admin/LithosAnanake
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): no VM but Artemis and Hera can make Hera run text; a message runs once; word-ACL elevation removed

Browse Source 
Any identity could have arbitrary FORTH run as Zuse: KH-ELEVATE-SEND and
KH-BLK-ATTACH-SEND sent any text to Hera, from any VM (shown live).  And the
drain popped a message after running it, so a payload calling a colon word
ran twice.  Both fixed test first (FABRIC-3 SXXXVII):

- KH-BLK-ATTACH-SEND is ( dev-addr ok? -- sent? ), Artemis only; the kernel
  writes the reply text.  BLK-ATTACH-ACK is Hera's only.
- The drain pops before it runs.
- Elevation, ruled not needed: KH-ELEVATE-SEND, message type 8,
  zuse-eligibility.4th, ZUSE-ELIGIBLE?/ZUSE-ELIGIBILITY-ADD/
  ELEVATE-PUBKEY-UNPACK and the eligibility list removed; its disk area
  stays reserved, unused.  FABRIC-3.7 closed.

Three ISAs: POST 1052 passed; new parity baseline word_count=523
hash=0xb73b58052d591638 (deliberate).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
rajames
2026-10-14 11:38:23 -04:00
co-authored by Claude Opus 5.5
parent 029a8ed9cf
commit 5e26fad30d
35 changed files with 72785 additions and 659 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kernel/src/capsule/mama_forth_words.c
-106
View File
@@ -49,7 +49,6 @@
#include "starkernel/capsule_mint.h"
#include "starkernel/user_identity_seed.h"
#include "starkernel/vm_identity.h"
#include "starkernel/zuse_eligibility.h"
#include "starkernel/capsule_loader.h"
#include "starkernel/capsule_run.h"
#include "starkernel/capsule_loader.h"
@@ -1345,70 +1344,6 @@ static void mama_word_mint_scratch_emit(VM *vm)
vm_push(vm, 1);
}
/**
* @brief ZUSE-ELIGIBILITY-ADD ( c-addr -- ok? )
* Add the 32-byte Ed25519 public key at c-addr to Zuse's elevation
* eligibility list (FABRIC-2.md §H.5/§H.12 item 19). Plain, unconditional
* primitive -- no authorization check here or anywhere else in this
* codebase gates on vm->zuse_session. Zuse's authority is the *absence*
* of any ACL restricting her, not a bit this or any other word checks;
* restricting who may call this word, if ever wanted, is the same
* standing word-level ACL mechanism (acl_allow/ACL-PIN in ACL.4th) any
* other word would use, applied later if and when actually needed --
* not invented here.
*/
static void mama_word_zuse_eligibility_add(VM *vm)
{
if (vm->dsp < 0) {
console_println("ZUSE-ELIGIBILITY-ADD: stack underflow");
vm->error = 1;
vm_push(vm, 0);
return;
}
cell_t caddr = vm_pop(vm);
const uint8_t *pubkey = vm_ptr(vm, (vaddr_t)caddr);
if (!pubkey) {
console_println("ZUSE-ELIGIBILITY-ADD: invalid address on the stack");
vm->error = 1;
vm_push(vm, 0);
return;
}
if (zuse_eligibility_add(pubkey) != 0) {
console_println("ZUSE-ELIGIBILITY-ADD: FAILED -- fence write error");
vm_push(vm, 0);
return;
}
vm_push(vm, 1);
}
/**
* @brief ZUSE-ELIGIBLE? ( c-addr -- flag )
* Membership check over Zuse's elevation eligibility list (FABRIC-2.md
* §H.5/§H.12 item 21). Plain, unconditional wrapper over
* zuse_eligibility_is_member() -- same "no bespoke gate" convention as
* ZUSE-ELIGIBILITY-ADD above; is_member() itself is already fail-closed.
