if (keep) {printf "%s", block; exit} block=""}
    '
}

section_is_alloc() {
    section_block "$1" "$2" | grep -q 'SHF_ALLOC'
}

section_signature() {
    elf=$1
    section=$2
    output=$3
    block="$output.block"
    data="$output.data"
    section_block "$elf" "$section" > "$block"
    [ -s "$block" ] || die "section yok: $section"
    awk '
        /Name:|Type:|Flags \[|SHF_|Address:|Size:|AddressAlignment:|EntrySize:/ {print}
    ' "$block" > "$output"
    if grep -q 'Type: SHT_NOBITS' "$block"; then
        printf 'CONTENT=NOBITS\n' >> "$output"
    else
        "$objcopy" --dump-section "$section=$data" "$elf" >/dev/null 2>&1 || die "section dump başarısız: $section"
        printf 'CONTENT_SHA256=%s\n' "$(sha256_file "$data")" >> "$output"
    fi
}

require_expected_sections() {
    label=$1
    elf=$2
    expected=$3
    actual=$(section_names "$elf" | tr '\n' ' ' | sed 's/[[:space:]]*$//')
    [ "$actual" = "$expected" ] || die "$label section inventory unexpected: $actual"
}

full_sections='.text .rodata .data .bss .debug_loc .debug_abbrev .debug_info .debug_aranges .debug_ranges .debug_str .debug_frame .debug_line .symtab .shstrtab .strtab'
strip_debug_sections='.text .rodata .data .bss .symtab .shstrtab .strtab'
strip_all_sections='.text .rodata .data .bss .shstrtab'
allowed_full_diffs='.debug_info .debug_str .symtab .strtab'
allowed_strip_debug_diffs='.symtab .strtab'

for id in main A B C; do
    require_expected_sections "$id full" "$audit_root/artifacts/$id/kernel.full.elf" "$full_sections"
    require_expected_sections "$id strip-debug" "$audit_root/artifacts/$id/kernel.strip-debug.elf" "$strip_debug_sections"
    require_expected_sections "$id strip-all" "$audit_root/artifacts/$id/kernel.strip-all.elf" "$strip_all_sections"
done

derive_section_diffs() {
    variant=$1
    suffix=$2
    sections=$3
    allowed=$4
    differences=''
    exact_count=0
    variant_count=0
    for section in $sections; do
        for id in main A B C; do
            elf="$audit_root/artifacts/$id/$suffix"
            sig="$audit_root/artifacts/$id/$variant-${section#.}.signature"
            section_signature "$elf" "$section" "$sig"
        done
        reference="$audit_root/artifacts/main/$variant-${section#.}.signature"
        same=1
        for id in A B C; do
            cmp -s "$reference" "$audit_root/artifacts/$id/$variant-${section#.}.signature" || same=0
        done
        if [ "$same" -eq 1 ]; then
            exact_count=$((exact_count + 1))
        else
            differences="${differences}${differences:+ }$section"
            variant_count=$((variant_count + 1))
            section_is_alloc "$audit_root/artifacts/main/$suffix" "$section" && \
                die "$variant farkı ALLOC section içinde: $section"
        fi
    done
    [ "$differences" = "$allowed" ] || die "$variant dynamic diff set unexpected: $differences"
    printf '%s_DIFFS=%s %s_EXACT=%s %s_VARIANT=%s\n' \
        "$variant" "$differences" "$variant" "$exact_count" "$variant" "$variant_count"
}

derive_section_diffs FULL_DEBUG kernel.full.elf "$full_sections" "$allowed_full_diffs"
derive_section_diffs STRIP_DEBUG kernel.strip-debug.elf "$strip_debug_sections" "$allowed_strip_debug_diffs"
main_root=$(replica_path main)
a_root=$(replica_path A)
b_root=$(replica_path B)
c_root=$(replica_path C)
[ "${#main_root}" -eq "${#a_root}" ] && [ "${#a_root}" -eq "${#b_root}" ] && \
    [ "${#b_root}" -eq "${#c_root}" ] || die "fresh replica roots equal-length değil"
for id in main A B C; do
    root=$(replica_path "$id")
    strings "$audit_root/artifacts/$id/FULL_DEBUG-debug_str.signature.data" | grep -Fq "$root" || \
        die "$id debug_str içinde canonical replica root yok"
done
echo "FULL_DEBUG=NON_ALLOC_VARIANT STRIP_DEBUG=NON_ALLOC_VARIANT DEBUG_ROOTS=OBSERVED_EQUAL_LENGTH_DISTINCT"

