Build the FIRSTTOUCH overflow trigger flagged in FABRIC-2.md §I.2
The overflow-triggered migration path (a WIREBIND-attached identity's own drive running low on space) was scoped but never built -- only the trigger-detection call site was missing, per this section's own text. - capsule_wirebind.c now tracks the attached blkio_dev* alongside the already-tracked VM id, set in try_attach() and cleared in both EJECT/UNCLEAN paths. - New capsule_wirebind_overflow_idle_check(), called once per idle tick in repl.c right alongside blk_migration_idle_check() (same cadence): reads the attached drive's free/total via blk_get_device_free_blocks(), and if free space is below a fixed 10% threshold, extends the identity's pool with a one-time blk_firsttouch_claim() of 8 additional devblocks on Artemis's system-resident device. - New blk_owner_has_claim(owner_fp) in block_subsystem.c answers the debounce question blk_firsttouch_claim()'s own doc comment had left open: a disk scan, not a RAM flag, so the already-extended answer survives reboot/reattach, matching BMAPFMT's "ownership travels with the block" model. Premise checked before building (does a WIREBIND-attached drive actually give a real free/total signal, or does it stay PROVISIONAL/raw): traced repl.c's attach sequence and confirmed blk_subsys_attach_device() runs on the same dev pointer right after WIREBIND, and a WIREBIND-eligible drive is always already STFR/v2-formatted, so the signal is real. Premise held, unlike the BAM item's overstated one. Verified with the mandatory 3-arch QEMU acceptance (identical dictionary hashes, no regression) plus a live logic test of blk_owner_has_claim(): a temporary TEST-OWNER-CLAIM word, run once via SK_CMD and reverted, confirmed it correctly detects the claiming owner and rejects an unrelated one. The low-disk-space-triggers-a-claim path itself is not verified end-to-end -- that needs a real minted WIREBIND-user thumbdrive with deliberately tiny capacity, out of scope for this pass; noted as such in the FABRIC-2.md §I.2 closure note rather than overclaimed. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018EjXFo7mPXjUMjfJeuUUz4
This commit is contained in:
Robert Allan James
co-authored by
Claude Sonnet 5
Claude Sonnet 5
parent
d8ac27abb2
commit
4d4ab59189
@@ -39,6 +39,11 @@ static int g_wirebind_attached_valid = 0;
|
||||
* user_vm_name ("<username>~user"), not the bare form the (user) prompt
|
||||
* segment wants (FABRIC-2.md §I.1/4.4s). */
|
||||
static char g_wirebind_attached_username[USER_IDENTITY_USERNAME_MAX] = {0};
|
||||
/* FABRIC-2.md §I.2 overflow trigger, 2026-09-05: the attached drive's own
|
||||
* blkio_dev pointer, tracked alongside the two fields above so
|
||||
* capsule_wirebind_overflow_idle_check() can query its free space later
|
||||
* without a new attach-time argument threaded through the idle loop. */
|
||||
static struct blkio_dev *g_wirebind_attached_dev = (struct blkio_dev *) 0;
|
||||
|
||||
/* WIREBIND_CERT_MAX_DEVBLOCKS: a sane upper bound on how much cert
|
||||
* content this reads, independent of whatever sig->cert_devblocks
|
||||
@@ -47,6 +52,17 @@ static char g_wirebind_attached_username[USER_IDENTITY_USERNAME_MAX] = {0};
|
||||
* generous headroom, not a real constraint. */
|
||||
#define WIREBIND_CERT_MAX_DEVBLOCKS 4u
|
||||
|
||||
/* FABRIC-2.md §I.2 overflow trigger, 2026-09-05: fixed constants, "fixed
|
||||
* first" per this project's own standing sequencing (MIGRATION_WEAR_
|
||||
* THRESHOLD, ZUSE_SESSION_TTL_SECONDS -- adaptive only after a real,
|
||||
* measured baseline exists, not from day one). A single DoE-tunable knob
|
||||
* apiece, not yet wired to Kconfig -- revisit once real usage data exists.