*/
static void mama_word_zuse_eligible_query(VM *vm)
{
if (vm->dsp < 0) {
log_message(LOG_ERROR, "ZUSE-ELIGIBLE?: stack underflow");
vm->error = 1;
vm_push(vm, 0);
return;
}
cell_t caddr = vm_pop(vm);
const uint8_t *pubkey = vm_ptr(vm, (vaddr_t)caddr);
if (!pubkey) {
log_message(LOG_ERROR, "ZUSE-ELIGIBLE?: invalid address on the stack");
vm->error = 1;
vm_push(vm, 0);
return;
}
vm_push(vm, zuse_eligibility_is_member(pubkey) ? -1 : 0);
}
/**
* @brief NAME>XT ( c-addr u -- xt|0 )
* Dynamic dictionary lookup for a name already sitting in a data buffer
@@ -1444,41 +1379,6 @@ static void mama_word_name_to_xt(VM *vm)
vm_push(vm, (cell_t)(uintptr_t)e);
}
/**
* @brief ELEVATE-PUBKEY-UNPACK ( pk0 pk1 pk2 pk3 buf-addr -- )
* Reconstructs a 32-byte Ed25519 pubkey from 4 cells into the 32-byte
* buffer at buf-addr, matching ZUSE-PUBKEY@'s own convention exactly:
* chunk i (0..3) is the 8-byte little-endian encoding of pubkey bytes
* [i*8 .. i*8+7] -- this is that packing's inverse, so a pubkey sent as
* 4 cells (the convention SEND-ELEVATE-REQUEST used before it was
* deleted with messaging.4th, FABRIC-3.6.md Phase 4 Stage E) round-trips
* byte-exact regardless of any individual chunk's sign bit.
*/
static void mama_word_elevate_pubkey_unpack(VM *vm)
{
if (vm->dsp < 4) {
log_message(LOG_ERROR, "ELEVATE-PUBKEY-UNPACK: stack underflow");
vm->error = 1;
return;
}
cell_t buf_addr = vm_pop(vm);
cell_t pk[4];
for (int i = 3; i >= 0; i--) pk[i] = vm_pop(vm);
uint8_t *buf = vm_ptr(vm, (vaddr_t)buf_addr);
if (!buf) {
log_message(LOG_ERROR, "ELEVATE-PUBKEY-UNPACK: invalid address on the stack");
vm->error = 1;
return;
}
for (int i = 0; i < 4; i++) {
uint64_t chunk = (uint64_t)pk[i];
for (int b = 0; b < 8; b++) {
buf[i * 8 + b] = (uint8_t)(chunk >> (8 * b));
}
}
}
/**
* @brief RUNCAP-TEST ( caddr u -- ok? rc )
* Diagnostic-only word (FABRIC-2.md §F.6/§F.18): calls
@@ -2375,10 +2275,7 @@ void register_mama_forth_words(VM *vm)
register_word(vm, "WORKER-BIRTH", mama_word_worker_birth);
register_word(vm, "UNATTENDED-BIRTH", mama_word_unattended_birth);
register_word(vm, "CONSOLE-ATTACH", mama_word_console_attach);
register_word(vm, "ZUSE-ELIGIBILITY-ADD", mama_word_zuse_eligibility_add);
register_word(vm, "ZUSE-ELIGIBLE?", mama_word_zuse_eligible_query);
register_word(vm, "NAME>XT", mama_word_name_to_xt);
register_word(vm, "ELEVATE-PUBKEY-UNPACK", mama_word_elevate_pubkey_unpack);
register_word(vm, "RUNCAP-TEST", mama_word_runcap_test);
register_word(vm, "PAIR-TEST", mama_word_pair_test);
register_word(vm, "MAMA-VM-ID", mama_word_mama_vm_id);
@@ -2440,10 +2337,7 @@ void register_mama_forth_words(VM *vm)
register_word(vm, "WORKER-BIRTH", mama_word_worker_birth);
register_word(vm, "UNATTENDED-BIRTH", mama_word_unattended_birth);
register_word(vm, "CONSOLE-ATTACH", mama_word_console_attach);
register_word(vm, "ZUSE-ELIGIBILITY-ADD", mama_word_zuse_eligibility_add);
register_word(vm, "ZUSE-ELIGIBLE?", mama_word_zuse_eligible_query);
register_word(vm, "NAME>XT", mama_word_name_to_xt);
register_word(vm, "ELEVATE-PUBKEY-UNPACK", mama_word_elevate_pubkey_unpack);
register_word(vm, "RUNCAP-TEST", mama_word_runcap_test);
register_word(vm, "PAIR-TEST", mama_word_pair_test);
register_word(vm, "MAMA-VM-ID", mama_word_mama_vm_id);
kernel/src/capsule/zuse_eligibility.c
-107
View File
@@ -1,107 +0,0 @@
/*
StarForth — Steady-State Virtual Machine Runtime
Copyright (c) 2023–2025 Robert A. James
All rights reserved.
