Artemis bus-agnostic discovery: signature format + idle-loop generalization (FABRIC-3.md §XXVI follow-on)

Step 1: new artemis_sig_t header format (magic 'ARTM', sibling to
homeblocks_sig_t, distinct so a generic scan can tell Artemis's own disk
apart from an identity thumbdrive by content alone) -- artemis_sig.h/.c,
wired into Makefile.starkernel.

Step 2: sk_repl_idle()'s existing per-USB-MSC-slot attach handling (the
pattern WIREBIND already uses for identity thumbdrives) now also checks
for the ARTM signature whenever a device's home-blocks check comes back
BLANK. On a match, once Artemis's own storage-attach round-trip
(HERA-BLK-ATTACH-REQ/BLK-ATTACH-ACK) confirms success,
capsule_zuse_boot_load_root_pubkey() runs -- the same call kernel_main.c's
synchronous QEMU-only virtio-blk path already makes, now reachable
without a hardcoded PCI vendor/device scan. That function is already
idempotent (no-op once zuse_root_pubkey_known is set), so no boot
restructuring was needed despite the initial concern that deferring
Artemis discovery to the idle loop would require one.

Verified: clean build + QEMU boot to [zuse@Hera] ok> on all three
architectures, zero regression to the existing virtio-blk/Zuse-thumbdrive
attach path.

Steps 3 (genesis-stamping onto disk/artemis.img) and 4 (growable
production log-persistence region) not yet started.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EXieurDfDSsDFdnSyusuWo

Makefile.starkernel

@@ -456,7 +456,8 @@ LOADER_SRCS_BASE := \
     $(KERNEL_SRC)/repl.c \
     $(KERNEL_SRC)/doe_log.c \
     $(KERNEL_SRC)/heartbeat.c \
-    $(KERNEL_SRC)/homeblocks_sig.c
+    $(KERNEL_SRC)/homeblocks_sig.c \
+    $(KERNEL_SRC)/artemis_sig.c
 
 LOADER_ASM := \
     $(KERNEL_SRC)/arch/$(ARCH)/boot.S \
@@ -511,7 +512,8 @@ KERNEL_SRCS_BASE := \
     $(KERNEL_SRC)/repl.c \
     $(KERNEL_SRC)/doe_log.c \
     $(KERNEL_SRC)/heartbeat.c \
-    $(KERNEL_SRC)/homeblocks_sig.c
+    $(KERNEL_SRC)/homeblocks_sig.c \
+    $(KERNEL_SRC)/artemis_sig.c
 
 KERNEL_ASM := $(wildcard $(KERNEL_SRC)/arch/$(ARCH)/*.S)
 

capsules/BLOCK_MAP.md

@@ -1,5 +1,5 @@
 # Capsule Block Manifest — Auto-generated
-<!-- Generated by mkcapsule --manifest  2026-09-13T10:39:15Z -->
+<!-- Generated by mkcapsule --manifest  2026-09-13T11:14:42Z -->
 <!-- DO NOT EDIT — re-run mkcapsule --manifest to refresh.  -->
 <!-- Hand-written justifications and immutability notes live  -->
 <!-- in MANIFEST.md alongside this auto-generated index.      -->

