diff --git a/.agents/skills/add-bsp/SKILL.md b/.agents/skills/add-bsp/SKILL.md index b3461a3e..a83f479b 100644 --- a/.agents/skills/add-bsp/SKILL.md +++ b/.agents/skills/add-bsp/SKILL.md @@ -80,12 +80,15 @@ Execute each item before moving to the next. Do **not** assume any item is alrea ### 4. Write `boot.s` -Minimum content (aarch64 EL1 example): +Minimum stack/FP/BSS skeleton for a target already confirmed to enter at aarch64 EL1. Mask DAIF before unsafe setup; install vectors and finish the target boot checklist before unmasking. This is not a complete reference-BSP boot implementation: ```asm .section .text.boot, "ax" .global _start _start: + /* 0. Mask debug, SError, IRQ and FIQ before stack/FP/BSS setup */ + msr daifset, #0xf + /* 1. Set stack pointer */ adrp x0, __stack_top add x0, x0, :lo12:__stack_top @@ -111,7 +114,7 @@ _start: b 2b ``` -Adjust for EL2→EL1 transition if the target enters at EL2 (add `msr hcr_el2, …` / `eret` sequence before step 1). +For EL2 entry, follow the target’s Accepted boot-flow ADR and complete the EL2→EL1 policy before using this EL1 skeleton. A bare HCR/ERET insertion is not sufficient: interrupt masks, stack selection, timer access, trap controls and transition context depend on the verified target. The reference [ADR-0024](../../../docs/decisions/0024-el-drop-policy.md) and [boot.s](../../../bsp-qemu-virt/src/boot.s) show the existing QEMU policy; do not assume another board has the same entry state. ### 5. Implement `cpu.rs` @@ -130,7 +133,7 @@ Implement `tyrne_hal::Console` for the target UART. Follow the existing `Pl011Ua `kernel_entry` must: 1. Initialise the console and print the greeting (`tyrne: hello from kernel_main`). -2. Call `tyrne_kernel::sched` to register tasks and start the scheduler. +2. Initialize the target-specific prerequisites and use `tyrne_kernel::sched` to register/start the selected smoke workload. That workload must emit its completion marker after doing its declared work. 3. Never return (`-> !`). Provide a `#[panic_handler]` that writes to the console and loops. @@ -147,27 +150,33 @@ Model on [`bsp-qemu-virt/linker.ld`](../../../bsp-qemu-virt/linker.ld). At minim Create `tools/run-.sh`. For QEMU targets, model on [`tools/run-qemu.sh`](../../../tools/run-qemu.sh): -- Include the `--int-log` flag (`-d int -D /tmp/qemu_int.log`) for silent-hang debugging. +- Include an exception-log option for silent-hang debugging. The reference `--int-log` uses `-d int -D `, with `${TMPDIR:-/tmp}/qemu_int..log` printed at startup; use the printed path. Smoke `--int` instead uses `-d int,unimp`. - Document the QEMU machine flags in the script header. For real hardware, document the flashing command (e.g. `openocd`, `rpiboot`, `cargo flash`). ### 10. Verify the smoke test -Boot the kernel and confirm: +Boot the selected workload and confirm this minimal serial-success shape; `...` elides workload-specific lines: ```text tyrne: hello from kernel_main tyrne: starting cooperative scheduler -tyrne: task A — iteration 0 -tyrne: task B — iteration 0 ... -tyrne: task A done; spinning +tyrne: all tasks complete +``` + +Exact intervening/trailing lines depend on the kernel version and target workload; see the [README Quick start](../../../README.md#quick-start) for the verified reference trace. This minimal porting check does not establish full reference EL0/IPC parity: the reference [smoke.sh](../../../tools/smoke.sh) separately gates debug/release console, userspace exit/completion and fault classes. Retain evidence for whichever workload the target ADR declares. + +If the kernel hangs silently, run with `--int-log` (QEMU) or attach a JTAG debugger (real hardware). After quitting QEMU, inspect its printed path: + +```sh +grep "Taking exception" '' ``` -If the kernel hangs silently, run with `--int-log` (QEMU) or attach a JTAG debugger (real hardware) and check for the following before anything else: +Check the following before anything else: -1. Exception log: `grep "Taking exception" /tmp/qemu_int.log` +1. Exception log at the printed PID-scoped path — which exception fired? 2. CPACR_EL1 — is FPEN set? (ESR EC=0x07 = FP/SIMD trap) 3. SP misalignment — AAPCS64 stack-alignment fault? 4. BSS not zeroed — statics have garbage values? @@ -200,7 +209,7 @@ Trailer: `Refs: ADR-NNNN` (the boot-flow ADR from step 1). ## Anti-patterns - **Skipping the boot-flow ADR.** Every BSP has target-specific boot decisions; writing code before documenting them produces undocumented assumptions. -- **Copying `boot.s` without checking the EL.** QEMU `virt` enters EL1; RPi4 enters EL2. The CPACR_EL1 sequence is only needed if the kernel runs at EL1; at EL2 you need CPTR_EL2. +- **Copying `boot.s` without checking the EL.** Confirm the actual target entry state. The EL1 skeleton configures CPACR_EL1 after EL1 entry; EL2 setup and the transition require the target’s Accepted boot policy, not a single substitute register write. - **Using `#[inline(never)]` instead of `#[unsafe(naked)]` for the context switch.** The compiler will still emit a prologue. See `docs/standards/unsafe-policy.md §5a`. - **Omitting d8–d15 from `Aarch64TaskContext`.** NEON is enabled at boot; the compiler may allocate d8–d15 in any function. Omitting them silently corrupts task state at higher optimisation levels. - **Not zeroing BSS.** Rust guarantees `.bss` is zero; if the hardware or QEMU does not zero it, every static initialised to zero will have garbage values. diff --git a/.agents/skills/conduct-review/SKILL.md b/.agents/skills/conduct-review/SKILL.md index 9cb8f7ca..614781c8 100644 --- a/.agents/skills/conduct-review/SKILL.md +++ b/.agents/skills/conduct-review/SKILL.md @@ -51,6 +51,14 @@ when-to-use: When a trigger for any of the four review types fires — milestone - Body: one-paragraph summary of the verdict / adjustments. - Trailer: `Refs: ADR-0013` and any ADRs the review cites. +## Evidence retention + +Follow [ADR-0044](../../../docs/decisions/0044-review-evidence-retention.md) and [documentation storage policy](../../../docs/standards/documentation-style.md#evidence-storage). Keep complete canonical Markdown reports, original verdicts/findings/read limits, actual source identities and compact archive metadata in Git. Put bulk execution streams, intermediate JSON, source exports and encoded scratch archives outside Git in a digest-verified durable archive with independently tested recovery; expiring Actions artifacts alone are insufficient. + +Before producing a source export, exclude previously retained raw archive/snapshot trees so evidence does not recursively retain itself. Preserve original evidence in its authoritative archive rather than embedding retained archives or entire source exports in new Git JSON. Never remove original verdicts or invent a historical run to obtain a smaller diff. Hash checks establish integrity, not a complete semantic read; retain each reviewer’s actual scope and limitations. The [recovery guide](../../../docs/guides/review-evidence.md) explains original SHA/source recovery. + +Stage intended artifacts and run the separate footprint command/fixtures in addition to corpus checks. The approved limits cover the index and complete HEAD history; later deletion does not erase an oversized historical blob. Future exceptions require exact-path reasons and reviewed fixtures, never broad review-directory exclusions. This storage discipline adds no substitute for any master-plan role or required independent review round. + ## Acceptance criteria - [ ] Correct review type chosen for the trigger. diff --git a/.agents/skills/propose-standard-change/SKILL.md b/.agents/skills/propose-standard-change/SKILL.md index 1dffe95d..fd265dad 100644 --- a/.agents/skills/propose-standard-change/SKILL.md +++ b/.agents/skills/propose-standard-change/SKILL.md @@ -23,11 +23,11 @@ when-to-use: Whenever a rule in `docs/standards/` needs to change. Covers additi - If no ADR explicitly motivated the rule, the current standard is effectively an implicit decision that never had its ADR. The first step is to write the ADR that captures it — then supersede it — rather than silently changing the standard. 3. **Decide ADR path.** - - **Amendment of existing ADR.** The old ADR is still largely right; it just needs to be updated or clarified. Use the *amendment* pattern — edit the ADR in place with a Proposed-amendment note, get it accepted, then update the standard. + - **Factual clarification of an existing Accepted ADR.** Preserve the original body and append a dated rider stating the correction and its evidence, following [ADR-0025 Rule 2](../../../docs/decisions/0025-adr-governance-amendments.md#rule-2--riders-are-not-failures-their-frequency-is-a-signal). Review the rider before updating the standard. A rider must not silently introduce a substantive rule change under the old ADR's Accepted status. Proposed drafts remain editable. - **Supersession.** The old decision is being reversed or significantly changed. Use [supersede-adr](../supersede-adr/SKILL.md): write a new ADR that supersedes the old one. - **New ADR, no supersession.** The change is additive — a new principle, a new constraint — that the old ADRs did not address. Use [write-adr](../write-adr/SKILL.md) to record the new decision. -4. **Author the ADR first.** Standards follow decisions. Do not change the standard file until the ADR is `Accepted`. Drafting both in parallel is fine; committing the standard change before the ADR is not. +4. **Author the ADR first.** Standards follow decisions. For a substantive new or changed decision, obtain the maintainer's explicit approval and make the motivating ADR `Accepted` before changing the standard file. For a factual clarification of an already Accepted decision, review and record the append-only rider first. Drafting in parallel is fine; committing the standard change before its decision or correction record is not. 5. **Update the standard file.** Once the ADR is Accepted: - Edit `docs/standards/.md`. @@ -53,7 +53,7 @@ when-to-use: Whenever a rule in `docs/standards/` needs to change. Covers additi ## Acceptance criteria - [ ] Motivating ADR written (or identified if pre-existing). -- [ ] ADR is `Accepted` before the standard file is modified. +- [ ] Motivating decision is `Accepted` before the standard file is modified; a substantive new or changed decision has explicit maintainer approval, and any factual clarification rider is reviewed and recorded first. - [ ] Standard file change minimal; unchanged adjacent rules untouched. - [ ] References at the bottom of the standard point to the new ADR. - [ ] Downstream effects searched; affected docs updated or tracked. diff --git a/.agents/skills/start-task/SKILL.md b/.agents/skills/start-task/SKILL.md index e11edc3b..7e7f4102 100644 --- a/.agents/skills/start-task/SKILL.md +++ b/.agents/skills/start-task/SKILL.md @@ -8,7 +8,7 @@ when-to-use: When the next task in the active milestone becomes ready to pick up ## Inputs -- The **phase and milestone** the task belongs to (e.g. `A`, `A2`). +- The **phase and milestone/bridge Track** the task belongs to (e.g. `A` / `A2`, or `B.2` / `B.2-2`). Path IDs are lowercase without dots: C → `phase-c` / `phase-c.md`; B.2 → `phase-b2` / `phase-b2.md`. Bridge Tracks B.2-1…B.2-6 are distinct from Phase B milestones B0–B6. - A **short imperative title** (e.g. "Capability table foundation"). - Enough context to write a useful user story: who wants this, what they want, why. - The **dependencies** — prior tasks (T-NNN) that must be `Done` before this one starts, if any. @@ -18,7 +18,7 @@ when-to-use: When the next task in the active milestone becomes ready to pick up 1. **Read the current roadmap state.** - Check [`docs/roadmap/current.md`](../../../docs/roadmap/current.md). - - Confirm the phase and milestone exist in [`docs/roadmap/phases/phase-.md`](../../../docs/roadmap/phases/). + - Confirm the phase and milestone exist in [`docs/roadmap/phases/phase-.md`](../../../docs/roadmap/phases/). - If the milestone is not on the roadmap, stop and ask the maintainer — a missing milestone is a structural change and needs an ADR per [ADR-0013](../../../docs/decisions/0013-roadmap-and-planning.md). 2. **Assign the next T-NNN.** @@ -27,7 +27,7 @@ when-to-use: When the next task in the active milestone becomes ready to pick up - IDs are sequential across the whole project, not restarted per phase. - **Single-writer assumption.** Two concurrent task-creation flows can both observe the same "highest existing T-NNN" and allocate the same ID. v1 relies on a *single active writer* per branch: run this skill on a branch rebased onto `development`, and if at merge time another `T-NNN-*.md` with your chosen id has landed, re-run the numbering step (list again, pick a fresh highest+1, `git mv` the file, update every internal reference). A ledger-based reservation mechanism may arrive later; for now, the single-writer convention is the contract. -3. **Create the task file** at `docs/analysis/tasks/phase-/T-NNN-.md`. +3. **Create the task file** at `docs/analysis/tasks/phase-/T-NNN-.md`. - Copy from [`docs/analysis/tasks/TEMPLATE.md`](../../../docs/analysis/tasks/TEMPLATE.md). - Fill the frontmatter fields: `Phase`, `Milestone`, `Status`, `Created`, `Author`, `Dependencies`, `Informs`, `ADRs required`. No placeholder values left from the template. @@ -38,9 +38,9 @@ when-to-use: When the next task in the active milestone becomes ready to pick up - If the task is being picked up for immediate work, move to `In Progress`. - Do not jump straight to `In Review` or `Done`. -6. **Update the phase's task index** at `docs/analysis/tasks/phase-/README.md`. Add the new task to its table. +6. **Update the phase's task index** at `docs/analysis/tasks/phase-/README.md`. Add the new task to its table. -7. **Update the phase plan** at `docs/roadmap/phases/phase-.md` if the task is mentioned by id in the milestone's `Tasks under ` list. +7. **Update the phase plan** at `docs/roadmap/phases/phase-.md` if the task is mentioned by id in the milestone's `Tasks under ` list. 8. **Update [`docs/roadmap/current.md`](../../../docs/roadmap/current.md)** if the status is `In Progress`. - The `Active task` line points at the new file. @@ -58,7 +58,7 @@ when-to-use: When the next task in the active milestone becomes ready to pick up ## Acceptance criteria -- [ ] New file at `docs/analysis/tasks/phase-/T-NNN-.md`. +- [ ] New file at `docs/analysis/tasks/phase-/T-NNN-.md`. - [ ] Frontmatter fields are filled — no placeholders from the template. - [ ] User story section answers *who / what / why* in one sentence. - [ ] Acceptance criteria are concrete and testable (3–8 items; at most 10). diff --git a/.agents/skills/supersede-adr/SKILL.md b/.agents/skills/supersede-adr/SKILL.md index ac7e0092..7f3a3656 100644 --- a/.agents/skills/supersede-adr/SKILL.md +++ b/.agents/skills/supersede-adr/SKILL.md @@ -1,7 +1,7 @@ --- name: supersede-adr description: Override a prior Accepted ADR with a new one, updating both files so the forward and backward pointers are consistent. -when-to-use: When a decision recorded in a prior ADR is being reversed or significantly changed. Not for minor clarifications (edit the original with a Proposed-amendment note instead). +when-to-use: When a decision recorded in a prior ADR is being reversed or significantly changed. Not for minor clarifications (append a dated correction rider under ADR-0025 instead). --- # Supersede ADR @@ -20,19 +20,26 @@ Before starting, the agent must have: 1. **Read the old ADR in full.** Understand what it claimed, what alternatives it considered, and what consequences it accepted. Do not supersede what you have not read. 2. **Decide: supersession or amendment?** - - **Amendment** (not this skill): small clarifications, typo fixes, reference updates. Edit the original ADR in place. + - **Amendment** (not this skill): small clarifications, typo fixes, reference updates. For an Accepted ADR, append a dated correction/pointer rider under [ADR-0025 Rule 2](../../../docs/decisions/0025-adr-governance-amendments.md#rule-2--riders-are-not-failures-their-frequency-is-a-signal), preserving the original body. Proposed drafts remain editable. - **Supersession** (this skill): the decision outcome changes, the considered options change meaningfully, or the consequences shift enough that a reader should understand a new decision has been made. 3. **Write the new ADR** using the [write-adr](../write-adr/SKILL.md) skill. - - In the **Context** section of the new ADR, explicitly say: - > This ADR supersedes [ADR-NNNN: Title](NNNN-slug.md). The earlier decision… - Then explain what was decided originally and what has changed to warrant the new decision. + - In the **Context** section of the new ADR, explicitly say (template; substitute the actual sibling filename): + +```markdown +This ADR supersedes [ADR-NNNN: Title](NNNN-slug.md). The earlier decision… +``` + + Then explain what was decided originally and what has changed to warrant the new decision. - In the **References** section, link the superseded ADR. 4. **Update the old ADR's header.** - Change `Status:` from `Accepted` to `Superseded by MMMM` (where MMMM is the new ADR's number). - - Add a `> **Superseded.**` callout at the very top of the body, before the Context section: - > **Superseded by [ADR-MMMM: New Title](MMMM-new-slug.md) (YYYY-MM-DD).** The original decision below is preserved for the historical record. + - Add a callout at the very top of the body, before Context (template; substitute the actual sibling filename and date): + +```markdown +> **Superseded by [ADR-MMMM: New Title](MMMM-new-slug.md) (YYYY-MM-DD).** The original decision below is preserved for the historical record. +``` - **Do not edit the original body.** The original reasoning is the historical record and must stay intact. 5. **Update the ADR index** at [`docs/decisions/README.md`](../../../docs/decisions/README.md): @@ -65,7 +72,7 @@ Before starting, the agent must have: - **Superseding without new information.** If nothing has changed, the old decision is still right and supersession is not needed. - **Silent overrides.** Making a contradicting decision in a new ADR without flipping the old one's status leaves the repo with two contradictory "Accepted" ADRs. - **Forgetting the back-pointer.** The old ADR must link forward to the new one; otherwise a reader following references misses the supersession. -- **Using supersession for a minor fix.** That is an amendment, not a supersession. Edit in place. +- **Using supersession for a minor fix.** That is an amendment, not a supersession. Append a dated correction/pointer to an Accepted record; preserve its body. ## References diff --git a/.agents/skills/sync-adr-index/SKILL.md b/.agents/skills/sync-adr-index/SKILL.md index a42110eb..1bfcdca9 100644 --- a/.agents/skills/sync-adr-index/SKILL.md +++ b/.agents/skills/sync-adr-index/SKILL.md @@ -22,13 +22,15 @@ None. This skill scans the filesystem and reconciles. - Extract: - **Number** — from the filename. - **Title** — from the first `#` heading, with the "NNNN — " prefix stripped. - - **Status** — from the `- **Status:** ...` line in the header block. Valid values: `Proposed`, `Accepted`, `Deprecated`, `Superseded by NNNN`. - - **Date** — from the `- **Date:** ...` line. + - **Status** — from the `- **Status:** ...` line in the header block. Ordinary values: `Proposed`, `Accepted`, `Deprecated`, `Superseded by NNNN`. Preserve the existing evidence-backed `Deferred` placeholder in ADR-0023 and ADR-0022's full qualified partial-supersession status; report these forms explicitly. An unfamiliar status is an anomaly, not permission to infer acceptance. + - **Date** — the entire `- **Date:** ...` value. New records use ISO-8601; preserve ADR-0023's existing prose-extended Date, reporting its historical form instead of truncating it or guessing a filing date. + - Preserve the heading's title exactly after stripping the number prefix, including inline code; a historical descriptive index alias is a mismatch to report, not the source of the title. - If any field is missing or malformed, record the anomaly and continue. Anomalies are reported at the end, not silently ignored. 3. **Cross-check supersession.** - - For every ADR whose status is `Superseded by MMMM`, confirm that ADR `MMMM` exists and is `Accepted`. - - For every ADR whose body (or `References`) points forward to a superseding ADR, confirm the older ADR's status actually says `Superseded by`. + - For every ADR whose status starts with `Superseded by MMMM`, confirm that ADR `MMMM` exists and is `Accepted`; retain any explicit partial-axis qualification. + - Check the older callout and newer Context/References for consistent forward/backward supersession pointers and scope. ADR-0022/0026 supersede only the idle-location axis; the typed-error decision still stands. ADR-0041/0042 record whole-decision supersession. + - Distinguish explicit supersession from ordinary correction, implementation, or cross-reference riders. A forward link alone does not require a status flip. Report an actual conflicting decision or missing supersession pointer; do not relabel every Accepted record that links to a later ADR. - Record inconsistencies as anomalies. 4. **Rebuild the index table.** In [`docs/decisions/README.md`](../../../docs/decisions/README.md), replace the contents of the `## Index` section's table with freshly generated rows: @@ -42,17 +44,19 @@ None. This skill scans the filesystem and reconciles. ``` - Rows are in numeric order. - - Each title is a relative link to its ADR file. + - Each title is a relative link to its ADR file and matches the exact header title. - Status column reflects exactly what the ADR header says. - Date column is the ADR's authoritative `Date:` field. -5. **Do not touch the rest of `README.md`.** The surrounding sections (Why ADRs, Format, Creating a new ADR) are not this skill's responsibility. +5. **Do not touch the rest of `README.md` during an ordinary index rebuild.** The surrounding sections (Why ADRs, Format, Creating a new ADR) are not this skill's responsibility. Separately authorized procedure/metadata reconciliation, such as [T-055](../../../docs/analysis/tasks/phase-b2/T-055-adr-append-only-corrections.md) under [ADR-0043](../../../docs/decisions/0043-documentation-corpus-consistency.md), records its own scope and evidence; an index sync alone does not authorize it. 6. **Report anomalies** to the maintainer, if any: - ADRs missing a Status or Date. - ADRs with status `Superseded by MMMM` where MMMM does not exist or is not Accepted. - - ADRs whose title does not match their filename slug. - - Gaps in numbering (unless justified — e.g. ADR-0003 was proposed and rejected before being saved; record the gap in the anomalies report). + - Missing, extra or duplicate index members and title/status/full-Date mismatches against source headers, with before/after values and disposition. + - ADRs whose title does not match their filename slug, separately from index/header mismatches. Normalize a full title by lowercasing ASCII alphanumerics and joining other runs with hyphens for this literal comparison; report fuller historical titles without renaming filed records or claiming a synchronized index removes those differences. + - Evidence-backed noncanonical metadata forms (Deferred, prose-extended Date, qualified partial supersession), explicitly distinguished from missing/malformed/unknown values. Preserve the supported historical value; do not make it a blanket exception for new records. + - Gaps in numbering with their actual evidence and disposition. Slot 0034 is intentionally reserved by ADR-0027 and documented in the index; do not invent a record or renumber later ADRs to close it. Report any other gap without fabricating its cause. 7. **Commit** per [commit-style.md](../../../docs/standards/commit-style.md): - Message: `docs(adr): sync index`. @@ -64,6 +68,7 @@ None. This skill scans the filesystem and reconciles. - [ ] Each row's title, status, and date match the corresponding ADR's header. - [ ] Supersession back-pointers consistent in both directions. - [ ] Anomalies (if any) reported explicitly, not silently patched. +- [ ] Historical title/slug differences and metadata forms are reported separately from repaired index/header mismatches; no blanket "no anomalies" claim hides them. ## Anti-patterns @@ -71,6 +76,7 @@ None. This skill scans the filesystem and reconciles. - **Silently fixing anomalies.** If an ADR lacks a Date, the sync reports the missing field; it does not guess. - **Reformatting the surrounding `README.md` prose.** The table is all this skill rebuilds. - **Renumbering ADRs to close gaps.** ADR numbers are stable history; gaps are acceptable, renumbering breaks citations. +- **Collapsing a rider into supersession.** A correction pointer is not a whole-decision override; preserve explicit partial-axis scope. ## References diff --git a/.agents/skills/write-adr/SKILL.md b/.agents/skills/write-adr/SKILL.md index 09a58674..9738f65a 100644 --- a/.agents/skills/write-adr/SKILL.md +++ b/.agents/skills/write-adr/SKILL.md @@ -21,6 +21,7 @@ Before starting, the agent must have: 1. **Determine the next ADR number.** - List files in `docs/decisions/` matching `NNNN-*.md`. - The next number is the highest existing number + 1, zero-padded to four digits. + - For a planned ledger decision, use its stable milestone-plus-purpose identity to locate the row; its historical numeric aliases do not reserve a number ([ADR-0043](../../../docs/decisions/0043-documentation-corpus-consistency.md)). The explicitly reserved 0034 slot is unchanged. 2. **Create the file** at `docs/decisions/NNNN-.md`. @@ -51,6 +52,7 @@ Before starting, the agent must have: - Format: `| NNNN | [Title](NNNN-slug.md) | Proposed | YYYY-MM-DD |`. 8. **Cross-link** the new ADR from any standard or architecture document that motivated it. + - If a phase ledger planned this decision, preserve its purpose identity as a historical alias in the filed record and update the existing ledger row to link to the real ADR. Do not delete the purpose identity or create a second live definition. 9. **Commit** per [commit-style.md](../../../docs/standards/commit-style.md): - Message: `docs(adr): propose ADR-NNNN — `. @@ -69,6 +71,7 @@ Before starting, the agent must have: - [ ] **Decision outcome includes a *Dependency chain* subsection** with every step grounded in either an existing T-NNN file or one opened as part of the same commit. No "future, not-yet-opened task" wording. - [ ] Consequences include both positive and negative items. - [ ] ADR index at [`docs/decisions/README.md`](../../../docs/decisions/README.md) has the new row. +- [ ] For a planned ledger decision, the filed record preserves its purpose identity as a historical alias and the existing ledger definition links to that record; historical numbers are not treated as reservations. - [ ] No contradiction with a prior Accepted ADR; if there was one, the [supersede-adr](../supersede-adr/SKILL.md) skill was used instead. - [ ] **Initial commit lands the ADR at `Proposed`.** The Propose commit is separate from any subsequent Accept commit so the careful-re-read pass shows up as its own diff. Accept may follow same-day after the re-read of step 10 (no calendar gate per [ADR-0025 §Revision notes](../../../docs/decisions/0025-adr-governance-amendments.md)), but never in the same commit as the initial draft. @@ -89,3 +92,4 @@ Before starting, the agent must have: - [docs/decisions/template.md](../../../docs/decisions/template.md) — the template to copy from. - [commit-style.md](../../../docs/standards/commit-style.md) — commit format. - [architectural-principles.md](../../../docs/standards/architectural-principles.md) — principles that constrain every ADR. +- [ADR-0043](../../../docs/decisions/0043-documentation-corpus-consistency.md) — stable planned-decision identities and allocation at filing. diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0c3a785f..642a5cb1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -88,6 +88,18 @@ jobs: # CI only reads the repo; do not persist the token into local git # config (least-privilege; avoids credential reuse by later steps). persist-credentials: false + # Footprint policy covers historical blobs, including later deletions. + fetch-depth: 0 + - name: Documentation consistency fixtures (offline) + run: | + python3 tools/test-check-docs.py + python3 tools/test-docs-metadata.py + - name: Documentation corpus consistency (required) + run: python3 tools/check-docs.py + - name: Repository footprint fixtures (offline temporary Git) + run: python3 tools/test-repo-footprint.py + - name: Repository footprint (required full history) + run: python3 tools/check-repo-footprint.py - name: Install pinned nightly with rustfmt + clippy run: | rustup toolchain install "$NIGHTLY_PIN" --component rustfmt --component clippy --no-self-update diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index eae6de63..b1d9fde8 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,6 +1,6 @@ # Contributing to Tyrne -Thank you for your interest. Tyrne is **pre-alpha** and mid-way through Phase B: the Rust workspace exists, the kernel boots end-to-end on QEMU `virt` aarch64, and it runs a two-task IPC demo. Implementation is active, but the codebase is not yet open for unsolicited code contributions — each subsystem is being grown along the phased roadmap, and changes outside the active milestone's scope force premature rewrites. Issues, references, and ADR review are very welcome (see below). +Thank you for your interest. Tyrne is **pre-alpha**. Phase B closed on 2026-06-01: the kernel boots on QEMU `virt` aarch64 and runs its first EL0 userspace task through a capability-gated syscall boundary. Phase B.2 is the active consolidation bridge; Phase C is next and gated on B.2 completion. Implementation is active, but the codebase is not yet open for unsolicited code contributions — each subsystem is being grown along the phased roadmap, and changes outside the active milestone's scope force premature rewrites. Issues, references, and ADR review are very welcome (see below). ## What is useful right now @@ -11,17 +11,17 @@ Thank you for your interest. Tyrne is **pre-alpha** and mid-way through Phase B: ## What is not useful yet -- Pull requests against source code outside the active milestone scope. The Rust workspace exists and the kernel boots end-to-end on QEMU virt (Phase A and milestones B0–B3 closed; B4 active), but each subsystem is being grown along the phased roadmap in [`docs/roadmap/`](docs/roadmap/); changes outside the current milestone's scope force premature rewrites and are usually not merged. Check [`docs/roadmap/current.md`](docs/roadmap/current.md) before opening a non-trivial PR. +- Pull requests against source code outside the active roadmap scope. Each subsystem follows the phased [roadmap](docs/roadmap/); check [current focus](docs/roadmap/current.md) before opening a non-trivial PR. Changes outside the active scope force premature rewrites and are usually not merged. - Feature requests for subsystems that have not yet been designed. File those as discussion issues if you want to influence the design, not as feature requests. -## When the project enters the implementation phase +## Implementation workflow -This document will be expanded with: +For work within the active scope: -- Branching strategy and release process. -- PR template and review expectations. -- CI gates (tests, clippy, rustfmt, capability auditing, `unsafe` auditing). -- Coding conventions (see [docs/standards/](docs/standards/)). +1. Start from [current focus](docs/roadmap/current.md) and the relevant [task](docs/analysis/tasks/). Propose a plan for non-trivial work; record architectural or process decisions as [ADRs](docs/decisions/) before implementation. +2. Follow the [coding and documentation standards](docs/standards/) and [commit style](docs/standards/commit-style.md). Keep changes focused and include verification appropriate to the change. +3. Use the [CI guide](docs/guides/ci.md) for local checks and the required merge gates. Record an ordinary [code review](docs/standards/code-review.md) and a distinct [security review](docs/standards/security-review.md) when the change touches a security-sensitive area. +4. Follow the [release standard](docs/standards/release.md) for releases. Release preparation and review remain separate from routine implementation. ## Communication diff --git a/LICENSE b/LICENSE index 0c0af79f..087130d0 100644 --- a/LICENSE +++ b/LICENSE @@ -186,7 +186,7 @@ same "printed page" as the copyright notice for easier identification within third-party archives. - Copyright 2026 Cemil İlik and Tyrne contributors + Copyright 2026 HodeTech, Cemil ILIK and Tyrne Contributors Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/NOTICE b/NOTICE index fe731e46..7d5ddbdf 100644 --- a/NOTICE +++ b/NOTICE @@ -1,5 +1,5 @@ Tyrne — a capability-based microkernel -Copyright 2026 HodeTech and Tyrne contributors +Copyright 2026 HodeTech, Cemil ILIK and Tyrne Contributors This product includes software developed by the Tyrne project (https://github.com/HodeTech/Tyrne). diff --git a/README.md b/README.md index 74a36dc3..f5d5a394 100644 --- a/README.md +++ b/README.md @@ -7,8 +7,8 @@ > A capability-based microkernel written in Rust, designed to scale from constrained smart-home devices to mobile-class hardware while carrying the same isolation and capability discipline to every tier. Tyrne is built around a single idea: **no ambient authority**. -Every action a component takes is authorised by a capability it was explicitly granted, and the kernel is small enough that the entire trusted computing base can be audited line by line. -Drivers, filesystems, and network stacks live in userspace; the kernel concerns itself only with capabilities, IPC, scheduling, memory, and interrupt dispatch. +Kernel-mediated object operations are authorised by explicitly granted capabilities, and the kernel is designed to keep the trusted computing base auditable. +Userspace drivers, filesystems and network stacks are the target architecture. Today the QEMU BSP supplies privileged hardware drivers; the running workload is two EL1 demo tasks and one EL0 hello program. The project is pre-alpha. The kernel boots end-to-end on QEMU `virt` aarch64 today, runs a capability-gated IPC demo, and serves the first real userspace task in EL0 via a capability-gated syscall boundary. @@ -21,15 +21,15 @@ Phase B.2 (consolidation and hardening: CI gates, correctness fixes, documentati | Area | State | |------|-------| -| Boot, console, scheduler | **Done** — kernel reaches steady state on QEMU `virt` aarch64; two cooperative tasks run an end-to-end IPC round-trip. | +| Boot, console, scheduler | **Done** — QEMU `virt` aarch64 completes the cooperative IPC/EL0 demo, then Task A spins without yielding. | | Capability tables + IPC | **Done** — `cap_copy` / `cap_derive` / `cap_revoke` / `cap_drop`; synchronous send/recv with rollback-on-deadlock. | -| Exception infrastructure + GIC v2 | **Done** — 16-entry vector table at `VBAR_EL1`; generic-timer IRQ wiring; idle `wfi` activation. | -| MMU activation + page-table walker | **Done** — identity-mapped `TTBR0_EL1` with typed `MapperFlush` discipline. | +| Exception infrastructure + GIC v2 | **Done** — 16-entry vector table at `VBAR_EL1`, generic-timer IRQ wiring and idle WFI fallback; the default demo exercises neither timer IRQ delivery nor idle. | +| MMU activation + page-table walker | **Done** — temporary bootstrap identity mappings, high-half kernel `TTBR1_EL1`, and per-task `TTBR0_EL1`; typed `MapperFlush` discipline. | | Physical Memory Manager | **Done** — bitmap allocator with zero-fill on `alloc_frame` and three-stage validation on `free_frame`. | -| Per-task `AddressSpace` kernel object | **Done** — cap-gated `cap_create_address_space` / `cap_map` / `cap_unmap`. | +| Per-task `AddressSpace` kernel object | **Done** — cap-gated kernel APIs `cap_create_address_space` / `cap_map` / `cap_unmap`; not yet userspace syscalls. | | Task loader (load half) | **Done** — `load_image` produces a `LoadedImage` describing a populated address space for a `.rodata`-resident raw-flat blob. | -| Syscall ABI + dispatcher | **Done** — Phase B5; `SVC` trap → panic-free dispatcher → typed `SyscallError`; five-syscall v1 set; capability-gated `console_write` (debug-gated); validated copy-from/to-user. | -| First userspace task (EL0) | **Done** — Phase B6 (closed 2026-06-01); `userland/hello` runs in its own address space, calls `console_write` through the real lower-EL `+0x400` vector, and exits via `task_exit`; per-page user-VA translation + per-task capability table in place. | +| Syscall ABI + dispatcher | **Done** — Phase B5; `SVC` trap → panic-free dispatcher → typed `SyscallError`; four release syscalls plus debug-only capability-gated `console_write`; validated copy-from/to-user primitives. | +| First userspace task (EL0) | **Done** — Phase B6 (closed 2026-06-01); `userland/hello` runs in its own address space, attempts `console_write` through the real lower-EL `+0x400` vector (greeting in debug only), and exits via `task_exit`; per-page user-VA translation + per-task capability table in place. | | Consolidation and hardening | **Active** — Phase B.2 ([ADR-0040](docs/decisions/0040-phase-b2-consolidation-bridge.md)); real CI gates (`--release`, userland clippy, QEMU smoke), correctness and robustness fixes, documentation catch-up; tasks in [`docs/analysis/tasks/phase-b2/`](docs/analysis/tasks/phase-b2/README.md). | | Multi-core + preemption | **Next** (gated by B.2) — Phase C; secondary core bring-up (PSCI), per-core state, preemptive scheduling, cross-core IPC, multi-core TLB shootdown. | @@ -41,20 +41,20 @@ Full phase plans are under [`docs/roadmap/phases/`](docs/roadmap/phases/). ## What makes Tyrne different **Capability discipline, end to end.