loadable_signature() {
    elf=$1
    out=$2
    {
        "$readobj" --file-headers "$elf" | awk '/^[[:space:]]*Entry:/ {print "ENTRY=" $2}'
        program_headers="$out.program-headers"
        "$readobj" --program-headers "$elf" | awk '
            /^[[:space:]]*ProgramHeaders \[/ {inside=1; next}
            inside && /^\]$/ {inside=0; exit}
            inside {sub(/^[[:space:]]*/, ""); print}
        ' > "$program_headers"
        [ "$(wc -l < "$program_headers" | tr -d '[:space:]')" -eq 51 ] || exit 1
        [ "$(sha256_file "$program_headers")" = edf9f3cbad0407b947c371388e45a21817637954b83e38ab7a71a74cf4d0a0d7 ] || exit 1
        grep -q 'Type: PT_GNU_STACK (0x6474E551)' "$program_headers" || exit 1
        cat "$program_headers"
        load_rows="$out.load-rows"
        "$readobj" --program-headers "$elf" | awk '
            /^[[:space:]]*ProgramHeader \{/ {load=0; offset=""; va=""; pa=""; filesz=""; memsz=""; r="-"; w="-"; x="-"; align=""; next}
            /^[[:space:]]*Type: PT_LOAD/ {load=1; count++; next}
            load && /^[[:space:]]*Offset:/ {offset=$2; next}
            load && /^[[:space:]]*VirtualAddress:/ {va=$2; next}
            load && /^[[:space:]]*PhysicalAddress:/ {pa=$2; next}
            load && /^[[:space:]]*FileSize:/ {filesz=$2; next}
            load && /^[[:space:]]*MemSize:/ {memsz=$2; next}
            load && /PF_R/ {r="R"; next}
            load && /PF_W/ {w="W"; next}
            load && /PF_X/ {x="X"; next}
            load && /^[[:space:]]*Alignment:/ {align=$2; next}
            load && /^[[:space:]]*\}/ {print count, offset, va, pa, filesz, memsz, r w x, align; load=0}
        ' > "$load_rows"
        expected_load_rows="$out.expected-load-rows"
        printf '%s\n' \
            '1 0x10000 0x80000 0x80000 165804 165804 R-X 65536' \
            '2 0x39000 0xA9000 0xA9000 145334 145334 R-- 65536' \
            '3 0x5D000 0xCD000 0xCD000 1472 17200008 RW- 65536' \
            > "$expected_load_rows"
        cmp -s "$load_rows" "$expected_load_rows" || exit 1
        load_count=$(wc -l < "$load_rows" | tr -d '[:space:]')
        printf 'PT_LOAD_COUNT=%s\n' "$load_count"
        [ "$load_count" -eq 3 ] || exit 1
        while read -r load_index load_offset load_va load_pa load_size load_mem load_flags load_align; do
            segment="$out.ptload-$load_index.data"
            dd if="$elf" of="$segment" bs=1 skip=$((load_offset)) count=$load_size 2>/dev/null || exit 1
            [ "$(file_bytes "$segment")" -eq "$load_size" ] || exit 1
            segment_sha=$(sha256_file "$segment")
            case "$load_index:$segment_sha" in
                1:9093334a4c505a5c9a0c06cf30c65d4b2e40760cea597b756a03981ff381ea30|\
                2:db531b647543f4721916838e1fe8c050fd6141c78dd69074bd0798c408177cc8|\
                3:ddfaafdbb55f568bdf81df864f8993397b0cb766bbd3117ca7413a48d36fb332) ;;
                *) exit 1 ;;
            esac
            printf 'PT_LOAD_%s_BYTES_SHA256=%s\n' "$load_index" "$segment_sha"
        done < "$load_rows"
        for section in .text .rodata .data .bss; do
            block=$(section_block "$elf" "$section")
            printf 'SECTION=%s\n' "$section"
            printf '%s\n' "$block" | awk '/Type:|Flags \[|SHF_|Address:|Size:|AddressAlignment:/ {print}'
            if ! printf '%s\n' "$block" | grep -q 'SHT_NOBITS'; then
                data="$out.${section#.}.data"
                "$objcopy" --dump-section "$section=$data" "$elf" >/dev/null 2>&1 || exit 1
                printf 'CONTENT_SHA256=%s\n' "$(sha256_file "$data")"
            else
                printf 'CONTENT=NOBITS\n'
            fi
        done
    } > "$out"
}

