refactor(kernel): Zuse's drive check without a VM

capsule_zuse_boot_check() makes the check capsule_zuse_boot_try_attach()
made -- the genesis marker, the drive's identity record (magic, version,
CRC-64, public key) -- and says HERS, GENESIS or NOT_HERS, with no VM;
capsule_zuse_boot_root_pubkey() reads the marker's key. try_attach and
load_root_pubkey call them; their behaviour and messages are unchanged.
The v4 boot will make the same check (identity gate plan, D1).

Shown on v3 (system=v3, amd64): the minted pair, "Zuse: identity
confirmed" and [zuse@Hera] ok> (logs/20261026-083603); a blank pair,
"Zuse: genesis minted onto attached thumbdrive" (logs/20261026-084729).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

kernel/include/starkernel/capsule_zuse_boot.h

@@ -27,6 +27,36 @@
 
 struct blkio_dev;
 
+/** What a just-attached drive is to Zuse (capsule_zuse_boot_check()). */
+typedef enum {
+    ZUSE_DRIVE_NOT_HERS = 0, /* another identity's, foreign, corrupt, or no genesis and not blank */
+    ZUSE_DRIVE_HERS,         /* the genesis marker's drive: its identity record checks out */
+    ZUSE_DRIVE_GENESIS       /* no genesis marker yet, and the drive is blank: eligible */
+} zuse_drive_t;
+
+/**
+ * capsule_zuse_boot_check - The check capsule_zuse_boot_try_attach() makes,
+ * with no VM: the v3 path and the v4 boot both use it
+ * (docs/v4.0.0/plans/2026-10-26-engine-step4-identity-gate.md, D1).
+ * Reads the genesis marker from the block subsystem's metadata fence and,
+ * when there is one, the drive's own identity record (magic, version,
+ * CRC-64, public key against the marker's). Writes nothing.
+ *
+ * @param seed, pubkey Zuse's seed and public key, filled in only for
+ *                     ZUSE_DRIVE_HERS.
+ */
+zuse_drive_t capsule_zuse_boot_check(struct blkio_dev *dev,
+                                      homeblocks_sig_result_t sig_rc,
+                                      const homeblocks_sig_t *sig,
+                                      uint8_t seed[32], uint8_t pubkey[32]);
+
+/**
+ * capsule_zuse_boot_root_pubkey - Zuse's public key from the genesis
+ * marker. Returns 0 with @p pubkey filled in, or -1 (no genesis yet, or the
+ * marker fails its checks; @p pubkey untouched).
+ */
+int capsule_zuse_boot_root_pubkey(uint8_t pubkey[32]);
+
 /**
  * capsule_zuse_boot_try_attach - Try to genesis-mint or authenticate
  * Zuse from a just-attached drive.

kernel/src/capsule/capsule_zuse_boot.c

@@ -113,10 +113,57 @@ static void install_and_activate(VM *mama_vm, struct blkio_dev *dev,
      * "ACL-ZUSE-BOOT") above already sets. Nothing to call here anymore. */
 }
 
+/* The check, with no VM (split out 2026-10-26 so the v4 boot makes the same
+ * one: docs/v4.0.0/plans/2026-10-26-engine-step4-identity-gate.md, D1). */
+zuse_drive_t capsule_zuse_boot_check(struct blkio_dev *dev,
+                                      homeblocks_sig_result_t sig_rc,
+                                      const homeblocks_sig_t *sig,
+                                      uint8_t seed[32], uint8_t pubkey[32]) {
+    zuse_genesis_marker_t marker;
+
+    if (!dev) return ZUSE_DRIVE_NOT_HERS;
+    if (genesis_marker_read(&marker) != 0) {
+        /* no marker: a blank drive is eligible for genesis, nothing else is */
+        return sig_rc == HOMEBLOCKS_SIG_BLANK ? ZUSE_DRIVE_GENESIS : ZUSE_DRIVE_NOT_HERS;
+    }
+
+    /* Marker present: genesis already happened, on some thumbdrive.
+     * Only this drive if it is that drive. */
+    if (sig_rc != HOMEBLOCKS_SIG_OK || !sig) return ZUSE_DRIVE_NOT_HERS;
+    if (sig->identity_src_offset == 0 || sig->identity_src_devblocks < 1) return ZUSE_DRIVE_NOT_HERS;
+
+    user_identity_seed_t idrec;
+    if (read_devblock(dev, sig->identity_src_offset, (uint8_t *)&idrec) != 0) return ZUSE_DRIVE_NOT_HERS;
+    /* Same magic -> version -> CRC-64 discipline as genesis_marker_read():
+     * this record carries Zuse's private key (the seed), so a corrupt or
+     * format-mismatched record must be refused, never loaded -- a bad CRC
+     * could otherwise install a garbage seed as Zuse's identity. */
+    if (idrec.magic != USER_IDENTITY_SEED_MAGIC) return ZUSE_DRIVE_NOT_HERS;
+    if (idrec.version != USER_IDENTITY_SEED_VERSION) return ZUSE_DRIVE_NOT_HERS;
+    uint64_t want_crc = compute_crc64((const uint8_t *)&idrec,
+                                      offsetof(user_identity_seed_t, crc));
+    if (want_crc != idrec.crc) return ZUSE_DRIVE_NOT_HERS;
+    if (memcmp(idrec.pubkey, marker.zuse_pubkey, 32) != 0) return ZUSE_DRIVE_NOT_HERS; /* not Zuse's drive */
+
+    memcpy(seed, idrec.seed, 32);
+    memcpy(pubkey, idrec.pubkey, 32);
+    return ZUSE_DRIVE_HERS;
+}
+
+int capsule_zuse_boot_root_pubkey(uint8_t pubkey[32]) {
+    zuse_genesis_marker_t marker;
+    if (genesis_marker_read(&marker) != 0) return -1; /* no genesis yet */
+    memcpy(pubkey, marker.zuse_pubkey, 32);
+    return 0;
+}
+
 void capsule_zuse_boot_try_attach(struct blkio_dev *dev,
                                    homeblocks_sig_result_t sig_rc,
                                    const homeblocks_sig_t *sig,
                                    VM *mama_vm) {
+    uint8_t seed[32], pubkey[32];
+    zuse_drive_t which;
+
     if (!dev || !mama_vm) return;
     /* FABRIC-2.md §I.8, re-scoped 2026-09-04: gate on zuse_session, not
      * zuse_cert_installed. zuse_cert_installed never clears (one-way,
@@ -126,13 +173,9 @@ void capsule_zuse_boot_try_attach(struct blkio_dev *dev,
      * Zuse THIS SESSION" check this early-return is actually for. */
     if (mama_vm->zuse_session) return;
 