** -Every privileged operation requires the caller to hold a capability that names it. -Capabilities are unforgeable kernel-held tokens with explicit derivation trees; revoking a parent cascades to its children. +Kernel-mediated IPC, debug-console access and address-space mutation require the corresponding capability; task yield/exit use the current task identity. +Capabilities are unforgeable kernel-held tokens with explicit per-table derivation trees; revocation cascades through descendants in that table. Cross-table transitivity is deferred in [ADR-0023](docs/decisions/0023-cross-table-capability-revocation-policy.md). There is no equivalent of a UNIX root, an admin override, or an ambient `CAP_SYS_ADMIN`. The discipline is documented in [ADR-0014](docs/decisions/0014-capability-representation.md) and surfaces in every wrapper — `cap_map(cap, …)`, `cap_create_address_space(parent_cap, …)`, etc. **Microkernel by construction, not by branding.** The kernel runs exclusively in privileged mode and contains five subsystems: capabilities, IPC, scheduling, memory management, and interrupt dispatch. -Drivers, filesystems, and network stacks land in userspace compartments — see [`docs/architecture/overview.md`](docs/architecture/overview.md) for the layer diagram. +The target design puts drivers, filesystems and network stacks in userspace compartments; today hardware drivers remain in the privileged BSP — see [`docs/architecture/overview.md`](docs/architecture/overview.md) for the layer diagram. Adding a feature does not enlarge the trusted computing base unless it strictly has to. **Memory safety through Rust + audited `unsafe`.** All kernel, HAL, and userspace code is Rust. Every `unsafe` block carries a SAFETY comment explaining (a) why it is needed, (b) the invariants it upholds, and (c) why safer alternatives were rejected, and is tracked in [`docs/audits/unsafe-log.md`](docs/audits/unsafe-log.md) with a numbered ID, a reviewed-by line, and a status field. -The audit log is the source of truth for the current set of `unsafe` blocks; in the kernel crate, production `unsafe` is a small audited set — the PMM frame-zeroing, the task-loader byte-copy, and the scheduler/IPC raw-pointer bridge — each carrying an audit-log entry. +The audit log is the source of truth for current `unsafe`. Illustrative kernel operations include PMM frame-zeroing, task-loader copying, the scheduler/IPC raw-pointer bridge, and validated copy-from/to-user byte moves ([UNSAFE-2026-0030](docs/audits/unsafe-log.md), [user-access implementation](kernel/src/syscall/user_access.rs)). `copy_from_user` serves console input; `copy_to_user` is a tested primitive without a v1 syscall caller. **HAL separation as a hard architectural rule.** Hardware-specific code lives behind a small set of traits — `Console`, `Cpu`, `Mmu`, `Timer`, `IrqController`, `ContextSwitch` — defined in the `tyrne-hal` crate. @@ -75,38 +75,46 @@ See the [ADR index](docs/decisions/README.md) for the full list with each ADR's ## Quick start The primary development target is QEMU's `virt` machine. -Boot the kernel end-to-end with two commands: +From the repository root, build userland before the BSP, then run the debug image: ```sh -# 1. Build the kernel image (aarch64-unknown-none target). +# 1. Generate hello.bin for the debug profile. +tools/build-userland.sh + +# 2. Build the kernel image (aarch64-unknown-none), embedding hello.bin. cargo kernel-build -# 2. Run it under QEMU; serial is multiplexed onto your terminal. +# 3. Run it under QEMU; serial is multiplexed onto your terminal. cargo kernel-run ``` -You should see, in order (the exact frame counts and addresses are representative and vary by build): +You should see the debug serial lines below in this order. `...` elides build/host-dependent values; the [fresh T-050 trace](docs/analysis/reports/2026-10-13-t050-entry-document-verification.md) records the exact output. ```text tyrne: hello from kernel_main tyrne: mmu activated tyrne: high-half active -tyrne: pmm initialized (32599 frames available; 169 reserved) -tyrne: address-space-arena ready (1 / 8 slots used; bootstrap AS root = 0x40095000) -tyrne: image loaded (entry = 0x800000; sp = 0x802000; image bytes 117; stack bytes 4096; AS cap = idx 1) -tyrne: timer ready (62500000 Hz, resolution 16 ns) +tyrne: pmm initialized (... frames available; ... reserved) +tyrne: address-space-arena ready (... slots used; bootstrap AS root = ...) +tyrne: timer ready (... Hz, resolution ... ns) tyrne: starting cooperative scheduler tyrne: task B — waiting for IPC tyrne: task A -- sending IPC -tyrne: task B — received IPC (label=0xaaaa); replying -tyrne: task A — received reply (label=0xbbbb); done hello from userspace tyrne: userspace task exited +tyrne: task B — received IPC (label=0xaaaa); replying +tyrne: task A — received reply (label=0xbbbb); done tyrne: all tasks complete tyrne: boot-to-end elapsed = ... ns ``` -Exit QEMU with `Ctrl-A x`. +Exit QEMU with `Ctrl-A x`; Task A spins after completion. For a bounded exception-logged build/run use: + +```sh +tools/smoke.sh --int +``` + +For release, use `tools/smoke.sh --release --int`, or build userland with `--release`, then `cargo kernel-build --release` and `tools/run-qemu.sh --release`. Release omits the debug-only greeting and still reaches exit/completion. Rebuild matching userland when switching profiles: both write the same ignored `hello.bin`. Full prerequisites, troubleshooting, and a line-by-line trace breakdown live in [`docs/guides/run-under-qemu.md`](docs/guides/run-under-qemu.md). **Host-side tests** (no QEMU required): @@ -122,8 +130,7 @@ cargo fmt --check ## Architecture at a glance -Three layers. -The kernel runs at EL1; userspace runs at EL0 via a capability-gated `SVC` boundary. +Three layers define the target design shown below. The kernel runs at EL1; userspace runs at EL0 via an `SVC` boundary with capability checks for object operations. Init, driver and service tasks in the diagram are planned; today the BSP hardware drivers run at EL1 and hello is the sole EL0 program. ```mermaid flowchart TB @@ -156,13 +163,13 @@ For a deeper read, start with [`docs/architecture/overview.md`](docs/architectur ## Hardware tiers -Tiers describe the level of support committed to a target, not the quality of that target. +Tiers express intended support priority. QEMU `virt` is implemented; the other targets below are planned ports or longer-term goals. | Tier | Target | Role | |------|--------|------| | 1 — primary dev | QEMU `virt`, aarch64 | First bring-up target; CI runs here | -| 2 — first real hardware | Raspberry Pi 4 (BCM2711, Cortex-A72) | First port off emulation | -| 2 | Raspberry Pi 5 (BCM2712, Cortex-A76) | Follow-on after Pi 4 | +| 2 — first real hardware | Raspberry Pi 4 (BCM2711, Cortex-A72) | Planned first port off emulation | +| 2 | Raspberry Pi 5 (BCM2712, Cortex-A76) | Planned follow-on after Pi 4 | | 3 | NVIDIA Jetson Nano / Orin (aarch64 CPU only) | Exploratory — see Jetson caveat below | | 3 | RISC-V embedded SoCs (e.g. ESP32-C3/C6, SiFive) | Roadmap — smart-home class | | 4 | Mobile-class aarch64 SoCs | Long-term vision | @@ -181,7 +188,7 @@ It is one of seven rules listed at the top of [`CLAUDE.md`](CLAUDE.md). ## Repository layout -``` +```text . ├── kernel/ tyrne-kernel — capability tables, IPC, scheduler, │ memory management, kernel objects (Task, Endpoint, @@ -197,13 +204,16 @@ It is one of seven rules listed at the top of [`CLAUDE.md`](CLAUDE.md). │ boot.s + vectors.s, EL2→EL1 drop, MMU bootstrap, │ PL011 UART driver, GIC v2 driver, kernel_entry │ wiring up every subsystem in order. -├── tools/ Developer helpers (run-qemu.sh, perf harness, etc.). +├── userland/ +│ ├── tyrne-user/ Safe syscall wrappers and audited bare-metal SVC shim. +│ └── hello/ First EL0 program; build-userland.sh generates hello.bin. +├── tools/ Developer helpers (userland build, QEMU smoke, perf harness). ├── docs/ │ ├── architecture/ System design chapters (overview · boot · scheduler │ │ · IPC · HAL · memory-management · task-loader │ │ · exceptions · security-model). │ ├── decisions/ Architecture Decision Records (MADR-style, append-only). -│ ├── guides/ How-to guides (run-under-qemu, two-task-demo, ci). +│ ├── guides/ How-to guides (run-under-qemu, two-task-demo, first-userspace, ci). │ ├── standards/ Coding, documentation, review, and security standards. │ ├── audits/ unsafe-log.md — every audited unsafe block. │ ├── analysis/ Per-task user stories, business / security / @@ -220,8 +230,7 @@ It is one of seven rules listed at the top of [`CLAUDE.md`](CLAUDE.md). └── NOTICE ``` -Four Rust crates, one Cargo workspace. -The split is pinned in [ADR-0006](docs/decisions/0006-workspace-layout.md). +Six Rust workspace members: kernel, HAL, test-HAL, the QEMU BSP and two userland crates. Three default host members are kernel/HAL/test-HAL. The initial split is [ADR-0006](docs/decisions/0006-workspace-layout.md); the userland pipeline is [ADR-0039](docs/decisions/0039-userland-build-pipeline.md). --- @@ -240,8 +249,10 @@ The first dozen ADRs establish the project's design language; the rest apply tha The index in [`docs/decisions/README.md`](docs/decisions/README.md) lists every ADR with title, status, and date. **Reader who wants to do something concrete.** + - [`docs/guides/run-under-qemu.md`](docs/guides/run-under-qemu.md) — boot the kernel under QEMU. - [`docs/guides/two-task-demo.md`](docs/guides/two-task-demo.md) — annotated trace of the IPC demo. +- [`docs/guides/first-userspace.md`](docs/guides/first-userspace.md) — build and inspect the first EL0 task, syscall return and exit. - [`docs/guides/ci.md`](docs/guides/ci.md) — what the CI pipeline runs and why. - [`docs/standards/`](docs/standards/) — coding, documentation, review, and security disciplines that every change is held to. - [`docs/glossary.md`](docs/glossary.md) — project-specific terminology. diff --git a/SECURITY.md b/SECURITY.md index c80f6964..d98512f3 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -4,7 +4,31 @@ Tyrne is a security-oriented operating system project. Even while it is in pre-a ## Project status and guarantees -Tyrne is **pre-alpha**. The kernel boots end-to-end on QEMU virt aarch64 (Phase A and milestones B0–B3 closed; B4 active) and runs a two-task IPC demo through to completion, but it is not yet a userspace-bearing OS — no production use is supported, and no security guarantees are made for the current tree. The formal threat model is documented in [`docs/architecture/security-model.md`](docs/architecture/security-model.md) (Accepted) and refined as Phase B progresses; both the model and the codebase will continue to evolve until the project reaches a stable release. +Tyrne is **pre-alpha**: no production use is supported and no security guarantees are made for the current tree. Phase B closed on 2026-06-01. The kernel boots on QEMU `virt` aarch64 and runs its first EL0 userspace task. Phase B.2 is the active consolidation bridge; Phase C is next and gated on B.2 completion. See [current focus](docs/roadmap/current.md) for active work and the [security model](docs/architecture/security-model.md) for the architectural threat model; design goals there must be distinguished from the implementation limits below. + +## Current EL0 boundary and limits + +The v1 ABI defines five calls ([ADR-0030](docs/decisions/0030-syscall-abi.md), [ADR-0031](docs/decisions/0031-initial-syscall-set.md)): + +| Number | Call | Authority and availability | +|--------|------|----------------------------| +| 1 | `ipc_send` | Endpoint capability with `SEND`. | +| 2 | `ipc_recv` | Endpoint capability with `RECV`. | +| 3 | `task_yield` | Acts on the current caller's own task; no capability argument. | +| 4 | `task_exit` | Terminates scheduling of the current caller; does not return; no capability argument. | +| 5 | `console_write` | `DebugConsole` capability with `CONSOLE_WRITE`; available only when `debug_assertions` is enabled. | + +In a normal release build, only calls 1–4 are recognized. For number 5, [`SyscallNumber::decode`](kernel/src/syscall/abi.rs) returns `None` and the [dispatcher](kernel/src/syscall/dispatch.rs) returns `BadSyscallNumber` before capability lookup or console output, even if the caller holds a debug-console capability. In debug builds the console capability is checked before buffer access/output; the buffer's range and user-accessible page mappings are validated before output. + +Kernel APIs for capability management, notifications and address spaces exist, but **none is exposed as an EL0 syscall in v1**. The ABI is not a claim that every kernel service is available to userspace. + +The current demonstration has explicit limits: + +- The [QEMU BSP](bsp-qemu-virt/src/main.rs) embeds a trusted `userland/hello` image and loads it through the [task loader](kernel/src/obj/task_loader.rs). This is not a supported arbitrary-untrusted-image loading service. +- A non-`SVC` EL0 synchronous fault follows the [vector panic path](bsp-qemu-virt/src/vectors.s) and panics the whole kernel. Per-task fault containment and supervisor notification are not implemented; syscall argument validation does not provide that execution-time containment. +- [`task_exit_current`](kernel/src/sched/mod.rs) stops scheduling the caller but does not reclaim its task slot, address space or capability table. Object destruction and resource reclamation remain future work. + +These limits are also recorded in the [Phase B seam review](docs/analysis/reviews/security-reviews/2026-06-01-phase-b-closure.md). They preclude treating the demonstration as an availability or resource-isolation guarantee for hostile workloads. ## Reporting a security issue diff --git a/docs/analysis/README.md b/docs/analysis/README.md index 5d80c1f7..e6c1580c 100644 --- a/docs/analysis/README.md +++ b/docs/analysis/README.md @@ -3,7 +3,7 @@ This folder is **the work**, tracked as it moves through the pipeline. Where [`../roadmap/`](../roadmap/) holds the plan, `analysis/` holds the execution: - [`tasks/`](tasks/) — individual task user stories, organized per phase. -- [`reviews/`](reviews/) — reviews, organized per type (business, code, security, performance-optimization). +- [`reviews/`](reviews/) — four event-triggered review types (business, code, security, performance optimization) and on-demand whole-tree master reviews. The separation is deliberate. The roadmap describes what we *intend*; analysis records what *happens*. The two are cross-linked in both directions but have different readers, different update cadences, and different lifetimes. @@ -13,7 +13,7 @@ See [ADR-0013](../decisions/0013-roadmap-and-planning.md) for the rationale. Tasks are the unit of work. Each one is a short markdown file following the user-story shape in [`tasks/TEMPLATE.md`](tasks/TEMPLATE.md). -- Tasks live under `tasks/phase-/` — the phase folder tells you which milestone the task is part of. +- Tasks live under `tasks/phase-/`. A lettered phase C maps to `phase-c`; the dotted bridge B.2 maps to `phase-b2` and its plan `phase-b2.md`. The phase/milestone or bridge Track is recorded in task metadata. - Task IDs (`T-NNN`) are sequential across the whole project; they do not restart per phase. - See [`tasks/README.md`](tasks/README.md) for the index, ID schema, status vocabulary, and lifecycle. @@ -21,7 +21,7 @@ Tasks are created with the [`start-task`](../../.agents/skills/start-task/SKILL. ## Reviews -Reviews come in four types. Each type has its own folder, its own master plan, and its own trigger criteria. +Four event-triggered review types have their own master plans. A fifth family provides on-demand whole-tree master reviews with a distinct run layout. | Type | Folder | Trigger | Produces | |------|--------|---------|----------| @@ -29,10 +29,11 @@ Reviews come in four types. Each type has its own folder, its own master plan, a | **Code** | [`reviews/code-reviews/`](reviews/code-reviews/) | Per non-trivial change, once PR flow begins. | Quality review (correctness / style / tests / docs) — one file per change. | | **Security** | [`reviews/security-reviews/`](reviews/security-reviews/) | Per change touching security-sensitive subsystems. | Deep security pass across capability / memory / kernel-discipline / crypto / secrets / dependencies axes. | | **Performance optimization** | [`reviews/performance-optimization-reviews/`](reviews/performance-optimization-reviews/) | Periodic or on concern. | Hypothesis-driven perf cycle: baseline, hotspot, proposal, measurement, regression check. | +| **Master reviews** | [Master-review README](reviews/master-review/README.md) | On demand, maintainer-initiated whole-tree sweep. | Timestamped run with consolidated report, coverage manifest and per-track evidence. | -Each folder contains a `README.md` describing when that type applies, a `master-plan.md` with a detailed multi-agent procedure, and one dated file per review conducted. +The four event-triggered folders contain a `README.md`, a `master-plan.md` and dated canonical reviews. The [master-review family](reviews/master-review/README.md#run-layout) has its own README and timestamped run directories; each consolidated report links its manifest and tracks. Companion plans and nested tracks are discoverable supporting artifacts, not additional canonical verdicts. -Reviews are produced with the [`conduct-review`](../../.agents/skills/conduct-review/SKILL.md) skill, which takes the review type as input and applies that type's master plan. +The four event-triggered review types use the [`conduct-review`](../../.agents/skills/conduct-review/SKILL.md) skill and their master plans. Whole-tree master reviews follow the [master-review procedure](reviews/master-review/README.md#how-it-is-run). See [`reviews/README.md`](reviews/README.md) for the cross-cutting review philosophy. diff --git a/docs/analysis/reports/2026-10-12-adr-0041-0043-supplied-review-reconciliation.md b/docs/analysis/reports/2026-10-12-adr-0041-0043-supplied-review-reconciliation.md new file mode 100644 index 00000000..94fffcb3 --- /dev/null +++ b/docs/analysis/reports/2026-10-12-adr-0041-0043-supplied-review-reconciliation.md @@ -0,0 +1,57 @@ +# ADR-0041–0043 — Supplied review reconciliation + +This report records source-verified dispositions for the maintainer's review of the Proposed ADR package and makes the required Acceptance-time and task-contract edits reviewable before implementation. + +- **Date:** 2026-10-12 +- **Author:** Codex (AI agent), on behalf of @cemililik +- **Review baseline:** `development` at `fb23823793b821b70f1252e16bb1b482f72fe1fe`. +- **Scope:** Proposed ADRs 0041–0043 and their [preflight plan](2026-10-12-phase-b2-track2-preflight-and-plan.md); no implementation, Accepted-ADR amendment, standard edit or task promotion. +- **State:** Reconciliation and both fresh independent follow-up rounds complete, with the sole Low finding corrected. Explicit maintainer package approval followed on 2026-10-12; see the dated execution record below. The original proposal-review scope and findings are preserved. +- **Prior review:** [Initial two-round preparation review](../reviews/code-reviews/2026-10-12-phase-b2-track2-preflight.md). Its original verdict/evidence remain historical; this supplied review and its follow-up do not erase them. +- **Authorization:** The maintainer supplied a readiness review with M/L/O findings, not an explicit Acceptance instruction. Copyright identity alone was approved separately and is unchanged. + +## Source verification and dispositions + +| ID | Source verification | Disposition in the revised proposal | +|----|---------------------|-------------------------------------| +| M1 | ADR-0040 Track B.2-1 implementation policy rule 4 explicitly limits the execution exception to that sequence/T-037; the proposal named its extension but promised the old-record clarification only for numbering. | Confirmed. ADR-0043 and the plan require a dated ADR-0040 rider for both Decision outcome rule 7 and implementation policy rule 4 in the same commit as 0043 Acceptance. A concrete rider is drafted in the plan; the Accepted record remains untouched pending approval. | +| M2 | T-055's sixth AC requires “index needs no edit / no anomalies”; its DoD omits the ADR index. The existing sync skill reports title/slug differences and has vocabulary narrower than the actual Deferred/partial-supersession corpus. | Confirmed live-contract conflict; the general reconciliation was already planned but needed literal scope. The plan now specifies the replacement AC, anomaly/disposition report and expanded DoD including the ADR index, sync skill and evidence/review artifacts. Step 0 applies this before T-055 implementation, after approval. | +| M3 | T-049 permits leaving dead retired-skill links with a history note and excludes other archive link repairs; neither is compatible with the selected full-corpus gate. | Confirmed. ADR-0043 explicitly rejects the note-only alternative. The plan requires verified immutable historical skill permalinks, preserved quoted paths/verdicts/measurements, bounded archive/master-plan repair ownership and the corresponding AC/Approach/Design-notes/Out-of-scope/DoD replacements. | +| L1 | Filing Proposed records 0041–0043 already occupies those identifiers; C2/C3/C4 and D1/D2 then collide with filed records. No 0044 record exists, so D3 still has only the C5 inter-ledger collision. | Confirmed in part, with that D3 distinction. ADR-0043 Context and Neutral consequences now state the temporary expanded collision set and T-054's complete migration ownership. No tentative row or filed number is changed here. | +| L2 | The old Option 4 grouped shell implementation and a packaged parser despite different costs. | Clarified. Separate Options 4 and 5 each have their own pros/cons; chosen Option 1 is unchanged. | +| L3 | ADR-0025's actual title is “ADR governance amendments: forward-reference contract, rider hygiene.” | Corrected the two abbreviated/misdescriptive reference labels in ADR-0041 and ADR-0043 to the actual title. Destinations and ADR-0025 are unchanged. | +| L4 | Literal sync-adr-index step 6 calls title/filename-slug differences reportable; 0040–0043 use descriptive titles and shorter slugs. Matching index/header text is a different comparison. | Recorded with M2. T-055 must report those differences and dispositions alongside existing metadata anomalies. Do not rename filed records, invent dates or silently suppress anomalies to claim clean comparison. | +| L5 | The standard-change procedure explicitly requires the changed standard's References to cite its motivating ADR; the original T-052 naming AC did not say so. | Added the requirement to ADR-0042's outcome/dependency chain and the plan's mandatory T-052 naming-AC replacement. testing.md remains unchanged until approval and the implementing step. | +| L6 | The initial commit grouped 0041/0042 and used a space rather than the skill example's em dash. Its English conventional subject and actual ADR trailers are present; the plan explains grouping so cross-links resolve at each checkpoint. | Documented justified presentation exception; no substantive defect or history rewrite. Keep the mutually linked proposal commit intact. Future single-record initial proposals follow the skill example. | +| O1 | write-adr permits retroactive Accepted filing only with maintainer agreement; that agreement was not supplied for this package. Current testing.md still contains its written prefix rule independently of the recovered record's status. | Recommendation: keep recovery Proposed until explicit approval. ADR-0041 now states that this status describes record approval and does not suspend the existing written rule. Acceptance remains a separate, reviewable transition. | +| O2 | The existing plan already intended 0042 Acceptance plus 0041 supersession together; it did not prescribe the hypothesized three commits leaving two contradictory Accepted ADRs. | Recommendation made explicit in both ADRs and the plan: first accept 0041 alone; then atomically accept 0042, flip 0041, add its callout and update both index rows in one commit. No committed checkpoint may leave both Accepted. | +| O3 | ADR-0040 Decision outcome rule 3 makes T-056 optional for general phase-exit accounting, just as the first implementation wave separately chose optional T-036 and required its delivered check. Policy approval is not task delivery. | Recommendation clarified: retain phase-wide optional status, fully implement/verify T-056 in this selected sequence, and require its checker on revisions containing delivered CI wiring. Acceptance alone neither enables the gate nor completes T-056. No carry-forward is selected by this plan. | + +## Concrete approval and implementation boundaries + +The proposed Acceptance sequence is: + +1. After explicit approval and the careful re-read, accept ADR-0041's historical recovery with its index row in a separate commit. +2. Atomically accept ADR-0042, supersede ADR-0041 with the forward callout, and update both index rows; preserve the old body. +3. Accept ADR-0043 and append the dated ADR-0040 rider covering both numbered rules in that same commit, with actual relative links and the actual Acceptance date. +4. Apply the plan's mandatory literal task-contract reconciliations at Step 0, recording their old/new clauses and governing ADRs in task history before implementation starts. +5. Execute all thirteen implementation steps, including T-056 implementation and both fresh review rounds per step. No new task reaches Done through agent action. + +Steps 1–4 are not performed by this proposal correction. In particular, [T-049](../tasks/phase-b2/T-049-review-indices-sync.md), [T-052](../tasks/phase-b2/T-052-standards-docs-reality-sync.md), [T-055](../tasks/phase-b2/T-055-adr-append-only-corrections.md), [ADR-0040](../../decisions/0040-phase-b2-consolidation-bridge.md), standards and workflows remain unchanged pending the package approval boundary. + +O1–O3 are recommendations presented for approval, not inferred maintainer answers. The supplied review's Ready/Ready-with-follow-up verdict is a readiness assessment. It does not replace the maintainer's requested explicit new-ADR approval. + +## Follow-up verification record + +The coordinator verified the findings against the live task contracts, ADR-0025 rider rule, ADR-0040's two distinct rule blocks, the three ADR proposals, sync/standard-change/supersession procedures, and the C/D ledger rows. This report does not adopt the supplied approximate test count as a new measurement or rerun implementation/runtime gates for a Markdown-only correction. + +Four fresh independent contexts assessed the corrected cumulative proposal in two follow-up rounds. Their source hashes, findings, dispositions and five master-plan roles are recorded in the existing preparation-review artifact. The original two rounds are preserved and are not relabeled as reviews of these new corrections. + +The first follow-up round identified one residual Step 9 alternative that still allowed the ADR-0040 rider to be added later. The coordinator confirmed it against the revised mandatory Acceptance-time sequence and changed Step 9 to verification of that already-filed rider in `7ccdde49aa77b35f181349adae4425bc68eb8801`. Both first-round contexts verified the correction; both new second-round contexts reviewed the cumulative corrected proposal at that tip, found no new issue and returned Approve for proposal readiness only. There are no unresolved proposal-review findings. The recommendation/Acceptance/task-delivery boundaries above remain in force. + +## Explicit package approval and execution (2026-10-12) + +After the follow-up rounds and the explicit package-approval question, the maintainer approved the current ADRs, plan and literal task corrections and instructed Acceptance commits followed by implementation. +This later authorization resolves O1–O3 and the original approval-pending boundary recorded above; it does not reinterpret the earlier readiness review as approval. +ADR-0041 recovery Acceptance is `862bfb6`; ADR-0042 Acceptance plus ADR-0041 supersession is atomic in `714c74b`; ADR-0043 Acceptance plus both ADR-0040 rule clarifications is atomic in `a72bea8`. +The Step 0 task-contract reconciliation follows those commits and is reviewed separately before implementation delivery begins. diff --git a/docs/analysis/reports/2026-10-12-phase-b2-track2-preflight-and-plan.md b/docs/analysis/reports/2026-10-12-phase-b2-track2-preflight-and-plan.md new file mode 100644 index 00000000..78311a7f --- /dev/null +++ b/docs/analysis/reports/2026-10-12-phase-b2-track2-preflight-and-plan.md @@ -0,0 +1,258 @@ +# Track B.2-2 — Preflight review and implementation plan + +This document records the source-backed documentation review, maintainer-approved decisions, reconciled task contracts and the reviewed-step execution plan for Track B.2-2. +It preserves the preparation brief and dated execution boundaries; the current delivery state is recorded in the [integrated readiness record](2026-10-15-phase-b2-track2-completion-readiness.md). + +- **Status:** Maintainer-approved2026-10-12. Steps0–13 completed both fresh review rounds and verified corrections. All twelve selected tasks are implemented/In Review; the one human SECURITY wording criterion and maintainer PR review/merge remain. PR #49 records final publication-tip CI before handoff. Detailed dated records preserve prior boundaries. +- **Date:** 2026-10-12 +- **Author:** Codex (AI agent), on behalf of @cemililik +- **Source baseline:** clean `development` at `7d48f50603fa0d30464ea7b032f4f0fb82c3964c`; `origin/main` at `c16997e003fbd1726d1205734380394781c52002`. +- **Scope:** T-045–T-056, including optional T-056; 57 original documentation items plus the already-fixed living-document item account for all 58 Track B.2-2 findings. +- **Authorization:** maintainer requested this track, `development` only, two fresh independent review rounds per implementation step, fixes/commits between rounds, and approval of new ADRs before implementation. +- **Publication baseline:** [PR #49](https://github.com/HodeTech/Tyrne/pull/49) is still open from the same `development` head. Keep this preparation local; publishing a separate track PR requires that predecessor to be merged or the maintainer to choose a combined PR explicitly. + +## Evidence and existing-document review + +The governing agent instructions, previously read numerical ADR corpus and standards are the process basis; the preflight rechecked the task contracts and relevant decision/source passages against this baseline. +Three independent read-only agents examined architecture/onboarding, roadmap/task/review/ADR history, and standards/CI/automation respectively. +Their findings were reconciled against the source; these are preflight advisory checks, not either of the two implementation review rounds and not an approval-promotion verdict. + +| Area | Existing documents and authoritative evidence reviewed | Required disposition | +|------|------------------------------------------------------|----------------------| +| Scope and status | [Phase B.2](../../roadmap/phases/phase-b2.md), [current focus](../../roadmap/current.md), [roadmap](../../roadmap/README.md), [phase index](../../roadmap/phases/README.md), [tasks process](../tasks/README.md), [B.2 task index](../tasks/phase-b2/README.md), all twelve task briefs | Keep B.2 Active and C/D gated; select this track without closing the later HIGH-correctness checkpoint. | +| Architecture | All nine existing chapters and [architecture index](../../architecture/README.md); ADRs 0007–0012, 0014, 0017–0023 and 0027–0039 where their mechanisms apply; current HAL/kernel/BSP/userland implementations | Review whole owned chapters for current-versus-planned claims, not only the stale sentences named at opening. | +| Historical closure | [Phase B plan](../../roadmap/phases/phase-b.md), T-020–T-029, first-parent merge history and the B5/B6 closure/security/performance records | Reconcile merged task states from evidence; preserve historical measurements and findings. | +| Reviews and reports | Four family indexes/master plans, master-review index and cited tracks, B6 performance review, old coverage/Miri reports, Track B.2-1 records | Add missing discovery links, repair navigation and obtain fresh reports now. | +| Entry points | Root README, CONTRIBUTING, SECURITY, guides/index, glossary, NOTICE/LICENSE and add-bsp/start-task skills | Repair clean-checkout instructions and current security boundaries; apply the exact maintainer-supplied copyright identity in T-050. | +| Standards and CI | Testing, error handling, logging, code/commit/review style, release and BSP checklist; infrastructure/CI guide, Cargo manifests/config, workflows, shell/Python tooling and versioned protection | Separate factual corrections from rule changes; implement the approved consistency gate without altering required-check identity. | +| ADR history | ADR-0008/0011/0012/0018/0033 and their sources; ADR-0025/0040 governance, ADR template/index; C–J phase ledgers and cross-phase references | Apply dated append-only corrections; migrate tentative identities by meaning; report index anomalies honestly. | + +### Verified findings that change the writing brief + +1. **The architecture is more stale than its banners.** Overview/HAL describe a nonexistent `BootInfo`/userspace-init handoff, priority/preemption and driver/IRQ service paths as current. The live reference BSP owns bring-up, runs kernel A/B plus one real EL0 `hello`, and uses a single-core cooperative scheduler. Rewrite or clearly label planned behavior with its actual decision/roadmap authority. +2. **Current fault isolation and teardown must be precise.** [The vector path](../../../bsp-qemu-virt/src/vectors.s) sends non-SVC synchronous faults to panic; [task exit](../../../kernel/src/sched/mod.rs) stops scheduling without reclaiming task/AS/table resources. The [Phase-B seam review](../reviews/security-reviews/2026-06-01-phase-b-closure.md) already tracks these limits. Remove present-tense TaskFault/supervisor/cleanup promises from current-state descriptions without implementing those future mechanisms here. +3. **Kernel IPC and EL0 syscall IPC are different surfaces.** [The dispatcher](../../../kernel/src/syscall/dispatch.rs) calls the bare send/receive primitives; [scheduler bridges](../../../kernel/src/sched/mod.rs) provide separate blocking/context-switch behavior. Explain the actual contract instead of attributing every bridge behavior to the five-syscall v1 ABI. +4. **Capability tables and rights are source-defined.** [CapObject](../../../kernel/src/cap/mod.rs) has five live variants; [rights](../../../kernel/src/cap/rights.rs) include DUPLICATE/DERIVE/REVOKE/TRANSFER and the IPC/console rights. Scope correlation, cross-table revocation and illustrative future kinds must not be described as already-enforced contracts. +5. **Memory/loader claims need a full consistency pass.** Bootstrap identity mode is temporary; current kernel high-half/per-task TTBR0 operation is live. The [loader](../../../kernel/src/obj/task_loader.rs) converts embedded high VA to PA for overlap checking. Correct its L3 arithmetic and half-open range description; NX does not prevent return-oriented execution through existing executable code. +6. **The clean-checkout command sequence is incomplete.** [BSP build.rs](../../../bsp-qemu-virt/build.rs) requires `hello.bin`; README and the two-task guide need `tools/build-userland.sh` before a direct kernel build. Update current guides before indexing them as current onboarding instructions. +7. **Smoke observations are not all script assertions.** [smoke.sh](../../../tools/smoke.sh) enforces profile-specific markers and panic/fault rejection; its `--int` trace prints exception events but does not assert an exact two-SVC count. Capture debug/release traces and inspect/count them explicitly. Do not claim `guest_errors` was enabled by `--int`, which uses `int,unimp`. +8. **Task-opening snapshots need reconciliation.** T-047 must record the completed T-030–T-037 wave as current history, not reset “last completed” to T-029. T-050 adds four glossary terms, so the baseline 50 headwords would become 54, not the stale 52-anchor expectation. Architecture index coverage citations are not evidence that T-024/T-028 edited a chapter: actual edit history and implementation coverage are separate facts. +9. **The unimplemented lint option is not a harmless one-line change.** [tyrne-user host stubs](../../../userland/tyrne-user/src/lib.rs) deliberately call `unimplemented!`; required ARM workspace Clippy compiles those stubs. Document the current lint/review boundary rather than adding a global deny in this track. +10. **Historical index and link drift is concrete.** Five canonical closure reviews are missing from indexes, Phase B indexes 15 of 23 task files, and three A/B task links are broken. Additional historical/master-plan links require bounded repair before a whole-corpus gate can start green. Preserve old quoted paths and verdicts; use historical permalinks where current targets would change the evidence. +11. **The IrqGuard diagnosis has provenance but lacks retained proof.** Commit `4fe547c` records an observed QEMU failure and generic-dispatch fix, without retained disassembly/Miri/compiler-issue evidence for the generalized `.rodata` aliasing explanation. Retract that unverified explanation, acknowledge the historical observation and retain the defensible direct-dispatch rationale. +12. **ADR index “no anomalies” is not true at baseline.** Existing descriptive-title differences, ADR-0023's prose-extended Date/Deferred status, ADR-0022's partial supersession and reserved 0034 need explicit handling. Reconcile source metadata and procedure vocabulary without guessing dates, changing historical decisions or hiding anomalies. +13. **The automation language premise is obsolete.