for id in workspace main A B C; do
    loadable_signature "$audit_root/artifacts/$id/kernel.full.elf" \
        "$audit_root/artifacts/$id/loadable.signature" || die "$id loadable signature başarısız"
done
for id in workspace main A B C; do
    alloc_count=$("$readobj" --sections "$audit_root/artifacts/$id/kernel.full.elf" | grep -c 'SHF_ALLOC')
    [ "$alloc_count" -eq 4 ] || die "$id ALLOC section count 4 değil: $alloc_count"
done
for id in workspace A B C; do
    cmp -s "$audit_root/artifacts/main/loadable.signature" "$audit_root/artifacts/$id/loadable.signature" || \
        die "main/$id loadable semantics farklı"
done

entry=$("$readobj" --file-headers "$workspace_elf" | awk '/^[[:space:]]*Entry:/ {print $2; exit}')
[ "$entry" = 0x80000 ] || die "entry 0x80000 değil: $entry"
pt_load_count=$("$readobj" --program-headers "$workspace_elf" | grep -c 'Type: PT_LOAD')
[ "$pt_load_count" -eq 3 ] || die "PT_LOAD count 3 değil: $pt_load_count"
alloc_count=$("$readobj" --sections "$workspace_elf" | grep -c 'SHF_ALLOC')
[ "$alloc_count" -eq 4 ] || die "ALLOC section count 4 değil: $alloc_count"
bss_block=$(section_block "$workspace_elf" .bss)
printf '%s\n' "$bss_block" | grep -q 'Address: 0xCE000' || die ".bss address değişti"
printf '%s\n' "$bss_block" | grep -q 'Size: 17195912' || die ".bss size değişti"
echo "ENTRY=0x80000 PT_LOAD_COUNT=3 ALLOC_SECTIONS=4/4 BSS=EXACT LOADABLE=EXACT"

for source_input in "$dtb" "$config"; do
    name=$(basename -- "$source_input")
    for id in A B C; do
        replica=$(replica_path "$id")
        cmp -s "$source_input" "$replica/firmware/$name" || die "$name replica $id farklı"
    done
    echo "SOURCE_INPUT=$name MODE=$(file_mode "$source_input") BYTES=$(file_bytes "$source_input") SHA256=$(sha256_file "$source_input") IDENTITY=MAIN_A_B_C"
done
echo "SOURCE_INPUT=bcm2712-rpi-5-b.dtb SOURCE_INPUT=config.txt CANONICAL_PATHS=EXACT"

main_after="$audit_root/manifests/workspace-elf.after"
build_after="$audit_root/manifests/build-rpi5.after"
dtb_after="$audit_root/manifests/dtb.after"
config_after="$audit_root/manifests/config.after"
tools_after="$audit_root/manifests/tools.after"
file_identity "$workspace_elf" > "$main_after"
snapshot_tree "$repo_root/build/rpi5" "$build_after"
file_identity "$dtb" > "$dtb_after"
file_identity "$config" > "$config_after"
tool_state "$tools_after"
cmp -s "$main_before" "$main_after" || die "main ELF pre/post identity değişti"
cmp -s "$build_before" "$build_after" || die "build/rpi5 pre/post değişti"
cmp -s "$dtb_before" "$dtb_after" || die "DTB source pre/post değişti"
cmp -s "$config_before" "$config_after" || die "config source pre/post değişti"
cmp -s "$tools_before" "$tools_after" || die "tool binary identity pre/post değişti"