include/starkernel/artemis_sig.h

@@ -0,0 +1,192 @@
+/*
+  StarForth — Steady-State Virtual Machine Runtime
+
+  Copyright (c) 2023–2025 Robert A. James
+  All rights reserved.
+
+  This file is part of the StarForth project.
+
+  Licensed under the StarForth License, Version 1.0 (the "License");
+  you may not use this file except in compliance with the License.
+
+  You may obtain a copy of the License at:
+      https://github.com/star.4th@proton.me/StarForth/LICENSE.txt
+
+  This software is provided "AS IS", WITHOUT WARRANTY OF ANY KIND,
+  express or implied, including but not limited to the warranties of
+  merchantability, fitness for a particular purpose, and noninfringement.
+
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+/**
+ * artemis_sig.h - Artemis disk signature format (FABRIC-3.md §XXVI follow-on,
+ * 2026-09-13)
+ *
+ * Identifies Artemis's own disk, distinct from an identity thumbdrive's
+ * homeblocks_sig_t -- needed once Artemis's disk stops being found by a
+ * hardcoded PCI virtio-blk vendor/device ID scan (QEMU-only; real hardware
+ * has no reason to expose a virtio-blk PCI device at all, since virtio is a
+ * paravirtualization standard, not something a physical storage controller
+ * speaks) and starts being discovered generically instead, the same way
+ * WIREBIND already discovers identity thumbdrives -- by content signature,
+ * not by which bus happened to present the device. Without a distinct
+ * signature, generic discovery on real hardware (where an identity
+ * thumbdrive and Artemis's own disk could both be attached as USB-MSC
+ * devices simultaneously) would have no way to tell them apart.
+ *
+ * Mirrors homeblocks_sig_t's own structural convention exactly (magic +
+ * version + CRC, one 4KiB devblock, same devblock-1 fixed location) --
+ * a sibling format, not a field bolted onto homeblocks_sig_t itself:
+ * homeblocks_sig_t's own header comment already states it's "deliberately
+ * narrow in scope" (identity-drive fields only, no spare room -- its
+ * padding is computed to fill exactly 4096 bytes), and Artemis's disk is
+ * conceptually a different kind of thing (one dedicated fleet-owned device,
+ * not one of many candidate identity drives), not a variant of the same one.
+ *
+ * Reserves offset/size pointers to the growable per-VM log-persistence
+ * region (FABRIC-3.md §XXVI follow-on's own log-record work), the same way
+ * homeblocks_sig_t reserves pointers to where the cert and identity source
+ * attach -- this format doesn't need revisiting when that region's own
+ * internal layout is designed.
+ */
+
+#ifndef STARKERNEL_ARTEMIS_SIG_H
+#define STARKERNEL_ARTEMIS_SIG_H
+
+#include <stdint.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*===========================================================================
+ * Magic Field Packing -- same bit layout convention as HOMEBLOCKS_SIG_PACK
+ *
+ * bits  0..31 : 'ARTM' (0x4D545241 little-endian) -- distinct from
+ *               homeblocks_sig_t's 'LAHB', so a generic scan can tell an
+ *               Artemis disk apart from an identity thumbdrive by content
+ *               alone, regardless of which bus either was found on.
+ * bits 32..39 : version (0 for v0)
+ * bits 40..63 : reserved (zero)
+ *===========================================================================*/
+
+#define ARTEMIS_SIG_MAGIC     0x4D545241ULL /* 'ARTM' */
+#define ARTEMIS_SIG_VERSION_0 0
+
+#define ARTEMIS_SIG_PACK(ver) \
+    (ARTEMIS_SIG_MAGIC | ((uint64_t)(ver) << 32))
+
+#define ARTEMIS_SIG_GET_MAGIC(m)   ((uint32_t)((m) & 0xFFFFFFFFULL))
+#define ARTEMIS_SIG_GET_VERSION(m) ((uint8_t)(((m) >> 32) & 0xFF))
+
+/* Same devblock-1 (forth-block 4) convention as HOMEBLOCKS_SIG_START_FBLOCK
+ * -- devblock 0 stays reserved for the block-subsystem's own generic
+ * 'STFR'/v2 volume header (block_subsystem.h), same reasoning as
+ * homeblocks_sig.h's own comment on this. No collision risk with an
+ * identity thumbdrive's own homeblocks_sig_t at the same devblock offset --
+ * they are different physical/virtual devices entirely. */
+#define ARTEMIS_SIG_START_FBLOCK 4u
+
+/*===========================================================================
+ * artemis_sig_t - Artemis disk signature header (exactly one 4KiB devblock)
+ *===========================================================================*/
+
+typedef struct {
+    uint64_t magic;              /* ARTEMIS_SIG_PACK(...) */
+    uint8_t  disk_uuid[16];      /* Mirrors homeblocks_sig_t's drive_uuid --
+                                  * one Artemis disk exists today, but costs
+                                  * nothing to future-proof the same way. */
+    uint64_t genesis_time_ns;    /* Monotonic timestamp when this signature