** Python already runs in the required lint job. Use Python 3.9+ standard library, compatible with local Python 3.9.6, and verify Linux execution remotely; syntax compilation is not a formatter/linter. + +## Decisions presented before implementation + +The maintainer explicitly approved the complete package, plan and contract reconciliations on 2026-10-12. The table preserves the decisions presented before implementation; their Acceptance commits below record the authorized transitions. + +| Decision | Recommendation | Approval / implementation boundary | +|----------|----------------|-------------------------------------| +| Historical naming rule | File [ADR-0041](../../decisions/0041-test-name-prefix-policy-recovery.md), then explicitly accept the recovered historical rule before superseding it. | Do not imply an earlier ADR approval or rename tests during recovery. | +| Current test naming | Accept [ADR-0042](../../decisions/0042-descriptive-test-names.md): descriptive names without mandatory `test_`, real examples, review-enforced clarity. | Atomically accept 0042 and supersede 0041 in one commit; then T-052 changes the standard and adds its ADR-0042 reference. | +| Planned ADR identity | Accept [ADR-0043](../../decisions/0043-documentation-corpus-consistency.md): unique milestone-plus-purpose slugs; numeric IDs assigned at filing. | T-054 migrates live rows/references; 0034 and filed numbers stay intact; 0043's Acceptance commit adds the ADR-0040 rider covering numbering and the execution exception. | +| T-056 tool/gate | Include optional-for-phase-exit T-056 in this implementation; Python 3.9+ stdlib, offline deterministic command and isolated fixtures, failing step inside existing required lint job. | Accept ADR-0043 before implementation. The gate is required on revisions with delivered CI wiring; Acceptance alone is not delivery. No seventh context, third-party package or change to the phase-wide optional status. | +| Panic documentation | Describe banner + PanicInfo message/location + spin/halt, distinguish saved exception diagnostics from generic panic-time registers. Approve removing T-052's automatic register-dump follow-up obligation. | This closes a false current-state claim; no new register-dump feature or ungrounded implementation promise is made. Choosing a feature instead needs a separately scoped task/design before proceeding. | +| `unimplemented!` and lint scope | State that `todo` is workspace-denied, `unimplemented!` relies on review, and panic-family per-crate denies apply to kernel/HAL/BSP with scoped allowances. | Preserve host stubs and avoid expanding runtime/lint policy in a documentation correction. | +| Copyright identity | Maintainer supplied `HodeTech, Cemil ILIK and Tyrne Contributors` on 2026-10-12. Use the common line `Copyright 2026 HodeTech, Cemil ILIK and Tyrne Contributors`, preserving that spelling and capitalization. | This identity choice is resolved. T-050 applies it after the ADR/plan approval gate; that identity reply alone did not accept the ADR package; explicit package approval followed on the same date. | +| History and fresh evidence | Archive old current-focus material; add missing B6 template sections as dated structural reconciliation; mechanically repair archive links; run fresh coverage/Miri reports now. | Keep historical verdicts, sources and measured numbers intact. No fabricated retrospective runs. | +| Commit scopes | Recommend `syscalls`, `architecture`, `bsp-` for new examples; document historically used aliases/prior-use scopes and retain the existing review-agreement extension rule. | No new prohibition or static commitlint allowlist. | +| Dependency execution | Extend reviewed stacked execution to this track as specified by ADR-0043. | Both rounds and verification must pass before dependent work starts; all new task states stop at In Review. | + +### ADR approval sequence + +The initial proposal commit contains ADR-0041 and ADR-0042 together so their cross-links resolve at every committed checkpoint. +After approval: accept the historical recovery separately, then accept ADR-0042 and supersede ADR-0041 with both index/callout directions intact. +The 0042 Acceptance, 0041 status/callout and both index rows change in one atomic commit; no committed checkpoint leaves both contradictory records Accepted. +Accept ADR-0043 separately and append its dated ADR-0040 rider in that same commit, covering Decision outcome rule 7 and Track B.2-1 implementation policy rule 4 before applying its standard/CI changes. +The standard-change skill's proposal cross-links are staged through task/plan/index references here; the standards themselves are edited only after Acceptance. + +**Reviewed Acceptance-time rider (filed on 2026-10-12):** + +> **2026-10-12 — Track B.2-2 clarification and limited execution extension (ADR-0043).** Decision outcome rule 7's numeric re-sequencing is implemented by T-054 through stable milestone-plus-purpose identifiers; filed ADR numbers and reserved 0034 remain intact. Track B.2-1 implementation policy rule 4's reviewed stacked-execution exception is extended by ADR-0043 to the maintainer-requested Track B.2-2 sequence only: prerequisite implementation, applicable gates and both fresh review rounds must pass on development before dependent work starts, and new tasks remain In Review until maintainer approval/merge. Decision outcome rule 3's optional-for-exit status for T-056 and the whole-phase C/D gate are unchanged; the selected sequence implements T-056, and its required CI enforcement begins on revisions containing the delivered wiring. The original decision body remains preserved; ADR-0043 supplies the current clarification and limited extension. + +At Acceptance, this appended rider links ADR-0043 and the existing T-054/T-056 task files using sibling/task-relative destinations; it does not rewrite ADR-0040's original body or status. +The date above is the proposal date; use the actual maintainer Acceptance date if it differs. + +## Task-contract reconciliation + +After approval, each affected task receives a dated reconciliation entry linking this plan and its applicable ADR, then its literal AC/DoD text is corrected before the task is implemented. +Its original opening history remains intact. +Task “Ready” at baseline is not authority to bypass a newly identified ADR precondition. +The three clauses below are mandatory proposed replacements, not merely advisory implementation notes; Step 0 applies them and reconciles the corresponding ADR-required metadata after explicit package approval. +That approval is now recorded; Step 0 applies the literal corrections while preserving each original opening-history entry. + +| Task | Reconciled scope and acceptance evidence | +|------|------------------------------------------| +| [T-045](../tasks/phase-b2/T-045-docs-overview-taskloader-arch-index.md) | Whole entry-chapter current/planned sweep; define freshness as source baseline/date/owning task; distinguish document history from implementation coverage. Recheck overview boot/index after T-046. | +| [T-046](../tasks/phase-b2/T-046-docs-subsystem-chapters-refresh.md) | Whole seven-chapter factual sweep, including fault/lifecycle, IPC bridge, high-half and HAL contract corrections. Exact SVC count is inspected trace evidence; add independent security review of boundary claims. | +| [T-047](../tasks/phase-b2/T-047-roadmap-state-and-phase-index-sync.md) | Correct all live bullets, preserve and archive dated history, record T-029 as historical completion and T-030–T-037 as the latest completed wave. Add the three seam-review carry-forwards with their actual triggers. | +| [T-048](../tasks/phase-b2/T-048-phase-b-task-corpus-sync.md) | Existing ten merged task closures, 23-row index and three link repairs. Formalize date_done in template and lifecycle; do not re-author old task implementation evidence. | +| [T-049](../tasks/phase-b2/T-049-review-indices-sync.md) | Five missing canonical reviews; explicit companion/master-review discovery; dated B6 structural repair; fresh coverage/Miri; bounded archive/master-plan link repairs discovered by T-056 baseline scan. Retired skill navigation uses verified immutable historical permalinks; remove the note-only option. Preserve quoted defect provenance. | +| [T-050](../tasks/phase-b2/T-050-entry-docs-and-glossary-sync.md) | Four terms and stable anchors, existing glossary factual corrections, build prerequisites, README current/target labels, two-task/first-userspace guide corrections and safe add-bsp template. Use the exact maintainer-supplied copyright identity recorded above. | +| [T-051](../tasks/phase-b2/T-051-contributing-and-security-status.md) | Current five-syscall/security-limit description and present contribution workflow, including the stale “when implementation begins” section. Maintainer reviews SECURITY wording before merge; disclosure policy is untouched. | +| [T-052](../tasks/phase-b2/T-052-standards-docs-reality-sync.md) | Accepted naming change and testing.md References entry for ADR-0042; approved panic-claim correction without promised register-dump task; truthful lint/logging scope, planned fault/supervision status and downstream-effects search. | +| [T-053](../tasks/phase-b2/T-053-standards-docs-mechanical-fixes.md) | Original eight corrections plus adjacent false tooling-status claims (missing_docs under -D warnings, planned audit/vet, live smoke runner). panic=abort target flags also cover userland built for that same triple. No lint-level change. | +| [T-054](../tasks/phase-b2/T-054-adr-ledger-renumbering-cascade.md) | Purpose identities, semantic cross-phase mapping and live-definition duplicate check; preserve real ADR-0040 references, historical aliases and unnumbered decisions. | +| [T-055](../tasks/phase-b2/T-055-adr-append-only-corrections.md) | Five dated append-only ADR corrections and IrqGuard comment; replace the unconditional index/no-anomalies AC; allow index/sync-skill/report edits and report all metadata/title-slug anomalies with dispositions. Align sync vocabulary to Deferred/partial-supersession precedent. | +| [T-056](../tasks/phase-b2/T-056-docs-consistency-automation.md) | Approved Python/gate/slug/index/history/audit contracts from ADR-0043; real syntax + fixture verification and independent style review replace the stale generic formatter/linter requirement. Run whole-corpus green before enabling CI. | + +Each step's allowed diff consists of its named task content plus the necessary task/current/track index updates, governing decision references, review artifacts and review index entries. +Assess the allowlist on that step's commit range, not the entire stacked development diff. +Extra file changes require a demonstrated existing-scope reason and a recorded review disposition; this is not authority for unrelated cleanup. + +### Mandatory literal contract edits at Step 0 + +**T-049 — history and link gate (M3).** Replace the `.claude/skills/` AC and its Approach/Design-notes alternatives with: retired skill navigation targets resolve to verified immutable historical commit permalinks containing the cited file; preserve old paths quoted as defect evidence and all historical verdicts/measurements. A migration note may explain history but cannot satisfy link validity. Remove the note-only alternative and do not substitute current skills where that changes the evidence. Any genuinely unavoidable exception follows ADR-0043's exact-destination, reason, review and fixture contract. Remove the Out-of-scope exclusion for other broken review-archive links: bounded navigation repair in touched historical/master-plan documents is owned by T-049 before gate enablement. Amend its DoD scope to include those repaired files, affected discovery indexes/companions and associated evidence/review artifacts. The full baseline gate must pass; no archive-wide exclusion is allowed. + +**T-055 — index and anomalies (M2/L4).** Replace the sixth AC's “index needs no edit / record no anomalies” clause with: compare and reconcile canonical index membership plus title/status/date against actual record headers; explicitly report each anomaly and its disposition. Preserve the existing additions-only/ADR-0012-strikethrough exception and no-status-change requirement for the five Accepted-ADR corrections. Report title/filename-slug differences, including 0040–0043, separately from index/header mismatches; a descriptive short slug does not justify renaming a filed ADR or concealing that report. Handle Deferred, prose-extended dates, partial supersession and reserved 0034 from existing records without inventing metadata. Expand the DoD file list by `docs/decisions/README.md`, `.agents/skills/sync-adr-index/SKILL.md` and the anomaly/review report artifacts, in addition to the existing files and necessary task/track indexes. Reconcile the sync procedure's vocabulary/reporting with those existing forms; do not silently redefine its anomaly report away. + +**T-052 — motivating reference (L5).** Add to the naming AC: after ADR-0042 is Accepted and ADR-0041 is atomically superseded, testing.md's References links ADR-0042; verify the link and record the downstream-effects search. The already-proposed panic AC correction removes the automatic register-dump follow-up obligation only upon package approval, and the chosen lint option changes no lint level. + +Step 0 records each old clause and its approved replacement in the task review history before implementation; task opening provenance remains intact. +This step is a preparation/contract boundary and does not report any task delivery. + +## Execution steps after approval + +Each row is a review boundary; large rows may use several focused commits inside the step, without skipping either review round. +The same root author implements changes; reviewers do not mutate the shared worktree. + +| Step | Tasks | Delivered result and verification | +|------|-------|-----------------------------------| +| 0 | ADR package / preflight | Reviewable Proposed documents, separate Acceptance transitions after explicit approval, corrected task briefs. No task delivery claimed. | +| 1 | T-051 | CONTRIBUTING/SECURITY describe current EL0 boundary and workflow. Verify against ABI/dispatcher/vector/exit source; separate code/document and security review roles. | +| 2 | T-045 | Define freshness convention; refresh overview/loader/index and architecture closure hook. Capture fresh debug/release QEMU traces, inspect SVC/fault counts and verify source-backed mapping/loading claims. | +| 3 | T-046 | Refresh seven subsystem chapters; recheck Step 2 overview/index/boot diagram coherence. Independent architecture/correctness and security-boundary reviews. | +| 4 | T-048 | Close already-merged Phase-B task records from exact merge evidence, index/date_done/template/lifecycle and known task-link repairs. Verify membership/status/date and historical evidence preservation. | +| 5 | T-049 | Complete review discovery and bounded link repairs; reconcile B6 template using existing evidence; run and commit fresh source-bound coverage/Miri reports. Check all canonical membership, historical provenance and repaired targets. | +| 6 | T-050 | README, guides, glossary, skill instructions and approved NOTICE/LICENSE wording. Verify clean-checkout command prerequisites, live traces, anchor uniqueness/order and source-defined terminology. | +| 7 | T-055 | Apply five ADR corrections and comment; normalize source/index metadata and report known conventions. Verify append-only diffs, fmt/host-clippy/host-test and unchanged runtime source apart from the doc comment. | +| 8 | T-052, T-053 | Reconcile overlapping standards in focused commits under Accepted policy. Verify actual CI/lints/config, downstream references, fence tags and scope history. | +| 9 | T-054 | Migrate all 32 planned-purpose rows plus live references; verify the Acceptance-time ADR-0040 rider covers numbering and the limited execution extension. Verify unique definitions, resolved references and historical/filed-number preservation. | +| 10 | T-047 | Concise accurate live focus plus preserved archive, B6 status tags and Phase-C seam carry-forwards. Verify live status claims against task files and source merge records. | +| 11 | T-056, parser portion | Implement deterministic offline link/fragment parser and meaningful positive/negative fixtures. Run against stabilized full corpus; discovered actual baseline defects return to their named owner rather than being suppressed. | +| 12 | T-056, integration portion | Add task/review/ADR/ledger/fence/audit checks, optional live-state check if reliable, usage documentation and existing-job CI wiring. Verify all isolated rejection/false-positive fixtures, macOS/local and Linux/hosted execution. | +| 13 | Integrated track record | Reverify architecture freshness, all 58 item dispositions and twelve task AC/DoDs; update six entry documents and publish final review/evidence. Leave delivered tasks In Review and publish combined existing PR #49 under the maintainer’s explicit2026-10-15 publication choice below. | + +### The review loop for every implementation step + +1. Implement the step, run its applicable checks and commit a reviewable result with English conventional messages and actual ADR references. +2. Start round 1 with fresh independent agents. Use at least two complementary contexts; architecture/security-sensitive descriptions receive a distinct security pass, and checker/CI changes receive parser/adversarial plus integration coverage. Select model/effort according to complexity (normally high effort; governance/parser seams may use the frontier model). +3. Independently validate each finding against the source/evidence, record its disposition, fix verified issues, rerun affected checks and commit. +4. Start round 2 with different fresh contexts. Verify the first-round corrections and the cumulative step rather than only its last patch; fix/commit confirmed findings and run the affected checks. +5. Complete the step only when no verified blocker remains. Record both rounds using the relevant master-plan roles and index the artifact, then continue automatically to the next step. + +The preparation documents also receive two fresh independent rounds before they are presented for approval; those rounds assess proposal readiness, not ADR Acceptance or task delivery. +No external review comments/messages or live policy changes are needed by this plan. + +## Verification and evidence contract + +- **Documentation steps:** check relative targets and fragments, fence/diagram form, task/index/current coherence, changed-file scope and `git diff --check`; verify factual prose against source and cite the decisions that supply its authority. +- **Trace-bearing steps:** build userland first, build matching kernel debug/release, capture `tools/smoke.sh --int` and `--release --int`, retain exact raw evidence with source/toolchain/QEMU identity, and distinguish inspected exception counts from automated marker/fault gates. +- **Fresh reports:** execute the pinned-toolchain workspace Miri command excluding only the BSP and the repository coverage command; record actual counts/percentages/limitations, not the opening expected numbers. Old reports remain historical. +- **Comment-bearing T-055:** fmt, host Clippy and host tests as required by the task; validate no executable Rust/unsafe delta. +- **Automation:** syntax compilation plus isolated unittest/CLI fixtures for every implemented check and valid edge form; fixtures operate in temporary roots, never by committing deliberate regressions or creating branches. Validate Python 3.9 compatibility locally and the available hosted Python interpreter on Linux. +- **CI publication:** inspect exact-source PR/push results and new step logs. All six required contexts retain app 15368 bindings; coverage/performance remain informational. Hosted evidence is recorded only after actual execution, with first-main evidence remaining merge-dependent where relevant. +- **Traceability:** task histories name commits, verification and review rounds. New tasks remain In Review for maintainer approval; ADRs follow their explicit maintainer-authorized Acceptance/supersession transitions; existing Phase-B merge closure is separately evidenced historical reconciliation. + +## Publication and remaining phase work + +Stay on `development` throughout. +At preparation, PR #49 owns this same remote source branch, so pushing new commits would enlarge that already-open bookkeeping PR. +Keep proposals/local implementation local until its merge, unless the maintainer explicitly chooses to combine the work; do not close, merge or repurpose PR #49 silently. +After its merge, fetch and reconcile ancestry on development without changing main or discarding local commits, then publish the Track B.2-2 PR from the same branch. + +**Maintainer publication choice, 2026-10-15:** explicitly combine B.2-2 with the existing PR #49 and publish from development. This selects the exception above; the local-only barrier is cleared. Keep the same branch and PR, update its scope to the final combined implementation, and verify the actual published commit's hosted gates. This authorization does not merge the PR or certify unfinished reviews/tasks. + +Selecting this documentation track is the maintainer's requested order, not a claim that T-038 or the other correctness work completed. +HIGH T-038 remains Ready; T-039/T-040 and later decision-bearing tasks keep their own preconditions. +ADR-0040's scope checkpoint still follows CI and HIGH-correctness work, and all Phase B.2 exit criteria still gate C/D. +This plan does not add implementation tasks or change the 46-task phase inventory. + +## Authorized Step 0 execution (2026-10-12) + +The maintainer explicitly approved the current ADR package, this plan and all contract corrections, including O1–O3 and removal of T-052's automatic register-dump follow-up obligation. +Following careful end-to-end re-reading, the coordinator committed: + +- `862bfb6`: ADR-0041 historical recovery Accepted, separately from its proposal. +- `714c74b`: ADR-0042 Accepted and ADR-0041 superseded atomically with both index rows/callout; the predecessor body is preserved. +- `a72bea8`: ADR-0043 Accepted with its ADR-0040 rider in the same commit, covering both numbered rules; ADR-0040's original bytes remain a prefix of the amended record. + +All twelve task briefs now contain the approved literal contracts and dated old-to-new reconciliation records. +T-045–T-055 remain Ready and T-056 remains Draft until its implementation prerequisites/review boundaries pass; this is preparation, not delivery. +Step 0 completed both fresh independent review rounds on cumulative `114be85..528893f`; the [canonical review](../reviews/code-reviews/2026-10-12-phase-b2-track2-step0.md) records the verified T-055/backlink corrections and zero unresolved findings. Step 1 (T-051) may now start. +The proposal-readiness reviews remain historical; they were not reused as those implementation rounds. + +## Step 1 execution — 2026-10-13 + +T-051 implementation `4ffda15` received two fresh code/document rounds, each followed by a distinct fresh full security pass. All four passes found zero verified issues; no correction commit was needed. The [canonical code review](../reviews/code-reviews/2026-10-13-t051-contribution-security-status.md) and [security checklist](../reviews/security-reviews/2026-10-13-t051-contribution-security-status.md) bind to the exact cumulative source. Static navigation, status and reporting/history preservation checks pass. T-051 is In Review, with maintainer SECURITY wording review retained before merge; Step 2/T-045 proceeds automatically. No runtime or hosted test result is newly claimed for this documentation-only step. + +## Step 2 execution — 2026-10-13 + +T-045 refreshed whole overview/loader chapters, coverage/edit-provenance index and the architecture closure hook. [Fresh debug/release evidence](2026-10-13-t045-architecture-verification.md) binds to executable source `4ad0b3d8a9d43310fcd937013131bffadcc803d7`; raw output and tool/profile/artifact identities are retained. Both smoke commands pass, manual counts show two SVCs and no other exception events, and the final Task A busy-spin is explicitly distinguished from unexercised idle/IRQ paths. + +[Both fresh code rounds](../reviews/code-reviews/2026-10-13-t045-architecture-entry-points.md), each followed by a distinct security pass, Approve cumulative `d6cb853..deec107`. Three unique R1 findings (Task-generation overclaim, transfer-stage ambiguity, idle/timer interpretation) were corrected in `deec107` and independently verified; R2 found none. T-045 is In Review, not Done. T-046 immediately owns seven whole-chapter refreshes and the remaining overview/boot/index shared checks; T-049 owns the pre-existing master-plan path repair. No runtime or historical evidence was rewritten and no publication occurred. + +## Step 3 execution — 2026-10-13 + +T-046 refreshed all seven subsystem chapters, their exact freshness markers and nine index cells against source `da18ed5`, reusing source-bound runtime `4ad0b3d` with no executable delta. [Both fresh code rounds](../reviews/code-reviews/2026-10-13-t046-subsystem-architecture.md) and distinct subsequent security passes approve cumulative `d71aa4a..4b33607`. Six unique R1 findings (three Medium, three Low) were corrected in `4b33607` and independently verified: SP_EL0 frame layout, real block error split, idle inherited mask, free-list capacity, PanicInfo diagnostics and PMM alignment boundary. R2 found no new issue. + +T-046 is In Review, with no new run or Done claim. T-045's overview/boot/index shared criteria now close; its old master-plan navigation remains T-049-owned. T-048 starts next for historical merged-task reconciliation. Existing runtime/future-phase limits and the PR49 publication barrier remain intact. + +## Step 4 execution — 2026-10-13 + +T-048 reconciled ten already-merged Phase B records from exact first-parent integration facts, completed the 23-member single rendered index table, formalized optional authorized real-date completion in template/lifecycle and repaired the three scoped historical paths. Existing bodies/history and all 88 checkboxes remain byte-identical. The [source-bound report](2026-10-13-t048-phase-b-task-reconciliation.md) identifies the kickoff baseline, checked implemented tree, actual implementation commit and historical source digests. + +[Both fresh five-role code rounds](../reviews/code-reviews/2026-10-13-t048-phase-b-task-reconciliation.md) Approve cumulative `a214532..a50f94a`; one R1 Low provenance ambiguity was corrected in `a50f94a` and independently verified. No unresolved finding remains. No runtime/security boundary changed or new runtime result was claimed. T-048 is In Review; existing historical Done authorization is distinct from new B.2 task completion. T-049 starts next; the publication barrier remains intact. + +## Step 5 boundary — 2026-10-13 + +[Both fresh primary/complementary code rounds](../reviews/code-reviews/2026-10-13-t049-review-corpus-reconciliation.md) complete on corrected `0ab0ba4..aa37e2c`. Low C01 was verified and fixed without rewriting the historical proposal; no unresolved finding remains. Discovery, B6 structural repair, immutable historical navigation and fresh source-bound Miri/coverage are delivered. T-049 is In Review; T-045’s deferred touched-file link DoD closes against the master-plan repair. No Done, retrospective runtime/security approval, hosted CI or publication claim. T-050 starts next; PR49 remains the publication barrier. + +## Step 6 boundary — 2026-10-13 + +[Both fresh code/security rounds](../reviews/code-reviews/2026-10-13-t050-entry-document-refresh.md) Approve corrected cumulative 75de2ba..946f45f. R1 raw-table-pointer C01 and R2 Bridge-phase R2-C01 were confirmed, fixed in separate commits and independently verified; zero unresolved delta findings. T-050 is In Review, with six clean-export profile commands and unmodified raw evidence. No new ADR, runtime/hosted/Done certification or publication. T-055 starts next; the PR49 publication barrier remains intact. + +## Step 7 boundary — 2026-10-13 + +[Both fresh code/security rounds](../reviews/code-reviews/2026-10-13-t055-adr-corrections.md) Approve corrected e8104e3..23391c7. Independent R1 timer-helper R1-C01/S01 is one Low; coordinator-origin procedure C-ROOT-01 is a separate Low corroborated after independent checkpoints. Both fixed at 23391c7 and verified; no new R2 or unresolved delta finding. Five original ADR corrections, source-backed timer/procedure/compatibility additions and exact 42-row index reconciliation delivered; 35 slug differences explicitly retained. Initial dirty-source fmt/host-clippy/host-test pass (366/two ignored), original captures unchanged and separately bound from corrected source. T-055 In Review/no date_done; Step 8/T-052/T-053 starts automatically. PR49 publication barrier remains. + +## Step 8 boundary — 2026-10-13 + +[Both fresh code/security rounds](../reviews/code-reviews/2026-10-13-t052-t053-standards-reconciliation.md) Approve `98378b5..d553efe`, with zero confirmed source/seam findings and no source correction needed. Accepted naming policy, truthful runtime/logging/lint/CI/configuration/scope/path guidance and bounded adjacent tooling claims delivered. Three additional surfaces were justified before editing; original normative P11/reproducibility properties remain. All 25 combined criteria checked, both tasks In Review/no date_done; fresh static/navigation checks and full reports retain their actual scope and chronology. No new runtime/hosted execution or T-038 closure. Step 9/T-054 starts automatically; PR49 barrier remains. + +## Step 9 boundary — 2026-10-13 + +[Both fresh code/security rounds](../reviews/code-reviews/2026-10-13-t054-planned-adr-identities.md) Approve corrected `f8c9b7f..a93926b`. Primary R1-C01/security T054-R1-S01 are one unique Low; the Phase I pointer correction in a93926b preserves the sketch/no-authorization boundary and is independently verified. Zero new R2 or unresolved findings. All 32 definitions/71 source lines/74 references, complete historical notes and 42 unchanged filed records/index rows verified; full actual reports and immutable captures retained. T-054 In Review/all 11 criteria checked/no date_done. Step 10/T-047 starts automatically; no runtime/hosted/phase-opening or maintainer approval claim. PR49 publication barrier remains. + +## Step 10 boundary — 2026-10-13 + +[Both fresh code/security rounds](../reviews/code-reviews/2026-10-13-t047-roadmap-state-reconciliation.md) Approve cumulative `20a0d25..8a89fd2`; zero confirmed R1/R2 or unresolved source findings. All 22 original groups, preamble and full old live/Notes tail are preserved exactly; explicit T-029 recovery gives 23 correctly ordered archive groups. Concise delimited live state, seven verified integrations, exact three B6 tags and four separately source-backed C flags delivered. Full actual reports/immutable initial prefixes and source captures retained; a reviewer locator correction is report QA, not a source defect. T-047 In Review/all eleven criteria checked/no date_done. Step 11/T-056 parser starts automatically; no runtime/hosted/whole-phase/Done or publication claim, PR49 barrier remains. + + +## Step 11 boundary — 2026-10-15 + +[Both fresh code rounds](../reviews/code-reviews/2026-10-13-t056-parser.md) and [separate security rounds](../reviews/security-reviews/2026-10-13-t056-parser.md), including explicitly attributed replacement R2 committed-fix verification, Approve the selected parser scope at830de9d. Original HOLDs, ten focused R2 correction increments, tests-first failures/oracle QA, actual reading gaps and source-retention limits are preserved; all verified source findings are closed. Full actual reports and current reviewer evidence are byte-bound in the [publication manifest](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/publication-manifest.json"). + +Actual149-method suites pass Python3.9.6/3.13.14;842 complete report/status/stderr controls and four387-file/6764-target/786-fragment/zero-finding runs pass independently. Finite resource/primary/differential checks do not prove full renderer or universal complexity. T-056 remains In Progress/all sixteen criteria unchecked/no date_done. Step12 remaining metadata families, existing required-job wiring and exact-source hostedLinux evidence start next, followed by Step13 integrated verification. No task delivery/Done/hosted/publication or phase opening is inferred; PR49 and maintainer/whole-phase gates remain. + +### Step12 implementation boundary — 2026-10-15 + +The [integration evidence](2026-10-15-t056-integration-evidence/README.md) records focused shared-reader/task/ADR/review/planned/fence/unsafe/live commits and final all-family CLI/required existing-job wiring. Final160/99 local suites and eight source-stable corpus CLI runs pass on Python3.9/3.13 with empty PATH. All verified author-stage false positives/false greens and resource/input failures have retained corrections; no oracle withdrawal or unsafe/runtime/dependency change is claimed. T-056 remains In Progress/all16unchecked/no date_done. Fresh independent full-Step12 paired R1 and different fresh R2, actual exact-source hosted Linux evidence and Step13 remain; internal increments/preparatory inventories are not those review rounds. PR49 still owns remote development, so the approved publication barrier remains in force. + +### Step12 R1 completed boundary — 2026-10-15 + +Both independent R1 contexts completed actual committed verification and authorized peer reconciliation at770d86b, after repairs0ae222d/0033d63/770d86b. All six reported groups, including S05/RV-S01, are scoped closed; the [sixteen full original reports and retained evidence](2026-10-15-t056-integration-evidence/README.md#completed-r1-boundary-and-current-hosted-checkpoint) preserve every earlier finding, HOLD, read extent and final scoped Approve. Different fresh CODE/SECURITY R2 now reviews the full cumulative91a64b5..770d86b range. Local161/118-method suites and392/7029/922/zero corpus agree with actual Linux PR/push documentation steps; all seven jobs and six app15368 required contexts pass at770d86b. The maintainer's explicit combined-publication choice above clears the old PR49 local-only barrier. Canonical both-round filing, Step13 and final PR-tip verification remain; T-056 stays In Progress/all16unchecked/no date_done. + +### Step12 completed boundary — 2026-10-15 + +[Canonical code](../reviews/code-reviews/2026-10-15-t056-integration.md) and [separate security](../reviews/security-reviews/2026-10-15-t056-integration.md) consolidate both fresh rounds, actual committed-fix verification and final peer reconciliation at4044b79. All six R1 and three R2 groups are scoped closed;24 complete original reports and lossless reviewer archives preserve severity/HOLD/source/QA/read limitations.161/124 suites pass both local runtimes; exact404 PR/push Linux CI passes seven jobs and all six app15368 contexts. T056 all16 criteria checked/In Review/no date_done; twelve selected tasks now In Review, phase census8Done/19Ready/12InReview/0InProgress/7Draft. Step13 begins automatically for58 dispositions, all task criteria/freshness and six entry documents; final-tip and maintainer gates remain. Combined PR49 publication is explicitly authorized; earlier barriers remain historical. + +### Step13 completed boundary — 2026-10-15 + +[Both fresh code rounds](../reviews/code-reviews/2026-10-15-phase-b2-track2-integration.md) and [separate security rounds](../reviews/security-reviews/2026-10-15-phase-b2-track2-integration.md) Approve cumulative ab847ee..7d1eca0. R1 SECURITY-R1-01 is one Low: two resolvable README links selected the docs index instead of the root README. Root validated all58 destinations, fixed both in7d1eca0 and obtained actual committed-fix verification; different fresh R2 verifies the full cumulative scope with zero new findings. Complete original reports preserve both initial prerequisite-order limitations; R2 completed every mandatory read before scope inspection under separately recorded preflight ledgers. No earlier procedure is backdated or extra review round invented. + +All58 original observations, all156 literal criteria (155 checked/one human wording pending), nine architecture source markers and six entry documents reconcile. Twelve tasks stop In Review/no date_done;26 further tasks remain unimplemented and HIGH T-038 is next/unstarted. Exact reviewed-source PR/push CI passes seven jobs each and six app15368 required contexts,161/124 fixture methods and397/7163/925/zero. Later canonical/publication census and final PR-tip checks are separate checkpoints; PR #49 records the final tip before handoff. Whole B.2 C/D gates remain. No known scoped implementation finding is deferred. + +> **Evidence migration (2026-10-16).