source_sha_after="$audit_root/manifests/source-manifest.after.sha256"
source_mode_after="$audit_root/manifests/source-manifest.after.mode"
raw_paths_after="$audit_root/manifests/source-paths.after.raw"
sorted_paths_after="$audit_root/manifests/source-paths.after.sorted"
(cd "$repo_root" && emit_snapshot_paths) > "$raw_paths_after"
duplicate_paths_after=$(LC_ALL=C sort "$raw_paths_after" | uniq -d)
[ -z "$duplicate_paths_after" ] || die "post-run duplicate source path: $duplicate_paths_after"
LC_ALL=C sort "$raw_paths_after" > "$sorted_paths_after"
cmp -s "$sorted_paths" "$sorted_paths_after" || die "workspace source path set pre/post değişti"
: > "$source_sha_after"
: > "$source_mode_after"
while IFS= read -r relative; do
    source="$repo_root/$relative"
    require_regular "$source"
    printf '%s %s %s\n' "$(sha256_file "$source")" "$(file_bytes "$source")" "$relative" >> "$source_sha_after"
    printf '%s %s\n' "$(file_mode "$source")" "$relative" >> "$source_mode_after"
done < "$sorted_paths"
cmp -s "$source_sha" "$source_sha_after" || die "workspace source manifest pre/post değişti"
cmp -s "$source_mode" "$source_mode_after" || die "workspace source modes pre/post değişti"
echo "MAIN_ELF_PRE_POST=UNCHANGED BUILD_RPI5_PRE_POST=UNCHANGED"
echo "DTB_CONFIG_PRE_POST=UNCHANGED TOOLS_PRE_POST=UNCHANGED WORKSPACE_SOURCE_PRE_POST=UNCHANGED"

echo "IMAGE_BUILD=NOT_RUN PACKAGE=STOP EVIDENCE=STOP MICROSD=STOP DEVICE=STOP UART=STOP POWER_ACTION=STOP"
echo "DOCS=NOT_WRITTEN WEB=NOT_WRITTEN PI_POWER=OFF"
echo "S99 PASS: fresh main+A/B/C production builds; workspace semantic reference ile raw/strip-all/loadable exact; izinli non-ALLOC varyantlar gözlendi ve eş-uzun distinct kökler kaydedildi"
echo "AUDIT_ROOT=$audit_root RETAINED=YES CLEANUP=MOVE_TO_TRASH_AFTER_REVIEW"
audit_ok=1

#[test]
fn make_exposes_only_the_image_free_s99_chain() {
    assert!(MAKEFILE.contains("verify-rpi5-g8h-reproducible verify-rpi5-g8h-image-input \\\n"));
    assert!(MAKEFILE.contains(
        "  make verify-rpi5-g8h-reproducible - Dört temiz RPi5 deploy-payload reproducibility kapısı"
    ));
    let body = MAKEFILE
        .split_once("verify-rpi5-g8h-reproducible:")
        .expect("S99 reproducibility target")
        .1
        .split_once("\n\n")
        .expect("bounded S99 target")
        .0;
    assert_eq!(
        body,
        concat!(
            "\n\t$(CARGO) test -p aselsan_microkernel_simulation \\\n",
            "\t\t--test rpi5_g8h_reproducible_source\n",
            "\t@sh scripts/verify-rpi5-g8h-reproducible.sh \\\n",
            "\t\t\"$(MAKE)\" \"$(CARGO)\" \"$(READOBJ)\" \"$(OBJDUMP)\" \"$(OBJCOPY)\" \\\n",
            "\t\t\"$(RPI5_ELF)\" \"$(RPI5_DTB)\" \"$(RPI5_CONFIG)\"",
        )
    );
    for forbidden in [
        "verify-rpi5-g8h-layout",
        "verify-rpi5-g8h-matrix",
        "verify-core",
        "image-rpi5",
        "flash-rpi5",
        "capture-rpi5",
        "package",
        "SD_DISK",
    ] {
        assert!(
            !body.contains(forbidden),
            "forbidden Make action: {forbidden}"
        );
    }
}

