Retire emergency CLI: Zuse goes thumbdrive-resident, ACL.4th activated
Three tightly-coupled changes, verified together per Captain Bob's own "getting rid of the emergency cli" direction: 1. Zuse's identity is thumbdrive-resident, never system-resident. New zuse_genesis_marker_t (magic/version/zuse_pubkey[32]/crc) replaces zuse_cert_devblock_t's slot in the top-of-device fence -- the system now remembers only that a root identity exists and its pubkey, never a seed. zuse_cert_devblock_t is kept in the repo, marked superseded, no longer written by any code path. capsule_mint_identity() grows a genesis mode (issuer_vm=NULL): no cert is built or written (Zuse isn't verified against a separate signer -- she's recognized by pubkey match against the marker) and two new optional out-params (out_pubkey/out_seed) let the caller install the cert immediately after a genesis mint. New capsule_zuse_boot_try_attach() (capsule_zuse_boot.c), called from sk_repl_idle() on every fresh USB attach (the only point in the boot lifecycle a thumbdrive can actually be detected -- attach polling doesn't exist yet at kernel_main.c's old one-shot mint point, which is why that whole block is gone): no marker + blank drive -> genesis-mint; marker present + matching drive -> read its own user_identity_seed_t, install the cert. Either way, re-runs ACL-ZUSE-BOOT (zuse.4th) so zuse_session activates exactly like it always has for a same-boot cert install -- ACL-PIN only blocks redefinition, not re-execution, so no new C-side auth logic needed. 2. ACL.4th activated (capsules/init.4th) -- inactive all session until now. Found and fixed a real bug this immediately surfaced: zuse.4th's ACL-ZUSE-BOOT tried `['] ACL-ZUSE-BOOT ACL-PIN` from inside its own still-compiling definition -- the word isn't findable yet at that point, so the whole definition silently failed to compile every previous boot this session (dormant, since ACL.4th never loaded). Fixed: pin after the definition closes, not from within it -- it only needs to happen once anyway, and pinning doesn't block the re-invocation genesis/attach needs. 3. The unauthenticated emergency-CLI ACL bypass is retired (repl.c): `emergency_console = is_hera ? (zuse_session ? 0 : 1) : 0` deleted from both sk_repl_step and sk_repl_run. Every word run from Hera's own bare prompt now goes through ordinary ACL enforcement; emergency_console is driven only by the genuine C-level fault handler again. Added ZUSE-SESSION? (starforth_words.c), a read-only diagnostic matching ZUSE-PUBKEY@'s own precedent, to verify the whole chain directly rather than by inference. Verified end-to-end live in QEMU: fresh boot, no thumbdrive -> ZUSE-SESSION? reads 0. Attach a genuinely blank drive via QMP -> genesis mint fires automatically (no typing) -> ZUSE-SESSION? reads -1 (true). Hermes/Artemis both birth clean on all three architectures with ACL now actually enforced for the first time all session -- no denials, no UNKNOWN WORD beyond the deliberate POST self-test cases. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019ZGkimpfyh63EZyRkNbkPD
This commit is contained in:
Robert Allan James
co-authored by
Claude Sonnet 5
Claude Sonnet 5
parent
7fc3e93358
commit
cc9521d2cc
+32
-19
@@ -38,6 +38,7 @@
|
||||
#include "starkernel/blkio_usb.h"
|
||||
#include "starkernel/homeblocks_sig.h"
|
||||
#include "starkernel/capsule_birth.h"
|
||||
#include "starkernel/capsule_zuse_boot.h"
|
||||
#include "starkernel/capsule_run.h"
|
||||
#include "starkernel/vm/bootstrap/sk_vm_bootstrap.h"
|
||||
#include "block_subsystem.h"
|
||||
@@ -183,6 +184,16 @@ static void sk_repl_idle(VM *active_vm)
|
||||
console_println("xhci: USB drive signature check failed to read the device -- read-only general use only");
|
||||
break;
|
||||
}
|
||||
|
||||
/* FABRIC-3.md §F.20/§F.21: Zuse is thumbdrive-resident now,
|
||||
* not system-resident -- this is the only point in the boot
|
||||
* lifecycle a just-attached drive's sig result is known, so
|
||||
* genesis-mint/attach-authenticate has to happen from here,
|
||||
* not as a one-shot kernel_main.c step (a thumbdrive can't
|
||||
* be detected before the REPL's own idle polling exists to
|
||||
* detect it). No-ops immediately if Zuse already has a real
|
||||
* identity this boot. */
|
||||
capsule_zuse_boot_try_attach(&usb_blk_dev, sig_rc, &sig, (VM *)sk_get_mama_vm());
|
||||
}
|
||||
if (rc == 0 && blk_subsys_attach_device(&usb_blk_dev) == BLK_OK) {
|
||||
xdev->bot_msc_attached = 1;
|
||||
@@ -447,12 +458,17 @@ static int sk_readline(char *buf, int size, VM *active_vm)
|
||||
}
|
||||
|
||||
/*===========================================================================
|
||||
* sk_repl - Emergency FORTH REPL
|
||||
* sk_repl - FORTH REPL
|
||||
*
|
||||
* FABRIC-3.md §F.20/§F.21 (2026-08-28): the unauthenticated emergency-CLI
|
||||
* ACL bypass this REPL used to grant itself on Hera's own bare prompt is
|
||||
* retired -- every word runs under ordinary ACL enforcement here now,
|
||||
* console identity included. emergency_console still exists as a field
|
||||
* (vm.h) and is still set, briefly, by the genuine C-level VM fault
|
||||
* handler (EMERGENCY_CONSOLE_ENABLED build flag) for crash recovery --
|
||||
* that's a distinct, narrower mechanism this REPL no longer touches.
