From 9b61a3355ef47005223ca3357634632759a55618 Mon Sep 17 00:00:00 2001 From: Robert Allan James Date: Mon, 3 Aug 2026 11:33:04 -0400 Subject: [PATCH] =?UTF-8?q?FABRIC.md=20=C2=A725:=20fix=20GAP-C1=20through?= =?UTF-8?q?=20C7=20=E2=80=94=20punch=20item=20defects?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit One batch commit for the seven mechanical item fixes from §25.7.1, each tagged in place: C1 Item 0.1 no longer contradicts its own Refs line. Delete set is 2051-2056 + 2058-2059; blocks 2057, 2049 and 2050 survive edited, with the per-block edits now spelled out. The old "remove 2050-2059" wording would have deleted the banner. C2 Items 0.2 and 0.5 accept on no-regression. Both previously required having taken and returned an interrupt at a stage where no interrupt source exists; the real evidence lands with 0.3's and 0.7's tick-advance acceptance, and both items now forbid pulling later work forward to manufacture it. C3 Item 0.3 carries sie.STIE and the every-tick re-arm -- the SBI timer is one-shot and a missed re-arm stops the heartbeat forever with no error. C4 §23.4 #4 is now schedulable as item 1.12 (continuation-cell encoding); 3.1's blocker line and the Phase 3 gate reference it. C5 Item 1.11 is formally blocked on 4.3 instead of informally deferred. C6 Item 0.10's "sane" sharpened to trust near Q48_ONE and variance small relative to the new expected_delta; the amd64-control framing is noted as valid again under the GAP-A1 ruling. C7 The commit template no longer hardcodes a model name. Co-Authored-By: Claude Fable 5 --- FABRIC.md | 59 +++++++++++++++++++++++++++++++++++++++---------------- 1 file changed, 42 insertions(+), 17 deletions(-) diff --git a/FABRIC.md b/FABRIC.md index 5145918..a0fdede 100644 --- a/FABRIC.md +++ b/FABRIC.md @@ -1966,7 +1966,7 @@ Commit message format: Punch list §25 item complete. -Co-Authored-By: Claude Opus 5 +Co-Authored-By: ``` ### Standing constraints from `.claude/CLAUDE.md` @@ -1998,12 +1998,18 @@ wrong because it is written down, and do not silently implement something differ on until there is a tick on all three architectures (§16.1, §16.5).* - [ ] **0.1 — Prune `capsules/init.4th` to Hera alone.** - Remove the Artemis and Hermes births, the `common:msg.4th` and `process.4th` loads, and - blocks 2050–2059's fleet test scaffolding. Adjust `BOOT-BANNER`, `VM-TREE`, `VM-CHILDREN`. - Leave `capsules/hermes/` and `capsules/artemis/` untouched on disk. + **Delete** blocks 2051, 2052, 2053, 2054, 2055, 2056, 2058, 2059 — the readiness + handshake, broadcast test, TRIPOD-TEST, HERMES-E2E, and fleet-DoE scaffolding. + **Edit** the three surviving blocks: 2057 (`BOOT-BANNER` — drop the Tripod lines), 2049 + (remove the Artemis and Hermes births with their `CD-INIT` calls and the `common:msg.4th` + / `process.4th` loads; keep `lib.4th`; adjust `VM-TREE` / `VM-CHILDREN`), and 2050 (keep + the `BOOT-BANNER` call; remove the `READINESS-HANDSHAKE` and `BROADCAST-TEST` calls). + Leave `capsules/hermes/` and `capsules/artemis/` untouched on disk. An earlier draft of + this item said "remove blocks 2050–2059," which contradicted its own Refs line — 2050 + survives, edited (C1). *Done when:* all three architectures boot to the prompt with Hera alone, no Hermes or Artemis in the banner, and the three logs exist under `logs/`. - *Refs:* the surviving blocks are 2057, 2049, 2050. + *Refs:* the surviving blocks are 2057, 2049, 2050. `mkcapsule --lint` before building. - [ ] **0.2 — riscv64: real trap entry.** Replace the one-way `riscv64_trap_entry` in `arch/riscv64/isr.S` with save / dispatch / @@ -2015,17 +2021,22 @@ on until there is a tick on all three architectures (§16.1, §16.5).* plus `fcsr` alongside the integer set; verify the exact register list against the RISC-V psABI, not this document. Do not "fix" this by switching to soft-float — that breaks existing code and is a build-system decision nobody has made. - *Done when:* riscv64 boots to the prompt unchanged, having taken and returned from at - least one trap. Exceptions still halt with the same diagnostic as before. + *Done when:* riscv64 boots to the prompt with no regression, and exceptions still halt + with the same diagnostic as before. **No trap source exists yet at this item** — the + timer arms in 0.3, whose tick-advance acceptance is what proves this entry path took and + returned an interrupt (C2). Do not arm the timer early to manufacture evidence here. - [ ] **0.3 — riscv64: SBI timer and real time base.