  {
    id: "rpi5-g8h-reproducible-payload-green",
    date: "2026-08-22",
    sequence: 99,
    status: "verified",
    title: "G8h reproducibility GREEN; S100 immutable package sırada",
    summary:
      "Sequence 98'in frozen image-free full-matrix prerequisite'i korunarak mevcut workspace ELF semantik referansı ve aynı exact 177-file snapshotından üretilen dört artifact-free production-context replica karşılaştırıldı. Workspace ile fresh main/A/B/C'nin G8–G8h layout zinciri 5×8=40/40 PASS; raw payload, strip-all ELF ve loadable signature beş subject arasında exact aynı çıktı. Full-debug ve strip-debug ELF'lerde yalnız allowlist'teki non-ALLOC debug/symbol bölümlerinin değişebileceği fail-closed doğrulandı. Workspace 313/313 ve bağımsız reviewer FINAL GO verdi. Bu image/package/evidence veya fiziksel BOOT8H kabulü değildir; S100 immutable package sıradadır. Son fiziksel PASS S92 BOOT8G ve Pi kapalıdır.",
    evidence: [
      "`make verify-rpi5-g8h-reproducible`: workspace testleri exact 313/313 PASS; focused S98+S99 source testleri 12/12 PASS.",
      "Canonical source snapshot exact 177 file / 3.352.289 B; sorted path hash 5244beead1eb65fc75ad16631240de8dc3e2eb830d9854c31444da93df9c80b8.",
      "Source content manifest exact 18.224 B / a9e769aa4884b961c8533a688a83efd3e6de9a3d8687cffd2b1ec8a467c86a51; mode manifest exact 6.496 B / 1948ee4dce2bd142145a937789ae8a407bb5d04eba605fdca9944cef4c3edd4a.",
      "Workspace ve fresh main/A/B/C source ağaçlarında independent inode exact 885/885; symlink, non-regular, duplicate path ve hardlink=0.",
      "Workspace semantic reference + fresh main/A/B/C üzerinde G8–G8h layout exact 5×8=40/40 PASS; workspace ELF yeniden üretilmedi.",
      "Workspace ELF 7.963.488 B / edf89d762ef3b210bd3b459785192e9f2f79037524a21e3d92f852a7de9d0d8f.",
      "Fresh full-debug ELF diagnostics: main 7.963.520 B / 1cb9f505…8ffbe, A 7.963.512 B / 49c30a7d…0ee43, B 7.963.480 B / 5be8b333…dad0b, C 7.963.512 B / 7494041e…f602d.",
      "Beş subject'in raw payload'ı exact 316.864 B / 7e4b713a4ba4f45d572b61ca170cf7f5c89f9a4485f839dc12cc5a8c23570de1.",
      "Beş subject'in strip-all ELF'i exact 382.824 B / 59a23f58801ed94986e0ace39b0e066d9c6ec7562acc951ab24b557f16ac79fa.",
      "Loadable signature exact 2.066 B / 4dac229f4f039c6c2550589c85b9f6fb94ee0f18e7a978d589ea70d4b3e28ee1; PHDR exact 739 B / edf9f3cbad0407b947c371388e45a21817637954b83e38ab7a71a74cf4d0a0d7.",
      "ENTRY=0x80000, PT_LOAD_COUNT=3, ALLOC_SECTIONS=4/4 ve BSS=EXACT; RAW_PAYLOAD=EXACT, STRIP_ALL=EXACT, LOADABLE=EXACT.",
      "FULL_DEBUG=NON_ALLOC_VARIANT yalnız `.debug_info/.debug_str/.symtab/.strtab`; STRIP_DEBUG=NON_ALLOC_VARIANT yalnız `.symtab/.strtab`. Full-debug exact equality iddia edilmez.",
      "Makefile exact 27.275 B / a5f86bfa5ecabe621f6dfd95338374360e39c617e0f445db4d012ecaff97a3a7; reproducibility script exact 36.168 B / ed1e813202a90d2efb40619224b3834c3b25747dd3a72a1d79a9c15053449f78.",
      "S99 source test exact 13.374 B / 64822a5f5e7b84fd532bde3de23fe45a8a87df86929dcca9dec2b5f6c9593956; versioned S98 test exact 10.834 B / 408f4df36a8a7b07b64168d217ff74cad625336233d838460ca60095a2d224f9.",
      "Source, tool identities, workspace ELF, build/rpi5 ve DTB/config pre/post exact değişmedi; canonical run IMAGE_BUILD=NOT_RUN bıraktı.",
      "Image/package/evidence/microSD/device/UART/power/physical BOOT8H ve Generic SMP runtime STOP; son fiziksel PASS S92 immutable BOOT8G raw ve Pi kapalı.",