Licensed under the StarForth License, Version 1.0
*/
#ifndef __STARKERNEL__
#error "zuse_eligibility.c is kernel-only"
#endif
#include "starkernel/zuse_eligibility.h"
#include "starkernel/zuse_eligibility_list.h"
#include "block_subsystem.h" /* compute_crc64(), blk_meta_zone_read/write */
#include <string.h>
#include <stddef.h>
/* Read and validate one devblock of the chain. Mirrors
* capsule_zuse_boot.c's genesis_marker_read() convention exactly: magic
* mismatch, version mismatch, and CRC mismatch are all merged into a
* single -1 ("treat as absent/corrupt, not present") -- the fence region
* is never zeroed at format time (block_subsystem.c's blk_commit_format()
* only zeroes BAM/reloc), so blank foreign bytes and genuine corruption
* are indistinguishable and must be handled identically here. */
static int list_devblock_read(uint32_t devblock_from_top, zuse_eligibility_devblock_t *out) {
if (blk_meta_zone_read(devblock_from_top, (uint8_t *)out) != 0) return -1;
if (out->magic != ZUSE_ELIGIBILITY_LIST_MAGIC) return -1;
if (out->version != ZUSE_ELIGIBILITY_LIST_VERSION) return -1;
if (out->count > ZUSE_ELIGIBILITY_ENTRIES_PER_DEVBLOCK) return -1;
uint64_t want_crc = compute_crc64((const uint8_t *)out,
offsetof(zuse_eligibility_devblock_t, crc));
if (want_crc != out->crc) return -1;
return 0;
}
static int list_devblock_write(uint32_t devblock_from_top, zuse_eligibility_devblock_t *blk) {
blk->crc = compute_crc64((const uint8_t *)blk, offsetof(zuse_eligibility_devblock_t, crc));
return blk_meta_zone_write(devblock_from_top, (const uint8_t *)blk) == 0 ? 0 : -1;
}
int zuse_eligibility_is_member(const uint8_t pubkey[32]) {
uint32_t devblock = ZUSE_ELIGIBILITY_LIST_HEAD_DEVBLOCK;
zuse_eligibility_devblock_t blk;
for (;;) {
if (list_devblock_read(devblock, &blk) != 0) return 0; /* fail-closed */
for (uint32_t i = 0; i < blk.count; i++) {
if (memcmp(blk.entries[i], pubkey, 32) == 0) return 1;
}
if (blk.next_devblock_from_top == ZUSE_ELIGIBILITY_LIST_NO_NEXT) return 0;
devblock = blk.next_devblock_from_top;
}
}
int zuse_eligibility_add(const uint8_t pubkey[32]) {
uint32_t devblock = ZUSE_ELIGIBILITY_LIST_HEAD_DEVBLOCK;
zuse_eligibility_devblock_t blk;
if (list_devblock_read(devblock, &blk) != 0) {
/* List doesn't exist yet (blank fence, or this is genuinely the
* first entry ever added) -- create the head devblock fresh. */
memset(&blk, 0, sizeof(blk));
blk.magic = ZUSE_ELIGIBILITY_LIST_MAGIC;
blk.version = ZUSE_ELIGIBILITY_LIST_VERSION;
blk.count = 1;
blk.next_devblock_from_top = ZUSE_ELIGIBILITY_LIST_NO_NEXT;
memcpy(blk.entries[0], pubkey, 32);
return list_devblock_write(devblock, &blk);
}
/* Walk the existing chain: bail out early (idempotent success) if
* already present, otherwise track the tail devblock to append to. */
