/*
 * zuse_genesis_marker.h -- on-disk record format for the system-resident
 * "a root Zuse identity already exists" marker (FABRIC-2.md §F.21),
 * stored in devblock_from_top=0 of the top-of-device system-metadata
 * fence (block_subsystem.h's blk_meta_zone_read()/write(), same location
 * zuse_cert_devblock_t used to occupy).
 *
 * Supersedes zuse_cert_devblock_t (zuse_cert_devblock.h, kept in the repo
 * as historical record, no longer written): that type stored Zuse's own
 * *seed* system-resident. Under the thumbdrive-resident Zuse design
 * (§F.20/§F.21), the seed lives only on Zuse's own minted thumbdrive --
 * this record deliberately holds only her *public* key, enough to (a)
 * know genesis has already happened, so a second blank thumbdrive
 * attached on some later boot never mints a second competing root, and
 * (b) recognize which attached identity is genuinely hers. Losing this
 * fence record is not a security problem (it's not a secret); losing the
 * thumbdrive itself is what actually loses the identity.
 */
#ifndef STARKERNEL_ZUSE_GENESIS_MARKER_H
#define STARKERNEL_ZUSE_GENESIS_MARKER_H

#include <stdint.h>

#define ZUSE_GENESIS_MARKER_MAGIC \
    ((uint32_t)'Z' | ((uint32_t)'G' << 8) | ((uint32_t)'E' << 16) | ((uint32_t)'N' << 24))

#define ZUSE_GENESIS_MARKER_VERSION 1u

typedef struct {
    uint32_t magic;       /* ZUSE_GENESIS_MARKER_MAGIC; anything else means
                            * "genesis has not happened yet" (blank/foreign
                            * bytes), not a format-corruption error. */
    uint32_t version;     /* ZUSE_GENESIS_MARKER_VERSION */
    uint8_t  zuse_pubkey[32]; /* Ed25519 public key of the root Zuse
                            * identity minted at genesis. No seed here --
                            * that lives only on Zuse's own thumbdrive. */
    uint64_t crc;         /* CRC-64/ISO (block_subsystem.h's compute_crc64())
                            * over every byte of this struct up to (not
                            * including) this field. */
    uint8_t  _pad[4096 - (4 + 4 + 32 + 8)];
} zuse_genesis_marker_t;

_Static_assert(sizeof(zuse_genesis_marker_t) == 4096,
               "zuse_genesis_marker_t must be exactly one 4 KiB devblock");

/* Version 2 (docs/v4.0.0/STICK.md 6, 6a; plan 2026-10-29-stick-5, Task 1): the
 * same magic and devblock, two keys -- the stick's proxy Zuse, minted at its
 * first boot, and the real Zuse, minted onto a second stick (zero, and
 * has_real 0, until she is). Written and read only by the v4 boot
 * (sk_v4_marker.c), which reads a version 1 marker as a proxy with no real
 * Zuse. v3 reads version 1 only, and never runs from a stick (STICK.md 5.5). */
#define ZUSE_GENESIS_MARKER_VERSION_2 2u

typedef struct {
    uint32_t magic;            /* ZUSE_GENESIS_MARKER_MAGIC */
    uint32_t version;          /* ZUSE_GENESIS_MARKER_VERSION_2 */
    uint8_t  proxy_pubkey[32]; /* the stick's proxy Zuse */
    uint8_t  real_pubkey[32];  /* the real Zuse, when has_real */
    uint32_t has_real;         /* 1 once the real Zuse is minted */
    uint32_t _reserved;        /* zero: makes the padding before crc explicit */
    uint64_t crc;              /* CRC-64/ISO over every byte before this field */
    uint8_t  _pad[4096 - (4 + 4 + 32 + 32 + 4 + 4 + 8)];
} zuse_genesis_marker_v2_t;

_Static_assert(sizeof(zuse_genesis_marker_v2_t) == 4096,
               "zuse_genesis_marker_v2_t must be exactly one 4 KiB devblock");

#endif /* STARKERNEL_ZUSE_GENESIS_MARKER_H */