** Raw evidence links now open the [immutable archive catalog](2026-10-16-pr49-evidence-catalog.md). Each link title retains its exact archived member path. Original verdicts, measurements, limitations and execution SHA identities remain historical; the archive bundle restores their original source. diff --git a/docs/analysis/reports/2026-10-12-pr-48-supplied-review-reconciliation.md b/docs/analysis/reports/2026-10-12-pr-48-supplied-review-reconciliation.md index 03f7d4b3..b6c0eb36 100644 --- a/docs/analysis/reports/2026-10-12-pr-48-supplied-review-reconciliation.md +++ b/docs/analysis/reports/2026-10-12-pr-48-supplied-review-reconciliation.md @@ -106,9 +106,13 @@ The [new exact-byte hosted snapshot](perf-baseline-2026-10-12-t035-pr48-p99-foll This completion/publication record changes no runtime, protection policy or Accepted ADR. Final publication-tip CI is verified separately in PR48 rather than attributed to the earlier reviewed/measured source. -## Remaining review and merge boundary +## Remaining review and merge boundary (pre-merge snapshot) All eight requested tasks remain **In Review** for the maintainer in PR48; none is promoted to Done by this document. Existing **HIGH T-038** remains open and excluded; smoke, lint and Miri successes do not certify the x2 assembly contract. First merged-main runs and the default-branch performance dispatch require the maintainer's merge and remain explicitly pending in [T-035](../tasks/phase-b2/T-035-ci-hygiene-tail.md). They are merge-dependent evidence, not deferred implementation of this follow-up. + +## Post-merge completion — 2026-10-12 + +The maintainer merged [PR #48](https://github.com/HodeTech/Tyrne/pull/48) at `c16997e003fbd1726d1205734380394781c52002` and explicitly authorized T-030–T-037 as Done. This supersedes the pre-merge task and pending-evidence statements above without relabeling earlier reviewed/measured source. First-main [CI 38217531542](https://github.com/HodeTech/Tyrne/actions/runs/38217531542) passes all seven jobs; default-branch [performance dispatch 38217799773](https://github.com/HodeTech/Tyrne/actions/runs/38217799773) passes with 20 valid/0 failed samples. The [exact-byte main snapshot](perf-baseline-2026-10-12-t035-main-dispatch-check.md) and [post-merge retrospective](../reviews/business-reviews/2026-10-12-phase-b2-track1-completion.md) preserve evidence and the remaining 38-task inventory. The read-only full live-policy check still matches the committed definition. HIGH T-038 remains open in its owning track and is the next Ready candidate; Phase B.2 remains Active and gates C/D. diff --git a/docs/analysis/reports/2026-10-13-t045-architecture-verification.md b/docs/analysis/reports/2026-10-13-t045-architecture-verification.md new file mode 100644 index 00000000..6b12fd13 --- /dev/null +++ b/docs/analysis/reports/2026-10-13-t045-architecture-verification.md @@ -0,0 +1,71 @@ +# T-045 — Architecture source and runtime verification + +This report binds the overview/loader refresh to executable source, retained matching-profile QEMU runs and document-edit provenance. It records bounded implementation evidence, not a phase-closure or task-Done verdict. + +- **Date:** 2026-10-13 (Europe/Istanbul; runtime capture began 2026-10-12 UTC). +- **Owner:** [T-045](../tasks/phase-b2/T-045-docs-overview-taskloader-arch-index.md), Step 2 of the [approved plan](2026-10-12-phase-b2-track2-preflight-and-plan.md). +- **Exact runtime/source revision:** `4ad0b3d8a9d43310fcd937013131bffadcc803d7`, `development`; tracked tree clean before capture. +- **Environment:** Darwin arm64; pinned `nightly-2026-01-15`, rustc `1.94.0-nightly (86a49fd71 2026-01-14)`, LLVM 21.1.8; QEMU 11.1.1. Complete toolchain/version text and SHA-256 manifests are retained in [metadata.json](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t045-architecture-evidence "Archived member: docs/analysis/reports/2026-10-13-t045-architecture-evidence/metadata.json"). +- **Scope:** overview, loader, architecture index, phase-closure architecture checklist hook, task/tracking and source-bound evidence. No Rust, assembly, dependency, toolchain or CI change. + +## Runtime capture + +Executed sequentially before prose edits so the shared `hello.bin` always matched the kernel profile: + +```sh +tools/smoke.sh --int +tools/smoke.sh --release --int +``` + +Both commands exited **0**. They built userland before the matching BSP, then ran QEMU `virt`, `cortex-a72`, 128 MiB, one core, serial stdio without monitor, with **`-d int,unimp`** and the script's default 20-second budget. `guest_errors` was not enabled. After completion/elapsed output, Task A busy-spins without yielding until the expected timeout/SIGTERM ends QEMU; the script decides success from its marker and fault gates, not QEMU's process exit status. These runs exercise neither idle/WFI nor timer IRQ delivery; the default demo arms no deadline. + +| Profile | Image size | Image SHA-256 | Script result | +|---------|------------|---------------|---------------| +| debug | 117 bytes | `05816ccb9be5caea862dbe3e0fc45fc2068ff06cd049f2dda3459492d0ef7d88` | PASS: exit/completion plus required greeting, no panic/fault match. | +| release | 69 bytes | `ade8d1695182284e1efba2436c5ead8e4db6dac816f61852d436fc3d300362df` | PASS: exit/completion, greeting forbidden, no panic/fault match. | + +Raw QEMU traces: [debug](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t045-architecture-evidence "Archived member: docs/analysis/reports/2026-10-13-t045-architecture-evidence/debug.qemu.log"), [release](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t045-architecture-evidence "Archived member: docs/analysis/reports/2026-10-13-t045-architecture-evidence/release.qemu.log"). Complete command output: [debug stdout](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t045-architecture-evidence "Archived member: docs/analysis/reports/2026-10-13-t045-architecture-evidence/debug.stdout.log") / [stderr](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t045-architecture-evidence "Archived member: docs/analysis/reports/2026-10-13-t045-architecture-evidence/debug.stderr.log"), [release stdout](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t045-architecture-evidence "Archived member: docs/analysis/reports/2026-10-13-t045-architecture-evidence/release.stdout.log") / [stderr](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t045-architecture-evidence "Archived member: docs/analysis/reports/2026-10-13-t045-architecture-evidence/release.stderr.log"). Metadata includes original PID-log paths, ELF/image sizes and hashes, capture times, flags and all retained-log hashes. Binary artifacts are regenerated and not committed. + +The root separately read both raw traces. Each has **two `Taking exception 2 [SVC]` events**, zero other `Taking exception` events and zero Translation/Permission fault, Data/Prefetch Abort, Undefined Instruction or panic matches. Each enters EL0 at PC `0x800000`, reaches `tyrne: userspace task exited` and `tyrne: all tasks complete`; only debug contains `hello from userspace`. These are **manual evidence counts**, not an assertion that `smoke.sh` enforces an exact SVC count. The console attempt still traps in release; ABI decoding rejects its number before output, then `hello` exits. That rejection's status follows source inspection, not an independently printed trace value. + +The traces' elapsed values (debug 5,106,000 ns; release 3,501,008 ns), reserved-frame counts and addresses describe these particular runs. They are not new performance baselines or stable ABI values. Absence of observed faults in these demonstrations does not establish arbitrary fault containment or global memory safety. + +## Source reconciliation + +| Claim area | Source inspected | Result reflected in chapters | +|------------|------------------|------------------------------| +| Boot and ownership | [`boot.s`](../../../bsp-qemu-virt/src/boot.s), [`main.rs`](../../../bsp-qemu-virt/src/main.rs), [`Cargo.toml`](../../../kernel/Cargo.toml) | Mask/drop/stack/BSS before Rust; low bootstrap → high-half transition → PMM/AS/load → GIC/timer → scheduling. BSP owns wiring and privileged board drivers; only QEMU BSP exists. | +| EL0 context and binding | [`sched/mod.rs`](../../../kernel/src/sched/mod.rs), [`cpu.rs`](../../../bsp-qemu-virt/src/cpu.rs), [`syscall.rs`](../../../bsp-qemu-virt/src/syscall.rs) | Task identity is separate from scheduler context; per-task kernel stack and TTBR0 activation are live. BSP reads registered table/window bindings by current scheduler slot and generation-resolves the AS; incomplete binding fails closed. No separate current-Task generation or table-pointer identity validation is claimed. | +| Syscalls | [`abi.rs`](../../../kernel/src/syscall/abi.rs), [`dispatch.rs`](../../../kernel/src/syscall/dispatch.rs), [`user_access.rs`](../../../kernel/src/syscall/user_access.rs) | Numbers 1–5; number 5 debug-gated; yield/exit act only on current caller without a capability argument. USER checks and range checks precede buffer output. | +| IPC | [`ipc/mod.rs`](../../../kernel/src/ipc/mod.rs), scheduler bridge, dispatcher | Bare send/recv return outcomes; EL1 bridge adds cooperative block/unblock/yield. EL0 uses bare primitives, not blocking wrappers. Send checks source authority/endpoint capacity before movement into the endpoint; receive checks table capacity before installation and preserves pending authority on a full table. Notifications have no v1 syscall. | +| Capability and memory limits | [`cap/mod.rs`](../../../kernel/src/cap/mod.rs), [`address_space.rs`](../../../kernel/src/mm/address_space.rs), [`mmu.rs`](../../../bsp-qemu-virt/src/mmu.rs) | Capability is move-only; memory mapping helpers are kind-checked trusted APIs without full per-operation rights/physical-ownership checks. ASID 0 with flush on root swap; shared privileged TTBR1. | +| Loader validation and cleanup | [`task_loader.rs`](../../../kernel/src/obj/task_loader.rs), [`pmm.rs`](../../../kernel/src/mm/pmm.rs) | VA check before budget; equality at one-past limit valid; zero base legal. Seven intermediates for 8 MiB image + one-page stack. High VA converted to PA for overlap. Leaves/cap cleaned; root/intermediate/AS slot not reclaimed. | +| Image/build and faults | [`hello`](../../../userland/hello/src/main.rs), [`hello.ld`](../../../userland/hello/hello.ld), [`build-userland.sh`](../../../tools/build-userland.sh), BSP handlers | Real raw-flat Rust image replaces historical 8-byte sample; no current image-loaded banner. RX image/RW-NX stack do not imply kernel W^X or ROP prevention. Non-SVC EL0 synchronous fault panics the kernel; exit is not complete resource reclamation. | + +The old speculative syscall enumeration was **removed**, rather than retained as an alternative ABI. Planned services and memory/IRQ authority are explicitly labeled. ADR-0037 governs EL0 entry; ADR-0038 governs user-access translation; ADR-0039 governs building the image. Reserved ADR-0034 is linked through the ADR index because no numbered file exists yet, and concerns kernel section permissions, not userspace section metadata. + +The loader test surface contains **42 `#[test]` functions** at the exact baseline. This inventory was checked against source; no fresh host suite, Miri or coverage run is claimed for this prose-only change. Those executions belong to their later evidence-owning steps where required. + +## Provenance and freshness + +The [architecture index](../../architecture/README.md) defines a single-line marker with date, full source SHA and linked task owner. It identifies the code baseline inspected, not the later documentation commit. Overview and loader use the exact runtime/source baseline above. The index distinguishes chapter coverage from last editing provenance; the full previous edit SHAs/messages from `git log -1 -- ` are retained in metadata. + +| Chapter | Previous document edit | Verification scope now | +|---------|------------------------|------------------------| +| overview | `24530fb` | Whole chapter, T-045. | +| task-loader | `f15ae9a` (pre-B6 preparation) | Whole chapter, T-045; covers T-024/T-028 without attributing old edits to them. | +| hal | `771ebd1` | Content/provenance surveyed for index; full refresh T-046. | +| scheduler | `bbc42e8` | Content/provenance surveyed for index; full refresh T-046. | +| exceptions | `806c966` | Content/provenance surveyed for index; full refresh T-046. | +| security-model | `afeed10` | Content/provenance surveyed for index; full refresh T-046. | +| memory-management | `3ecef5e` | Content/provenance surveyed for index; full refresh T-046. | +| boot | `dfba2b6` | Current common reset/MMU/high-half prefix checked; stale loader/steady-state detail explicitly owned by T-046. | +| ipc | `d20e6d0` | Content/provenance surveyed for index; full refresh T-046. | + +The overview's boot summary follows executable source. Its shared reset, EL drop, bootstrap and high-half stages agree with the existing boot chapter; that chapter's obsolete non-running blob/banner and incomplete scheduler ending are corrected by the immediately following T-046 step. No old boot sequence is copied as current truth. T-046 must recheck the overview, detailed boot sequence and all index cells together before finishing; this is an approved sequencing dependency, not unowned deferral. The new phase-closure master-plan hook requires the same chapter/marker/index verification in every closure batch. + +## Verification boundaries + +The root checked simple local targets and relevant Markdown fragments, tagged Mermaid fences, exact source references, retained-log hashes, old/new claims and step scope before the implementation commit. Full-corpus grammar enforcement is T-056's later deliverable. Two fresh code/document rounds, each followed by a distinct security pass, are recorded separately after the implementation commit; this report does not pre-claim their verdicts. Maintainer Done promotion remains pending PR review/merge. + +> **Evidence migration (2026-10-16).** Raw evidence links now open the [immutable archive catalog](2026-10-16-pr49-evidence-catalog.md). Each link title retains its exact archived member path. Original verdicts, measurements, limitations and execution SHA identities remain historical; the archive bundle restores their original source. diff --git a/docs/analysis/reports/2026-10-13-t046-subsystem-architecture-verification.md b/docs/analysis/reports/2026-10-13-t046-subsystem-architecture-verification.md new file mode 100644 index 00000000..e7200b05 --- /dev/null +++ b/docs/analysis/reports/2026-10-13-t046-subsystem-architecture-verification.md @@ -0,0 +1,59 @@ +# T-046 — Subsystem architecture verification + +- **Date:** 2026-10-13, Europe/Istanbul. +- **Owner:** [T-046](../tasks/phase-b2/T-046-docs-subsystem-chapters-refresh.md), approved Step 3 under [ADR-0043](../../decisions/0043-documentation-corpus-consistency.md). +- **Source baseline checked:** `da18ed5c2a2d8b3d61f82337a9da021d05d73451` on development, after T-045's canonical review publication. +- **Exact runtime capture:** `4ad0b3d8a9d43310fcd937013131bffadcc803d7`, [T-045 report](2026-10-13-t045-architecture-verification.md) and [metadata](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t045-architecture-evidence "Archived member: docs/analysis/reports/2026-10-13-t045-architecture-evidence/metadata.json"). All executable paths remain identical; this step reuses retained evidence and claims no repeated build, smoke, host test, coverage or Miri run. + +## Whole-chapter reconciliation + +Each chapter's summary, context, design, invariant, trade-off, open-question and reference claims were checked, including those beyond the original named drift. Source bodies and dated decision/audit riders take precedence over stale adjacent code comments. Existing relevant boundary tests were read as contract context, not reported as newly passing. + +| Chapter | Load-bearing source and corrections | +|---------|------------------------------------| +| [HAL](../../architecture/hal.md) | Actual Cpu/ContextSwitch/Mmu/IRQ/Timer/Console signatures, empty Iommu; privileged QEMU implementations, FrameProvider callbacks, round-up deadlines, live EL0 initial scrub versus incomplete trap SIMD preservation. Remove invented BootInfo/Timer::init/build packages and unimplemented hardware claims. | +| [Scheduler](../../architecture/scheduler.md) | Per-slot AS/table/window arrays and current accessors; trusted registration without Task-generation/table-identity check, activation hook, separate idle fallback without an entry unmask, inherited dispatch-mask limitation, resume semantics, bridge receive rollback and non-reclaiming exit. Preserve the 2026-05-06 paragraph as explicitly historical rather than a current staleness verdict. | +| [IPC](../../architecture/ipc.md) | Message words, four endpoint states, generation-reset housekeeping/debug assertion versus release discard, leaf transfer/source and free-list-head receive-capacity stages, new receiver root and cross-table revocation limit. Bare EL0 calls differ from EL1 Delivered wake/yield and Pending block/resume. No current Miri count or line-count claim. | +| [Security model](../../architecture/security-model.md) | Five CapObject kinds/eight named rights; copy peers versus derive children, trusted arbitrary new_object correlation, descendant-only revoke and leaf drop/take. Actual PanicInfo-based fault diagnostics/exit leaks, PMM/arena/table bounds, no current badge/supervisor/IOMMU/secure-boot/crypto assurance. Future authority comes from the existing roadmap and deferred ADR-0023. | +| [Boot](../../architecture/boot.md) | boot.s, linker.ld and main's low/high/setup/registration bodies. DAIF-first EL drop, stack/FP-SIMD/BSS, vectors twice, six table frames inside BSS, PMM after TTBR0-off, matching raw image, caller tables before add_user/start, real hello interleaved with EL1 demo, Task A final spin. PA/VMA table avoids invented fixed section ends. | +| [Memory](../../architecture/memory-management.md) | Temporary identity → high-half/per-task roots, actual TCR/MAIR/AP/PXN/UXN/nG, AlreadyMapped for map into a block, BlockMapped for unmap/translate, no automatic split, must-use limits, PMM high-pointer helpers/type-enforced frame alignment versus free-time extent/reservation/allocation checks, AS preflight/child derivation, kind-only map/unmap and lifecycle leaks. Retain T-019's removed banner solely as dated historical evidence. | +| [Exceptions](../../architecture/exceptions.md) | Actual vector targets, 192-byte IRQ frame and 272-byte syscall frame (including SP_EL0, no padding), absent SIMD save, complete binding, debug decode order, Resume/Reschedule/Terminate distinction, timer ceil conversion/mask/EOI, no scheduler IRQ mutation. Installed delivery/idle paths are not asserted exercised. | + +## Shared T-045 checks + +The overview's reset/MMU/high-half/PMM/load/GIC/table/register/EL0/completion sequence agrees with the expanded boot sequence, including table publication before dispatch and EL1/EL0 interleaving. Both name Task A's final busy-spin. No overview correction is needed. Its ADR and current/planned limits agree with all seven refreshed chapters. + +Every architecture-index cell was rechecked. Nine existing Accepted documents remain distinct from two unwritten planned chapters. Overview/loader retain T-045 edit ownership and source `4ad0b3d`; the seven refreshed chapters name T-046 and exact checked source `da18ed5`. Earlier nine edit SHAs remain the independently verified T-045 metadata records. Implementation coverage does not imply that a historically covered task edited a document. + +Incoming live anchors `memory-management.md#frame-allocation-discipline` and `boot.md#high-half-migration-t-022--adr-0033` are preserved. Old review `#L...` links and retired skill provenance remain T-049-owned archive work, without silently treating them as valid heading links. T-045's shared criteria can be checked only after T-046's two fresh rounds complete; its old master-plan navigation criterion remains pending T-049 repair. + +## Evidence and limits + +Both retained profiles reach EL0 PC `0x800000`, exit and completion; debug alone emits the greeting. Each raw trace contains exactly two SVC events and no other exception events/fault matches. Counts are manual inspection, not smoke.sh assertions. The captured runtime neither arms timer IRQs nor selects idle/WFI; it cannot prove arbitrary loader safety, complete destruction/reclamation, full FP/SIMD trap isolation, preemption/SMP or kernel-wide soundness. Release syscall rejection follows the source decoder, not a printed status value. + +This prose refresh changes no Rust/assembly, ABI, unsafe contract, dependency, CI identity, architectural decision or raw evidence. No new ADR is needed for the maintainer-approved correction of actual current behavior. Fresh independent code and subsequent distinct security rounds remain required and will be recorded separately after the implementation commit. This report does not preclaim their verdict, task Done promotion, phase closure or whole-corpus cleanliness. + +## Implementation checks + +Coordinator checks at correction tip `4b33607` passed: `git diff --check`; the bounded inline-path scan over eight chapter/index files plus this report, including code-formatted labels (280 local paths, zero missing); a separate bounded check of ten current chapter heading links, seven exact freshness lines, balanced tagged fences and all four task-specific stale-token checks. These scratch checks cover the stated files/forms and do not replace T-056's later full-corpus grammar gate. A read-only comparison of kernel/HAL/BSP/userland/test-hal/tools/Cargo/config/CI/toolchain paths confirms no delta from the exact runtime capture. The old business-master-plan link is unchanged and remains T-049-owned. + +## First-round corrections + +Fresh code context `b22_t046_r1_code` completed at `5e191ad`; the distinct subsequent security context `b22_t046_r1_security` completed its own source assessment before reading the code report. Their initial verdicts requested three Medium and three Low unique factual corrections. The coordinator independently verified each against source and corrected all occurrences: + +| Finding / origin | Correction | +|------------------|------------| +| C1 / S1, shared Medium | The 272-byte syscall frame includes SP_EL0; all 34 u64 slots are saved values, with no padding. | +| C2 / S2, shared Medium | Map into a block returns AlreadyMapped; unmap/translate return BlockMapped. Corrected the chapter/report duplicate; T-041 still owns its older fake. | +| C3 / S3, shared Medium | Idle performs WFI/yield without an explicit IRQ unmask. Initial dispatch holds a guard on an abandoned caller frame; boot's earlier unmask does not establish an unmasked idle entry. Actual mask/delivery evidence remains required. | +| C4 / S4, shared Low | Receive capacity checks the free-list head, without a table scan or slot reservation. | +| C5 / S5, shared Low | Exception messages carry class/ESR/class-id or IRQ identifier through the BSP's PanicInfo output; no prior saved-frame print/dump exists. Corrected boot/security wording. | +| S6, security-only Low | PhysFrame construction supplies alignment; free-time checks cover extent, reservations and allocation state. | + +No runtime change, new decision or new test execution is involved. Bounded correction verification by the first-round reviewers and the two fresh second-round contexts are still pending at this correction record; no final approval is preclaimed. + +## Review completion + +Both fresh rounds now approve cumulative `d71aa4a..4b33607`: [code](../reviews/code-reviews/2026-10-13-t046-subsystem-architecture.md), [distinct security](../reviews/security-reviews/2026-10-13-t046-subsystem-architecture.md). All six R1 corrections were independently verified; R2 found no additional issue. The preceding pending statements record implementation/correction time and are superseded by this completion entry. Whole-chapter and shared T-045 overview/boot/index verification are complete; T-046 and T-045 remain In Review. No runtime evidence changed or new execution/full-corpus/Done/phase-closure result is asserted. + +> **Evidence migration (2026-10-16).** Raw evidence links now open the [immutable archive catalog](2026-10-16-pr49-evidence-catalog.md). Each link title retains its exact archived member path. Original verdicts, measurements, limitations and execution SHA identities remain historical; the archive bundle restores their original source. diff --git a/docs/analysis/reports/2026-10-13-t047-roadmap-state-preflight.md b/docs/analysis/reports/2026-10-13-t047-roadmap-state-preflight.md new file mode 100644 index 00000000..963a05a8 --- /dev/null +++ b/docs/analysis/reports/2026-10-13-t047-roadmap-state-preflight.md @@ -0,0 +1,28 @@ +# T-047 — roadmap live-state preflight and execution plan + +- **Date:** 2026-10-13. +- **Author:** Codex implementation coordinator. +- **Clean source:** 20a0d25e69a0ce9872ee9dd58e7bd994f22230e1, development; Step 9's actual full both-round canonical boundary. +- **Authority:** [approved 13-step plan](2026-10-12-phase-b2-track2-preflight-and-plan.md), Accepted [ADR-0043](../../decisions/0043-documentation-corpus-consistency.md), [T-047](../tasks/phase-b2/T-047-roadmap-state-and-phase-index-sync.md). +- **State:** pre-content plan/source inventory only. Seven AC/four DoD remain unchecked; no delivery/reviewer/maintainer verdict. + +## Reverified sources and decisions + +The full approved T-047 contract, current pointer/history, roadmap/phase indexes, relevant B/C phase context, consolidated Phase-B seam security review and actual task/ADR states were reviewed. Earlier read-only preparation at c508fa62/a93926b is not implementation evidence; the [baseline](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t047-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t047-verification-evidence/semantic-baseline.json") records the actual clean source above. Current has 141 lines/82594 UTF-8 bytes, with 22 dated groups and an old contradictory live-state tail. The outdated T-028 last-task/PR #48-open/first-wave bullets reproduce. The phases index already has no “it is active” phrase; no unnecessary index rewrite is planned. + +Git integration records, including squash integrations, are captured with full IDs, author/committer dates, subjects and parents. T-029 PR #44/#45 both integrated 2026-06-01; Phase-B closure PR #43 is integrated and its b6-closure branch is historical/retired. Latest completed work remains T-030–T-037/PR #48 on 2026-10-12. PR #36's actual Git integration date is 2026-05-30, while an old human narrative says May 31; new B6 status text will name Done/PR #36 without inventing a May 31 merge. Historical dates, measured evidence and original supersession notes remain verbatim in the archive. + +The unsafe-log inventory is 33 entries: 32 Active, one Removed (0012), from each entry's first status. This is a metadata recount, not re-audit or soundness proof. The 2026-07-15 review is local-only and absent from the repository; self-contained phase-b2/task records provide provenance without a dead private-file link. + +The existing Phase-C carry-forward section contains lifecycle, reserved 0034 and K3-4 only. The approved AC requests gate #3 atomicity, gate #1 loader trust and SP_EL1 high-water distinct from IRQ/TTBR1. No separate IRQ/TTBR1 item currently exists, so four source-backed bullets are needed: the three requested flags plus that distinct IRQ item. Both latter concerns are explicit in the consolidated review's final forward-flag bullet. This is a demonstrated same-section completeness repair under the approved contract, not a new architecture decision or T-074 milestone rewrite. + +## Bounded execution plan + +1. Preserve all original dated groups byte-for-byte in same-directory current-archive.md, reverse chronological by event date, retaining same-day source order and full multi-paragraph May 8/May 9 groups. Preserve the original preamble and entire old live-state/Notes tail as explicitly historical snapshots. Add a clearly recovered June1 T-029 completion banner, without replacing the latest completed wave. Same-directory placement preserves relative-link path math. A prewrite assertion rejected an initial date-in-link grouping false positive; the baseline records the corrected headline-only segmentation. +2. Replace current.md with a concise dated live section delimited exactly by current-state:start/current-state:end HTML comments. Describe active B.2-2/T-047/development, actual task table/counts, latest wave/historical T-029/retired closure, real decision states, recent reviews, next selected T-056 then HIGH correctness work and eventual T-075 closure. Keep the archive linked. The delimiter is a routine choice within Accepted ADR-0043; no new ADR/maintainer choice is needed. +3. Correct only the B6 sequence's T-022/T-027/T-028 status tags to Done with PR #36/41/42, preserving dependency rationale and implementation narrative. Add separate C flags: atomic context before C2/C3 preemption/SMP, loader trust before first untrusted-image/filesystem exposure (E, or earlier C if it exposes it), SP_EL1 high-water before C3 richer IRQ execution, and IRQ/TTBR1 verification before C3 preemptive IRQ enablement. T-029 performance is not stack-bound evidence. +4. Retain reproducible archive/source/merge/status/audit checks and fresh bounded navigation; commit. Run fresh paired R1 code/security, validate/fix/commit, then different fresh paired R2; fully retain actual reports and cross-read chronology. Stop T-047 In Review/no date_done; automatically continue T-056 after the actual both-round canonical boundary. + +Content scope is current.md, linked archive, phase-b.md and phase-c.md; tracking/evidence/review bookkeeping uses the approved allowance. No runtime, unsafe-log, filed ADR, numeric planning identity, C/D gate, T-074 folding or external publication change. Root remains sole writer. Existing PR49 publication barrier remains; this step claims no hosted execution. + +> **Evidence migration (2026-10-16).** Raw evidence links now open the [immutable archive catalog](2026-10-16-pr49-evidence-catalog.md). Each link title retains its exact archived member path. Original verdicts, measurements, limitations and execution SHA identities remain historical; the archive bundle restores their original source. diff --git a/docs/analysis/reports/2026-10-13-t047-roadmap-state-reconciliation.md b/docs/analysis/reports/2026-10-13-t047-roadmap-state-reconciliation.md new file mode 100644 index 00000000..d6706771 --- /dev/null +++ b/docs/analysis/reports/2026-10-13-t047-roadmap-state-reconciliation.md @@ -0,0 +1,30 @@ +# T-047 — roadmap live-state reconciliation + +- **Date:** 2026-10-13. +- **Author:** Codex implementation coordinator. +- **Clean step base:** 20a0d25e69a0ce9872ee9dd58e7bd994f22230e1, development. +- **Pre-content kickoff:** c989237a6a2b0a7ef946d1fbed5621b5e0c71941. +- **Authority:** [approved plan](2026-10-12-phase-b2-track2-preflight-and-plan.md), [preflight](2026-10-13-t047-roadmap-state-preflight.md), Accepted [ADR-0043](../../decisions/0043-documentation-corpus-consistency.md), [T-047](../tasks/phase-b2/T-047-roadmap-state-and-phase-index-sync.md). +- **Delivery state:** both fresh paired rounds Approve frozen cumulative 20a0d25..8a89fd2; In Review, all eleven criteria checked. No maintainer approval or task Done claimed. + +## Live state and preserved history + +[current.md](../../roadmap/current.md) is a 56-line pointer with explicit current-state:start/current-state:end comments, twelve source-matching selected task rows, current inventory, actual completed wave, future selected work and real review/decision states. Old PR #48-open/In-Review-first-wave and T-028-last-task claims are replaced in the live section. T-029's two June 1 integrations remain historical; latest completed work is Track B.2-1 plus prerequisite T-037. Phase B closure PR #43 and b6-closure are merged/retired. The July 15 review is explicitly local-only, with self-contained public roadmap/task provenance and no private-file link. + +[current-archive.md](../../roadmap/current-archive.md) preserves every byte of all 22 original dated groups, the complete old live-state/Notes tail and the original preamble (as a clearly labelled literal snapshot). Groups are reverse chronological by event date; original same-day order, full multi-paragraph groups, measured values and supersession notes remain. One explicitly recovered June 1 T-029 banner gives 23 groups. The archive's clean source is the actual Step 9 boundary, not the transitional T-047 kickoff worktree. Same-directory placement preserves relative-link semantics. The original old status/date claims are historical evidence, not newly certified facts. + +## Source-backed corrections + +Only three B6 sequence status tags change: T-022/PR #36, T-027/PR #41 and T-028/PR #42 now Done. Dependency rationale and implementation narrative remain exact. PR #36 integrated May 30 according to Git; its May 31 security review is a separate event. The later explicitly historical May 30 status snapshot remains unchanged. A prewrite uniqueness assertion caught the duplicate historical tag; the actual edit was then scoped to the single sequence line. + +Four distinct Phase-C carry-forward bullets cite the consolidated seam security review: gate #3 atomic context resolution before C2/C3 preemption/SMP; gate #1 loader trust before first untrusted-image/filesystem exposure, whichever milestone introduces it; SP_EL1 4 KiB high-water before richer C3 IRQ/exception execution; and the separate IRQ/TTBR1 reachability assumption before preemptive IRQ enablement. Existing lifecycle, reserved 0034 and K3-4 text and all milestones/backlogs/ledgers remain unchanged. These are future source-supported triggers, not implemented protections, T-029 stack proof or T-074 folding. + +## Reproducible bounded verification + +The [retained source comparator](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t047-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t047-verification-evidence/verify-roadmap.py") uses Python 3.9+ standard library/Git and resolves root from its own file. It checks all original groups/preamble/tail against the clean source and hashes, reverse chronology/same-day order, exact B6 three-line transformations, exact C insertion boundary, live table/inventory versus actual tasks, seven Git integration records, unchanged unsafe-log first-status inventory and protected source domains. Its [implementation result](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t047-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t047-verification-evidence/implementation-verification.json") records the actual kickoff HEAD plus owned worktree hashes. Original source inventory remains immutable. Local Python 3.9.6 syntax compilation passed, and invocation by absolute path from /tmp produced an identical comparison result without rewriting the original capture. + +The [navigation capture](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t047-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t047-verification-evidence/implementation-navigation.json") is separate: existing third-party rendering and approximate heading/line checks, with tracked plus visible untracked scope explicitly stated. It is not T-056 grammar/CI delivery, external-link validation, a runtime test or soundness proof. See [evidence instructions](2026-10-13-t047-verification-evidence/README.md) for invocation and limits. + +Both fresh paired review rounds and actual report cross-reading completed on frozen 8a89fd2, with zero confirmed source findings and no warranted corrective commit. [Full canonical code](../reviews/code-reviews/2026-10-13-t047-roadmap-state-reconciliation.md) and [security](../reviews/security-reviews/2026-10-13-t047-roadmap-state-reconciliation.md) reports retain all actual initial/final bytes. The [publication manifest](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t047-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t047-verification-evidence/publication-manifest.json") binds original captures, reviewed content and later coordinator lifecycle/discovery checks. Report-only source-locator QA is separate from source-finding accounting. Root remains sole writer on development; no runtime/config/unsafe-log/filed-ADR/phase-opening/external publication change is claimed. T-047 stops In Review/no date_done; T-056 follows automatically. PR49 publication barrier remains. + +> **Evidence migration (2026-10-16).** Raw evidence links now open the [immutable archive catalog](2026-10-16-pr49-evidence-catalog.md). Each link title retains its exact archived member path. Original verdicts, measurements, limitations and execution SHA identities remain historical; the archive bundle restores their original source. diff --git a/docs/analysis/reports/2026-10-13-t047-verification-evidence/README.md b/docs/analysis/reports/2026-10-13-t047-verification-evidence/README.md new file mode 100644 index 00000000..a8bc7959 --- /dev/null +++ b/docs/analysis/reports/2026-10-13-t047-verification-evidence/README.md @@ -0,0 +1,23 @@ +# T-047 verification evidence + +- [semantic-baseline.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t047-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t047-verification-evidence/semantic-baseline.json"): actual clean source, original dated-group/preamble/tail hashes, full Git integration records and first-status unsafe inventory. Metadata only, not unsafe re-audit or delivery. + +Original source and later snapshots remain separately attributable. The archive stays beside current.md so original relative paths retain their meaning. Further captures are added only when actually produced. + +- [verify-roadmap.py](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t047-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t047-verification-evidence/verify-roadmap.py"): bounded source/history diagnostic, Python 3.9+ stdlib/Git, root from its own location; optional explicit output is its only write. +- [implementation-verification.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t047-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t047-verification-evidence/implementation-verification.json"): original actual post-content comparison, kickoff HEAD plus worktree hashes; retained unchanged after review. +- [implementation-navigation.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t047-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t047-verification-evidence/implementation-navigation.json"): actual visible-corpus navigation capture using the existing third-party diagnostic, with explicit grammar/source limits. + +From repository cwd: + +~~~sh +python3 docs/analysis/reports/2026-10-13-t047-verification-evidence/verify-roadmap.py +~~~ + +An absolute script path works from another cwd. Use --output /tmp/t047-comparison.json for a separate fresh result; do not overwrite original snapshots. Comparison errors or invalid/missing source fail nonzero. This is an intentionally step-bound diagnostic, not general T-056 functionality: later owning edits can legitimately change its frozen content, so reproduce historical results on the recorded source and compare the owned hashes. It inventories audit metadata, not source annotations or Rust soundness. Navigation uses the existing third-party diagnostic rather than proving complete Markdown grammar. + +- [publication-manifest.