** **First, the prerequisite this item silently assumed (B1 verified it absent):** the kernel has no DTB access — `BootInfo` (`uefi.h:624-639`) carries no FDT pointer and no FDT code exists in the tree. Capture the DTB pointer from the EFI configuration table (DTB table GUID) into a new `BootInfo` field in the shared loader. This also serves 0.6. - Then: arm the timer via the SBI TIME extension. Switch the time base from `rdcycle` to - the `time` CSR and take its frequency from the device tree `timebase-frequency`, with a - named fallback constant — not a bare magic number (§16.2). + Then: arm the timer via the SBI TIME extension, **enable `sie.STIE`**, and **re-arm + inside the handler on every tick — the SBI timer is one-shot by nature, and a missed + re-arm stops the heartbeat forever with no error. That is the single most likely silent + failure of this item (C3).** Switch the time base from `rdcycle` to the `time` CSR and + take its frequency from the device tree `timebase-frequency`, with a named fallback + constant — not a bare magic number (§16.2). *Done when:* `heartbeat_ticks()` advances on riscv64 and the tick interval matches the configured rate within measurement noise. Verify the SBI extension is present before relying on it; if it is absent, stop and report rather than falling back silently. @@ -2052,7 +2063,10 @@ on until there is a tick on all three architectures (§16.1, §16.5).* never consulted for exceptions taken at EL2. The EL detected in 0.4 must select the vector base register (`VBAR_ELx`), the saved-state pair (`ELR_ELx`/`SPSR_ELx`), and the `eret` target state, not just the timer registers. - *Done when:* aarch64 boots to the prompt having taken and returned from at least one IRQ. + *Done when:* aarch64 boots to the prompt with no regression. **No IRQ source exists yet + at this item** — the GIC lands in 0.6 and the timer arms in 0.7, whose tick-advance + acceptance is what proves this path took and returned an IRQ (C2). Do not pull 0.6/0.7 + work forward to manufacture evidence here. - [ ] **0.6 — aarch64: minimal GICv2.** Enable the distributor and CPU interface, set the priority mask, enable the timer PPI, @@ -2089,8 +2103,10 @@ on until there is a tick on all three architectures (§16.1, §16.5).* - [ ] **0.10 — Phase 0 acceptance.** Full three-architecture QEMU run. Confirm: boots to prompt on all three; tick count - non-zero on all three; TIME-TRUST and variance sane on riscv64 after 0.3; amd64 output - unchanged from its pre-branch behaviour. + non-zero on all three; on riscv64 after 0.3, trust near `Q48_ONE` and variance small + relative to the new `expected_delta` — not merely "sane", which is unfalsifiable (C6); + amd64 output unchanged from its pre-branch behaviour (a valid control under the GAP-A1 + ruling, since 0.8 no longer touches engine plumbing). **Then boot one architecture twice and confirm the parity dict hash is identical across runs.** If it drifts, something is firing on wall time and Phase 0 is not complete. *Done when:* all of the above observed, logs committed. @@ -2151,8 +2167,17 @@ document and committing that amendment as its own item.* - [ ] **1.10 — Identity elision.** Whether identity can be dropped for some kinds without a per-kind branch. Optimisation; may be closed as "no". *Refs:* §23.4 #3. -- [ ] **1.11 — Dirty-event granularity.** Leaning region-based. **Deferred to console work** - — do not settle speculatively. *Refs:* §17.5, §23.2, §23.4 #1. +- [ ] **1.11 — Dirty-event granularity.** Leaning region-based. **Blocked on item 4.3** — + it is settled as part of the console migration, not speculatively before it (C5). + *Refs:* §17.5, §23.2, §23.4 #1. + +- [ ] **1.12 — The continuation-cell encoding.** Contiguous (continuation cells are pure + payload; allocation must find runs, reintroducing fragmentation) or linked (each + continuation cell carries a next-index, costing 4 bytes of payload and changing every + large patron's mass). §22.3's per-VM free list guarantees no adjacency, so linked is the + default unless allocation changes. This was §23.4 #4 — a stated blocker of item 3.1 that + was never a schedulable item until now (C4). Settling it completes §23.3's sizing table. + *Refs:* §23.4 #4, §23.3, §22.3. **Prerequisite of 3.1.** --- @@ -2203,13 +2228,13 @@ document and committing that amendment as its own item.* ## 25.4 Phase 3 — Stadium core -*Blocked on Phase 0 complete, and on items 1.1–1.7.* +*Blocked on Phase 0 complete, and on items 1.1–1.7 and 1.12.* - [ ] **3.1 — Cell and header.** Define the entry with all eight wires (§3) — **nine if item 1.1 resolves to a holder index.** Define both members of §3's closed two-valued union: patron header and continuation cell. Validate the 64-byte cell by counting real bytes; adjust and record if it does not fit. - **Blocked on:** item 1.1 (may add a wire) and §23.4 #4 (the continuation-cell encoding — + **Blocked on:** item 1.1 (may add a wire) and item 1.12 (the continuation-cell encoding — contiguous or linked — which sets the mass of every large patron and cannot be guessed). *Refs:* §3, §23.3, §23.4 #4. - [ ] **3.2 — Boot-time allocation.** One global cell array, sized from the memory budget,