admin/LithosAnanake
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Channel-open policy hook -- FABRIC-3.6.md task 3.7

Browse Source 
Added HERMES-CHANNEL-OPEN? ( req-hi req-lo -- allow? ) at
capsules/ACL.4th block 4008 (default: approve everything) -- the one
word policy authors edit. sk_hermes_channel_open_policy(VM*, VMUuid)
(kernel_hermes.h/.c) is the C-side query that calls it via plain
word-dispatch against the target VM's own dictionary/stack, never
vm_interpret() (avoids task 3.4's input-buffer cursor hazard entirely)
and never decides the answer itself. Fails closed: no policy word,
a policy error, or stack underflow all deny, matching CLAUDE.md's
posture that absence of policy must never mean "always allow."

Two real bugs found and fixed before this was called done:
missing current_executing_entry assignment before calling the word's
func pointer (colon words silently no-op without it, vm_core.c:730 --
no crash, just a wrong answer); and a second FAIL with debug
instrumentation still in place whose precise cause isn't
reconstructable, since no intermediate commit exists for that attempt.

Self-test proves the task's check four ways against the same
unchanged C function: default approve, live redefinition to deny
(zero C change), restore, and a VM with no ACL.4th loaded at all
(fail closed). A fifth check wires the result into task 3.6's
sk_hermes_channel_respond() end to end: a denied policy produces a
NACK and no channel, ledger/stadium_conserved() holding throughout.

Scope, per Captain Bob's ruling: closes with the query built and
proven; sk_hermes_channel_respond() still takes a caller-supplied
approved bool rather than calling the policy internally. Wiring a
real channel-open call site to only this query is deferred to
whichever later task first needs a live decision.