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t047-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t047-verification-evidence/publication-manifest.json"): actual completed four-report identities/initial-prefix retention, unchanged original captures and archive/B/C source, explicit later live-state lifecycle transition; coordinator verification, not a third independent round. +- [publication-verification.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t047-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t047-verification-evidence/publication-verification.json"): separate actual final source/history comparison after authorized In Review bookkeeping. +- [publication-navigation.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t047-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t047-verification-evidence/publication-navigation.json"): separate actual final visible-corpus navigation with the same third-party/approximate grammar limits. + +> **Evidence migration (2026-10-16).** Raw evidence links now open the [immutable archive catalog](../2026-10-16-pr49-evidence-catalog.md). Each link title retains its exact archived member path. Original verdicts, measurements, limitations and execution SHA identities remain historical; the archive bundle restores their original source. diff --git a/docs/analysis/reports/2026-10-13-t048-phase-b-task-reconciliation.md b/docs/analysis/reports/2026-10-13-t048-phase-b-task-reconciliation.md new file mode 100644 index 00000000..4299ee7a --- /dev/null +++ b/docs/analysis/reports/2026-10-13-t048-phase-b-task-reconciliation.md @@ -0,0 +1,65 @@ +# T-048 Phase B task reconciliation — 2026-10-13 + +- **Status:** Both fresh independent code rounds Approve cumulative `a214532..a50f94a`; one R1 Low provenance correction independently verified, no unresolved finding. T-048 is In Review. +- **Implementation baseline:** `f573ae1d39271da4ea4ded57c1252abb29630683` on `development`; historical comparison before this step at `a214532`. +- **Verified implementation:** The checks below ran on the resulting uncommitted implementation tree above that baseline; implementation, report and initial verification record were then committed as `550500f3080179fdb9b7254f64ea6fc48bf636d0`. The clean kickoff tree alone does not contain or prove the reconciliation. +- **Merged-main evidence:** `origin/main` at `c16997e003fbd1726d1205734380394781c52002`. Local `main` is not the verification source. +- **Authority:** Maintainer-approved [T-048 contract](../tasks/phase-b2/T-048-phase-b-task-corpus-sync.md), [13-step plan](2026-10-12-phase-b2-track2-preflight-and-plan.md), [ADR-0043](../../decisions/0043-documentation-corpus-consistency.md), and the Phase B completion/PR record in [current.md](../../roadmap/current.md). + +## Reconciliation and merge evidence + +Ten already-merged Phase B records now have plain Done status and the final integration date immediately after Created. Each gains one dated merge-confirmation bullet while retaining its earlier body/history verbatim. T-029 names both integrations and receives the approved B6 follow-on milestone. This reconciliation uses existing maintainer authorization; it does not promote new B.2 tasks to Done or invent fresh test/review evidence. + +| Task | PR | Integration commit | Author = committer date | +|------|----|--------------------|-------------------------| +| T-020, T-021 | #34 | `f98e1af8e9f044d8d28858ca40c11ede03ef7e06` | 2026-05-29 | +| T-022 | #36 | `b6549d7e41667d62e42a16491e26165518b09510` | 2026-05-30 | +| T-023 | #37 | `eb3125f716db7944f80f973ef04e046fb101ada3` | 2026-05-31 | +| T-024 | #38 | `5f17a30705c49e1b6fccb58b194e259994cf38ab` | 2026-05-31 | +| T-025 | #39 | `f21eece3e956926d2d2219294850fe8d6f4d4872` | 2026-05-31 | +| T-026 | #40 | `a8ce11e3b9d48145d9e81d2007dfa5bb8d094c91` | 2026-05-31 | +| T-027 | #41 | `9551a331645b5843778ffc8ff2f35a85f79845a8` | 2026-06-01 | +| T-028 | #42 | `0040f23fdc87d6453c2ef9752899b001012bf5c5` | 2026-06-01 | +| T-029 Phase 1 | #44 | `9c61a8ec49ab571b1d9686cb709699bc2fd5879d` | 2026-06-01 | +| T-029 Phase 2 | #45 | `2ff65cb3bb12684092889fdb910d39af3fe2316d` | 2026-06-01 | + +Checked each full SHA, author/committer date, subject, ancestry and membership in `git rev-list --first-parent origin/main` using `git show -s --format=%H%n%as%n%cs%n%s ` and `git merge-base --is-ancestor origin/main`. PR #42 is a one-parent integration commit; two-parent merge shape is not presumed. The final T-029 integration determines its date_done. The dated opening observations and merge table in T-048 remain historical context. + +The Phase B index now contains exactly the same 23 unique task filenames as disk, in one contiguous Markdown table: eight new rows use each exact H1 title and frontmatter milestone; T-020/T-021 rows name PR #34 and 2026-05-29. T-010 is absent on disk and no synthetic row is created. Older row wording outside the two scoped status corrections is preserved. + +Only the three contract-named historical paths changed: T-002's cap table and T-004's ContextSwitch links gain the missing parent traversal; T-011's coverage link now resolves to the same report as its existing second link. Template/lifecycle formalize optional date_done on maintainer-authorized Done, after Created, with a real ISO date; omit while open and never fabricate unknown historical dates. The Draft template carries a non-rendered insertion instruction rather than a live placeholder field. + +## Preservation evidence + +For each of the ten files, compared the complete bytes after the frontmatter separator before this step with the implementation prefix, including all existing history. Exactly one new merge-confirmation bullet follows. All existing acceptance/DoD checkboxes and all other frontmatter fields are unchanged; T-029's new Milestone is the explicit exception. The SHA-256 values below identify those unchanged original body/history bytes, encoded as UTF-8. + +| Task | Preserved original body SHA-256 | +|------|--------------------------------| +| T-020 | `91205d69952ee65e6c287428a23aa471552fda9f2200753e840fb7c5e00f40f3` | +| T-021 | `ec6d367597ff5d839ac703b9d03bb9a6877fac82d50bd68bce9dd5b9d2d6c547` | +| T-022 | `6d8abaf2e46b9a9b6599096afc5e2479917911f813e753b2b26af2e5f0dbca62` | +| T-023 | `0ad1cb9c50212cfb16fc78569bb1b132967b4f472c53462d28bb46b02f99e876` | +| T-024 | `5364f746c04c31164e5d8cc6d147f1d0ffca166c3a93ea66e3af852ec9bc4a7d` | +| T-025 | `e849695c7c00d7c6f0bfa41748a0891f7fc86beff7e97ef3706b43ca9f7fc2cf` | +| T-026 | `50809789c9645b3e923ebc9b1cdb995cbe14da15b497b35a770cd43d25486303` | +| T-027 | `9ea03eec23e289b89541236d3993953e06e44fa6477b6ef9636a94ade6d8061b` | +| T-028 | `5e141c7e81817e5b88913ed50648b0d0e7dd39491812c1b35f62d8198c457603` | +| T-029 | `07e5b01c906783ca0f74c90e34f4b09af3cbd22ac7abb62e4baafaf9dbea5c4b` | + +The three link-only files also match their original bytes with only the single authorized destination replacement. No raw runtime/coverage/security review evidence is rewritten. + +## Implementation verification + +Coordinator scratch assertions passed against the implemented tree: 23 unique/contiguous index rows equal the disk set; all ten exact status/date and integration facts; all eight new literal title/milestone cells; ten body/history/checkbox and other-header preservation checks; three whole-file link-only comparisons. B.2 counts remain 8 Done / 26 Ready / 1 In Progress / 3 In Review / 8 Draft = 46; the one In Progress task is T-048. + +`python3 /tmp/tyrne-b22-bounded-md-links.py docs/analysis/tasks/phase-a/*.md docs/analysis/tasks/phase-b/*.md docs/analysis/tasks/TEMPLATE.md docs/analysis/tasks/README.md` resolves **800 bounded inline local paths, zero missing**. Separate source-derived scratch fragment assertions resolve **99 heading references and two source-line references**, with duplicate heading slug handling and source-line bounds. Scans include code-formatted link labels, exclude fenced/code-contained examples, and cover the stated files/forms. They are not the full-corpus grammar gate owned by T-056. The scratch scripts are coordinator checks, not shipped tools or a reproducibility claim about another machine. + +`git diff --check` passes. New prose is English; no diagram/fence, executable, API, unsafe, dependency or CI change is introduced. No build, Rust test, smoke, Miri or coverage run was necessary or performed for this metadata/navigation step. Review will independently assess correctness, style, tests/evidence, documentation and integration, including preservation and literal contracts; both fresh rounds are still pending at this implementation record. + +## First-round provenance correction + +The fresh R1 reviewer independently verified the merged-task facts, preservation, rendered table and navigation at `550500f`, and identified one Low ambiguity in the former Checked source field: it named the clean kickoff commit although checks ran after applying the implementation. The header now separates the kickoff baseline, checked resulting tree and actual implementation commit. This changes no historical task content, status/date fact, runtime evidence or verification result. The R1 bounded follow-up and different fresh R2 assessment are still pending at this correction record. + +## Review completion + +[Both fresh five-role code rounds](../reviews/code-reviews/2026-10-13-t048-phase-b-task-reconciliation.md) now Approve the exact corrected tip `a50f94ab7d8a28d67e3527be6ad0504ca0ca21d1`. R1's one Low provenance finding is resolved; no unresolved finding remains. Earlier pending statements record their implementation/correction time and are superseded by this completion. T-048 moves only to In Review, with no date_done; historical Done facts remain independently authorized. No runtime evidence or original historical task body/history/checkbox changed. diff --git a/docs/analysis/reports/2026-10-13-t049-coverage-rerun.md b/docs/analysis/reports/2026-10-13-t049-coverage-rerun.md new file mode 100644 index 00000000..1516550f --- /dev/null +++ b/docs/analysis/reports/2026-10-13-t049-coverage-rerun.md @@ -0,0 +1,77 @@ +# Host coverage rerun — 2026-10-13 / T-049 + +- **Executed source:** clean `development` at `0ab0ba427ae97d5233afd01dfe7205b1ae8bc0c3`, before the Step-5 archive/report edits. This is the tested source, not a claim that later documentation changes already exist in that commit. +- **Date:** 2026-10-13, Europe/Istanbul. Retained timestamps are UTC (2026-10-12 23:xx), the same local execution date. +- **Actual command exit:** `0`; tracked/untracked tree clean before and after; source HEAD unchanged. +- **Started / finished UTC:** `2026-10-12T23:29:57.450170+00:00` / `2026-10-12T23:29:59.775303+00:00`. +- **Host:** Darwin 27.0.0 / arm64, Rust host `aarch64-apple-darwin`; Python 3.9.6 captured the process. +- **Toolchain:** repository override `nightly-2026-01-15`; rustc `1.94.0-nightly`, commit `86a49fd71fecd25b0fd20247db0ba95eeceaba28` (2026-01-14), rustc LLVM 21.1.8; cargo `1.94.0-nightly (6d1bd93c4 2026-01-10)`. +- **Raw output:** [coverage.log](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t049-review-evidence "Archived member: docs/analysis/reports/2026-10-13-t049-review-evidence/coverage.log"), SHA-256 `a22757c1f702bbf7d0b3a376ef1ce7e0785427833c63c2599a9695cb7d657a14`; [process/tool/environment metadata](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t049-review-evidence "Archived member: docs/analysis/reports/2026-10-13-t049-review-evidence/coverage.json"). +- **Review state:** [Both fresh primary/complementary rounds](../reviews/code-reviews/2026-10-13-t049-review-corpus-reconciliation.md) complete at `aa37e2c`; C01 corrected and independently verified. T-049 is In Review; no Done, hosted CI or main-merge claim. + +## Invocation + +```bash +cargo llvm-cov --workspace --exclude tyrne-bsp-qemu-virt --exclude tyrne-user --exclude tyrne-userland-hello --summary-only +``` + +The local runner was `cargo-llvm-cov 0.9.0`, already installed before this task. The repository command uses the repository-pinned default Rust toolchain. CI pins `cargo-llvm-cov@0.6.16`; this local report does not claim that hosted version ran or that the versions produce identical denominators. No CI/tool pin or shipping dependency changed here. + +## Actual result + +The three included host suites pass **363 unit tests**: HAL 46, kernel 259 and test-HAL 58. This command did not request doc-test coverage; no doc-test execution is inferred from its output. BSP, `tyrne-user` and `tyrne-userland-hello` are explicitly excluded. + +| Measure | Total | Missed | Covered / executed | Percent | +|---------|------:|-------:|-------------------:|--------:| +| Regions | 14,039 | 518 | 13,521 | 96.31% | +| Functions | 786 | 54 | 732 | 93.13% | +| Lines | 8,346 | 345 | 8,001 | 95.87% | + +The retained table reports 28 source files. Branch columns are zero with percentage `-`: branch coverage was not measured, and this is not a 100% branch-coverage claim. Lower included measurements such as scheduler functions (73.33%) and loader lines (93.74%) remain visible in the full output; the aggregate is not proof that every path is exercised. + +## Coverage table + +The table below is copied verbatim from this command's output; numerators and percentages above were checked against TOTAL. + +```text +Filename Regions Missed Regions Cover Functions Missed Functions Executed Lines Missed Lines Cover Branches Missed Branches Cover +------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- +hal/src/console.rs 6 0 100.00% 1 0 100.00% 4 0 100.00% 0 0 - +hal/src/cpu.rs 11 0 100.00% 2 0 100.00% 7 0 100.00% 0 0 - +hal/src/mmu/mod.rs 76 16 78.95% 20 4 80.00% 64 12 81.25% 0 0 - +hal/src/mmu/vmsav8.rs 420 2 99.52% 26 0 100.00% 279 0 100.00% 0 0 - +hal/src/timer.rs 206 0 100.00% 28 0 100.00% 143 0 100.00% 0 0 - +kernel/src/cap/mod.rs 67 1 98.51% 9 0 100.00% 54 1 98.15% 0 0 - +kernel/src/cap/rights.rs 120 0 100.00% 18 0 100.00% 75 0 100.00% 0 0 - +kernel/src/cap/table.rs 1462 39 97.33% 63 1 98.41% 632 25 96.04% 0 0 - +kernel/src/ipc/mod.rs 1448 21 98.55% 54 0 100.00% 765 12 98.43% 0 0 - +kernel/src/mm/address_space.rs 1046 35 96.65% 46 1 97.83% 561 20 96.43% 0 0 - +kernel/src/mm/mod.rs 27 0 100.00% 6 0 100.00% 18 0 100.00% 0 0 - +kernel/src/mm/pmm.rs 1068 7 99.34% 39 0 100.00% 542 3 99.45% 0 0 - +kernel/src/obj/arena.rs 262 9 96.56% 20 1 95.00% 130 6 95.38% 0 0 - +kernel/src/obj/endpoint.rs 64 0 100.00% 9 0 100.00% 41 0 100.00% 0 0 - +kernel/src/obj/notification.rs 109 4 96.33% 12 1 91.67% 65 3 95.38% 0 0 - +kernel/src/obj/task.rs 103 0 100.00% 13 0 100.00% 68 0 100.00% 0 0 - +kernel/src/obj/task_loader.rs 1819 104 94.28% 66 4 93.94% 1135 71 93.74% 0 0 - +kernel/src/sched/mod.rs 2073 159 92.33% 105 28 73.33% 1430 115 91.96% 0 0 - +kernel/src/syscall/abi.rs 243 0 100.00% 25 0 100.00% 169 0 100.00% 0 0 - +kernel/src/syscall/dispatch.rs 1098 50 95.45% 33 0 100.00% 723 25 96.54% 0 0 - +kernel/src/syscall/error.rs 125 0 100.00% 10 0 100.00% 89 0 100.00% 0 0 - +kernel/src/syscall/user_access.rs 493 11 97.77% 21 0 100.00% 277 3 98.92% 0 0 - +test-hal/src/console.rs 57 0 100.00% 8 0 100.00% 39 0 100.00% 0 0 - +test-hal/src/context_switch.rs 182 2 98.90% 14 1 92.86% 113 2 98.23% 0 0 - +test-hal/src/cpu.rs 159 0 100.00% 20 0 100.00% 102 0 100.00% 0 0 - +test-hal/src/irq_controller.rs 195 3 98.46% 21 1 95.24% 104 3 97.12% 0 0 - +test-hal/src/mmu.rs 964 55 94.29% 79 12 84.81% 629 44 93.00% 0 0 - +test-hal/src/timer.rs 136 0 100.00% 18 0 100.00% 88 0 100.00% 0 0 - +------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- +TOTAL 14039 518 96.31% 786 54 93.13% 8346 345 95.87% 0 0 - +``` + +## Scope and historical comparison + +This is host instrumentation, including test-side source regions, not bare-metal/QEMU/assembly, userland, branch or security coverage. The command reports `cfg(coverage)` and `cfg(coverage_nightly)` in the raw output. Local source/tool/profile scope controls the denominator; no architectural correctness or no-regression verdict follows from the percentage alone. + +The [2026-04-23 baseline](2026-04-23-coverage-baseline.md) and [2026-04-27 rerun](2026-04-27-coverage-rerun.md) preserve their historical methodology and numbers. They covered an earlier source and used a broader workspace exclusion list. Neither a direct percentage trend nor an improvement/regression is inferred across those different denominators and tool versions. Fresh Miri results are recorded independently in [the companion report](2026-10-13-t049-miri-validation.md). + +> **Evidence migration (2026-10-16).** Raw evidence links now open the [immutable archive catalog](2026-10-16-pr49-evidence-catalog.md). Each link title retains its exact archived member path. Original verdicts, measurements, limitations and execution SHA identities remain historical; the archive bundle restores their original source. diff --git a/docs/analysis/reports/2026-10-13-t049-miri-validation.md b/docs/analysis/reports/2026-10-13-t049-miri-validation.md new file mode 100644 index 00000000..0c25acd1 --- /dev/null +++ b/docs/analysis/reports/2026-10-13-t049-miri-validation.md @@ -0,0 +1,45 @@ +# Miri validation — 2026-10-13 / T-049 + +- **Executed source:** clean `development` at `0ab0ba427ae97d5233afd01dfe7205b1ae8bc0c3`, before the Step-5 archive/report edits. This is the tested source, not a claim that later documentation changes already exist in that commit. +- **Date:** 2026-10-13, Europe/Istanbul. Retained timestamps are UTC (2026-10-12 23:xx), the same local execution date. +- **Actual command exit:** `0`; tracked/untracked tree clean before and after; source HEAD unchanged. +- **Started / finished UTC:** `2026-10-12T23:29:24.354905+00:00` / `2026-10-12T23:29:49.830726+00:00`. +- **Host:** Darwin 27.0.0 / arm64, Rust host `aarch64-apple-darwin`; Python 3.9.6 captured the process. +- **Toolchain:** repository override `nightly-2026-01-15`; rustc `1.94.0-nightly`, commit `86a49fd71fecd25b0fd20247db0ba95eeceaba28` (2026-01-14), rustc LLVM 21.1.8; cargo `1.94.0-nightly (6d1bd93c4 2026-01-10)`. +- **Raw output:** [miri.log](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t049-review-evidence "Archived member: docs/analysis/reports/2026-10-13-t049-review-evidence/miri.log"), SHA-256 `1ecc45d89c2cdc6caf8f0dd51af791c8fbd56a6a7fe90fc7c5e99c9f99c77d67`; [process/tool/environment metadata](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t049-review-evidence "Archived member: docs/analysis/reports/2026-10-13-t049-review-evidence/miri.json"). +- **Review state:** [Both fresh primary/complementary rounds](../reviews/code-reviews/2026-10-13-t049-review-corpus-reconciliation.md) complete at `aa37e2c`; C01 corrected and independently verified. T-049 is In Review; no Done, hosted CI or main-merge claim. + +## Invocation + +```bash +cargo +nightly-2026-01-15 miri test --workspace --exclude tyrne-bsp-qemu-virt +``` + +Miri version is `0.1.0 (86a49fd71f 2026-01-14)`. Only `tyrne-bsp-qemu-virt` is excluded; both userland crates remain in the workspace invocation and each runs zero host unit tests. `MIRIFLAGS` and the other recorded compile-environment overrides were unset. + +## Actual result + +| Suite | Passed | Failed | Ignored | +|-------|-------:|-------:|--------:| +| HAL unit tests | 46 | 0 | 0 | +| Kernel unit tests | 259 | 0 | 0 | +| Test-HAL unit tests | 58 | 0 | 0 | +| User / hello host unit tests | 0 | 0 | 0 | +| Test-HAL doc-tests | 3 | 0 | 0 | +| HAL doc-tests | 0 | 0 | 2 | +| Kernel / user doc-tests | 0 | 0 | 0 | +| **Total** | **366** | **0** | **2** | + +The command completed with no reported undefined-behavior error on the executed host paths. The raw output retains five notices that Miri ignores optimization levels; the other profile settings still apply. This is not a release optimization/codegen validation. + +## Observed limits + +Miri reported seven integer-to-pointer-cast warnings, at `kernel/src/mm/pmm.rs:965`, `:409`, `:1028`; `kernel/src/obj/task_loader.rs:1020`, `:1683`, `:2076`; and `kernel/src/mm/mod.rs:145`. The warning explains that exposed-provenance semantics can hide pointer bugs. No permissive flag suppressed the warning, and no strict-provenance run is claimed. These existing physical-address/test-backing conversions were not rewritten in this documentation task. Zero observed UB does not establish absence of all pointer bugs. + +The two ignored HAL doc-tests are `FmtWriter` (`console.rs:51`) and `IrqGuard` (`cpu.rs:108`). Their ignored status is explicit; they are not included in the passing total. Pure Rust and fake-HAL paths are exercised; BSP boot assembly, MMIO, hardware page-table walks, real context switching and actual EL0 execution are outside this host run. The zero-test userland host crates do not validate AArch64 `svc` assembly. QEMU evidence remains separately source-bound under T-045/T-046. + +## Historical reports + +[2026-04-23 Miri validation](2026-04-23-miri-validation.md) and the Miri discussion in [2026-04-27 coverage rerun](2026-04-27-coverage-rerun.md) retain their original source, tool and test-count claims. This new artifact records the actual current invocation and results; it does not overwrite those historical observations or independently reproduce their old runs. + +> **Evidence migration (2026-10-16).** Raw evidence links now open the [immutable archive catalog](2026-10-16-pr49-evidence-catalog.md). Each link title retains its exact archived member path. Original verdicts, measurements, limitations and execution SHA identities remain historical; the archive bundle restores their original source. diff --git a/docs/analysis/reports/2026-10-13-t049-review-corpus-reconciliation.md b/docs/analysis/reports/2026-10-13-t049-review-corpus-reconciliation.md new file mode 100644 index 00000000..27afcf8a --- /dev/null +++ b/docs/analysis/reports/2026-10-13-t049-review-corpus-reconciliation.md @@ -0,0 +1,54 @@ +# T-049 review-corpus reconciliation — 2026-10-13 + +- **Task / approved scope:** [T-049](../tasks/phase-b2/T-049-review-indices-sync.md), Step 5 of the [approved plan](2026-10-12-phase-b2-track2-preflight-and-plan.md), under [ADR-0043](../../decisions/0043-documentation-corpus-consistency.md). +- **Comparison / executed source:** clean `development` at `0ab0ba427ae97d5233afd01dfe7205b1ae8bc0c3`, after the kickoff at completed T-048 source `468812b8e765f655edcfcfca161586e609d2478f`. Archive/report changes described here are subsequent implementation edits; they are not claimed to exist at the executed source. +- **State:** [Both fresh primary/complementary rounds](../reviews/code-reviews/2026-10-13-t049-review-corpus-reconciliation.md) complete at `aa37e2c`; the one confirmed Low C01 is corrected and independently verified. T-049 is In Review. No Done, main merge, hosted CI or old-review re-approval is claimed. +- **Evidence:** [retained evidence directory](2026-10-13-t049-review-evidence/README.md), including [navigation/source-object ledger](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t049-review-evidence "Archived member: docs/analysis/reports/2026-10-13-t049-review-evidence/navigation.json"), [preparation reads](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t049-review-evidence "Archived member: docs/analysis/reports/2026-10-13-t049-review-evidence/preflight-read-ledger.json") and [verification results](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t049-review-evidence "Archived member: docs/analysis/reports/2026-10-13-t049-review-evidence/verification.json"). + +## Discovery and structural changes + +The missing business Phase B closure, three security closure reports and B6 performance closure now have rows in their own family tables. Their original dates and verdicts were copied from the reports: each security report retains Approve, and B6 retains Re-baseline, no regression. Business/performance tables retain their Date / Scope / File shape; security retains its Verdict column. + +The code index identifies the May-6 companion plan separately from canonical verdicts. Existing nested May-6, May-7 and May-8 tracks remain discoverable from their canonical reports. Both analysis/review entry points distinguish the four event-triggered types with master plans from the on-demand whole-tree master-review family. The May-22 consolidated report now links its manifest and all 25 tracks in a dated appendix; its entire prior body remains an exact prefix. + +B6 gains dated Hotspot, Proposal, Measurement and Regression check sections before its original Verdict, plus the index acceptance item. They describe the existing re-baseline, same-host control and original micro-measurements; they introduce no optimization target, retrospective run or improved verdict. Host drift, noise floor, TCG limitations, absent full raw smoke trace and the distinction between reused unsafe operations and added call sites are explicit. No unrecorded whole-B6 unsafe-site count is invented. + +The business master-plan gains the approved closure-batch discovery sweep alongside the existing T-045 architecture/smoke requirements. Business/security master-plan navigation is corrected. + +## Historical navigation and evidence integrity + +The preparation baseline at `550500f` found 48 broken navigation occurrences, rather than 48 unique destinations: 41 missing paths and seven fragment issues. All have bounded dispositions. The full preparation read covered 35 existing documents / 6,137 lines / 76 untruncated chunks; it is not either implementation-review round. + +Retired skill links use verified full-SHA historical permalinks. Different review periods retain their own skill versions, including the earlier B1 content and the later Simulation amendment. Removed `hal/src/mmu.rs` links open the reviewed May-6 source. Wrong-depth paths, missing heading fragments and malformed source-line destinations are corrected. Original quoted defective/proposed Markdown in master tracks remains exact literal data with adjacent dated functional navigation; the D2b fenced reference definition is unchanged. The optional `.gitattributes` input, absent from both the tree and available path history, is explicit filename data. No fake destination, archive waiver or note-only broken-link exception is introduced. + +Within the already-owned May-6/May-7 files, 419 original local line citations now bind to their review-era source: 418 originally rendered citations and one malformed label repaired explicitly. Original labels/fragments remain historical, except the documented unmatched backtick/spacing repair in the May-6 test track. Four original ranges were imprecise or incomplete; dated supplementary ranges clarify the boot entry, IPC queue-full test, F1 blocker and audit tag without erasing the original citations. Two later PR-18 closure links bind to `25854a1949ed9cec0de46d10955a27ddbba774bc`, rather than the older May-7 tip. Nine misleading SHA-labelled directory destinations now open their exact verified commits. + +The 419 citation occurrences overlap seven of the 48 baseline repairs; these classes must not be summed as independent findings. The retained ledger contains 58 other navigation disposition records, including grouped SHA occurrences, plus the 419 citations. These ledger records are unrelated to the track's separate 58-disposition acceptance inventory. There are 451 rendered occurrences of 363 distinct delivered immutable blob URLs, covering 82 distinct commit/path pairs; URL ranges and Git objects are different count units. The preparation/mutation stage verified 364 URL keys, including two superseded same-blob aliases; the delivered-target map records the actual current destinations, including D2b's added source link. + +Markdown source-line permalinks use `?plain=1#L…`, following [GitHub's Markdown source-link documentation](https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/creating-a-permanent-link-to-a-code-snippet#linking-to-markdown). The recorded URLs were checked against local Git objects and ranges. This is not a live HTTP availability check or independent proof of every original code claim or historical run. + +## Fresh execution + +[Miri validation](2026-10-13-t049-miri-validation.md) executed the pinned workspace command with only the BSP excluded: 366 passed, zero failed, two ignored HAL doc-tests, seven retained integer-to-pointer warnings, no reported UB on exercised host paths. The report distinguishes exposed-provenance limitations, userland's zero host tests and unexercised bare-metal/EL0 behavior. + +[Coverage rerun](2026-10-13-t049-coverage-rerun.md) executed the repository command: 363 unit tests passed; 28 files; regions 96.31%, functions 93.13%, lines 95.87%. Branch coverage is unmeasured. Local cargo-llvm-cov 0.9.0 differs from CI's 0.6.16; no identical-denominator or hosted-run claim is made. Raw logs, commands, tools, environment, timestamps, clean-tree checks and SHA-256 are retained. Both commands executed clean `0ab0ba4` before these documentation edits. + +## Coordinator verification and boundaries + +The one-off comparison checked 25 historical bodies: original non-destination text is exact after the declared navigation/literal/label changes and dated additions are accounted for. B6's prior measurements, verdict and four acceptance items remain unchanged; the consolidated report is append-only, and D2b's original body is exact after removing its dated annotation. All 419 original line citations were checked against their recorded original Markdown and historical source excerpts/objects; original-label precision caveats remain visible. + +Discovery membership is complete for 14 business, 21 security, eight performance files, and 27 code canonicals plus one companion plan. All 25 May-22 tracks and its manifest are linked. The one-off rendered-navigation diagnostic found no missing local paths or fragments across the review corpus and new report surfaces; exact snapshot counts and scope are in the verification JSON. It uses Python Markdown for a bounded diagnostic and independently checks heading/line targets. It is not the future T-056 parser, grammar or fixture suite. Raw-log hashes, process exits, 366/363 passing totals and two/zero ignored totals were independently checked. + +No Rust, build, toolchain, dependency or CI implementation changed. No new runtime/security behavior is claimed. Both fresh rounds and the verified correction are retained in the canonical review. Its index row is inside the existing code-review table, before Companion plans. The implementation-tip discovery snapshot above remains historical; publication adds one canonical report, yielding 28 code canonicals plus one companion. + +## Round-1 correction and verification detail + +The primary five-role review requested changes for C01: the May-6 infrastructure track's proposed back-pointer had been rewritten relative to the archive, although its original destination was correct for the proposed `infrastructure.md` sentence. The exact original Markdown is now literal proposal data with adjacent dated archive navigation. The complementary evidence review approved its stated scope with no confirmed findings; neither report is broadened beyond its actual reading/verification scope. Original R1 findings/verdicts and subsequent verification will be retained in the canonical review. + +Default `git diff --check` reports the original captured Miri log's blank EOF line (543). Both raw runtime hashes remain unchanged; raw command output is not cosmetically normalized. The check over all non-log changes passes with the two retained raw logs excluded explicitly; the logs are verified byte-for-byte and by SHA-256 instead. This is a narrow raw-evidence formatting observation, not a globally clean default whitespace-check claim. + +## Publication verification — 2026-10-13 + +After both R2 verdicts, coordinator checks over the publication working tree on `aa37e2c` retained all four actual context reports exactly and revalidated the 25 historical comparisons, 419 citation bindings, raw hashes, master-run discovery and lifecycle. Expanded navigation scope: 145 Markdown files, 2,143 local targets and 331 fragments, zero errors; it includes T-045 overview/loader/index and the repaired master-plan. The original verification JSON remains the implementation-stage snapshot. Code discovery now contains 28 canonicals plus one separate companion. New task counts are eight Done / 25 Ready / five In Review / eight Draft, with none In Progress at this boundary. These are coordinator bookkeeping checks, not another independent review or clean-runtime source claim. + +> **Evidence migration (2026-10-16).** Raw evidence links now open the [immutable archive catalog](2026-10-16-pr49-evidence-catalog.md). Each link title retains its exact archived member path. Original verdicts, measurements, limitations and execution SHA identities remain historical; the archive bundle restores their original source. diff --git a/docs/analysis/reports/2026-10-13-t049-review-evidence/README.md b/docs/analysis/reports/2026-10-13-t049-review-evidence/README.md new file mode 100644 index 00000000..48617fb7 --- /dev/null +++ b/docs/analysis/reports/2026-10-13-t049-review-evidence/README.md @@ -0,0 +1,16 @@ +# T-049 retained execution and navigation evidence — 2026-10-13 + +Runtime captures executed clean source `0ab0ba427ae97d5233afd01dfe7205b1ae8bc0c3` before archive/report edits; UTC timestamps correspond to 2026-10-13 Europe/Istanbul. Raw bytes and metadata are retained together, with SHA-256 in each metadata record and companion report. + +- [Miri raw output](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t049-review-evidence "Archived member: docs/analysis/reports/2026-10-13-t049-review-evidence/miri.log") and [metadata](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t049-review-evidence "Archived member: docs/analysis/reports/2026-10-13-t049-review-evidence/miri.json"); [interpreted report](../2026-10-13-t049-miri-validation.md). +- [Coverage raw output](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t049-review-evidence "Archived member: docs/analysis/reports/2026-10-13-t049-review-evidence/coverage.log") and [metadata](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t049-review-evidence "Archived member: docs/analysis/reports/2026-10-13-t049-review-evidence/coverage.json"); [interpreted report](../2026-10-13-t049-coverage-rerun.md). + +Navigation evidence records historical source binding and bounded repair, not runtime execution or either fresh review round. + +- [Navigation dispositions, source objects/ranges and file hashes](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t049-review-evidence "Archived member: docs/analysis/reports/2026-10-13-t049-review-evidence/navigation.json"). +- [Completed preparation read ledger](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t049-review-evidence "Archived member: docs/analysis/reports/2026-10-13-t049-review-evidence/preflight-read-ledger.json"): 35 full documents / 6,137 lines / 76 bounded chunks; preparation is not an implementation-review round. +- [Coordinator verification results](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t049-review-evidence "Archived member: docs/analysis/reports/2026-10-13-t049-review-evidence/verification.json"), with parser/scope limitations; [reconciliation report](../2026-10-13-t049-review-corpus-reconciliation.md). No binary, profile database or generated build artifact is retained. + +The original Miri output ends with a blank line (line 543), so default `git diff --check` reports that narrow raw-output formatting warning. Raw bytes and SHA-256 remain unchanged. Non-log changes are checked separately; this record does not claim a universally clean default whitespace check. + +> **Evidence migration (2026-10-16).** Raw evidence links now open the [immutable archive catalog](../2026-10-16-pr49-evidence-catalog.md). Each link title retains its exact archived member path. Original verdicts, measurements, limitations and execution SHA identities remain historical; the archive bundle restores their original source. diff --git a/docs/analysis/reports/2026-10-13-t050-entry-document-evidence/README.md b/docs/analysis/reports/2026-10-13-t050-entry-document-evidence/README.md new file mode 100644 index 00000000..4090fdcb --- /dev/null +++ b/docs/analysis/reports/2026-10-13-t050-entry-document-evidence/README.md @@ -0,0 +1,29 @@ +# T-050 retained build and QEMU evidence — 2026-10-13 + +All six commands executed an isolated tracked-source export of clean `development` at `75de2ba90e151bae33e14d2db4a8278837e7775d`, before entry-document edits. The export initially contained neither target/ nor hello.bin; machine toolchains/Cargo caches were reused. It is a generated-artifact-free source check, not a new-machine installation or network reproducibility test. No Git branch/worktree was created or switched. + +Metadata records exact argv, cwd, UTC intervals, process exits, tool identities, seven relevant unset environment overrides, stream SHA-256/bytes and each profile’s raw-QEMU/ELF/raw-image identities. Raw output is unnormalized; empty stdout captures are intentional. QEMU is timeout-terminated after successful completion because Task A spins. No compiled binary, target directory or source tar is retained here; the source archive digest is metadata. + +- [debug-kernel.stderr.log](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t050-entry-document-evidence "Archived member: docs/analysis/reports/2026-10-13-t050-entry-document-evidence/debug-kernel.stderr.log") +- [debug-kernel.stdout.log](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t050-entry-document-evidence "Archived member: docs/analysis/reports/2026-10-13-t050-entry-document-evidence/debug-kernel.stdout.log") +- [debug-smoke.stderr.log](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t050-entry-document-evidence "Archived member: docs/analysis/reports/2026-10-13-t050-entry-document-evidence/debug-smoke.stderr.log") +- [debug-smoke.stdout.log](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t050-entry-document-evidence "Archived member: docs/analysis/reports/2026-10-13-t050-entry-document-evidence/debug-smoke.stdout.log") +- [debug-userland.stderr.log](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t050-entry-document-evidence "Archived member: docs/analysis/reports/2026-10-13-t050-entry-document-evidence/debug-userland.stderr.log") +- [debug-userland.stdout.log](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t050-entry-document-evidence "Archived member: docs/analysis/reports/2026-10-13-t050-entry-document-evidence/debug-userland.stdout.log") +- [debug.qemu.log](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t050-entry-document-evidence "Archived member: docs/analysis/reports/2026-10-13-t050-entry-document-evidence/debug.qemu.log") +- [glossary.