|
||||
*
|
||||
* Mirrors vm_repl() from src/repl.c:
|
||||
* - Sets vm->emergency_console = 1 for the duration (this IS the emergency
|
||||
* console; bypasses ACL so zuse authentication is not required to recover)
|
||||
* - Prints "zuse)ok> " when zuse_session=1, else "ok> "
|
||||
* - Reads a line via sk_readline (non-blocking, heartbeat-serviced)
|
||||
* - Calls vm_interpret
|
||||
* - Prints " ok" or " ERROR"
|
||||
@@ -487,12 +503,13 @@ int sk_repl_step(VM *vm)
|
||||
{
|
||||
/* Unified prompt (FABRIC.md 4.4a): console_putc()'s existing per-line
|
||||
* "[VMName] " prefix (console.c, g_active_vm_name) already supplies the
|
||||
* bracket -- print only "ok> " here, don't build a second one. The
|
||||
* emergency_console bypass is a security decision, not a display one --
|
||||
* it still applies only to Hera's bare prompt, per FABRIC.md 4.4. */
|
||||
const char *vn = console_get_vm_name();
|
||||
int is_hera = (!vn || (vn[0]=='H' && vn[1]=='e' && vn[2]=='r' && vn[3]=='a' && vn[4]=='\0'));
|
||||
vm->emergency_console = is_hera ? (vm->zuse_session ? 0 : 1) : 0;
|
||||
* bracket -- print only "ok> " here, don't build a second one.
|
||||
* emergency_console is no longer set from here (FABRIC-3.md §F.20/
|
||||
* §F.21: the emergency-CLI ACL bypass is retired) -- it's driven
|
||||
* only by the genuine C-level fault handler now (vm.c's own
|
||||
* emergency-fault-recovery use, EMERGENCY_CONSOLE_ENABLED). Every
|
||||
* word run from this REPL, Hera's bare prompt included, goes
|
||||
* through ordinary ACL enforcement. */
|
||||
console_puts(SK_PROMPT_TEXT);
|
||||
}
|
||||
|
||||
@@ -533,15 +550,11 @@ void sk_repl_run(VM *vm)
|
||||
|
||||
/* Unified prompt (FABRIC.md 4.4a): console_putc()'s existing per-line
|
||||
* "[VMName] " prefix (console.c, g_active_vm_name) already supplies the
|
||||
* bracket -- print only "ok> " here, don't build a second one. The
|
||||
* emergency_console bypass is a security decision, not a display one --
|
||||
* it still applies only to Hera's bare prompt, per FABRIC.md 4.4. */
|
||||
{
|
||||
const char *vn = console_get_vm_name();
|
||||
int is_hera = (!vn || (vn[0]=='H' && vn[1]=='e' && vn[2]=='r' && vn[3]=='a' && vn[4]=='\0'));
|
||||
active->emergency_console = is_hera ? (active->zuse_session ? 0 : 1) : 0;
|
||||
console_puts(SK_PROMPT_TEXT);
|
||||
}
|
||||
* bracket -- print only "ok> " here, don't build a second one.
|
||||
* emergency_console is no longer set from here (FABRIC-3.md §F.20/
|
||||
* §F.21: the emergency-CLI ACL bypass is retired) -- see sk_repl_
|
||||
* step()'s matching comment above. */
|
||||
console_puts(SK_PROMPT_TEXT);
|
||||
|
||||
sk_readline(input, sizeof(input), active);
|
||||
|
||||
|
||||
Reference in New Issue
Block a user