Robert Allan JamesandClaude Sonnet 5
cc9521d2cc
Three tightly-coupled changes, verified together per Captain Bob's own "getting rid of the emergency cli" direction: 1. Zuse's identity is thumbdrive-resident, never system-resident. New zuse_genesis_marker_t (magic/version/zuse_pubkey[32]/crc) replaces zuse_cert_devblock_t's slot in the top-of-device fence -- the system now remembers only that a root identity exists and its pubkey, never a seed. zuse_cert_devblock_t is kept in the repo, marked superseded, no longer written by any code path. capsule_mint_identity() grows a genesis mode (issuer_vm=NULL): no cert is built or written (Zuse isn't verified against a separate signer -- she's recognized by pubkey match against the marker) and two new optional out-params (out_pubkey/out_seed) let the caller install the cert immediately after a genesis mint. New capsule_zuse_boot_try_attach() (capsule_zuse_boot.c), called from sk_repl_idle() on every fresh USB attach (the only point in the boot lifecycle a thumbdrive can actually be detected -- attach polling doesn't exist yet at kernel_main.c's old one-shot mint point, which is why that whole block is gone): no marker + blank drive -> genesis-mint; marker present + matching drive -> read its own user_identity_seed_t, install the cert. Either way, re-runs ACL-ZUSE-BOOT (zuse.4th) so zuse_session activates exactly like it always has for a same-boot cert install -- ACL-PIN only blocks redefinition, not re-execution, so no new C-side auth logic needed. 2. ACL.4th activated (capsules/init.4th) -- inactive all session until now. Found and fixed a real bug this immediately surfaced: zuse.4th's ACL-ZUSE-BOOT tried `['] ACL-ZUSE-BOOT ACL-PIN` from inside its own still-compiling definition -- the word isn't findable yet at that point, so the whole definition silently failed to compile every previous boot this session (dormant, since ACL.4th never loaded). Fixed: pin after the definition closes, not from within it -- it only needs to happen once anyway, and pinning doesn't block the re-invocation genesis/attach needs. 3. The unauthenticated emergency-CLI ACL bypass is retired (repl.c): `emergency_console = is_hera ? (zuse_session ? 0 : 1) : 0` deleted from both sk_repl_step and sk_repl_run. Every word run from Hera's own bare prompt now goes through ordinary ACL enforcement; emergency_console is driven only by the genuine C-level fault handler again. Added ZUSE-SESSION? (starforth_words.c), a read-only diagnostic matching ZUSE-PUBKEY@'s own precedent, to verify the whole chain directly rather than by inference. Verified end-to-end live in QEMU: fresh boot, no thumbdrive -> ZUSE-SESSION? reads 0. Attach a genuinely blank drive via QMP -> genesis mint fires automatically (no typing) -> ZUSE-SESSION? reads -1 (true). Hermes/Artemis both birth clean on all three architectures with ACL now actually enforced for the first time all session -- no denials, no UNKNOWN WORD beyond the deliberate POST self-test cases. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019ZGkimpfyh63EZyRkNbkPD
src/word_source/
FORTH-79 word implementations, one file per category, registered into the
dictionary via include/word_registry.h. Each .c file here has a
matching header in src/word_source/include/ and (for most categories) a
matching test module in src/test_runner/modules/.
FORTH-79 core
arithmetic_words.c,mixed_arithmetic_words.c—+ - * / MOD ABS MIN MAXand mixed-precision arithmetic.stack_words.c—DUP DROP SWAP ROT OVER NIP TUCK.control_words.c—IF ELSE THEN DO LOOP BEGIN UNTIL WHILE.defining_words.c—: ; CREATE DOES> VARIABLE CONSTANT.memory_words.c—@ ! C@ C! MOVE FILL.return_stack_words.c—>R R> R@ RDROP 2>R 2R@ 2R>.double_words.c—2DUP 2DROP 2SWAP 2@ 2! D+ D-.logical_words.c—AND OR XOR NOT INVERT LSHIFT RSHIFT.io_words.c—EMIT KEY TYPE CR TAB SPACE ACCEPT.string_words.c—S" SLITERALand other string operations.block_words.c—BLOCK BUFFER LOAD THRU FLUSH.format_words.c—.( .R .S HEX DECIMAL BASE.system_words.c—BYE ABORT INCLUDE STATE.dictionary_words.c—FIND SEARCH-WORDLIST WORDS.dictionary_manipulation_words.c— dictionary entry manipulation words.vocabulary_words.c—VOCABULARY DEFINITIONS FORTH-WORDLIST.editor_words.c— block editor words.defer_words.c—DEFER/ISdeferred-word mechanism, used by the Tripod message-dispatch shim (seetools/hermes_tripod_smoke.sh).
StarForth-specific extensions
q48_16_words.c,q48_words.c— Q48.16 fixed-point word bindings.starforth_words.c— StarForth-specific extensions.acl_words.c— word-level ACL system's FORTH-callable primitives (seedocs/03-architecture/word-acl/).lifecycle_words_hosted.c— hosted-build VM lifecycle words (birth/run primitives on the hosted side; kernel-only primitives live insrc/starkernel/capsule/mama_forth_words.c).log_words.c— FORTH-callable logging primitives.inference_words.c— FORTH-callable bindings for the statistical inference engine (Loops #5/#6).physics_benchmark_words.c— benchmark harness for the 7 physics feedback loops.physics_diagnostic_words.c— physics diagnostics (WORD-ENTROPY).physics_freeze_words.c—PHYSICS-FREEZE/PHYSICS-THAW.physics_pipelining_diagnostic_words.c— Loop #4 pipelining diagnostics.dictionary_heat_diagnostic_words.c— Loop #1 heat diagnostics.
See src/word_source/include/ for the matching headers (also includes
mama_forth_words.h, whose .c implementation lives under
src/starkernel/capsule/ since it's kernel-only).