      "S99 reproducibility source, ELF, deploy-semantics ve yan-etki sınırlarının tamamında independent reviewer FINAL GO aldı.",
      "S99 docs/static-site proof 409 satır / 12.027 B / dc377aba…d8373; web 184/184, lint, TypeScript ve 23/23 static export PASS sonrasında frozen out exactly-one deploy ile `e0a62488.aselsan-microkernel.pages.dev` production'a yayımlandı ve dört canonical route byte-for-byte eşleşti.",
    ],
    terminalSessionsNote:
      "Sequence 99 oturumları mevcut workspace ELF'i salt-okunur referans alan ve yalnız geçici audit-root türevleri üreten reproducibility denetimleridir; canonical image/package/evidence veya fiziksel oturum değildir.",
    terminalSessions: [
      {
        id: "g8h-sequence99-source-contract",
        title: "Reproducibility source TDD ve snapshot sınırı",
        commandLines: [
          "cargo test -p aselsan_microkernel_simulation --test rpi5_g8h_reproducible_source -- --test-threads=1",
          "audit canonical path/content/mode manifests and independent replica inodes",
        ],
        outputLines: [
          "source=177 files/3352289 B · paths=5244beea…0b8",
          "content=a9e769aa…6a51 · modes=1948ee4d…d4a",
          "independent inodes=885/885 · symlink/nonregular/hardlink=0",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8h-sequence99-reproducibility",
        title:
          "Dört fresh production replica ve workspace semantik karşılaştırması",
        commandLines: [
          "make verify-rpi5-g8h-reproducible",
          "compare workspace + fresh main/A/B/C layout, raw, strip-all, loadable and debug variance",
        ],
        outputLines: [
          "workspace tests=313/313 · layout=5x8=40/40",
          "raw=316864/7e4b713a…70de1 · strip-all=382824/59a23f58…79fa",
          "loadable=2066/4dac229f…8ee1 · full/strip-debug=NON_ALLOC_VARIANT",
          "image build/package/evidence/device=NOT_RUN",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8h-sequence99-independent-final-audit",
        title: "Bağımsız reproducibility final audit",
        commandLines: [
          "re-audit frozen S99 source identities and five-subject deploy semantics",
          "compare source/tool/workspace/build-rpi5/DTB/config pre/post and inspect STOP boundaries",
        ],
        outputLines: [
          "S99 reproducibility reviewer=FINAL GO · blocker=NONE",
          "RAW_PAYLOAD=EXACT · STRIP_ALL=EXACT · LOADABLE=EXACT",
          "FULL_DEBUG/STRIP_DEBUG=NON_ALLOC_VARIANT only",
          "S100 immutable package=NEXT/STOP · physical BOOT8H=STOP · Pi=OFF",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
    ],
    limitations: [
      "S99 yalnız reproducible deploy-semantics kabulüdür; S100 immutable image/package sıradaki ayrı kapıdır ve henüz STOP'tur.",
      "Workspace ELF fresh build değildir; dört fresh main/A/B/C replica ile salt-okunur semantik referans olarak karşılaştırılmıştır.",
      "Full-debug ve strip-debug ELF byte'ları exact değildir; yalnız allowlist'teki non-ALLOC debug/symbol varyansı kabul edilir.",
      "IMAGE_BUILD=NOT_RUN; image, package, evidence, microSD ve bütün device/artifact kapıları STOP'tur.",
      "Pi kapalı tutulur; UART descriptor/capture, power ve fiziksel BOOT8H kapıları STOP'tur. Son fiziksel PASS S92 BOOT8G'dir.",
      "Generic SMP runtime, scheduler/runqueue, migration, TLB shootdown, CPU2/CPU3, hotplug ve soak kapalıdır.",
      "Web deploy provenance'i yalnız yayınlanan docs/static-site çıktısına aittir; kernel/image/package üretim veya Git-provider provenance'i kurmaz.",
    ],
  },