+                                  * was first stamped (the one-time genesis
+                                  * step, not every boot). */
+    uint64_t metadata_devblocks; /* Size of the metadata region at the start
+                                  * of this raw device (sig header + log
+                                  * region), in 4KiB devblocks -- everything
+                                  * past this is Artemis's own general
+                                  * block-storage pool, same "no partition
+                                  * boundary" convention homeblocks_sig_t
+                                  * uses for an identity's own pool. */
+
+    uint32_t log_region_offset;    /* Devblock offset where the growable
+                                    * per-VM log-persistence region starts;
+                                    * 0 = not yet allocated. */
+    uint32_t log_region_devblocks; /* Current reserved size of the log
+                                    * region, in devblocks -- grows over
+                                    * time (same growable-reservation
+                                    * mechanism the metadata fence design
+                                    * already uses elsewhere), not a single
+                                    * fixed guess made once at genesis. */
+
+    uint64_t hdr_crc;            /* Computed over every field above this
+                                  * one, same boundary/discipline as
+                                  * homeblocks_sig_compute_crc(). */
+
+    /* Padding to keep the header exactly one 4KiB devblock. */
+    uint8_t _pad[4096 - (
+                     8 +           /* magic */
+                     16 +          /* disk_uuid */
+                     8 +           /* genesis_time_ns */
+                     8 +           /* metadata_devblocks */
+                     4 + 4 +       /* log_region_offset, log_region_devblocks */
+                     8             /* hdr_crc */
+                 )];
+} artemis_sig_t;
+
+/* C99-portable compile-time size assertion (no _Static_assert -- that's
+ * C11), same discipline homeblocks_sig.h's own check uses. */
+typedef char artemis_sig_size_check[(sizeof(artemis_sig_t) == 4096) ? 1 : -1];
+
+/*===========================================================================
+ * Signature check (mirrors homeblocks_sig_result_t exactly)
+ *===========================================================================*/
+
+typedef enum {
+    ARTEMIS_SIG_OK = 0,       /* magic, version, and crc all check out */
+    ARTEMIS_SIG_BLANK,        /* magic does not match -- blank, foreign, or
+                               * an identity thumbdrive (different magic) */
+    ARTEMIS_SIG_BAD_VERSION,  /* magic matches, version unrecognized */
+    ARTEMIS_SIG_BAD_CRC,      /* magic+version match, crc fails -- corrupt
+                               * or tampered */
+    ARTEMIS_SIG_READ_ERROR    /* could not read from the device at all */
+} artemis_sig_result_t;
+
+/* Forward-declared, not included here -- same reasoning as
+ * homeblocks_sig.h's own forward declaration of struct blkio_dev. */
+struct blkio_dev;
+
+/*
+ * artemis_sig_check - Read and verify the Artemis disk signature header.
+ * Mirrors homeblocks_sig_check()'s own contract exactly (same forth-block
+ * read pattern, same "starting block is a caller-supplied parameter"
+ * separation of concerns).
+ *
+ * @param dev              Open block device to read from.
+ * @param sig_start_fblock First of 4 consecutive forth-blocks holding the
+ *                         4KB header -- ARTEMIS_SIG_START_FBLOCK for every
+ *                         real caller today.
+ * @param out_sig          On ARTEMIS_SIG_OK, populated with the verified
+ *                         header. Left unspecified on any other result.
+ * @return ARTEMIS_SIG_OK, or the specific reason for refusal.
+ */
+artemis_sig_result_t artemis_sig_check(struct blkio_dev *dev,
+                                        uint32_t sig_start_fblock,
+                                        artemis_sig_t *out_sig);
+
+/*
+ * artemis_sig_compute_crc - CRC-64 over every field of `sig` up to but not
+ * including hdr_crc itself and the trailing padding. Exposed publicly for
+ * the same reason homeblocks_sig_compute_crc() is: both the check and the
+ * future genesis-stamping step need the identical computation.
+ *
+ * @param sig  Header to checksum. hdr_crc and _pad are not read.
+ * @return The CRC-64 value that hdr_crc should hold for `sig` to verify.
+ */
+uint64_t artemis_sig_compute_crc(const artemis_sig_t *sig);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* STARKERNEL_ARTEMIS_SIG_H */