|
||||
* 10% is a conservative first guess (extend well before actually full);
|
||||
* 8 devblocks (24 Forth blocks, ~24 KiB) is a modest first extension, not
|
||||
* a large land-grab. */
|
||||
#define WIREBIND_OVERFLOW_FREE_THRESHOLD_PCT 10u
|
||||
#define WIREBIND_OVERFLOW_CLAIM_DEVBLOCKS 8u
|
||||
|
||||
/* Read exactly one devblock (4096 bytes) at devblock offset `devblock`
|
||||
* -- same convention capsule_runcap.c/capsule_mint.c already use. */
|
||||
static int read_devblock(struct blkio_dev *dev, uint32_t devblock, uint8_t *buf4096) {
|
||||
@@ -184,6 +200,7 @@ void capsule_wirebind_try_attach(struct blkio_dev *dev,
|
||||
* actually owns block-subsystem state). */
|
||||
g_wirebind_attached_vm_id = user_id;
|
||||
g_wirebind_attached_valid = 1;
|
||||
g_wirebind_attached_dev = dev;
|
||||
memcpy(g_wirebind_attached_username, username, sizeof(g_wirebind_attached_username));
|
||||
|
||||
/* Register the pairing in the console's own routing table, index 3
|
||||
@@ -233,6 +250,7 @@ int capsule_wirebind_eject(void) {
|
||||
|
||||
capsule_vm_kill(entry.name);
|
||||
g_wirebind_attached_valid = 0;
|
||||
g_wirebind_attached_dev = (struct blkio_dev *) 0;
|
||||
g_wirebind_attached_username[0] = '\0';
|
||||
|
||||
console_puts("EJECT: ");
|
||||
@@ -254,6 +272,7 @@ void capsule_wirebind_unclean_detach(void) {
|
||||
|
||||
capsule_vm_kill(entry.name);
|
||||
g_wirebind_attached_valid = 0;
|
||||
g_wirebind_attached_dev = (struct blkio_dev *) 0;
|
||||
g_wirebind_attached_username[0] = '\0';
|
||||
|
||||
console_puts("WIREBIND: ");
|
||||
@@ -265,3 +284,41 @@ const char *capsule_wirebind_attached_username(void) {
|
||||
if (!g_wirebind_attached_valid) return (const char *)0;
|
||||
return g_wirebind_attached_username;
|
||||
}
|
||||
|
||||
void capsule_wirebind_overflow_idle_check(void) {
|
||||
if (!g_wirebind_attached_valid || !g_wirebind_attached_dev) return;
|
||||
|
||||
VMRegistryEntry entry;
|
||||
if (capsule_vm_registry_get(g_wirebind_attached_vm_id, &entry) != 0 ||
|
||||
entry.state != VM_STATE_LIVE || !entry.vm_ptr) {
|
||||
return;
|
||||
}
|
||||
|
||||
uint64_t free_blocks, total_blocks;
|
||||
if (blk_get_device_free_blocks(g_wirebind_attached_dev, &free_blocks, &total_blocks)
|
||||
!= BLK_OK || total_blocks == 0) {
|
||||
return;
|
||||
}
|
||||
|
||||
if (free_blocks * 100u >= total_blocks * WIREBIND_OVERFLOW_FREE_THRESHOLD_PCT) {
|
||||
return; /* plenty of room left on the drive itself */
|
||||
}
|
||||
|
||||
uint8_t owner_fp[8];
|
||||
memcpy(owner_fp, ((VM *)entry.vm_ptr)->identity.owner_pubkey, sizeof(owner_fp));
|
||||
|
||||
if (blk_owner_has_claim(owner_fp)) {
|
||||
return; /* already extended once -- not a growth loop, see header doc */
|
||||
}
|
||||
|
||||
uint32_t chain_head;
|
||||
if (blk_firsttouch_claim(owner_fp, WIREBIND_OVERFLOW_CLAIM_DEVBLOCKS, &chain_head)
|
||||
!= BLK_OK) {
|
||||
console_println("WIREBIND: overflow trigger fired but Artemis has no room to extend into");
|
||||
return;
|
||||
}
|
||||
|
||||
console_puts("WIREBIND: ");
|
||||
console_puts(g_wirebind_attached_username);
|
||||
console_println(" running low on drive space -- extended onto system-resident storage");
|
||||
}
|
||||
|
||||
@@ -368,6 +368,13 @@ static void sk_repl_idle(VM *active_vm)
|
||||
* migration, needs a call site threaded from WIREBIND). */
|
||||
blk_migration_idle_check();
|
||||
|
||||
/* FABRIC-2.md §I.2's own overflow trigger, closed 2026-09-05: the
|
||||
* call site named above, now built. Same cadence, same idle-tick
|
||||
* neighbor -- see capsule_wirebind_overflow_idle_check()'s own doc
|
||||
* comment for what it does and why it's a one-time extension, not a
|
||||
* growth loop. */
|
||||
capsule_wirebind_overflow_idle_check();
|
||||
|
||||
/* FABRIC-2.md Phase C (2026-08-28): distributed messaging pump. Every
|
||||
* live VM except Hera herself now owns its own MSG-ARENA/CH-ARENA and
|
||||
* MSG-TICK word (see capsules/common/messaging.4th) instead of only
|
||||
|
||||
Reference in New Issue
Block a user