fix(security): no VM but Artemis and Hera can make Hera run text; a message runs once; word-ACL elevation removed

Browse Source

Any identity could have arbitrary FORTH run as Zuse: KH-ELEVATE-SEND and
KH-BLK-ATTACH-SEND sent any text to Hera, from any VM (shown live).  And the
drain popped a message after running it, so a payload calling a colon word
ran twice.  Both fixed test first (FABRIC-3 SXXXVII):

- KH-BLK-ATTACH-SEND is ( dev-addr ok? -- sent? ), Artemis only; the kernel
  writes the reply text.  BLK-ATTACH-ACK is Hera's only.
- The drain pops before it runs.
- Elevation, ruled not needed: KH-ELEVATE-SEND, message type 8,
  zuse-eligibility.4th, ZUSE-ELIGIBLE?/ZUSE-ELIGIBILITY-ADD/
  ELEVATE-PUBKEY-UNPACK and the eligibility list removed; its disk area
  stays reserved, unused.  FABRIC-3.7 closed.

Three ISAs: POST 1052 passed; new parity baseline word_count=523
hash=0xb73b58052d591638 (deliberate).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

...

This commit is contained in:

rajames

2026-10-14 11:38:23 -04:00

co-authored by Claude Opus 5.5

parent 029a8ed9cf

commit 5e26fad30d

35 changed files with 72785 additions and 659 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

experiments/bare_metal/runs/doe-aarch64-20261014-113232.csv

experiments/bare_metal/runs/doe-amd64-20261014-105930.csv

experiments/bare_metal/runs/doe-amd64-20261014-110937.csv

experiments/bare_metal/runs/doe-amd64-20261014-111859.csv

experiments/bare_metal/runs/doe-amd64-20261014-112514.csv

experiments/bare_metal/runs/doe-amd64-20261014-113112.csv

experiments/bare_metal/runs/doe-amd64-20261014-113615.csv

experiments/bare_metal/runs/doe-riscv64-20261014-113450.csv