for (;;) {
for (uint32_t i = 0; i < blk.count; i++) {
if (memcmp(blk.entries[i], pubkey, 32) == 0) return 0; /* already eligible */
}
if (blk.next_devblock_from_top == ZUSE_ELIGIBILITY_LIST_NO_NEXT) break;
devblock = blk.next_devblock_from_top;
if (list_devblock_read(devblock, &blk) != 0) return -1; /* corrupt mid-chain */
}
if (blk.count < ZUSE_ELIGIBILITY_ENTRIES_PER_DEVBLOCK) {
memcpy(blk.entries[blk.count], pubkey, 32);
blk.count++;
return list_devblock_write(devblock, &blk);
}
/* Tail devblock is full -- chain a fresh one drawn from the
* already-reserved fence budget, one devblock_from_top past the
* current tail (blk_meta_zone_write() itself refuses any offset at
* or beyond the on-disk meta_fence_blocks reservation, so an
* exhausted budget surfaces here as an ordinary write failure). */
uint32_t new_devblock = devblock + 1;
zuse_eligibility_devblock_t new_blk;
memset(&new_blk, 0, sizeof(new_blk));
new_blk.magic = ZUSE_ELIGIBILITY_LIST_MAGIC;
new_blk.version = ZUSE_ELIGIBILITY_LIST_VERSION;
new_blk.count = 1;
new_blk.next_devblock_from_top = ZUSE_ELIGIBILITY_LIST_NO_NEXT;
memcpy(new_blk.entries[0], pubkey, 32);
if (list_devblock_write(new_devblock, &new_blk) != 0) return -1;
blk.next_devblock_from_top = new_devblock;
return list_devblock_write(devblock, &blk);
}
kernel/src/log_region.c
+2 -3
View File
@@ -96,9 +96,8 @@ static int log_region_write_slot(uint32_t slot_index, const log_slot_t *slot) {
* granularity, and a devblock holds LOG_SLOTS_PER_DEVBLOCK slots, so a
* single-slot write must preserve its siblings. A read failure on a
* never-yet-written devblock (blank fence content) is not fatal here --
* proceed with a zeroed buffer, matching zuse_eligibility.c's own
* "blank fence content is indistinguishable from absent, treat as
* absent" discipline. */
* proceed with a zeroed buffer: blank fence content is
* indistinguishable from absent, and is treated as absent. */
if (blk_meta_zone_read(dft, devblock_buf) != 0) {
memset(devblock_buf, 0, sizeof(devblock_buf));
}
kernel/src/repl.c
+51 -94
View File
@@ -260,6 +260,15 @@ static void sk_word_blk_attach_ack(VM *vm) {
cell_t dev_addr = vm_pop(vm);
blkio_dev_t *dev = (blkio_dev_t *)(uintptr_t)dev_addr;
/* Hera's own, run from Artemis's reply (2026-10-14): every VM has this
* word (word_registry.c), and it births identities -- from any other
* VM it is refused (FABRIC-3.md SXXXVII). */
if (vm != (VM *)sk_get_mama_vm()) {
console_println("BLK-ATTACH-ACK: refused -- Hera's own, from Artemis's reply");
vm->error = 1;
return;
}
if (!g_usb_blk_dev_slots || !g_blk_attach_pending) return;
uint32_t found_slot = 0;
@@ -359,11 +368,9 @@ static void sk_word_blk_attach_ack(VM *vm) {
* message type that actually flowed through a messaging layer.