-    zuse_genesis_marker_t marker;
+    which = capsule_zuse_boot_check(dev, sig_rc, sig, seed, pubkey);
-    int have_marker = (genesis_marker_read(&marker) == 0);
 
-    if (!have_marker) {
+    if (which == ZUSE_DRIVE_GENESIS) {
-        if (sig_rc != HOMEBLOCKS_SIG_BLANK) return; /* not eligible for genesis */
-
-        uint8_t seed[32], pubkey[32];
         MintResult r = capsule_mint_identity(dev, (VM *)0, "Zuse", "zuse",
                                               (const char *)0, (const char *)0,
                                               pubkey, seed,
@@ -159,26 +202,10 @@ void capsule_zuse_boot_try_attach(struct blkio_dev *dev,
         return;
     }
 
-    /* Marker present: genesis already happened, on some thumbdrive.
+    if (which != ZUSE_DRIVE_HERS) return;
-     * Only act if THIS attach is that drive. */
-    if (sig_rc != HOMEBLOCKS_SIG_OK || !sig) return;
-    if (sig->identity_src_offset == 0 || sig->identity_src_devblocks < 1) return;
-
-    user_identity_seed_t idrec;
-    if (read_devblock(dev, sig->identity_src_offset, (uint8_t *)&idrec) != 0) return;
-    /* Same magic -> version -> CRC-64 discipline as genesis_marker_read():
-     * this record carries Zuse's private key (the seed), so a corrupt or
-     * format-mismatched record must be refused, never loaded -- a bad CRC
-     * could otherwise install a garbage seed as Zuse's identity. */
-    if (idrec.magic != USER_IDENTITY_SEED_MAGIC) return;
-    if (idrec.version != USER_IDENTITY_SEED_VERSION) return;
-    uint64_t want_crc = compute_crc64((const uint8_t *)&idrec,
-                                      offsetof(user_identity_seed_t, crc));
-    if (want_crc != idrec.crc) return;
-    if (memcmp(idrec.pubkey, marker.zuse_pubkey, 32) != 0) return; /* not Zuse's drive */
 
     console_println("Zuse: identity confirmed from attached thumbdrive");
-    install_and_activate(mama_vm, dev, idrec.seed, idrec.pubkey);
+    install_and_activate(mama_vm, dev, seed, pubkey);
 }
 
 void capsule_zuse_boot_logout(VM *mama_vm, struct blkio_dev *dev) {
@@ -203,9 +230,6 @@ struct blkio_dev *capsule_zuse_boot_attached_dev(void) {
 void capsule_zuse_boot_load_root_pubkey(VM *mama_vm) {
     if (!mama_vm || mama_vm->zuse_root_pubkey_known) return;
 
-    zuse_genesis_marker_t marker;
+    if (capsule_zuse_boot_root_pubkey(mama_vm->zuse_root_pubkey) != 0) return; /* no genesis yet -- nothing to load */
-    if (genesis_marker_read(&marker) != 0) return; /* no genesis yet -- nothing to load */
-
-    memcpy(mama_vm->zuse_root_pubkey, marker.zuse_pubkey, 32);
     mama_vm->zuse_root_pubkey_known = 1;
 }