dict_hash identical across amd64/aarch64/riscv64 for every VM, zero
UNKNOWN WORD, mkcapsule --lint clean (38 files, 0 violations).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Robert Allan James
2026-09-22 09:08:48 -04:00
co-authored by Claude Sonnet 5
parent 205a49ecd0
commit f37aa0fb17
11 changed files with 46618 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/starkernel/kernel_main.c
+86
View File
@@ -1749,6 +1749,92 @@ static void kernel_main_deep(BootInfo *boot_info) {
}
}
/* FABRIC-3.6.md task 3.7 self-test: the channel-open policy hook.
* Proves "a denied open is denied by FORTH policy, with the C
* unchanged" three ways against the SAME unchanged C function
* (sk_hermes_channel_open_policy()): Hera's default
* HERMES-CHANNEL-OPEN? (capsules/ACL.4th block 4008, "approve
* everything") approves; redefining that same word live on Hera to
* deny flips the answer with no C change; and Hermes -- who never
* loads ACL.4th at all (grep-confirmed: only init.4th/ACL.4th/
* zuse.4th/block-acl.4th reference it) -- is correctly refused
* closed (no policy present), not silently approved. A fourth check
* wires the policy result straight into sk_hermes_channel_respond()
* (task 3.6) end to end: a denied policy really produces a NACK and
* no channel, exactly like task 3.6's own deny path. */
{
VMRegistryEntry hera_pol_entry, hermes_pol_entry;
VMUuid requester_pol;
int pol_ok = 1;
requester_pol.hi = 0; requester_pol.lo = 17;
console_puts("Kernel-Hermes channel-open policy self-test: ");
if (capsule_vm_find_by_name_nocase("Hera", &hera_pol_entry) != 0 || !hera_pol_entry.vm_ptr ||
capsule_vm_find_by_name_nocase("Hermes", &hermes_pol_entry) != 0 ||
hermes_pol_entry.state != VM_STATE_LIVE || !hermes_pol_entry.vm_ptr) {
console_println("SKIPPED (Hera/Hermes not available)");
} else {
VM *hera_vm = (VM *)hera_pol_entry.vm_ptr;
VM *hermes_vm = (VM *)hermes_pol_entry.vm_ptr;
/* Default: approve. */
if (sk_hermes_channel_open_policy(hera_vm, requester_pol) != 1) pol_ok = 0;
/* Same C function, policy redefined on Hera alone -- deny. */
if (pol_ok) {
vm_interpret(hera_vm, ": HERMES-CHANNEL-OPEN? ( a b -- f ) 2DROP 0 ;");
if (hera_vm->error) { hera_vm->error = 0; pol_ok = 0; }
}
if (pol_ok && sk_hermes_channel_open_policy(hera_vm, requester_pol) != 0) pol_ok = 0;
/* Restore the default before this self-test's own later use
* of respond()/negotiation against Hera, and for whatever
* runs after this block. */
if (pol_ok) {
vm_interpret(hera_vm, ": HERMES-CHANNEL-OPEN? ( a b -- f ) 2DROP 1 ;");
if (hera_vm->error) { hera_vm->error = 0; pol_ok = 0; }
}
if (pol_ok && sk_hermes_channel_open_policy(hera_vm, requester_pol) != 1) pol_ok = 0;
/* No policy word at all (Hermes never loads ACL.4th) --
* fail closed, not open. */
if (pol_ok && sk_hermes_channel_open_policy(hermes_vm, requester_pol) != 0) pol_ok = 0;
/* End to end with task 3.6: a denied policy really produces
* a NACK and no channel. Funds requester/target fresh so
* this sub-test doesn't depend on the negotiation self-test
* above having left any particular ledger state. */
if (pol_ok) {
VMUuid pub_id5, sub_id5;
int grant_rc3, grant_rc4;
pub_id5.hi = 0; pub_id5.lo = 19;
sub_id5.hi = 0; sub_id5.lo = 20;
grant_rc3 = stadium_grant_quota(pub_id5, vm_uuid_hera());
grant_rc4 = stadium_grant_quota(sub_id5, vm_uuid_hera());
if (grant_rc3 != 0 || grant_rc4 != 0) {
pol_ok = 0;
} else {
int approved = sk_hermes_channel_open_policy(hermes_vm, pub_id5); /* Hermes: no policy -> denied */
int ch5 = sk_hermes_channel_respond(sub_id5, pub_id5, approved);
if (approved != 0 || ch5 != -1) pol_ok = 0;
if (pol_ok && sk_hermes_pending_count(pub_id5) != 1) pol_ok = 0; /* NACK only */
if (pol_ok) {
SkHermesMessage *m5 = sk_hermes_pending_peek(pub_id5);
if (!m5 || m5->type != SK_HERMES_MSG_TYPE_NACK) pol_ok = 0;
if (pol_ok && sk_hermes_release(m5) != 0) pol_ok = 0;
if (pol_ok && sk_hermes_pending_pop(pub_id5) != 0) pol_ok = 0;
}
if (pol_ok && !stadium_conserved(pub_id5)) pol_ok = 0;
if (pol_ok && !stadium_conserved(sub_id5)) pol_ok = 0;
}
}
console_println(pol_ok ? "PASS" : "FAIL");
}
}
/* Decided 2026-09-05: no console for the running system unless a
* thumbdrive is present -- headless by default (EMERGENCY_CONSOLE_
* ENABLED off), reusing that flag's own existing "does this build
src/starkernel/vm/kernel_hermes.c
+39
View File
@@ -713,4 +713,43 @@ int sk_hermes_channel_close(VMUuid closer, int channel_id) {
return sk_hermes_channel_destroy(channel_id);
}
int sk_hermes_channel_open_policy(VM *target_vm, VMUuid requester) {
static const char word_name[] = "HERMES-CHANNEL-OPEN?";
DictEntry *entry;
DictEntry *saved_entry;
cell_t result;
if (!target_vm) return 0;
entry = vm_find_word(target_vm, word_name, sizeof(word_name) - 1);
if (!entry || !entry->func) return 0; /* fail closed: no policy, no open */
/* Colon words dispatch through execute_colon_word(), which reads its
* own body address from vm->current_executing_entry and no-ops
* silently if it is NULL (vm_core.c:730) -- vm_interpret_word() always
* sets this immediately before calling entry->func(); matched here
* for the same reason (found live: without it, every call silently
* did nothing, leaving the pushed requester untouched on the stack
* rather than erroring, which is why this needed a debug session to
* catch rather than showing up as an obvious crash). Saved and
* restored, not just set, in case target_vm is ever called into
* mid-dispatch (not exercised by this task's own self-test, but no
* reason to assume it away). */
saved_entry = target_vm->current_executing_entry;
target_vm->current_executing_entry = entry;
vm_push(target_vm, (cell_t)requester.hi);
vm_push(target_vm, (cell_t)requester.lo);
entry->func(target_vm);
target_vm->current_executing_entry = saved_entry;
if (target_vm->error || target_vm->dsp < 0) {
target_vm->error = 0; /* a broken policy word must not leak into
* whatever else target_vm is doing */
return 0;
}
result = vm_pop(target_vm);
return result != 0;
}
#endif /* __STARKERNEL__ */