*
* sk_hermes_drain_checkpoint() (task 3.4) calls vm_interpret() directly
* on a message's payload_addr, so it must be NUL-terminated -- Artemis's
* own ATTACH-ACK-BUF (artemis:init.4th) is a raw CMOVE'd byte buffer
* with no such guarantee, so this copies into its own NUL-terminated
* buffer rather than passing ATTACH-ACK-BUF's address through
* unchanged.
* on a message's payload_addr, so it must be NUL-terminated; since
* 2026-10-14 the kernel writes the whole reply text into this buffer
* itself (KH-BLK-ATTACH-SEND, below), from two numbers.
*
* CORRECTED 2026-09-22 (real defect, this task's own findings log):
* this comment used to claim "static, not stack-local" was load-bearing
@@ -383,47 +390,47 @@ static void sk_word_blk_attach_ack(VM *vm) {
#define SK_KH_BLK_ATTACH_BUF_SIZE 80
static char g_kh_blk_attach_buf[SK_KH_BLK_ATTACH_BUF_SIZE];
/* KH-BLK-ATTACH-SEND ( paddr plen -- ok? ): copies the caller's payload
* (Artemis's own ATTACH-ACK-BUF content) into the NUL-terminated buffer
* above and sends it to Hera via kernel-Hermes. `from`/`to` are derived
* from the calling VM and sk_get_mama_vm() -- the caller never has to
* name a VMUuid, matching how HERA-BLK-ATTACH-REQ never had to before
* either (FORTH's own IDX 0/1/2 convention did that translation for
* it). Refusal (reservoir/arena/destination-queue exhaustion) is logged
* rather than silently dropped -- FABRIC-3.5.md SXXXV.0 names silent
* failure as this project's single most common defect shape, and this
* is exactly the class of message (identity birth gates on it) where a
* silent drop would be expensive to ever notice. */
/* KH-BLK-ATTACH-SEND ( dev-addr ok? -- sent? ): Artemis's storage-attach
* reply to Hera. The kernel builds the message text itself --
* "<dev-addr> <ok?> BLK-ATTACH-ACK" -- from the two numbers, and only for
* Artemis. Until 2026-10-14 it took ( paddr plen ), any text at all, from
* any VM, and Hera ran that text in her own dictionary, Zuse's: a
* WIREBIND identity could have any FORTH run as Zuse (shown live,
* FABRIC-3.md SXXXVII). `from`/`to` are derived from the calling VM and
* sk_get_mama_vm() -- the caller never names a VMUuid. Refusal
* (reservoir/arena/destination-queue exhaustion) is logged rather than
* silently dropped -- FABRIC-3.5.md SXXXV.0 names silent failure as this
* project's single most common defect shape, and identity birth gates on
* this message. */
static void sk_word_kh_blk_attach_send(VM *vm) {
VMRegistryEntry artemis;
VM *mama_vm = (VM *)sk_get_mama_vm();
cell_t ok_flag, dev_addr;
int n, rc;
if (vm->dsp < 1) {
log_message(LOG_ERROR, "KH-BLK-ATTACH-SEND: stack underflow");
console_println("KH-BLK-ATTACH-SEND: expects dev-addr ok? -- nothing on the stack");
vm->error = 1;
return;
}
cell_t plen = vm_pop(vm);
cell_t paddr = vm_pop(vm);
/* paddr is a VM-relative offset (vaddr_t), not a host pointer --
* CLAUDE.md's own "Important Conventions": "Stack values are VM
* offsets (vaddr_t), not C pointers -- use VM_ADDR()/CELL()".
* mama_forth_words.c's own VM-EXEC/VM-CALL words all translate a
* popped paddr the same way (vm_ptr(vm, (vaddr_t)caddr)) before
* touching it as a C pointer -- found live, not assumed: the first
* cut here raw-cast paddr directly and silently read all-zero
* memory (some unmapped/zeroed low address), producing an empty
* NUL-terminated payload that vm_interpret() executed as a no-op --
* no crash, no error, just a message that arrived and did nothing.