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t050-entry-document-evidence "Archived member: docs/analysis/reports/2026-10-13-t050-entry-document-evidence/glossary.json") +- [verification.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t050-entry-document-evidence "Archived member: docs/analysis/reports/2026-10-13-t050-entry-document-evidence/verification.json"): coordinator working-tree contract/navigation checks, distinct from executed-source runtime metadata. +- [metadata.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t050-entry-document-evidence "Archived member: docs/analysis/reports/2026-10-13-t050-entry-document-evidence/metadata.json") +- [release-kernel.stderr.log](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t050-entry-document-evidence "Archived member: docs/analysis/reports/2026-10-13-t050-entry-document-evidence/release-kernel.stderr.log") +- [release-kernel.stdout.log](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t050-entry-document-evidence "Archived member: docs/analysis/reports/2026-10-13-t050-entry-document-evidence/release-kernel.stdout.log") +- [release-smoke.stderr.log](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t050-entry-document-evidence "Archived member: docs/analysis/reports/2026-10-13-t050-entry-document-evidence/release-smoke.stderr.log") +- [release-smoke.stdout.log](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t050-entry-document-evidence "Archived member: docs/analysis/reports/2026-10-13-t050-entry-document-evidence/release-smoke.stdout.log") +- [release-userland.stderr.log](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t050-entry-document-evidence "Archived member: docs/analysis/reports/2026-10-13-t050-entry-document-evidence/release-userland.stderr.log") +- [release-userland.stdout.log](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t050-entry-document-evidence "Archived member: docs/analysis/reports/2026-10-13-t050-entry-document-evidence/release-userland.stdout.log") +- [release.qemu.log](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t050-entry-document-evidence "Archived member: docs/analysis/reports/2026-10-13-t050-entry-document-evidence/release.qemu.log") + +The glossary ledger separately records 50 → 54 headwords, four additions, all stable IDs, the two pure-ordering moves/grouping exception and 27 source-corrected existing definitions. It is document metadata, not runtime evidence. See the [verification report](../2026-10-13-t050-entry-document-verification.md) and [preflight source map](../2026-10-13-t050-entry-document-preflight.md). Both fresh implementation-review rounds remain pending. + +**Later review boundary (2026-10-13):** the pending snapshot above is superseded by both completed fresh rounds; T-050 is In Review. [Canonical code](../../reviews/code-reviews/2026-10-13-t050-entry-document-refresh.md) and [security](../../reviews/security-reviews/2026-10-13-t050-entry-document-refresh.md) preserve actual delivered outcomes. Raw captures/metadata/glossary.json/verification.json remain unchanged; no later runtime execution is implied. + +> **Evidence migration (2026-10-16).** Raw evidence links now open the [immutable archive catalog](../2026-10-16-pr49-evidence-catalog.md). Each link title retains its exact archived member path. Original verdicts, measurements, limitations and execution SHA identities remain historical; the archive bundle restores their original source. diff --git a/docs/analysis/reports/2026-10-13-t050-entry-document-preflight.md b/docs/analysis/reports/2026-10-13-t050-entry-document-preflight.md new file mode 100644 index 00000000..9dbab918 --- /dev/null +++ b/docs/analysis/reports/2026-10-13-t050-entry-document-preflight.md @@ -0,0 +1,120 @@ +# T-050 source and entry-document preflight + +Read-only preparation for Step 6, generated 2026-10-13 against clean development HEAD `a191a2f1d0667a613fc0a45caf08c58a58bf4c89`. T-050 is Ready; T-049 is the active step. This note is not implementation, either implementation-review round, approval review, task delivery or authorization to change an architectural decision. No repository files, branches, commits, posts, builds or guest runs were created by this preparation. Only this requested temporary report was written. + +## Governing contract and method + +The complete T-050 brief and approved Track B.2-2 plan require four additions, 54 explicit anchors after recount, source corrections to existing entries, clean-checkout build prerequisites, current/target labels, accurate guides and add-bsp instructions, exact approved copyright wording and fresh profile traces. ADR-0043 requires both fresh review rounds before dependent work, with tasks left In Review. All implementation starts only after the T-049 boundary passes. The root coordinator already holds the full numerical ADR/standards reading; this bounded source map explicitly records this agent's independent reading limits below. + +Use write-guide for rewritten first-userspace and two-task guides: summary, Goal, Prerequisites, Steps with numbered imperative instructions, Verifying it worked, Troubleshooting (or explicit none), References. Both guides currently lack that full contract. The index is orientation, not a fifth substantive guide. Use update-glossary's flat bold-headword format, self-contained first sentence, alphabetical placement and inward related-term links. Its outward-link step is explicitly excluded by T-050; do not widen scope to all consumers. add-bsp/start-task are edit targets, not authorization to create a BSP or task. + +## Highest-impact finding: current three-task scheduling order + +The earlier hypothesized B → A → B → EL0 → A ordering is false. Source and retained earlier evidence agree on: + +1. B prints waiting; blocks on receive. +2. A prints sending; delivers to B and yields. +3. EL0 hello runs, greets in debug only, then exits. +4. B resumes, receives and queues reply; explicitly yields. +5. A receives reply, prints completion/timing and spins permanently. + +Source chain: `bsp-qemu-virt/src/main.rs:1600–1643` registers B, A, user; idle is a separate fallback. `kernel/src/sched/mod.rs:104–136` implements FIFO enqueue-back/dequeue-front. B blocking selects A at `:1453–1484`. A's delivery calls `unblock_receiver_on` (`:628–645`, `:1302–1308`), appending B behind the already-ready user. `yield_now` appends A and dequeues user (`:1115–1150`). User exit calls the free `task_exit_current` and dispatches B (`:979–994`). B reply's explicit yield selects A (`main.rs:621–659`). A reply/completion are contiguous (`main.rs:735–767`). Queue evolution: initial [B,A,U] → B runs, [A,U] → B blocks, A runs, [U] → delivery appends B, [U,B] → yield appends A, U runs, [B,A] → U exits, B runs, [A] → B yields, A runs, [B]. Idle never runs in this path; B's post-yield spin tail never resumes. + +Retained comparison evidence fully read: `docs/analysis/reports/2026-10-13-t045-architecture-evidence/debug.qemu.log` (30 lines), `release.qemu.log` (29), and `metadata.json`. These are clean source `4ad0b3d8a9d43310fcd937013131bffadcc803d7`, not T-050 evidence. Debug log lines 8–9 show B/A; 17 greeting; 25 exit; 26 B reply; 27 A reply; 28 completion. Release omits greeting, then lines 24–27 show exit/B/A/completion. Fresh T-050 capture must confirm the actual implementation baseline and retain new source/toolchain/profile/artifact identity. + +## File-by-file correction map + +| Target and baseline lines | Source or decision | Required correction | +|---|---|---| +| `README.md:9–11,45–50,124–154` | Actual boot/registration above; Cargo workspace; current architecture overview | Label userspace driver/filesystem/network/service/init diagram as target design. Today's running workload is two privileged demo tasks plus one EL0 hello, with BSP hardware drivers in EL1. Avoid implying full driver/service architecture already exists. | +| `README.md:28` | `main.rs:921–1029`; MMU bootstrap/high-half source | Replace identity-only current-MMU row with temporary bootstrap identity, high-half kernel TTBR1 and per-task TTBR0. | +| `README.md:43–46` | `kernel/src/cap/table.rs:97–108,329–414`; ADR-0023 | Qualify transitive revocation as per-table; no cross-table global CDT. | +| `README.md:57` | `kernel/src/syscall/user_access.rs:177–245,256–317`; unsafe log entry 0030 `:682–709` | Include validated copy-from/to-user byte moves, or explicitly make the unsafe list illustrative. Current primitive is `core::ptr::copy`; original audit heading says copy_nonoverlapping but its amendments supersede that. `copy_from_user` is used by console; `copy_to_user` is an available tested primitive with no v1 syscall caller. | +| `README.md:77–84` | `tools/build-userland.sh:1–14,28–62`; `bsp-qemu-virt/build.rs:23–35`; `.cargo/config.toml:33–47` | Build userland before BSP, matching profile; do not promise two commands when showing three. Alias build/run does not orchestrate userland. | +| `README.md:87–109` | Actual serial writes and fresh future trace; prior T-045 comparison above | Remove nonexistent image-loaded line. Elide fragile frame counts, root PA, frequency/resolution/timing as appropriate. Place hello/exit before B's received/reply line. Explain debug expectation; release console #5 decodes invalid. Keep literal labels/punctuation (`task A --`, B em dash). | +| `README.md:189–226,242–247` | `Cargo.toml:6–23`; actual guide files | Add userland crates/tree and first-userspace guide link; six workspace members, three default-members. Tag currently untagged repository-layout fence `text`. | +| `docs/guides/README.md:7–19` | README framing, four actual substantive guides | Replace architecture-phase placeholder. Index run-under-qemu, ci, two-task-demo, first-userspace. Existing headers do not justify inventing an Accepted status for the latter two; use Available/current refresh In Review as appropriate. Separate planned nonexistent filenames from actual-file inventory or remove them; drop obsolete numeric phase tags. Explicitly exclude index README from substantive guide count. | +| `docs/guides/two-task-demo.md:14–32` | build scripts, build.rs, run-qemu `:106–112` | Add prerequisites and matching userland/kernel builds for debug and release. `--release` runner alone does not build. Use `sh` fences and printed PID-scoped exception-log path rather than `/tmp/qemu_int.log`. | +| `two-task-demo.md:34–78` | Three-task FIFO chain; `main.rs:1055–1069,1398–1429,1590–1686` | Current full trace includes MMU/high-half/PMM/AS and EL0 interleaving. Keep A6 origins distinct from current behavior. Remove B done/spinning print (none exists). Startup unmasked only IRQ I; initial dispatch IrqGuard masks DAIF again and abandonment preserves it until resumed guard restoration. Banner is not proof idle/IRQ delivery ran. Timing begins post-migration in kernel_main_high and excludes MMU activation/migration; do not call elapsed time a QEMU-default value or benchmark. | +| `two-task-demo.md:80–94` | `main.rs:571–659,690–727`; ADR-0021; ADR-0018 | Pass raw pointers, no live mutable references across switch; old UNSAFE-0012 problem was retired. Timer exists and GIC deadline support is implemented, though demo arms none and does not measure per-operation latency. Badges/reply_recv deferred; do not claim every server design must wait for badges (separate endpoints/protocol identity remain possible). | +| `docs/guides/first-userspace.md:27–32,128–139` | `hal/src/mmu/vmsav8.rs:318–350`; bootstrap RAM flags `mmu_bootstrap.rs:159–174,282–292` | AP controls EL0 data access; UXN blocks EL0 instruction fetch; PXN blocks privileged execution. Current high-half RAM AP=00, UXN=1, PXN=0; device MMIO AP=00 and both XN bits=1. Do not say UXN/PXN jointly prevent all EL0 access or claim current kernel physmap PXN=1. User image USER|EXECUTE is AP=11, UXN=0,PXN=1; stack USER|WRITE is AP=01, UXN=1,PXN=1. | +| `first-userspace.md:35–76` | smoke `:44,74–87,130–156`; syscall `:268–293`; user wrapper `:131–148` | `--int` is QEMU exception/unimplemented tracing `-d int,unimp`, not instruction tracing. Only console SVC resumes EL0; task_exit never returns/ERETs to exiting task. Show addresses elided; count exactly two SVCs only as inspected fresh debug/release evidence, not a smoke assertion. Separate serial and annotated exception excerpts. | +| `first-userspace.md:112–123,147–156` | `kernel/src/sched/mod.rs:954–994`; `bsp-qemu-virt/src/syscall.rs:268–293` | `tyrne_kernel::sched::task_exit_current` is a module-level unsafe free function, not Scheduler method. Stops scheduling; no task/AS/cap-table reclamation, no terminal state, exit code currently ignored. Explain explicitly, not “drops the task” as resource teardown. | +| `.agents/skills/add-bsp/SKILL.md:82–113` | boot.s `:44–46`; Accepted boot-policy/checklist | First `_start` instruction `msr daifset,#0xf`, before stack/FP/BSS. Label minimal template as already-EL1 only. EL2 requires the target's Accepted boot-flow ADR and complete EL policy; do not prescribe merely adding HCR/eret before step 1 or claim this documents real-hardware bring-up. | +| `add-bsp:150,155–175,199–202` | run-qemu `:106–112`; actual serial markers; boot checklist | PID-scoped printed log path; minimal success trace greeting → scheduler → all tasks complete, with elision and kernel-version note/link to README. Clearly distinguish minimal BSP success from reference BSP's full EL0/IPC trace. Correct anti-pattern to “CPACR config after entering EL1; EL2-target setup governed by accepted ADR,” not “at EL2 you need only CPTR_EL2.” Preserve current process requirements; no new BSP implementation. | +| `docs/analysis/README.md:16`; `docs/roadmap/README.md:16,21`; `.agents/skills/start-task/SKILL.md:21,30,41,43,61` | ADR-0040, approved T-050 | Use phase-; explain B.2 → directory phase-b2 and file phase-b2.md. Track B.2-1…6 is sub-unit, not milestone B1…6. | +| `NOTICE:2`, `LICENSE:189` | Complete LICENSE/NOTICE read; approved plan/T-050 exact choice | Common line `Copyright 2026 HodeTech, Cemil ILIK and Tyrne Contributors`; preserve LICENSE's existing indentation and every byte outside line 189. Do not touch author fields or infer other legal changes. | + +## Glossary sweep: additions, factual changes and pure moves + +Baseline full glossary has 50 bold headwords (lines 7–105); no per-entry HTML anchors. Four additions give 54. Preserve grouped mmu_bootstrap/.boot_pt entry convention, explicitly documenting that local alphabetical exception. + +Add AddressSpace after ABI, before ADR: kernel object wrapping the BSP MMU translation context, stored in AddressSpaceArena and named by a generation-tagged handle; cite ADR-0028. Actual struct `kernel/src/mm/address_space.rs:81–83`, arena capacity `:42`, handle `:163`, arena alias `:205`; cap-gated wrappers `:539,728,775`. Do not imply those wrappers are current userspace syscalls, that ASIDs already exist, or that memory ownership is enforced by cap_map. + +Add Bridge phase between Badge and BSP: inserted phase with dotted identifier, B.2 between B and C without renumbering published phases; cite ADR-0040. Add PMM between Notification and PSCI: bitmap physical-frame allocator, reserves boot ranges, zero-fills returned 4 KiB frames, validates free operations; cite ADR-0035. Primary implementation `kernel/src/mm/pmm.rs:1–24,110–145,348–482,486–540`; current single-core discipline, not SMP-safe. Add Track before Trust boundary: named bridge sub-unit, current B.2-1…6, not a numbered milestone; cite ADR-0040. + +Pure moves, separately recorded: M sequence becomes MADR, MAIR, MapperFlush, Microkernel, Miri, MMU, then grouped mmu_bootstrap/.boot_pt. Rendezvous IPC precedes Reply capability. These moves do not claim existing text is otherwise accurate. + +Existing definitions requiring factual correction: + +- Badge `:15`, Reply capability `:81`: describe borrowed seL4 concepts, but Tyrne has no injected badges/automatic reply-capability mechanism; Accepted ADR-0018 formally defers badges and reply_recv. Source Capability `kernel/src/cap/mod.rs:180–183` has only rights/object; SlotEntry `table.rs:97–108` has local links, no badge; current SyscallNumber `abi.rs:48–61` has no reply_recv. +- Capability rights `:23`: add CONSOLE_WRITE; source `kernel/src/cap/rights.rs:21–45,64–73` has eight bits. +- Capability-based security `:21`, CDT `:27`: do not promise non-leakage merely from capabilities or global transitivity. CDT already explicitly says per-table; retain that. Current control-plane yield/exit require current task identity, not a capability (`dispatch.rs:137–161`). +- CNTPCT/CNTVCT `:31–33`, Generic Timer `:45`: deadline support is implemented, not future/read-only. `cpu.rs:679–752` programs CNTV_CVAL/CTL, enables timer PPI through GIC, cancels at source/controller. `exceptions.rs:227–273` masks timer source and EOIs; no scheduler tick/preemption hook. `hal/src/timer.rs:145–161` cached resolution rounds nearest; `:207–222` deadline ns-to-ticks rounds upward. Keep these separate. +- Cooperative scheduling `:37`: current single-core/cooperative; preemption is Phase C, gated by B.2, not Phase B/C ambiguity (`docs/roadmap/phases/phase-c.md:1–5,54–69`). +- Handle `:49`, Arena `:13`: include AddressSpace in illustrative kinds; CapHandle itself is generation-tagged, not merely an index (`kernel/src/cap/table.rs` handle definition, ABI packing `abi.rs:23–43`). +- Kernel `:55`: include interrupt dispatch if enumeration is meant to describe complete current mechanisms; drivers/services are target architecture, not current userspace implementation. +- Miri `:61`: use pinned repository Miri command and describe dynamic checking as detecting exercised UB, not proof. Retain old dated report as history or link the fresh T-049 report only once root records its actual destination. +- MAIR `:63`: normal memory cacheability is inner+outer WB/WA; shareability is separate descriptor SH field, current normal RAM inner-shareable (`vmsav8.rs:62–85,318–333`). Do not conflate “inner+outer cacheable” with “inner+outer shareable.” +- MapperFlush `:65`: source does carry VA only (`hal/src/mmu/mod.rs:394`); flush/ignore `:432–450`. Avoid linear-token/enforced-unique-discharge implication: token is Copy; explicit discard remains possible. Current source document itself contains obsolete single-AS forward language; do not copy it. T-040 owns AS/ASID discriminant hardening. +- MMU `:67`: current kernel high-half TTBR1, user TTBR0; temporary low identity is only bootstrap. Source `main.rs:921–1029` and `mmu.rs` activation. +- mmu_bootstrap `:69`: four initial low frames are populated by first bootstrap; two high roots by high_half_activate, six reserved in total. This happens before post-migration boot_ns snapshot, and after early console MMIO/vector install. Do not repeat source-header stale claims “after cpu.now_ns” / “before any MMIO.” +- .boot_pt `:71`: six 4 KiB frames = 24 KiB, low L0/L1/L2_low/L2_high plus high L0_hh/L1_hh with shared L2. Linker `:72–105` brackets an allocated range inside .bss; there is no distinct .boot_pt output section in current linker script. Preserve headword as established term and call it reserved bootstrap-table region/range. No allocator dependency at boot. +- Stacked Borrows `:87`: remove “Tree Borrows is a stricter successor.” No comparative model claim is needed. Current repository CI is explicitly Stacked Borrows; external model research is unnecessary if simply deleting the false comparison. +- StaticCell `:89`: one-time initialization does not mean contents become immutable; current scheduler/table state is mutated later through raw pointers. `main.rs:151–212` documents single-core/cooperative unsafe access and no live mutable borrow across switch. +- Syscall `:93`: capability checks apply to send/recv/console operations; yield/exit use current-task identity. console_write only recognized with debug_assertions (`abi.rs:79–90`); release has four recognized calls. Do not imply every syscall returns: task_exit terminates. +- TCB/Userspace/Microkernel `:59,97,105`: clearly separate target userspace driver/filesystem/network/services from current privileged BSP drivers and lone EL0 hello. No statement that these services already run. + +Anchor scheme recommendation: derive lowercase ASCII alphanumeric words joined with hyphens from the full displayed headword, remove code ticks/punctuation, convert underscores to hyphens, remove leading dot. E.g. `addressspace`, `bridge-phase`, `pmm`, `track`, `mmu-bootstrap`, `boot-pt`, `cntfrq-el0`, `capability-rights-caprights`, `el0-el1-exception-levels`. Freeze the chosen exact 54 IDs in task/review history before checking; check uniqueness and immediate placement before each bold headword. No HTML heading conversion or visual headword changes. Existing glossary links currently target whole file; new outward links are out of scope. + +## Implementation verification plan (not executed here) + +After T-049 reviews pass and root starts T-050: + +1. Record kickoff SHA, clean tracked status and plan; update task/current as authorized. Apply content edits only in T-050 scope plus necessary source-bound evidence/review/index accounting. +2. Capture fresh debug and release `tools/smoke.sh --int` / `--release --int` with matching userland builds. Retain full raw trace and stdout/stderr plus source/toolchain/QEMU identity, artifact hashes/bytes and explicit manual SVC/fault counts. Restore debug userland afterward. Never use the old T-045 runtime logs as fresh T-050 results. +3. Verify guide command prerequisite chains statically and by fresh matching builds. Explain smoke marker/fault gate versus separately inspected SVC count; the timeout after successful demo is expected because A spins. +4. Mechanically check 50 → 54 headwords, 54 unique immediately preceding anchors, exact headword inventory, alphabetical order with grouped exception, and pure-move list distinct from text changes. Check actual substantive guide inventory against index; review all seven required rewritten-guide sections. +5. Check local targets/fragments, tagged fences, English, Mermaid-only architectural diagrams, diff whitespace and step-only changed-file scope. LICENSE before/after split-lines must differ only at index 188; preserve newline/indentation. NOTICE exact holder matches stripped LICENSE copyright line. +6. Commit reviewable implementation with Refs ADR-0040 (and governing 0043 where useful). Run two fresh complementary rounds, including distinct security-boundary review; this preflight cannot be reused as a review round. Fix confirmed findings between rounds and independently verify fixes. Stop new task state at In Review, then automatically continue only after this boundary passes. + +No architectural decision is needed to report these existing source facts. If implementation proposes different BSP bring-up policy, syscall/lifecycle behavior, new glossary vocabulary, permission changes, actual driver/service implementation, a broader LICENSE edit or a revised phase/track structure, return to root/maintainer before doing it. + +## Complete-read ledger and limits + +Independently fully read in bounded, visible output: CLAUDE.md; full T-050 task; README.md; docs/guides/README.md; all four guides (first-userspace and glossary were re-read individually after an earlier aggregate output truncation; ci.md read lines 1–90 and 91–196); docs/glossary.md; .agents/skills/{README.md,write-guide/SKILL.md,update-glossary/SKILL.md,add-bsp/SKILL.md,start-task/SKILL.md}; docs/analysis/README.md; docs/roadmap/README.md; entire approved preflight/plan in two ranges 1–105/106–205; NOTICE; LICENSE; Cargo.toml; .cargo/config.toml; tools/{build-userland,run-qemu,smoke}.sh; bsp-qemu-virt/build.rs, src/boot.s and linker.ld; userland/hello/src/main.rs and userland/tyrne-user/src/lib.rs; kernel/src/cap/rights.rs; ADR-0003,0018,0023,0043; standards README, documentation-style, bsp-boot-checklist, commit-style, testing, unsafe-policy; T-045 comparison raw logs/metadata. + +Inspected complete targeted source units/ranges, not claimed full files: main.rs task_a/task_b/idle entries 490–790; early/high-half entry 834–1069; task registration/start 1590–1690; GIC/timer banner 1390–1445; StaticCell 150–226. Scheduler FIFO 95–170, enqueue/unblock 550–660, start/exit/dispatch/yield 900–1215, IPC bridges 1230–1555. AddressSpace 1–225; PMM 1–145 and 440–548; HAL timer 1–225; CPU timer 640–754; GIC 1–95; exceptions IRQ dispatch 190–315; syscall terminate 250–311; user_access 1–105,177–245,310–355; descriptor encoder 280–359; mmu_bootstrap 1–85 and 265–375; unsafe-log 0030 full entry including its amendments 682–709. Searches located mapping/rights/loader/CapHandle/MapperFlush definitions, but search hits are not full-file reads. + +Limits: the first attempted current.md + ADR glob and one large entry-document aggregate returned truncation warnings; these outputs are excluded from complete-read claims except documents later re-read fully or visibly complete individual first documents. This agent did not independently complete the full numerical ADR corpus, every standard, all historical current.md snapshots, all architecture chapters, all source tests, the whole unsafe log or full CI workflows. The root's already-complete governance readings remain the process basis. The useful new evidence here is the independently checked task/doc/source map, not a claim of full-corpus independent review. No external browser research, runtime execution, hosted CI evidence, new model/architecture claim or implementation approval is asserted. Recheck source line numbers and HEAD after T-049 accounting commits. + + +## Final independent prerequisite completion — appended 2026-10-13 + +This append records work completed after the initial ledger above. It preserves that ledger as the historical state at first delivery; its statement that full numerical ADR/standards/current.md reads were still pending is now superseded by this completion record. No root-only or inherited read is counted as an independent read. + +Independently completed in bounded, untruncated output: the supplied AGENTS.md instructions and full CLAUDE.md; all of docs/roadmap/current.md (ranges 1–30, 31–50, 51–70, 71–95, 96–115, 116–141); all existing numerical ADR files in order, 0001–0033 then 0035–0043, including their revision notes and riders. There is no ADR-0034 file; the reserved slot does not constitute a missing read. An aggregate output covering 0025/0026 truncated, so each was re-read individually before marking complete. Relevant status distinctions are retained: ADR-0023 is Deferred, ADR-0022 is superseded only on its idle-location axis by 0026, and 0041 is superseded by 0042. No historical body was treated as overriding a later accepted rider or superseding ADR. + +All files in docs/standards/ were independently read in full: README.md (48 lines), architectural-principles.md (130), bsp-boot-checklist.md (224), code-review.md (135), code-style.md (155), commit-style.md (146), documentation-style.md (91), error-handling.md (178), infrastructure.md (246, read 1–123 and 124–246), localization.md (100), logging-and-observability.md (149), release.md (155), security-review.md (135), testing.md (155), and unsafe-policy.md (193). The full task, documentation, skill, build-script, boot-source, userspace, rights, approved-plan and retained-evidence reads listed in the initial ledger remain complete. Targeted source units remain targeted reads; this completion does not claim whole-file reads for those source files, whole architecture/audit corpora, CI execution or runtime verification. + +### Timer clarification within approved factual-document scope + +The actual source has two distinct algorithms: hal/src/timer.rs:145–160 computes nearest-integer resolution_ns_for_freq (clamped to at least 1 ns), whereas ns_to_ticks at 207–220 uses saturating ceiling division for absolute deadline conversion. The latter's existing rationale at 178–186 expressly cites ADR-0010's reaches-or-exceeds contract. BSP timer implementation calls this helper; glossary prose can describe that existing behavior without choosing a new policy. The QEMU 62.5 MHz case gives exactly 16 ns resolution, but does not establish a rounding rule for arbitrary frequencies. + +There is an existing wording discrepancy: Timer::resolution_ns rustdoc at hal/src/timer.rs:52–53 and ADR-0010:78 describe deadlines as rounded to the nearest resolution multiple. ADR-0010:76 instead specifies reaching or exceeding the requested deadline, and its 2026-04-28 revision note at line 145 records the implemented IRQ half. The explicit implementation-review history in docs/analysis/tasks/phase-b/T-012-exception-and-irq-infrastructure.md:112 identifies d820a88's floor-to-ceiling correction to honor reaches-or-exceeds, plus 5c9cf06's regression case frequency 3 Hz / 333333334 ns → 2 ticks. Those are existing decision/implementation authorities; T-050 needs only accurate source-qualified wording, with no runtime change, new normative rounding policy or extra ADR/rider. Keep this discrepancy visible to root for its separate T-055 authority/index assessment; do not silently rewrite an accepted ADR body during T-050. + +### Final repository boundary and outstanding execution + +The initial source mapping was prepared at a191a2f1d0667a613fc0a45caf08c58a58bf4c89. Final read-only status check found a clean working tree at aa37e2cff3eada2e20ccb13efc6a0bb2267201d4. The intervening commit is docs(analysis): preserve T-049 quoted proposal evidence; its diff changes eight T-049 analysis/task/evidence files only, with no source, README, guide, glossary, license, standard, skill or ADR change. Thus the mapped implementation/document source claims retain their line positions at this boundary. Recheck HEAD and changed files at actual T-050 kickoff, since T-049 accounting/review work may continue. + +No repository mutation, branch, commit, external post, delegated task, browser lookup, build, test, QEMU run or implementation review was performed by this preflight. Only this requested /tmp note was written. The existing source facts and approved document contracts are sufficient for T-050; no unapproved new architectural decision was discovered. Fresh matching debug/release userland-before-BSP builds and runtime captures, static documentation checks, implementation, and both independent review rounds remain T-050 work after kickoff. This is source preparation, not delivery acceptance, either review round, or task promotion approval. diff --git a/docs/analysis/reports/2026-10-13-t050-entry-document-verification.md b/docs/analysis/reports/2026-10-13-t050-entry-document-verification.md new file mode 100644 index 00000000..aca25561 --- /dev/null +++ b/docs/analysis/reports/2026-10-13-t050-entry-document-verification.md @@ -0,0 +1,140 @@ +# T-050 entry-document verification — 2026-10-13 + +- **Task / plan:** [T-050](../tasks/phase-b2/T-050-entry-docs-and-glossary-sync.md), Step 6 of the [approved plan](2026-10-12-phase-b2-track2-preflight-and-plan.md). +- **Executed source:** clean `development` at `75de2ba90e151bae33e14d2db4a8278837e7775d` after T-049’s canonical boundary `054e13e`. Entry-document edits described below are subsequent working-tree changes, not claimed at that executed source. +- **State:** T-050 In Review after both fresh code/security rounds and bounded correction verification; canonical boundary below supersedes the implementation-time pending snapshots. No Done, maintainer review, hosted CI or merge claim. +- **Evidence:** [full preparation/source map](2026-10-13-t050-entry-document-preflight.md), [raw captures/metadata](2026-10-13-t050-entry-document-evidence/README.md), [glossary disposition/ID ledger](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t050-entry-document-evidence "Archived member: docs/analysis/reports/2026-10-13-t050-entry-document-evidence/glossary.json"). + +## Existing-document review and implementation scope + +The retained preparation map reviews all existing entry/guide/glossary/skill/path/license targets and their relevant source definitions. Its initial partial prerequisite ledger and subsequent independent full-corpus completion remain explicitly separate; preparation is not either implementation-review round. Source remained unchanged through T-049 publication and the T-050 kickoff. No new architectural decision, BSP, phase, syscall, lifecycle policy or parser is introduced. + +README now shows current versus target placement, per-table revocation, current high-half/per-task translation, an illustrative unsafe list including audited user copies, six workspace members and the verified userland-before-BSP/profile commands. Its serial trace removes the nonexistent loader banner and uses actual EL0 interleaving with fragile values elided. Both existing task guides follow write-guide’s complete structure; they explain console return versus non-returning exit, free-function dispatch, unreclaimed resources, AP/UXN/PXN, current W^X/fault-containment limits, timer/idle non-execution and raw-log options. Guides inventory contains the four substantive files; availability and refresh review status are distinguished from acceptance. The prior execution-trace anchor remains for existing historical links. + +The BSP procedure masks DAIF before stack/FP/BSS setup, labels its skeleton as already-EL1, requires the existing accepted target boot policy for EL2, and distinguishes minimal declared-workload success from full reference EL0/IPC smoke. Exception diagnostics use the printed PID-scoped path. Analysis/roadmap/start-task path templates cover lowercase dot-free IDs: C → phase-c; B.2 → phase-b2 and phase-b2.md; Tracks remain distinct from B milestones. + +Glossary additions are AddressSpace, Bridge phase, PMM and Track. Pure M-section and Rendezvous/Reply ordering moves are separately recorded from factual corrections. All 54 existing/new bold headwords have immediate explicit unique stable anchors derived from their full displayed headword (lowercase ASCII alphanumerics, other runs to hyphens). The established mmu_bootstrap/.boot_pt grouping is retained as the sole local ordering exception. Existing definitions were verified against current rights/handles, IPC stages, MMU/frame allocation, source-qualified timer arithmetic, raw-pointer discipline and syscall behavior; target userspace services and dynamically exercised Miri coverage are qualified. No outward glossary-link sweep is claimed or required by the approved contract. + +The maintainer’s exact common copyright line was recorded in task history before editing. NOTICE line 2 and LICENSE appendix line 189 now read `Copyright 2026 HodeTech, Cemil ILIK and Tyrne Contributors`. LICENSE indentation/newline and every other byte remain unchanged; no legal-policy change is made. + +## Clean-source build prerequisites + +The coordinator exported tracked HEAD with git archive into a disposable directory. Assertions confirmed no target/, no generated hello.bin and no .git initially. The shared installed Rust/Cargo/QEMU tools and machine caches were reused; this is not a fresh-install test. Root repository HEAD/status remained unchanged and clean throughout capture. The source tar hash is `68500b9e7a5f05d48b668ca6bd8e1c28ed8e7f5625e6ee4d2fbf5f10a56ebe28`; the archive was not retained, and exact source is available from Git. + +Commands ran sequentially in that export, with matching profiles. The explicit README prerequisite builds preceded each smoke; smoke then repeated its normal automatic matching build (warm reuse within that profile). Interactive mon:stdio/Ctrl-A behavior was not newly automated; the same resulting images were exercised through smoke’s noninteractive runner. + +| Capture | Exact command | Exit | +|---------|---------------|-----:| +| debug-userland | `tools/build-userland.sh` | 0 | +| debug-kernel | `cargo kernel-build` | 0 | +| debug-smoke | `tools/smoke.sh --int --timeout 5` | 0 | +| release-userland | `tools/build-userland.sh --release` | 0 | +| release-kernel | `cargo kernel-build --release` | 0 | +| release-smoke | `tools/smoke.sh --release --int --timeout 5` | 0 | + +Tools: pinned nightly-2026-01-15, rustc 1.94.0-nightly `86a49fd71fecd25b0fd20247db0ba95eeceaba28`, cargo `6d1bd93c47f059ec1344cb31e68a2fb284cbc6b1`, LLVM 21.1.8, QEMU 11.1.1, Python 3.9.6, Darwin arm64 / aarch64-apple-darwin. Exact tool output and UTC capture intervals are retained; no tool upgrade, dependency or CI change was made. Captures ran 2026-10-13 UTC/Europe-Istanbul. Compiler/target/QEMU override variables recorded in metadata were unset. + +## Fresh raw traces and manual interpretation + +### Debug + +Raw [QEMU output](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t050-entry-document-evidence "Archived member: docs/analysis/reports/2026-10-13-t050-entry-document-evidence/debug.qemu.log"): 