src/starkernel/artemis_sig.c

@@ -0,0 +1,87 @@
+/*
+  StarForth — Steady-State Virtual Machine Runtime
+
+  Copyright (c) 2023–2025 Robert A. James
+  All rights reserved.
+
+  This file is part of the StarForth project.
+
+  Licensed under the StarForth License, Version 1.0 (the "License");
+  you may not use this file except in compliance with the License.
+
+  You may obtain a copy of the License at:
+      https://github.com/star.4th@proton.me/StarForth/LICENSE.txt
+
+  This software is provided "AS IS", WITHOUT WARRANTY OF ANY KIND,
+  express or implied, including but not limited to the warranties of
+  merchantability, fitness for a particular purpose, and noninfringement.
+
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+/**
+ * artemis_sig.c - Artemis disk signature check (FABRIC-3.md §XXVI follow-on).
+ * See starkernel/artemis_sig.h for the format and interface design.
+ */
+
+#include "starkernel/artemis_sig.h"
+
+#include <stddef.h>
+#include <string.h>
+
+#include "blkio.h"
+#include "block_subsystem.h" /* compute_crc64() -- same CRC-64/ISO
+                              * homeblocks_sig.c's own check reuses,
+                              * not duplicated here either */
+
+uint64_t artemis_sig_compute_crc(const artemis_sig_t *sig) {
+    /* Covers every field up to but not including hdr_crc itself (and never
+     * _pad, which sits after it) -- offsetof is the exact boundary, same
+     * discipline as homeblocks_sig_compute_crc(). */
+    size_t crc_span = offsetof(artemis_sig_t, hdr_crc);
+    return compute_crc64((const uint8_t *)sig, crc_span);
+}
+
+artemis_sig_result_t artemis_sig_check(struct blkio_dev *dev,
+                                        uint32_t sig_start_fblock,
+                                        artemis_sig_t *out_sig) {
+    uint8_t          buf[4096];
+    uint32_t         i;
+    artemis_sig_t    local;
+    uint64_t         expected_crc;
+
+    if (!dev) return ARTEMIS_SIG_READ_ERROR;
+
+    /* artemis_sig_t is exactly one 4KiB devblock; blkio's own unit is a
+     * 1KiB "forth block" (BLKIO_FORTH_BLOCK_SIZE), so the header spans 4
+     * consecutive reads starting at sig_start_fblock -- same pattern as
+     * homeblocks_sig_check(). */
+    for (i = 0; i < 4; i++) {
+        if (blkio_read((blkio_dev_t *)dev, sig_start_fblock + i,
+                        buf + (size_t)i * BLKIO_FORTH_BLOCK_SIZE) != BLKIO_OK) {
+            return ARTEMIS_SIG_READ_ERROR;
+        }
+    }
+
+    /* Copy into a properly-aligned local rather than reinterpreting buf's
+     * address directly -- same strict-aliasing/alignment reasoning as
+     * homeblocks_sig_check(). */
+    memcpy(&local, buf, sizeof(local));
+
+    if (ARTEMIS_SIG_GET_MAGIC(local.magic) != (uint32_t)(ARTEMIS_SIG_MAGIC & 0xFFFFFFFFULL)) {
+        return ARTEMIS_SIG_BLANK;
+    }
+
+    if (ARTEMIS_SIG_GET_VERSION(local.magic) != ARTEMIS_SIG_VERSION_0) {
+        return ARTEMIS_SIG_BAD_VERSION;
+    }
+
+    expected_crc = artemis_sig_compute_crc(&local);
+    if (expected_crc != local.hdr_crc) {
+        return ARTEMIS_SIG_BAD_CRC;
+    }
+
+    if (out_sig) *out_sig = local;
+    return ARTEMIS_SIG_OK;
+}

src/starkernel/repl.c

@@ -39,6 +39,7 @@
 #include "starkernel/blkio_usb.h"
 #include "starkernel/kmalloc.h"
 #include "starkernel/homeblocks_sig.h"
+#include "starkernel/artemis_sig.h"
 #include "starkernel/capsule_birth.h"
 #include "starkernel/capsule_zuse_boot.h"
 #include "starkernel/capsule_wirebind.h"
@@ -158,6 +159,22 @@ blkio_dev_t *sk_repl_get_attached_blk_dev(void) {
     return g_attached_blk_dev;
 }
 
+/* FABRIC-3.md §XXVI follow-on (2026-09-13): Artemis's own disk, once found
+ * generically via USB-MSC content signature (artemis_sig_t, 'ARTM') rather
+ * than the QEMU-only PCI virtio-blk vendor/device scan kernel_main.c still
+ * does synchronously at boot. Mirrors g_homeblocks_dev's own accessor
+ * shape. NULL on QEMU (virtio-blk finds Artemis before this file's idle
+ * loop ever runs) and on any boot where no USB-MSC device presents the
+ * 'ARTM' signature -- real bare-metal hardware is the case this exists
+ * for. Set once sk_word_blk_attach_ack() below confirms the storage-attach
+ * succeeded for a device this loop already recognized as Artemis's own;
+ * cleared on detach alongside g_homeblocks_dev/g_attached_blk_dev. */
+static blkio_dev_t *g_artemis_usb_dev = (void *)0;
+
+blkio_dev_t *sk_repl_get_artemis_usb_dev(void) {
+    return g_artemis_usb_dev;
+}
+
 /* Storage-attach messaging migration (Bob, 2026-09-07): Hera keeps
  * polling/sig-checking, but no longer registers a newly-attached drive
  * into the block subsystem herself -- that's Artemis's own domain now,
@@ -190,6 +207,14 @@ typedef struct {
     int                     pending;
     homeblocks_sig_result_t sig_rc;
     homeblocks_sig_t        sig;
+    /* FABRIC-3.md §XXVI follow-on: set when the attach loop below already
+     * recognized this device as Artemis's own disk (artemis_sig_t 'ARTM'
+     * check, only attempted when sig_rc is HOMEBLOCKS_SIG_BLANK -- a
+     * device can't be both an identity thumbdrive and Artemis's disk).
+     * The ack handler uses this to run capsule_zuse_boot_load_root_pubkey()
+     * once storage-attach is confirmed, same as kernel_main.c's own
+     * virtio-blk path already does synchronously. */
+    int                     is_artemis;
 } sk_blk_attach_pending_t;
 static sk_blk_attach_pending_t *g_blk_attach_pending = (void *)0;
 
