Block 4016
( zuse.4th - Bootstrap superuser for StarForth ACL )
( Named for Konrad Zuse, pioneer of programmable computers. )
( Sole superuser; mints credentials; owns emergency REPL. )
( Loaded by ACL.4th; must not load before ACL.4th. )
( FUTURE: Replace with thumbdrive Ed25519 PKI. )
( HUMAN-REVIEW: capsule hash = root of superuser trust. )
( Cert (seed+pubkey) lives in C-only VM fields, installed by )
( kernel_main.c's first-boot mint-or-load (NVRAM ZuseCert). )
( NOT a CONSTANT: ACL-PIN blocks redefinition, not a )
( >BODY-then-store, so a pinned CONSTANT isn't tamper-proof. )
( Read with ZUSE-PUBKEY@ / ZUSE-CERT-INSTALLED? -- both C )
( primitives, read-only; the seed has no FORTH access at all. )

Block 4017
( ACL-ZUSE-BOOT ( -- )                               )
( Only authenticates if a real cert was installed this boot -- )
( refuses god-mode to a Zuse with no real identity behind her )
( (no runtime services, no entropy). Pins itself against )
( redefinition either way. ZUSE-AUTHENTICATE is C-only; no )
( FORTH word grants god-mode except through this sequence. )
: ACL-ZUSE-BOOT ( -- )
  ZUSE-CERT-INSTALLED? IF
    ZUSE-AUTHENTICATE
    LOG-INFO" zuse: activated"
  ELSE
    LOG-INFO" zuse: NOT activated -- no cert installed"
  THEN
  ['] ACL-ZUSE-BOOT ACL-PIN ;

Block 4018
( Self-activation )
ACL-ZUSE-BOOT