* Diagnosed via a temporary probe printing the copied buffer content
* at send time (per feedback_revert_probes_after_capture); reverted
* once this fix confirmed correct. */
const char *src = (const char *)vm_ptr(vm, (vaddr_t)paddr);
size_t n = (size_t)plen;
VM *mama_vm = (VM *)sk_get_mama_vm();
size_t i;
int rc;
ok_flag = vm_pop(vm);
dev_addr = vm_pop(vm);
if (n >= SK_KH_BLK_ATTACH_BUF_SIZE) n = SK_KH_BLK_ATTACH_BUF_SIZE - 1;
for (i = 0; i < n; i++) g_kh_blk_attach_buf[i] = src[i];
g_kh_blk_attach_buf[n] = '\0';
if (capsule_vm_find_by_name_nocase("Artemis", &artemis) != 0 ||
artemis.vm_ptr != (void *)vm) {
console_println("KH-BLK-ATTACH-SEND: refused -- only Artemis replies to a storage attach");
vm->error = 1;
return;
}
n = snprintf(g_kh_blk_attach_buf, sizeof(g_kh_blk_attach_buf),
"%llu %u BLK-ATTACH-ACK",
(unsigned long long)(uint64_t)dev_addr, ok_flag ? 1u : 0u);
if (n <= 0 || (size_t)n >= sizeof(g_kh_blk_attach_buf)) {
console_println("KH-BLK-ATTACH-SEND: FAILED -- reply does not fit");
vm_push(vm, 0);
return;
}
rc = sk_hermes_send_one(vm->stadium_vm_id, mama_vm->stadium_vm_id,
SK_HERMES_MSG_TYPE_BLK_ATTACH, 0,
@@ -434,64 +441,14 @@ static void sk_word_kh_blk_attach_send(VM *vm) {
vm_push(vm, rc == 0 ? 1 : 0);
}
/* FABRIC-3.6.md task 3.10 (Stage D): sized to match messaging.4th's own
* ELEVATE-REQ-BUF (256 bytes) -- the FORTH-side sender never builds a
* longer payload than that buffer allows, so this is a safe match, not
* an arbitrary choice. static, not stack-local: safe now that
* sk_hermes_send_one() copies into the message's own storage (the
* payload-aliasing fix landed before this task started) -- no lifetime
* caveat to carry forward this time, unlike g_kh_blk_attach_buf/
* g_kh_console_cmd_buf's own now-corrected history. */
#define SK_KH_ELEVATE_BUF_SIZE 256
static char g_kh_elevate_buf[SK_KH_ELEVATE_BUF_SIZE];
/* KH-ELEVATE-SEND ( paddr plen -- ok? ): built for messaging.4th's own
* SEND-ELEVATE-REQUEST (a FORTH command string calling ELEVATE-GRANT,
* zuse-eligibility.4th block 4022), which handed its payload here
* instead of CH-REQUEST's old COMMON-CH/MSG-SEND path. `from`/`to` are
* derived the same way KH-BLK-ATTACH-SEND's own already does (the
* calling VM and sk_get_mama_vm() -- ELEVATE-GRANT always runs on Hera,
* per zuse-eligibility.4th's own header comment) -- the caller never
* supplies either, which is a real correctness improvement over the
* FORTH path it replaced: CH-REQUEST's own "initiator-only gate...
* refuses if from doesn't match MY-CH-ID" existed only because a caller
* COULD claim to be a different VM by passing the wrong stack value;
* deriving `from` from the C-level calling VM's own identity makes that
* spoof structurally impossible rather than merely gated. FABRIC-3.6.md
* Phase 4, Stage E deleted messaging.4th -- SEND-ELEVATE-REQUEST no
* longer exists anywhere, so this word currently has no FORTH caller.