@@ -227,8 +252,25 @@ static void sk_word_blk_attach_ack(VM *vm) {
     if (ms) ms->bot_msc_attached = 1;
     g_attached_blk_dev = dev;
 
-    homeblocks_sig_result_t sig_rc = g_blk_attach_pending[found_slot].sig_rc;
-    homeblocks_sig_t        sig    = g_blk_attach_pending[found_slot].sig;
+    homeblocks_sig_result_t sig_rc     = g_blk_attach_pending[found_slot].sig_rc;
+    homeblocks_sig_t        sig        = g_blk_attach_pending[found_slot].sig;
+    int                     is_artemis = g_blk_attach_pending[found_slot].is_artemis;
+
+    if (is_artemis) {
+        /* FABRIC-3.md §XXVI follow-on: bus-agnostic Artemis discovery.
+         * Mirrors kernel_main.c's own virtio-blk-found branch exactly
+         * (blk_subsys_attach_device() there is this device's equivalent,
+         * already done for us above via HERA-BLK-ATTACH-REQ/BLK-ATTACH --
+         * ok_flag being true is that confirmation). Safe to call even if
+         * virtio-blk already found Artemis first (the common QEMU case,
+         * since that path runs synchronously before this idle loop ever
+         * gets a beat): capsule_zuse_boot_load_root_pubkey() is a no-op
+         * once mama_vm->zuse_root_pubkey_known is already set. */
+        g_artemis_usb_dev = dev;
+        log_message(LOG_INFO, "xhci: Artemis's own disk attached via USB-MSC");
+        capsule_zuse_boot_load_root_pubkey((VM *)sk_get_mama_vm());
+    }
+
     capsule_zuse_boot_try_attach(dev, sig_rc, &sig, (VM *)sk_get_mama_vm());
     if (sig_rc == HOMEBLOCKS_SIG_OK) {
         capsule_wirebind_try_attach(dev, &sig, (VM *)sk_get_mama_vm());
@@ -441,6 +483,27 @@ static void sk_repl_idle(VM *active_vm)
                     break;
             }
 
+            /* FABRIC-3.md §XXVI follow-on: a device isn't an identity
+             * thumbdrive (sig_rc above came back BLANK, i.e. no 'LAHB'
+             * magic) -- check whether it's Artemis's own disk instead
+             * (distinct 'ARTM' magic, same devblock-1 convention). Only
+             * attempted on BLANK, not on every device: a drive that
+             * already checked out as home-blocks (or failed a home-blocks
+             * version/CRC check) can't also be Artemis's disk, and
+             * skipping the second read keeps the common identity-drive
+             * case down to one signature check per attach, same as
+             * before this feature existed. */
+            int is_artemis_disk = 0;
+            if (sig_rc == HOMEBLOCKS_SIG_BLANK) {
+                artemis_sig_t asig;
+                artemis_sig_result_t art_rc =
+                    artemis_sig_check(usb_blk_dev, ARTEMIS_SIG_START_FBLOCK, &asig);
+                if (art_rc == ARTEMIS_SIG_OK) {
+                    log_message(LOG_DEBUG, "xhci: USB drive recognized as Artemis's own disk");
+                    is_artemis_disk = 1;
+                }
+            }
+
             /* FABRIC-2.md §F.20/§F.21 / §F.5/§F.23 (WIREBIND): Zuse
              * genesis-mint/attach-authenticate and regular-identity
              * verify-then-birth-then-pair both used to run synchronously,
@@ -451,9 +514,10 @@ static void sk_repl_idle(VM *active_vm)
              * no longer happens on top of storage that might not have
              * registered. Stash what that deferred call needs. */
             if (g_blk_attach_pending) {
-                g_blk_attach_pending[slot_id].pending = 1;
-                g_blk_attach_pending[slot_id].sig_rc  = sig_rc;
-                g_blk_attach_pending[slot_id].sig     = sig;
+                g_blk_attach_pending[slot_id].pending    = 1;
+                g_blk_attach_pending[slot_id].sig_rc     = sig_rc;
+                g_blk_attach_pending[slot_id].sig        = sig;
+                g_blk_attach_pending[slot_id].is_artemis = is_artemis_disk;
             }
 
             /* Storage-attach registration (blk_subsys_attach_device(),