1139 bytes, SHA-256 `80a53a565fa95fcf4d509d38668ddc9ad3a73b03bff93d74b16a17797a1c0d8c`. Raw hello image: 117 bytes, SHA-256 `05816ccb9be5caea862dbe3e0fc45fc2068ff06cd049f2dda3459492d0ef7d88`; ELF identities are in metadata. + +```text +tyrne: hello from kernel_main +tyrne: mmu activated +tyrne: high-half active +tyrne: pmm initialized (32593 frames available; 175 reserved) +tyrne: address-space-arena ready (1 / 8 slots used; bootstrap AS root = 0x40099000) +tyrne: timer ready (62500000 Hz, resolution 16 ns) +tyrne: starting cooperative scheduler +tyrne: task B — waiting for IPC +tyrne: task A -- sending IPC +Exception return from AArch64 EL1 to AArch64 EL0 PC 0x800000 +Taking exception 2 [SVC] on CPU 0 +...from EL0 to EL1 +...with ESR 0x15/0x56000000 +...with SPSR 0x3c0 +...with ELR 0x800034 +...to EL1 PC 0xffffffff40080c00 PSTATE 0x3c5 +hello from userspace +Exception return from AArch64 EL1 to AArch64 EL0 PC 0x800034 +Taking exception 2 [SVC] on CPU 0 +...from EL0 to EL1 +...with ESR 0x15/0x56000000 +...with SPSR 0x600003c0 +...with ELR 0x80005c +...to EL1 PC 0xffffffff40080c00 PSTATE 0x3c5 +tyrne: userspace task exited +tyrne: task B — received IPC (label=0xaaaa); replying +tyrne: task A — received reply (label=0xbbbb); done +tyrne: all tasks complete +tyrne: boot-to-end elapsed = 5068000 ns +qemu-system-aarch64: terminating on signal 15 from pid 52249 () +``` + +### Release + +Raw [QEMU output](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t050-entry-document-evidence "Archived member: docs/analysis/reports/2026-10-13-t050-entry-document-evidence/release.qemu.log"): 1113 bytes, SHA-256 `2a09900e123c78f16118db5999f7f8a1aa358ece6e779cf86788915f61ef499a`. Raw hello image: 69 bytes, SHA-256 `ade8d1695182284e1efba2436c5ead8e4db6dac816f61852d436fc3d300362df`; ELF identities are in metadata. + +```text +tyrne: hello from kernel_main +tyrne: mmu activated +tyrne: high-half active +tyrne: pmm initialized (32598 frames available; 170 reserved) +tyrne: address-space-arena ready (1 / 8 slots used; bootstrap AS root = 0x40094000) +tyrne: timer ready (62500000 Hz, resolution 16 ns) +tyrne: starting cooperative scheduler +tyrne: task B — waiting for IPC +tyrne: task A -- sending IPC +Exception return from AArch64 EL1 to AArch64 EL0 PC 0x800000 +Taking exception 2 [SVC] on CPU 0 +...from EL0 to EL1 +...with ESR 0x15/0x56000000 +...with SPSR 0x3c0 +...with ELR 0x800020 +...to EL1 PC 0xffffffff40080c00 PSTATE 0x3c5 +Exception return from AArch64 EL1 to AArch64 EL0 PC 0x800020 +Taking exception 2 [SVC] on CPU 0 +...from EL0 to EL1 +...with ESR 0x15/0x56000000 +...with SPSR 0x3c0 +...with ELR 0x80002c +...to EL1 PC 0xffffffff40080c00 PSTATE 0x3c5 +tyrne: userspace task exited +tyrne: task B — received IPC (label=0xaaaa); replying +tyrne: task A — received reply (label=0xbbbb); done +tyrne: all tasks complete +tyrne: boot-to-end elapsed = 3643008 ns +qemu-system-aarch64: terminating on signal 15 from pid 52345 () +``` + +Both raw logs show exactly two Taking exception SVC records, each from EL0 to EL1, and no other Taking exception record or listed fault class. The first ERET enters EL0, the second resumes after the console call; exit then prints its marker and dispatches B without returning to the exiting task. Debug contains one greeting; release contains none. Both have one exit and one completion marker. The delivered serial excerpts are ordered subsequences with explicit value elision, not fabricated complete raw output. + +The FIFO source agrees: initial [B,A,user] → B blocks → A delivers to B/yields behind user → user exits → B receives/replies/yields → A receives/completes/spins. B’s tail and idle remain unreached. This is neither a timer-IRQ/preemption test nor a benchmark: the observed 5,068,000 / 3,643,008 ns lines are host-dependent single-run elapsed values after the high-half snapshot, not comparable performance measurements. Smoke’s marker/fault gates and the coordinator’s separate SVC/order inspection are different checks. + +The successful path does not prove all permission/isolation cases, arbitrary hostile EL0 behavior, resource reclamation, strict provenance, SMP, real hardware or every ABI property. Current non-SVC fault panic, privileged executable RAM and lifecycle gaps remain explicit descriptions of existing behavior, not new policy. Existing host adversarial tests and historical security reviews remain distinct evidence. Both fresh code/security rounds must assess the actual document change next. + +## Coordinator static verification + +Coordinator checks passed: all touched rendered local paths/fragments, both full guide structures and four-file inventory, tagged fences, five ordered serial/exception excerpt blocks against retained debug output, exact 50-to-54 headword inventory/54 IDs and only the approved ordering moves, source-qualified BSP DAIF/scope and phase paths, raw stream hashes/exits/order, exact one-line LICENSE delta and step-only allowlist. The [diagnostic snapshot](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t050-entry-document-evidence "Archived member: docs/analysis/reports/2026-10-13-t050-entry-document-evidence/verification.json") labels the checked subsequent implementation working tree separately from the clean executed source. The checker initially caught sorting by parenthetical expansions (MMU, Syscall, Unsafe); before commit, ordering was corrected to primary headwords while retaining complete displayed-headword anchor IDs. No original definition is frozen merely to preserve a move. These checks are one-off diagnostics using an existing Python Markdown tool, not the T-056 shipping parser/grammar/fixture suite. Both fresh implementation-review rounds remain pending. + +## Round 1 correction — 2026-10-13 + +Fresh primary code review confirmed Low C01: the first-userspace boot wire-up combined an address-space handle and a raw capability-table pointer under the word “handles”. Source `add_user_task` takes `AddressSpaceHandle` and `*mut CapabilityTable` separately; its safety contract requires the table to outlive the task and forbids a live mutable borrow across a context switch. The BSP subsequently dereferences that stored pointer for syscall dispatch. The guide now states those distinct inputs and caller obligations. The distinct security reviewer independently confirmed the shared finding after its initial standalone assessment; count C01 once under code-review provenance. No runtime or retained raw-evidence bytes changed. Both complete rounds and canonical integration remain pending. + +The post-correction bounded diagnostic passes on the same 32-file implementation range: 13 Markdown files, 293 rendered local targets, 18 fragments, zero errors; all 14 retained stream hashes, six recorded exits, glossary inventory/order/anchors and LICENSE preservation checks still pass. `git diff --check` passes. The retained verification.json remains the earlier implementation snapshot (292 targets), not a rewritten claim about this later tree. + +## Round 2 correction — 2026-10-13 + +Fresh primary R2 code review confirmed Low R2-C01: the new Bridge phase definition said B.2 must close before all C/D “work begins”. Accepted ADR-0040 Decision outcome rule 2 instead gates milestone opening and implementation tasks leaving Draft, while explicitly permitting Phase C planning, Proposed ADRs and the readiness sweep. The glossary now preserves that distinction. The separate fresh R2 security reviewer independently corroborated this shared code-origin finding after completing its own source/evidence assessment. Count it once, separately from resolved R1 C01. No new policy, ADR, glossary vocabulary/anchor, runtime source or retained raw-evidence change. Bounded R2 correction verification and canonical integration remain pending. + +## Canonical review boundary — 2026-10-13 + +[Code](../reviews/code-reviews/2026-10-13-t050-entry-document-refresh.md) and [security](../reviews/security-reviews/2026-10-13-t050-entry-document-refresh.md) artifacts retain all four complete delivered reports, original findings/verdicts and final bounded approvals. Both fresh rounds approve corrected source 946f45f. R1 C01 fixed at 5236156 and R2-C01 fixed at 946f45f; each code-origin Low is counted once, security corroborations attributed. Zero unresolved delta findings; existing HIGH T-038 remains Ready. + +T-050 acceptance/DoD now checked against delivered evidence and step-scoped allowances; status In Review without date_done. The later canonical bookkeeping has separate coordinator static verification; retained verification.json remains the original 292-target implementation snapshot. Six runtime commands and all raw evidence still refer to clean executed 75de2ba. No new run, human approval, hosted CI, merge or future-tool certification. T-055 starts next. + +Final coordinator publication diagnostic: 39 step paths (the original 32 plus seven canonical/lifecycle surfaces), 20 Markdown files, 664 rendered local targets and 42 fragments, zero errors. Four exact delivered report copies and unique table-index membership verified; all 54 glossary anchors, 27 existing-definition dispositions, five serial excerpts, 14 raw stream hashes, six recorded exits and one-line LICENSE preservation pass. Task-state recount: 8 Done, 24 Ready, 6 In Review, 8 Draft; no new Done. This bounded existing-Markdown-tool diagnostic is not T-056 grammar coverage. An initial coordinator count assertion incorrectly expected 35 original paths; it failed before commit, was corrected to the verified 32, and the complete check was rerun. + +> **Evidence migration (2026-10-16).** Raw evidence links now open the [immutable archive catalog](2026-10-16-pr49-evidence-catalog.md). Each link title retains its exact archived member path. Original verdicts, measurements, limitations and execution SHA identities remain historical; the archive bundle restores their original source. diff --git a/docs/analysis/reports/2026-10-13-t052-t053-standards-preflight.md b/docs/analysis/reports/2026-10-13-t052-t053-standards-preflight.md new file mode 100644 index 00000000..d7018746 --- /dev/null +++ b/docs/analysis/reports/2026-10-13-t052-t053-standards-preflight.md @@ -0,0 +1,48 @@ +# T-052 / T-053 — Step 8 source review and execution plan + +- **Date:** 2026-10-13 +- **Coordinator:** Codex (AI agent), implementation author; not an independent reviewer +- **Source:** `98378b5add44755f7cbab6e8bc96337accf0574a` on `development` +- **Authority:** maintainer-approved [13-step plan](2026-10-12-phase-b2-track2-preflight-and-plan.md), [T-052](../tasks/phase-b2/T-052-standards-docs-reality-sync.md), [T-053](../tasks/phase-b2/T-053-standards-docs-mechanical-fixes.md), Accepted [ADR-0042](../../decisions/0042-descriptive-test-names.md) and [ADR-0043](../../decisions/0043-documentation-corpus-consistency.md). +- **State:** implementation preflight; no delivery, independent review, new runtime result or maintainer completion claimed. + +## Reviewed sources and decisions + +The coordinator reread both complete task contracts and the complete owned standards. Full root Cargo/config and all six member lint opt-ins, exact crate attributes/scoped allowances, panic/exception/userland-stub spans, complete hello source, runner scripts and relevant live CI/protection configuration were checked. This is source inspection, not fresh Cargo/QEMU/hosted execution. T-032 is Done and its kernel/HAL/BSP denies exist. ADR-0042 is Accepted and ADR-0041 already Superseded atomically; no unresolved rule choice remains. + +| T-052 choice | Classification and implementation | +|---------------|----------------------------------| +| Test names | Rule change authorized by Accepted ADR-0042: descriptive snake_case, no mandatory test_ prefix, concise unambiguous names allowed; three actual IPC identifiers and motivating References link. No rename or naming lint. | +| Panic diagnostics | Approved claim correction: current QEMU BSP emits banner and formatted PanicInfo, then spins. Exception-specific class/ESR diagnostics are separate from a generic register dump. No automatic register-dump follow-up. | +| Incomplete markers | Approved claim correction: workspace Clippy todo deny; no unimplemented deny. Preserve two intentional non-bare-metal user-library stubs and review completeness of reachable runtime paths. | +| Logging | Approved claim correction: structured facade/rings/log service/metrics/configuration are planned; current diagnostics use raw Console/BSP UART. Preserve secret-redaction and nonblocking-context constraints. | +| Deny scope | Approved claim correction: kernel/HAL/QEMU BSP carry panic-family denies with explicit scoped allowances; test-hal/userland inherit workspace lints only. No lint-level change. | + +Adjacent TaskFault/supervision/reclamation prose must distinguish intended Phase-E/E3 design from the current non-SVC EL0 whole-kernel panic and retained task/address-space/frame state after explicit exit. Hello's own panic calls task_exit(101); that is not general fault containment. + +## Focused commits and review boundary + +1. Kick off both tasks and retain source-bound inventory before content edits. +2. T-052 content commit: four named standards plus any demonstrated restatement of the five claims, classifications and downstream dispositions. +3. T-053 content commit: actual panic flags for every aarch64-unknown-none build, live target-aware tooling, current lint table, missing_docs/-D warnings boundary, scope history, printed QEMU log path, fence tags, test-hal and release grammar. +4. Freeze cumulative Step 8 source for two complementary fresh code/security reviewers; verify/fix/commit actual findings. Repeat with two different fresh contexts over the whole corrected step. Actual paired reports are cross-read and retained, with parallel initial passes attributed accurately. +5. Publish canonical reviews/evidence and move both tasks only to In Review, then continue Step 9/T-054 automatically. No date_done or maintainer approval is inferred. + +## Additional file scope, recorded before editing + +These are bounded corrections of the already-approved adjacent volatile tooling claims, not new standards policy: + +- `docs/standards/security-review.md`: its Tooling section falsely calls cargo-audit/cargo-vet live CI gates; current infrastructure/CI makes them planned at the first external dependency. Align that delivery status only. +- `docs/standards/architectural-principles.md`: P11's current-tense cargo-vet claim needs a delivery-status note. Preserve P11's normative Statement, Why and Applies to in full; do not weaken reproducibility or dependency audit requirements. +- `docs/standards/infrastructure.md`: Reproducibility bullets are required properties, not proof of an existing binary-comparison job. Add a factual status note distinguishing pinning/build checks from absent cross-run bit comparison/certification; preserve the required properties. +- Necessary task/current/task-index/approved-plan records, this source-bound report/evidence, canonical review artifacts and their indexes are covered by the tasks' step-scoped evidence allowance. No runtime, lint, CI, runner or branch-protection file is selected for mutation. + +## Downstream search and verification + +[Retained search](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t052-t053-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t052-t053-verification-evidence/downstream-baseline.txt") captures 141 broad matched lines across `.agents/skills/`, architecture and standards; these are search hits, not 141 defects. All hits were read in bounded outputs. The completion evidence must list updated owner documents and explicit unchanged historical/normative/already-accurate dispositions. Accepted/Superseded ADR bodies remain historical. + +[Scope inventory](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t052-t053-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t052-t053-verification-evidence/scope-baseline.json") binds actual git-log extraction to the source above. Recommend syscalls/architecture/bsp- while preserving prior-use aliases and the existing prior-commit OR review-agreement extension rule; never turn this inventory into an allowlist. + +Verify source-backed claims, exact task/index/current state and step-only allowed paths; ensure executable/config/CI bytes unchanged; check all touched relative paths/fragments and every standards opening fence using a stateful parser, and run diff whitespace checks while attributing any inherited raw-log EOF exceptions separately. Prose-only edits do not warrant new runtime tests; no source inspection is reported as test execution. PR #49 remains the publication barrier; no push, remote-policy change or external message is authorized by this step. + +> **Evidence migration (2026-10-16).** Raw evidence links now open the [immutable archive catalog](2026-10-16-pr49-evidence-catalog.md). Each link title retains its exact archived member path. Original verdicts, measurements, limitations and execution SHA identities remain historical; the archive bundle restores their original source. diff --git a/docs/analysis/reports/2026-10-13-t052-t053-standards-reconciliation.md b/docs/analysis/reports/2026-10-13-t052-t053-standards-reconciliation.md new file mode 100644 index 00000000..4d26122c --- /dev/null +++ b/docs/analysis/reports/2026-10-13-t052-t053-standards-reconciliation.md @@ -0,0 +1,62 @@ +# T-052 / T-053 — source reconciliation and verification + +- **Date:** 2026-10-13 +- **Author:** Codex (AI agent), coordinator/implementation author +- **Step baseline:** `98378b5add44755f7cbab6e8bc96337accf0574a`; kickoff `cbd4cd15798e0580fe11efff8c4ce2f1a15a3bf3` +- **Authority and scope:** [preflight](2026-10-13-t052-t053-standards-preflight.md), [approved plan](2026-10-12-phase-b2-track2-preflight-and-plan.md), Accepted [ADR-0042](../../decisions/0042-descriptive-test-names.md) / [ADR-0043](../../decisions/0043-documentation-corpus-consistency.md). +- **Boundary:** canonical Step 8 boundary after both fresh paired rounds; both tasks In Review. Dated initial verification below remains attributable to its earlier snapshot. This coordinator report is not an independent review, maintainer approval or Done promotion. + +## T-052 choices and source facts + +| Choice / classification | Corrected claim and verification | +|-------------------------|----------------------------------| +| Naming — rule change | Accepted ADR-0042 supplies descriptive snake_case guidance without a mandatory prefix or word count, including concise contextual names and valid old prefixed names. The three named IPC tests actually have #[test] attributes in [ipc/mod.rs](../../../kernel/src/ipc/mod.rs); testing References now links the motivating ADR. No runtime rename or naming lint. | +| Panic — approved claim correction | [BSP main panic handler](../../../bsp-qemu-virt/src/main.rs) selects the low/high UART alias from SP, emits the banner and formatted PanicInfo, then spins. [exceptions.rs](../../../bsp-qemu-virt/src/exceptions.rs) can supply class/ESR/identifier context in panic messages, not a general saved-register dump. Reset, shell and backtrace are not implemented. No automatic dump follow-up is required. | +| Incomplete markers — approved claim correction | [Cargo.toml](../../../Cargo.toml) inherits clippy::todo deny in all six opt-in members, but has no unimplemented deny. Two non-bare-metal [tyrne-user](../../../userland/tyrne-user/src/lib.rs) syscall stubs remain intentional host-compilation paths; review rejects unfinished reachable runtime paths. No lint-level change or source edit. | +| Logging — approved claim correction | All six workspace members are kernel/HAL/BSP/test-hal/user library/hello. No structured facade/ring/worker/log service/metrics/control API exists. The status banner and affected sections now mark those designs planned; Console/UART is the current path. Secret-redaction and nonblocking constraints remain. | +| Panic-family scope — approved claim correction | Exact crate denies exist in [kernel](../../../kernel/src/lib.rs), [HAL](../../../hal/src/lib.rs) and [QEMU BSP](../../../bsp-qemu-virt/src/main.rs), with explicit local boot/demo/fatal/test allowances. test-hal/userland only inherit workspace lints. Both error-handling and code-style restatements align. | + +Adjacent fault prose now distinguishes the [hello](../../../userland/hello/src/main.rs) handler's task_exit(101), arbitrary non-SVC EL0 synchronous whole-kernel panic, and [scheduler](../../../kernel/src/sched/mod.rs) removal from scheduling with retained Task/address-space/table/frame state. TaskFault delivery, supervision and reclamation are future Phase E work (E3 supplies supervisor Fault-endpoint plumbing), consistent with the refreshed security model. Planned ISR rings are explicitly unavailable today. + +## T-053 mechanical / tooling reconciliation + +| Contract | Source-backed result | +|----------|----------------------| +| Panic flags | [.cargo/config.toml](../../../.cargo/config.toml) target rustflags set -C panic=abort for every aarch64-unknown-none build, including userland. The root Cargo release comment explains why host tests retain harness unwinding; no profile panic key exists. | +| Live CI and review | [ci.yml](../../../.github/workflows/ci.yml) contains current host/kernel/userland Clippy, debug/release tests/build/smoke, stable, Miri and native ARM jobs/probes. The standards use target-aware commands and matching userland-before-kernel prerequisites. Coverage remains advisory. No new execution or hosted result is claimed here. | +| Protection | [main.json](../../../.github/branch-protection/main.json) retains six exact app-15368 checks/strict status/linear history/conversation resolution/no force or deletion. Solo approval count 0/admin false is accurately distinguished from the maintainer's cold-review policy. No remote policy write. | +| Scope vocabulary | [source-bound git-log inventory](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t052-t053-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t052-t053-verification-evidence/scope-baseline.json") has 470 subjects and 75 distinct captured scope strings (combined scopes retained). Includes perf/roadmap/analysis/audits/architecture/mmu and recommends syscalls/architecture/bsp-; historical aliases remain valid and prior-commit OR review-agreement extension remains. No allowlist or retroactive rename. | +| Lints / warnings | All nine workspace lint entries appear with correct levels in code-style; Cargo remains authoritative. missing_docs warn and pedantic warn are escalated by required -D warnings for emitted diagnostics in covered targets, subject to explicit source allowances. Review still covers internal documentation that missing_docs does not diagnose. | +| QEMU log path | [run-qemu.sh](../../../tools/run-qemu.sh) supplies -d int -D with printed TMPDIR-or-/tmp/qemu_int..log. The checklist directs grep to that printed path and distinguishes smoke's int,unimp evidence paths; manual explicit destinations remain valid. | +| Fences / small corrections | A stateful scan of all 15 standards files finds 20 tagged opening fences, zero untagged/unclosed. T-052 tags the rewritten naming block; T-053 tags both commit examples. Existing test-hal parenthetical and release grammar corrected. | +| Adjacent tooling | cargo-audit/cargo-vet are planned at the first external dependency, consistent with infrastructure and absent jobs/supply-chain files. security-review status aligned. P11's entire original Statement/Why/Applies is preserved, with a delivery note; infrastructure preserves all reproducibility requirements and explicitly says pinning/build checks are not bit-for-bit certification. | + +## Downstream-effects search dispositions + +The [baseline hits](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t052-t053-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t052-t053-verification-evidence/downstream-baseline.txt") are 141 broad matched lines, not unique defects. They were captured at 23391c7; the three searched domains are byte-identical at Step 8 baseline 98378b5 (verified in [search metadata](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t052-t053-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t052-t053-verification-evidence/downstream-search-method.json")). The explicit post-edit search includes naming/fault/supervision/logging/lints/audit-vet/smoke/panic/log-path vocabulary; its exact argv and [full hits](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t052-t053-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t052-t053-verification-evidence/downstream-after-content.txt") are retained. + +| Hit group / domain | Disposition | +|--------------------|-------------| +| testing / error-handling / code-style / logging-and-observability | Updated the five owned claim families and adjacent fault/current-transport descriptions as above; normative redaction, error propagation and hot-path policy preserved. | +| code-review / commit-style / bsp-boot-checklist / release | Updated live local/CI/protection scope, history vocabulary, tagged examples, actual log path and grammar. Existing historical review examples/PR-number notes retained. | +| security-review | Corrected false audit/vet CI-gate assertions. Its dependency checklist requiring trust decisions on actual additions remains normative; it does not claim a job ran. | +| architectural-principles | P11 receives only current delivery status; original P11 and P12 incremental-completeness principles are preserved. Unrelated authority/blob/audit vocabulary is not one of the five false claims. | +| infrastructure | Required/planned/advisory CI and dependency policy already align. Reproducibility delivery note removes the implication of present binary-comparison certification, preserving all requirements. Future vet certification/import/upgrade/supply-chain text sits under explicit planned gate/file context and remains policy. | +| architecture: security-model / exceptions / scheduler / task-loader / memory-management / hal / ipc / boot | Current fault, retained lifecycle, raw console, target/pointer/audit and future-phase statements were verified by T-045/T-046 and remain accurate. No prefix/facade/dump/unimplemented-deny/uniform-userspace-deny promise to repair. Broad audit/"uniformly linked" hits are unrelated to the five claims. Preserve architecture freshness/source provenance. | +| skills: add-dependency | Certification/import/trust requirements apply when adding the first actual external dependency; they are not claims of an existing CI job. Preserve that policy and evidence checklist. | +| skills: approval/code/security review, justify-unsafe, conduct-review, write-adr, add-bsp and skill index | Audit-log/checklist/certification/history references are normative procedure or dated examples; no mandatory test_ prefix, available structured logger, generic panic dump, unimplemented deny or userspace-wide panic-family deny restatement. Preserve them. | +| standards: unsafe-policy / README and unaffected documents | Broad audit references describe existing audit requirements/discovery, not the false claim families; unchanged. Historical ADR-0041 and source-bound earlier snapshots elsewhere preserve the superseded rule as evidence, not current guidance. | + +## Initial verification and limits + +[Static result](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t052-t053-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t052-t053-verification-evidence/initial-static-verification.json") records 15 unchanged source/config/runner digests, every documented workspace lint, three real test identifiers, preserved original P11, six app-bound policy entries, exact 46-task counts and clean step diff whitespace. Its changed-path list is a snapshot taken before adding this report/result and later review evidence, not the final publication inventory. The command was `python3 /tmp/tyrne-b22-step8-verify.py`; it uses a stateful matching-delimiter fence scan. This temporary verifier is coordinator evidence, not the shipped T-056 tool. + +[Initial navigation result](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t052-t053-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t052-t053-verification-evidence/initial-navigation-verification.json") records whole visible source-corpus local-path/fragment diagnostics with zero candidates. This existing third-party Markdown diagnostic does not prove the future T-056 grammar. Report links added afterward will be checked again before the review freeze/publication. `git diff --check 98378b5` returns 0 for this step; inherited prior raw-log EOF whitespace is not normalized or reclassified. + +No new Cargo/QEMU/Miri/coverage/Linux-hosted/reproducibility test ran for this prose-only step. Runtime, manifests/config, CI, scripts, Accepted ADR bodies and branch-protection bytes are unchanged. Two fresh paired review rounds are still required before both tasks can become In Review. + +## Canonical boundary — 2026-10-13 + +[Code](../reviews/code-reviews/2026-10-13-t052-t053-standards-reconciliation.md) and [security](../reviews/security-reviews/2026-10-13-t052-t053-standards-reconciliation.md) retain all four required reports and the supplementary primary assessment, initial verdicts, commands, limitations and actual paired cross-reads. Both rounds Approve frozen `d553efe`; zero confirmed source or seam findings and no source correction commit required. Both tasks In Review/all 25 criteria checked/no date_done. The R1 interim progress relay, original R2 primary template exposure/replacement and report-only S28 link QA remain explicit. Earlier initial snapshots/raw evidence are unchanged; later canonical diagnostics are separate. Step 9/T-054 is next. No new runtime/hosted/reproducibility execution, T-056 grammar certification, maintainer approval or T-038 closure. + +> **Evidence migration (2026-10-16).** Raw evidence links now open the [immutable archive catalog](2026-10-16-pr49-evidence-catalog.md). Each link title retains its exact archived member path. Original verdicts, measurements, limitations and execution SHA identities remain historical; the archive bundle restores their original source. diff --git a/docs/analysis/reports/2026-10-13-t052-t053-verification-evidence/README.md b/docs/analysis/reports/2026-10-13-t052-t053-verification-evidence/README.md new file mode 100644 index 00000000..48f964a8 --- /dev/null +++ b/docs/analysis/reports/2026-10-13-t052-t053-verification-evidence/README.md @@ -0,0 +1,16 @@ +# T-052 / T-053 verification evidence — 2026-10-13 + +Original snapshots were captured during content implementation before canonical review publication. They remain immutable; metadata records their source and scope. No new Cargo/QEMU/Miri/coverage/hosted or reproducibility run is claimed. + +- [scope-baseline.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t052-t053-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t052-t053-verification-evidence/scope-baseline.json"): 470 historical subjects/75 captured scope strings at Step 8 baseline; combined strings are data, not an allowlist. +- [downstream-baseline.txt](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t052-t053-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t052-t053-verification-evidence/downstream-baseline.txt"): all 141 broad baseline lines, not a defect count. +- [downstream-after-content.txt](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t052-t053-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t052-t053-verification-evidence/downstream-after-content.txt"): exact 73-line post-edit search output. +- [downstream-search-method.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t052-t053-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t052-t053-verification-evidence/downstream-search-method.json"): source, argv and provenance for both searches; patterns intentionally differ. +- [initial-static-verification.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t052-t053-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t052-t053-verification-evidence/initial-static-verification.json"): 19-path pre-report snapshot, 15 unchanged source digests, lints/tests/fences/task counts/policy checks. +- [initial-navigation-verification.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t052-t053-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t052-t053-verification-evidence/initial-navigation-verification.json"): bounded existing third-party parser diagnostic at the 367-file snapshot, not future T-056 grammar proof. +- [retained-report-manifest.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t052-t053-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t052-t053-verification-evidence/retained-report-manifest.json"): exact final report byte counts/SHA-256, retained once verbatim in canonical reports. +- [publication-verification.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t052-t053-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t052-t053-verification-evidence/publication-verification.json"): separate later coordinator scope/retention/lifecycle/navigation checks. + +[Reconciliation](../2026-10-13-t052-t053-standards-reconciliation.md), [preflight](../2026-10-13-t052-t053-standards-preflight.md), [code](../../reviews/code-reviews/2026-10-13-t052-t053-standards-reconciliation.md) and [security](../../reviews/security-reviews/2026-10-13-t052-t053-standards-reconciliation.md) preserve initial verdicts and actual later cross-read chronology. Both tasks stop In Review without date_done. Original evidence does not become an execution of later publication content. + +> **Evidence migration (2026-10-16).** Raw evidence links now open the [immutable archive catalog](../2026-10-16-pr49-evidence-catalog.md). Each link title retains its exact archived member path. Original verdicts, measurements, limitations and execution SHA identities remain historical; the archive bundle restores their original source. diff --git a/docs/analysis/reports/2026-10-13-t054-identity-preflight.md b/docs/analysis/reports/2026-10-13-t054-identity-preflight.md new file mode 100644 index 00000000..23da0b3c --- /dev/null +++ b/docs/analysis/reports/2026-10-13-t054-identity-preflight.md @@ -0,0 +1,35 @@ +# T-054 — planned ADR identity migration preflight + +- **Date:** 2026-10-13 +- **Author:** Codex (AI agent), coordinator/implementation author +- **Clean step baseline:** `f8c9b7f34a28d0974cbc9e03f1ef8355dc2df4f3`, `development`; Step 8's complete paired rounds and canonical In Review boundary precede this kickoff. +- **Authority:** maintainer-approved [13-step plan](2026-10-12-phase-b2-track2-preflight-and-plan.md), Accepted [ADR-0043](../../decisions/0043-documentation-corpus-consistency.md), [T-054 contract](../tasks/phase-b2/T-054-adr-ledger-renumbering-cascade.md). The task's old numeric-cascade title/opening inventory is historical; its approved executable criteria select stable purpose identities. +- **Boundary:** preparation/start only. No planned ADR is filed or accepted, no phase is opened, no runtime/executable/CI change or Done/human approval claimed. Task In Progress/unchecked until implementation and both fresh paired rounds pass. + +## Existing-document review and source reconciliation + +The coordinator fully reviewed all C–I phase files and their ledger, milestone, carry-forward and cross-phase references, the phase-B.2 finding/action/acceptance/polish language, ADR-index Numbering gaps/creation reminders, full write-adr procedure and Accepted ADR-0043/ADR-0040 rider. This source-bound step rechecks the unchanged planning surface against the clean baseline; earlier read-only preparation at d553efe is attributed in [semantic-baseline.json](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t054-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t054-verification-evidence/semantic-baseline.json"), not represented as an implementation or independent review. + +There are exactly 32 numbered definitions: C:5 / D:5 / E:6 / F:5 / G:5 / H:3 / I:3. The old rows use 29 distinct numbers; 0042/0043/0044 each occur in C and D. Actual filed 0040–0043 are separate records. Every original purpose/milestone/note and full row is retained in the baseline. The two F2 definitions are I2C and SPI and require distinct identities. D4 and F4 require no new planned identity; object-lifecycle, G1.5 and Phase J remain explicitly unallocated, and reserved 0034 remains reserved. + +Semantic checks cover C's 0040 planning alias versus filed governance 0040, D's boot/memory references, the D historical “ADR-0043, roadmap C4” SGI/IPI quotation versus D2 GIC-400, F's cross-phase G2 crypto/D5 memory references, and G's verification-tool/measured-boot references. Live references will link to one explicit ledger anchor by purpose. Historical quoted numbers, row notes and the dated 2026-05-22 cascade remain evidence, explicitly superseded as allocation guidance. No global numeric replacement is authorized. + +## Demonstrated additional-file reason — recorded before editing + +The named T-054 content surface includes phase files and docs/decisions/README.md. One additional workflow file, [.agents/skills/write-adr/SKILL.md](../../../.agents/skills/write-adr/SKILL.md), is necessary: its actual next-number/cross-link/checklist procedure omits ADR-0043's existing requirement to preserve the planning purpose as a historical alias in the filed record and connect the original ledger row to that record. Add a conditional reminder and governing reference, without changing number allocation, proposal/Acceptance separation, supersession or reserved 0034. Otherwise this migration would leave the filing procedure able to discard the identity it introduces. This is implementation of already Accepted policy, not a new process choice or ADR. + +Evidence/reconciliation/review/index/task/current/plan files use the approved step-scoped evidence allowance. Record any further content surface before editing. Accepted ADR bodies and actual index record rows remain byte-unchanged; verify the existing ADR-0040 Acceptance rider covers both rule 7 numbering and rule 4's limited B.2-2 execution extension. + +## Execution and verification plan + +1. Commit this preflight, source-bound baseline and In Progress bookkeeping before changing owned planning/workflow content. +2. Migrate all 32 definitions to explicit stable purpose anchors; resolve every live reference one semantically reviewed line at a time. Clarify historical snapshots and retain original numeric notes, filed references and unallocated/reserved decisions. +3. Align the B.2 executable remediation/acceptance/consistency description, ADR-index workflow and conditional write-adr reminder. No numeric allocation or planned architecture selection. +4. Retain actual source-bound checks: exactly 32 unique definitions, separate repeated-reference counts and correct destinations, historical-note/record/index/rider preservation, unchanged executable domains, scoped diff, lifecycle and bounded local-link/fragment diagnostics. Temporary preparation scripts are coordinator tools, not future T-056 delivery. +5. Commit implementation/evidence; conduct two different fresh primary-code/complementary-security paired rounds. Validate/fix/commit any confirmed findings, preserve full actual reports and chronology, then publish canonical indexes and transition only to In Review. Continue automatically to T-047 after this boundary. + +No new maintainer decision is needed for these approved edits. HIGH T-038 and whole-phase C/D gates stay outstanding. PR49 publication barrier remains; all work is local until the predecessor merges or the maintainer explicitly chooses a combined PR. + +[Kickoff navigation diagnostic](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t054-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t054-verification-evidence/kickoff-navigation.json") records the pre-implementation visible corpus after this preflight was written. It uses the existing third-party diagnostic, not shipped T-056 grammar or runtime verification. + +> **Evidence migration (2026-10-16).