* Found, not fixed; see FABRIC-3.6.md's own Phase 4 entry. */
static void sk_word_kh_elevate_send(VM *vm) {
if (vm->dsp < 1) {
log_message(LOG_ERROR, "KH-ELEVATE-SEND: stack underflow");
vm->error = 1;
return;
}
cell_t plen = vm_pop(vm);
cell_t paddr = vm_pop(vm);
const char *src = (const char *)vm_ptr(vm, (vaddr_t)paddr);
size_t n = (size_t)plen;
VM *mama_vm = (VM *)sk_get_mama_vm();
size_t i;
int rc;
if (n >= SK_KH_ELEVATE_BUF_SIZE) n = SK_KH_ELEVATE_BUF_SIZE - 1;
for (i = 0; i < n; i++) g_kh_elevate_buf[i] = src[i];
g_kh_elevate_buf[n] = '\0';
rc = sk_hermes_send_one(vm->stadium_vm_id, mama_vm->stadium_vm_id,
SK_HERMES_MSG_TYPE_ELEVATE_REQUEST, 0,
g_kh_elevate_buf, (uint32_t)(n + 1));
if (rc != 0) {
log_message(LOG_ERROR, "KH-ELEVATE-SEND: kernel-Hermes refused the send");
}
vm_push(vm, rc == 0 ? 1 : 0);
}
/* KH-ELEVATE-SEND was here until 2026-10-14: it sent any text to Hera as
* an ELEVATE-REQUEST, and Hera ran it as Zuse. Removed with word-ACL
* elevation itself (FABRIC-3.7, closed as not needed; FABRIC-3.md
* SXXXVII). */
void sk_repl_register_words(VM *vm) {
register_word(vm, "BLK-ATTACH-ACK", sk_word_blk_attach_ack);
register_word(vm, "KH-BLK-ATTACH-SEND", sk_word_kh_blk_attach_send);
register_word(vm, "KH-ELEVATE-SEND", sk_word_kh_elevate_send);
}
/*===========================================================================
kernel/src/vm/kernel_hermes.c
+7 -21
View File
@@ -656,26 +656,13 @@ int sk_hermes_drain_checkpoint(VM *vm) {
console_println(line);
}
/* FABRIC-3.6.md task 3.10 evidence: ELEVATE-REQUEST also has no fixed
* C-side handler word -- its payload is a FORTH command string
* calling ELEVATE-GRANT (zuse-eligibility.4th), interpreted as-is
* below, same shape as CONSOLE-CMD-EVENT above. Same mid-hold-instant
* evidence, same reasoning; `self` here is always Hera (`vm`'s own
* caller already resolved it that way in KH-ELEVATE-SEND, since
* ELEVATE-GRANT only ever runs on Hera). */
if (msg->type == SK_HERMES_MSG_TYPE_ELEVATE_REQUEST) {
uint64_t held, pulled, returned, consumed;
char line[160];
int conserved = stadium_conserved(self);
sk_hermes_ledger(&held, &pulled, &returned, &consumed);
snprintf(line, sizeof(line),
"Kernel-Hermes ELEVATE-REQUEST (real, Stage D): ledger held=%llu "
"pulled=%llu returned=%llu consumed=%llu stadium_conserved(self)=%s",
(unsigned long long)held, (unsigned long long)pulled,
(unsigned long long)returned, (unsigned long long)consumed,
conserved ? "true" : "FALSE");
console_println(line);
}
/* Off the queue BEFORE it runs (2026-10-14): running it can reach a
* colon-word checkpoint that drains this same VM again, and that
* drain must find the next message, not this one -- popped only after,
* a message whose payload calls a colon word ran twice (FABRIC-3.md
* SXXXVII). The message itself, and so its payload bytes, is still
* held until sk_hermes_release() below. */
sk_hermes_pending_pop(self);
vm->mode = MODE_INTERPRET; /* a payload is never compiled into whatever
* the enclosing context was mid-defining */
@@ -691,7 +678,6 @@ int sk_hermes_drain_checkpoint(VM *vm) {
vm->abort_requested = saved_abort;
sk_hermes_release(msg);
sk_hermes_pending_pop(self);
return drain_error ? -1 : 1;
}