** Raw evidence links now open the [immutable archive catalog](2026-10-16-pr49-evidence-catalog.md). Each link title retains its exact archived member path. Original verdicts, measurements, limitations and execution SHA identities remain historical; the archive bundle restores their original source. diff --git a/docs/analysis/reports/2026-10-13-t054-planned-adr-identity-migration.md b/docs/analysis/reports/2026-10-13-t054-planned-adr-identity-migration.md new file mode 100644 index 00000000..fec235f1 --- /dev/null +++ b/docs/analysis/reports/2026-10-13-t054-planned-adr-identity-migration.md @@ -0,0 +1,48 @@ +# T-054 — stable planned ADR identities + +- **Date:** 2026-10-13 +- **Author:** Codex (AI agent), implementation coordinator +- **Clean step base:** f8c9b7f34a28d0974cbc9e03f1ef8355dc2df4f3, development. +- **Pre-content kickoff:** f8c7e1f70e93e9cea4fef67c2b2077769bc9996d. +- **Authority:** [approved plan](2026-10-12-phase-b2-track2-preflight-and-plan.md), Accepted [ADR-0043](../../decisions/0043-documentation-corpus-consistency.md), [T-054](../tasks/phase-b2/T-054-adr-ledger-renumbering-cascade.md). +- **Delivery state:** In Review after [both fresh paired rounds](../reviews/code-reviews/2026-10-13-t054-planned-adr-identities.md); one unique R1 Low fixed and verified, zero new R2 or unresolved findings. No task Done, planned ADR filing/acceptance or Phase C/D opening claimed. + +## Reviewed migration + +All 32 numbered C–I ledger rows now define stable milestone-plus-purpose identities with explicit navigable anchors: C:5, D:5, E:6, F:5, G:5, H:3, I:3. I2C and SPI remain two separate F2 decisions. Each row retains its exact original purpose, milestone and complete old note, prefixed by a dated historical alias. D4's implementation-only row, unallocated object-lifecycle/G1.5/J planning and reserved 0034 are preserved. + +The coordinator resolved 71 live reference source lines individually by meaning, resulting in 74 linked occurrences. These are references, not extra definitions. The [actual migration ledger](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t054-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t054-verification-evidence/live-reference-migration.json") preserves original source lines and actual replacements. This includes C's old 0040 versus filed governance 0040, C/D's ambiguous 0042–0044, D's historical SGI/IPI quotation versus GIC-400, F's cross-phase crypto/memory references and G's verification-tool/measurement references. No global numeric substitution was used. + +Each ledger explains allocation at filing, preservation of the purpose as a historical alias and linkage of its existing row to the filed record. Where the phase already has acceptance criteria, they refer to the future filed record's Accepted state; planning identities convey no ADR status or implementation authorization. Phase I remains a sketch without newly invented criteria. Original dated C/D gate snapshots and E's 2026-05-22 cascade quote remain intact, with dated clarifications superseding only the allocation guidance. C's old tentative-number paragraph and B.2's opening remediation are retained as explicitly historical evidence. Runtime/backlog work and whole-phase gates remain outstanding. + +Phase B.2's executable action, acceptance language and consistency-check description now match stable identities. The ADR-index Numbering gaps/creation guidance and conditional write-adr procedure preserve the identity during filing. The [preflight](2026-10-13-t054-identity-preflight.md) records the demonstrated additional skill-file reason before its edit. Filed ADR bodies, filenames, statuses and all 42 index record rows are unchanged. The existing ADR-0040 rider is verified to cover both rule 7's numbering clarification and rule 4's limited B.2-2 execution extension; it was not edited. + +## Source-bound verification + +The retained [bounded verification script](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t054-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t054-verification-evidence/verify-migration.py") reads the recorded clean Git base and current worktree. It verifies baseline hashes/rows, all definitions, complete historical notes, original/replacement reference lines, destinations and separate occurrence counts. It also checks classified residual historical numeric references, dated snapshots, reserved/unallocated planning, all 42 filed records/index rows and the existing rider. This diagnostic is specific to T-054; it does not implement T-056's parser, prove architectural correctness or verify Rust soundness. + +~~~text +definitions: 32 unique +distribution: C=5 D=5 E=6 F=5 G=5 H=3 I=3 +semantic reference source lines: 71 +linked reference occurrences: 74 +filed ADRs unchanged: 42 +filed ADR-index rows unchanged: 42 +errors: 0 +~~~ + +See [implementation snapshot](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t054-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t054-verification-evidence/implementation-verification.json") and [evidence instructions](2026-10-13-t054-verification-evidence/README.md). The initial snapshot is taken against kickoff HEAD plus the actual content worktree; later review/fix commits are recorded separately without rewriting that initial result. The actual [navigation snapshot](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t054-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t054-verification-evidence/implementation-navigation.json") reports 374 visible Markdown files, 6,395 local targets, 743 fragments and zero candidates. Navigation uses the existing third-party diagnostic, with its grammar limitations stated separately from the source comparison. No runtime, build/configuration, Cargo dependency, CI or unsafe audit entry changes; no new QEMU/Miri/hosted CI result is claimed for this documentation migration. + +## Implementation review boundary (historical checkpoint before R1) + +Implementation and evidence are committed before R1. R1 primary code/complementary security and different fresh R2 reviewers inspect the actual frozen commit range. Their initial source checks precede any peer report or verdict exchange; full actual reports, confirmed findings/fixes and paired cross-reading chronology will be published in the canonical artifacts. No provisional future review verdict is asserted here. Criteria stay unchecked until both rounds and final publication checks finish; then T-054 stops at In Review pending maintainer PR review/merge. + +## R1 confirmed correction + +Both independent initial reports identified the same Low accuracy defect (primary R1-C01 / complementary T054-R1-S01): Phase I's copied workflow note referred to nonexistent acceptance criteria above. The coordinator read both full reports, verified the complete Phase I sketch and removed only that sentence fragment, retaining the explicit no-status/no-authorization boundary. No new Phase I criterion or future decision was introduced. Initial implementation/baseline/navigation snapshots remain byte-unchanged. A separate [R1 correction comparison](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t054-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t054-verification-evidence/r1-correction-verification.json") records the actual corrected worktree and fresh hashes. Both initial source checks preceded peer exchange; actual cross-reading and correction verification follow the correction commit. The unique finding count is one, not two; final R1 verdicts and R2 remain pending at this correction boundary. + +## Final both-round and publication boundary + +All four distinct final reviewers Approve corrected source through `a93926b3836e5e661495ed53356f1ded04dc216d`. The [code artifact](../reviews/code-reviews/2026-10-13-t054-planned-adr-identities.md) and [security artifact](../reviews/security-reviews/2026-10-13-t054-planned-adr-identities.md) retain full actual reports and actual cross-reading chronology. Original initial reports remain prefixes of their final reports; the one shared Low is counted once. R1 report-metadata QA remains separate from source findings. The [publication manifest](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t054-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t054-verification-evidence/publication-manifest.json") binds all final report bytes, original captures, ten reviewed content surfaces and the separate final source/navigation checks. Publication is coordinator bookkeeping, not another independent round. All eleven criteria are checked and T-054 is In Review without date_done; T-047 follows automatically. No external publication or stronger runtime/CI/maintainer certification is claimed. + +> **Evidence migration (2026-10-16).** Raw evidence links now open the [immutable archive catalog](2026-10-16-pr49-evidence-catalog.md). Each link title retains its exact archived member path. Original verdicts, measurements, limitations and execution SHA identities remain historical; the archive bundle restores their original source. diff --git a/docs/analysis/reports/2026-10-13-t054-verification-evidence/README.md b/docs/analysis/reports/2026-10-13-t054-verification-evidence/README.md new file mode 100644 index 00000000..dccd9a67 --- /dev/null +++ b/docs/analysis/reports/2026-10-13-t054-verification-evidence/README.md @@ -0,0 +1,30 @@ +# T-054 verification evidence + +These are bounded coordinator diagnostics for [T-054](../../tasks/phase-b2/T-054-adr-ledger-renumbering-cascade.md), not independent review reports or the delivered T-056 gate. + +- [semantic-baseline.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t054-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t054-verification-evidence/semantic-baseline.json"): immutable pre-content inventory of all 32 original definitions, source hashes and ambiguity resolutions at f8c9b7f34a28d0974cbc9e03f1ef8355dc2df4f3; earlier preparation is separately attributed. +- [kickoff-navigation.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t054-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t054-verification-evidence/kickoff-navigation.json"): immutable visible-corpus navigation diagnostic before content migration. +- [live-reference-migration.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t054-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t054-verification-evidence/live-reference-migration.json"): actual 71 source-line edit records, including original text, replacement and purpose resolution. Earlier preparation and actual clean/kickoff bases are separate fields. +- [verify-migration.py](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t054-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t054-verification-evidence/verify-migration.py"): source comparison; uses Python 3.9+ standard library and Git, resolves repository root from its own file and reads the recorded Git base. It reads the current worktree; optional output is the only write. +- [implementation-verification.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t054-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t054-verification-evidence/implementation-verification.json"): actual initial post-content comparison, keyed to kickoff HEAD and owned worktree hashes. It is not rewritten after review. +- [implementation-navigation.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t054-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t054-verification-evidence/implementation-navigation.json"): actual initial post-content visible-corpus navigation diagnostic. It uses the existing third-party Markdown diagnostic, not T-056's complete grammar. + +- [r1-correction-verification.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t054-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t054-verification-evidence/r1-correction-verification.json") and [r1-correction-navigation.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t054-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t054-verification-evidence/r1-correction-navigation.json"): separate actual post-R1-correction captures at the implementation HEAD plus corrected worktree; the initial snapshots above remain immutable. + +From any working directory, invoke the script by its path: + +~~~sh +python3 docs/analysis/reports/2026-10-13-t054-verification-evidence/verify-migration.py +~~~ + +The example path assumes repository cwd; an absolute path works elsewhere. A fresh invocation reports the current HEAD/worktree and may include later bookkeeping paths; compare owned source hashes when reproducing the frozen content result. The optional --output /tmp/t054-comparison.json retains a separate new result. Exit status is nonzero when a comparison check fails. Missing Git objects/files or invalid evidence also fail rather than returning a green result. The source-bound semantic edit ledger is review evidence; it cannot prove that the original human meaning was interpreted correctly. Independent review checks that meaning against source. + +## Canonical publication checks + +- [publication-verification.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t054-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t054-verification-evidence/publication-verification.json"): separate current-worktree comparison after canonical report/lifecycle edits; reviewed content hashes remain those of a93926b. +- [publication-navigation.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t054-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t054-verification-evidence/publication-navigation.json"): fresh visible-corpus diagnostic after canonical additions, with its actual source/scope and grammar limits. +- [publication-manifest.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t054-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t054-verification-evidence/publication-manifest.json"): final actual report/prefix/capture/content hashes, lifecycle/scope and publication-check correspondence. Original snapshots above remain unchanged. + +Both fresh paired rounds Approve the corrected frozen source. Full actual reports are retained in the [code artifact](../../reviews/code-reviews/2026-10-13-t054-planned-adr-identities.md) and [security artifact](../../reviews/security-reviews/2026-10-13-t054-planned-adr-identities.md). These final captures are coordinator bookkeeping, not a third review round or T-056 delivery. + +> **Evidence migration (2026-10-16).** Raw evidence links now open the [immutable archive catalog](../2026-10-16-pr49-evidence-catalog.md). Each link title retains its exact archived member path. Original verdicts, measurements, limitations and execution SHA identities remain historical; the archive bundle restores their original source. diff --git a/docs/analysis/reports/2026-10-13-t055-adr-correction-preflight.md b/docs/analysis/reports/2026-10-13-t055-adr-correction-preflight.md new file mode 100644 index 00000000..12de3c2b --- /dev/null +++ b/docs/analysis/reports/2026-10-13-t055-adr-correction-preflight.md @@ -0,0 +1,51 @@ +# T-055 — existing-document review and scoped plan + +- Source: clean development `523615603f87f6f11f2030db4d6d974c38330f0d` on 2026-10-13; T-050 fresh R2 pending. No T-055 repository implementation has begun. +- This is coordinator preparation, not either fresh implementation review or maintainer approval. Existing AGENTS prerequisites, Accepted ADR-0025/0043 and the approved task/plan apply. +- Full executable T-055 contract reread. Rechecked ADR-0008 revision/IrqGuard comment, ADR-0011 Context, ADR-0012 Open questions, full ADR-0018, ADR-0033 top/canonical correction, full ADR index/sync skill and provenance commits. The five approved corrections choose no new decision or status. + +## Index baseline + +Read-only header/index extraction retained in `/tmp/tyrne-b22-t055-baseline-index.json` (its source74f8e837 has identical ADR/index bytes to this preparation source). 42 numbered files/42 rows; 14 literal title mismatches (8 descriptive differences and 6 backtick-only differences), one Date mismatch (0023 prose-extended source Date versus index ISO prefix), 35 normalized full-title/filename-slug differences. No filename/status difference in the actual indexed rows. Do not mistake row/header agreement after synchronization for removal of title/slug differences. Reserved0034, Deferred0023, partial0022 supersession and 0041→0042 are existing evidence, not new vocabulary decisions. + +Rebuild exact source-title/status/date rows; retain the complete authoritative prose-extended Date, report all initial differences and noncanonical forms, do not invent dates or rename records. Sync skill's valid-status/date/supersession vocabulary must distinguish whole supersession from partial-axis riders and ordinary correction pointers. Whole supersession target must exist and be Accepted; partial-axis historical status is not a reason to erase the standing typed-error decision. ADR README Format may describe the existing observed forms under ADR-0043, without changing metadata semantics. + +## Existing timer discrepancy — bounded existing-contract correction + +HAL timer rustdoc52–53 and ADR-0010 Decision outcome78 describe nearest-multiple deadlines, conflicting with the existing reaches-or-exceeds contract and current ceiling implementation. Read full ADR-0010 and relevant timer helpers. `resolution_ns_for_freq`145–160 computes nearest integer period/min1ns; `ns_to_ticks`207–220 uses saturating ceiling. These are distinct calculations. `git show d820a88d902e77ccf33b30ebe9c7be03a9c25cea` and `5c9cf069c2f5fa3be77c048d865ae89c4055ba11`, together with T-012 review history112, explicitly record the accepted floor→ceiling fix and the non-divisor3Hz/333333334ns→2ticks regression. d820a88 is an ancestor of merged-mainc16997e. No fresh runtime policy or function change is needed. + +Recommended T-055 allowance: an append-only dated factual clarification in existing ADR-0010, plus comment-only Timer::resolution_ns wording. Preserve old body/Date/Status. Explain approximate reported resolution separately from the already-shipped deadline conversion; do not promise representability beyond saturating counter bounds. Source provenance and named owner are existing T-012/T-055. This adds two demonstrated existing-scope files; record that reason before implementation and verify comment-only source/append-only ADR deltas. + +## Additional real navigation/procedure drift — do not suppress in gate + +Read-only coarse tracked-corpus diagnostic `/tmp/tyrne-b22-readonly-corpus-scan.py` (existing third-party Markdown tool, NOT shipping T-056 parser/grammar) at source5236156 scans359MD,5938local targets/601fragments. Six candidates independently inspected: two rendered template destinations in supersede-adr skill (NNNN-slug.md, MMMM-new-slug.md), and four old P7 fragments in Accepted ADR-0015. Source heading is `P7 — No proprietary binary blobs in the kernel`; old destinations use `p7--no-proprietary-blobs`. No claim of complete Markdown grammar or shipped gate coverage. + +Recommended T-055 allowance: render supersession examples as tagged markdown code fences (template syntax is quoted data); fix its existing minor-amendment instruction to append-only rider wording supplied by Accepted ADR-0025 rather than an in-place rewrite. Add invisible legacy id `p7--no-proprietary-blobs` immediately before the matching P7 standard heading, preserving all four Accepted ADR-0015 historical links/body bytes and current heading. This is navigation/authority reconciliation, not a standard rule change/new ADR or historical exception. Add the two demonstrated existing-scope files and explicit provenance to T-055 report/history at kickoff. Do not change these files during T-050 R2. + +## Approved correction constraints + +- IrqGuard: preserve 4fe547cf47beb54a51ad09f8a5705d2f30841a29's recorded QEMU failure and concrete-dispatch choice; retract generalized rodata/vtable aliasing cause as unverified. No retained compiler/Miri/disassembly proof, no broad trait-object-unsoundness claim. Comment and rider agree. +- ADR-0033: dated top pointer to existing 2026-05-30 single-offset/KBASE correction; unchanged body. +- ADR-0011: dated GICv2/no trait-surface-change pointer to ADR-0036; unchanged body. +- ADR-0012: exact original EL-drop sentence preserved inside strikethrough; resolved2026-04-27 link to ADR-0024; separately date pointer application2026-10-13 so resolution date is not claimed as application date. +- ADR-0018: append dated pros/cons of all six historical options, with links to original considered-options/decision sections. Avoid amplifying decision-time badge emulation/API-compatibility claims as current guarantees; present historical tradeoffs and retain current source-defined boundary. No option/outcome changes. +- Verify every touched ADR has additions only, except stated ADR-0012 strikethrough; no status/date/body rewrites. Root sole writer; fmt/host-clippy/host-test required; runtime source otherwise byte-identical except the two documented rustdoc corrections. Two fresh complementary rounds, separate security pass because rationale describes unsafe/scheduler boundary. New T-055 stops In Review. + +## Step 7 kickoff — 2026-10-13 + +T-050 completed both fresh code/security rounds and canonical publication at 69afa33f67ea9dd7e97c127841222d2edc5c9f00 before this task starts. Its reviewed source was 946f45f; these are distinct checkpoints. The preparation snapshot above remains historical; this kickoff records execution authority and planned extra surfaces before modifying them. [T-055](../tasks/phase-b2/T-055-adr-append-only-corrections.md), [approved plan](2026-10-12-phase-b2-track2-preflight-and-plan.md), [ADR-0025](../../decisions/0025-adr-governance-amendments.md) and [ADR-0043](../../decisions/0043-documentation-corpus-consistency.md) supply the settled contract. No new decision or ADR is needed. + +The five original ADR corrections, CPU rustdoc, exact source-metadata index reconstruction, procedure alignment and explicit anomaly report are the named scope. Four further files have demonstrated existing-scope reasons under the approved step allowance: + +| File | Evidence and bounded correction | +|------|---------------------------------| +| [ADR-0010](../../decisions/0010-timer-trait.md) | Existing reaches-or-exceeds contract and merged T-012 ceiling fix conflict with old nearest-multiple prose; append dated source-backed clarification, preserving original body/status/date. | +| [Timer rustdoc](../../../hal/src/timer.rs) | Same stale nearest-deadline wording; comment-only correction distinguishes approximate reported resolution from ceiling conversion and saturation. No function/signature/behavior change. | +| [supersede-adr skill](../../../.agents/skills/supersede-adr/SKILL.md) | Rendered dummy destinations are broken, and edit-in-place minor-amendment instructions conflict with Accepted ADR-0025 Rule 2; quote templates as data and apply the existing append-only discipline. No new supersession rule. | +| [architectural principles](../../standards/architectural-principles.md) | Four preserved ADR-0015 citations use the retired P7 fragment; add one invisible compatibility anchor at the exact current P7 heading, without changing rule text or ADR-0015 bytes. | + +Apply the approved corrections and index/report together, then run append-only/source-token/metadata/navigation checks plus required fmt/host-clippy/host-test. Commit implementation before fresh R1 code/security contexts. Verify/fix/commit every confirmed finding, then use different fresh R2 contexts for the corrected cumulative range; bounded fix verification closes R2. Publish all actual reports/indexes and stop task state at In Review, then automatically start Step 8. No task delivery or test execution claimed at kickoff. + +## Round 1 additional-file reason — recorded before correction + +After the independent assessments of frozen implementation f256a610, the coordinator confirmed Low C-ROOT-01 in [propose-standard-change](../../../.agents/skills/propose-standard-change/SKILL.md): its amendment path still instructs rewriting an Accepted ADR in place, contradicting [ADR-0025 Rule 2](../../decisions/0025-adr-governance-amendments.md#rule-2--riders-are-not-failures-their-frequency-is-a-signal). This fifth additional file has the same demonstrated existing-scope procedure drift as the already-recorded supersede-adr correction. Record this reason before editing the skill; align it with dated append-only factual riders, editable Proposed drafts and the existing new-decision/supersession approval gates. No new rule, ADR or decision is proposed. Both reviewers assess this coordinator-origin finding after their independent checkpoints; fresh R2 reviews the cumulative correction. The independently found timer helper citation is a completion of the already-recorded timer rustdoc surface, not another additional file. diff --git a/docs/analysis/reports/2026-10-13-t055-adr-correction-reconciliation.md b/docs/analysis/reports/2026-10-13-t055-adr-correction-reconciliation.md new file mode 100644 index 00000000..770639ea --- /dev/null +++ b/docs/analysis/reports/2026-10-13-t055-adr-correction-reconciliation.md @@ -0,0 +1,135 @@ +# T-055 — ADR corrections, index anomalies and dispositions + +- **Date:** 2026-10-13. +- **Base:** development e8104e3 (Step 7 kickoff), following T-050 canonical publication 69afa33. Exact baseline SHA is retained in the evidence JSON; implementation is the subsequent working tree, not a claim of clean committed execution. +- **Task / authority:** [T-055](../tasks/phase-b2/T-055-adr-append-only-corrections.md), [approved plan](2026-10-12-phase-b2-track2-preflight-and-plan.md), [ADR-0025](../../decisions/0025-adr-governance-amendments.md), [ADR-0043](../../decisions/0043-documentation-corpus-consistency.md). +- **Preflight / evidence:** [existing-document review and extra-scope reasons recorded before edits](2026-10-13-t055-adr-correction-preflight.md), [raw checks and metadata](2026-10-13-t055-verification-evidence/README.md). +- **State:** T-055 In Review after both fresh code/security rounds and bounded correction verification; canonical boundary below supersedes earlier pending checkpoints. No ADR decision/status/date change, runtime behavior, Done or human approval. + +## Append-only correction ledger + +| Surface | Correction and preservation | +|---------|-----------------------------| +| [ADR-0008](../../decisions/0008-cpu-trait.md#revision-notes), [IrqGuard rustdoc](../../../hal/src/cpu.rs) | Dated retraction of unverified generalized vtable/.rodata aliasing explanation; historical boot failure and concrete-dispatch rationale retained. Comment only; no claim that dynamic dispatch is unsound. | +| [ADR-0033](../../decisions/0033-kernel-high-half-migration.md) | Dated top pointer to existing May-30 canonical single-offset/KBASE correction. Body/status/date intact. | +| [ADR-0011](../../decisions/0011-irq-controller-trait.md) | Dated GICv2 banner points to ADR-0036; trait and old body intact. | +| [ADR-0012](../../decisions/0012-boot-flow-qemu-virt.md#open-questions) | Exact original EL-drop sentence wrapped in strikethrough; resolved April-27 by ADR-0024, pointer actually applied October-13. No fabricated historical edit date. | +| [ADR-0018](../../decisions/0018-badge-scheme-and-reply-recv-deferral.md#pros-and-cons-of-the-options) | Appended dated pros/cons for all six options before References, same template placement as other ADRs. A/D deferrals unchanged; original emulation/compatibility text preserved and present applicability qualified against current IPC. | +| [ADR-0010](../../decisions/0010-timer-trait.md#revision-notes), [Timer rustdoc](../../../hal/src/timer.rs) | Previously recorded extra scope: factual rider/comment distinguish approximate resolution from existing ceiling deadline conversion and saturation. No function or policy change. | +| [supersede-adr](../../../.agents/skills/supersede-adr/SKILL.md), [P7 compatibility anchor](../../standards/architectural-principles.md#p7--no-proprietary-blobs) | Previously recorded extra scope: template links now quoted Markdown data, existing append-only discipline restored, invisible legacy P7 ID repairs four original ADR-0015 links while preserving ADR-0015 and current P7 rule bytes. | +| [ADR index](../../decisions/README.md), [sync procedure](../../../.agents/skills/sync-adr-index/SKILL.md) | Exact source titles/status/full Date, reporting aliases and historical forms separately; whole/partial supersession distinguished from ordinary riders. README Format changes separately authorized by T-055, beyond an ordinary table-only sync. | + +## Source provenance and limits + +Full historical commit 4fe547cf47beb54a51ad09f8a5705d2f30841a29 and its CPU/BSP changes were read. Its commit message reports QEMU failure and a generic-dispatch fix; it also changes FP/SIMD setup and naked context-switch assembly. No retained isolated reproduction, disassembly, Miri diagnostic or compiler issue proves the generalized cause. Retracting that explanation does not retract the recorded observation or settle all possible compiler/runtime questions. The unchanged CPU/guard API remains source-defined. + +Timer provenance: full d820a88d902e77ccf33b30ebe9c7be03a9c25cea changes floor to ceiling to honor the existing reaches-or-exceeds contract; full 5c9cf069c2f5fa3be77c048d865ae89c4055ba11 includes the 3 Hz / 333333334 ns → 2 ticks regression. T-012 history records both, and d820a88 is an ancestor of merged main c16997e. Current helpers separately compute nearest-integer period (minimum 1 ns) and saturating ceiling tick count. This is evidence for existing behavior, not a new rounding decision, exact IRQ-latency proof or unlimited representability guarantee. + +The original six ADR-0018 options and accepted A/D outcomes are preserved. Its old unqualified sender-handle emulation and source-compatibility claims are not repeated as current guarantees: received IPC contains no authenticated sender-capability identity, and adding fields/parameters needs a compatibility assessment. No successor decision or implemented badge/reply_recv feature is claimed. + +## Baseline index/header differences + +42 files and 42 uniquely indexed rows, numeric order, no membership/filename/status mismatch. **14 title mismatches: eight descriptive aliases and six inline-code-markup omissions. One Date mismatch: ADR-0023's full authoritative prose was truncated.** Every row below is reconciled to the exact source header, without editing that header. + +| ADR / field | Old index value | Authoritative header / delivered value | Disposition | +|-------------|-----------------|----------------------------------------|-------------| +| 0004 / title | Target hardware platforms and tiers | Target hardware platforms and support tiers | Exact header copied; historical source unchanged. | +| 0007 / title | Console HAL trait signature | `Console` HAL trait signature | Exact header copied; historical source unchanged. | +| 0008 / title | Cpu HAL trait signature (v1, single-core scope) | `Cpu` HAL trait signature (v1, single-core scope) | Exact header copied; historical source unchanged. | +| 0009 / title | Mmu HAL trait signature (v1) | `Mmu` HAL trait signature (v1) | Exact header copied; historical source unchanged. | +| 0010 / title | Timer HAL trait signature (v1) | `Timer` HAL trait signature (v1) | Exact header copied; historical source unchanged. | +| 0011 / title | IrqController HAL trait signature (v1) | `IrqController` HAL trait signature (v1) | Exact header copied; historical source unchanged. | +| 0012 / title | Boot flow and memory layout for bsp-qemu-virt | Boot flow and memory layout for `bsp-qemu-virt` | Exact header copied; historical source unchanged. | +| 0020 / title | `ContextSwitch` trait and `Cpu` v2 | `Cpu` trait v2: context-switch extension | Exact header copied; historical source unchanged. | +| 0023 / date | 2026-04-27 | 2026-04-27 (deferred at B0 closure); placeholder body landed 2026-05-07 (B1 closure trio) | Exact header copied; historical source unchanged. | +| 0026 / title | Idle dispatch via separate fallback slot | Idle dispatch via separate fallback slot (supersedes ADR-0022 Option A) | Exact header copied; historical source unchanged. | +| 0029 / title | Initial userspace image format (B4 — raw flat binary) | Initial userspace image format | Exact header copied; historical source unchanged. | +| 0030 / title | Syscall ABI and userspace error taxonomy (B5) | Syscall ABI and userspace error taxonomy | Exact header copied; historical source unchanged. | +| 0031 / title | Initial syscall set (B5 — `send`/`recv`/`console_write`/`task_yield`/`task_exit`) | Initial syscall set (B-phase) | Exact header copied; historical source unchanged. | +| 0033 / title | Kernel high-half migration (B6 — kernel → `TTBR1_EL1`, boot-time) | Kernel high-half migration | Exact header copied; historical source unchanged. | +| 0037 / title | EL0 entry context (B6 — userspace register file + enter-EL0/`ERET` path + per-task `SP_EL1`) | EL0 entry context (userspace register file + enter-EL0/`ERET` path) | Exact header copied; historical source unchanged. | + +## Title/filename-slug differences — separate retained observations + +35 literal normalized full-title/filename-slug differences remain after index synchronization. For this diagnostic, lowercase ASCII alphanumerics are retained and other runs joined with hyphens. This is a transparent literal comparison, not semantic proof that a short descriptive slug is defective. These include 0040–0043; no filed file is renamed, no title rewritten and no anomaly concealed behind a “clean index” claim. All 35 have the same disposition: preserve immutable filed identity, report the difference. + +| ADR file | Normalized full title | +|----------|-----------------------| +| [0001-microkernel-architecture.md](../../decisions/0001-microkernel-architecture.md) | `capability-based-microkernel-architecture` | +| [0002-implementation-language-rust.md](../../decisions/0002-implementation-language-rust.md) | `rust-as-the-implementation-language` | +| [0003-license-apache-2.md](../../decisions/0003-license-apache-2.md) | `apache-2-0-license` | +| [0004-target-platforms.md](../../decisions/0004-target-platforms.md) | `target-hardware-platforms-and-support-tiers` | +| [0005-documentation-language-english.md](../../decisions/0005-documentation-language-english.md) | `english-as-the-documentation-and-code-language` | +| [0006-workspace-layout.md](../../decisions/0006-workspace-layout.md) | `workspace-layout-and-initial-crate-boundaries` | +| [0007-console-trait.md](../../decisions/0007-console-trait.md) | `console-hal-trait-signature` | +| [0008-cpu-trait.md](../../decisions/0008-cpu-trait.md) | `cpu-hal-trait-signature-v1-single-core-scope` | +| [0009-mmu-trait.md](../../decisions/0009-mmu-trait.md) | `mmu-hal-trait-signature-v1` | +| [0010-timer-trait.md](../../decisions/0010-timer-trait.md) | `timer-hal-trait-signature-v1` | +| [0011-irq-controller-trait.md](../../decisions/0011-irq-controller-trait.md) | `irqcontroller-hal-trait-signature-v1` | +| [0012-boot-flow-qemu-virt.md](../../decisions/0012-boot-flow-qemu-virt.md) | `boot-flow-and-memory-layout-for-bsp-qemu-virt` | +| [0013-roadmap-and-planning.md](../../decisions/0013-roadmap-and-planning.md) | `roadmap-and-planning-process` | +| [0015-ai-integration-stance.md](../../decisions/0015-ai-integration-stance.md) | `ai-integration-stance-userspace-only-kernel-neutral` | +| [0018-badge-scheme-and-reply-recv-deferral.md](../../decisions/0018-badge-scheme-and-reply-recv-deferral.md) | `badge-scheme-and-reply-recv-fastpath-formal-deferral` | +| [0020-cpu-trait-v2-context-switch.md](../../decisions/0020-cpu-trait-v2-context-switch.md) | `cpu-trait-v2-context-switch-extension` | +| [0021-raw-pointer-scheduler-ipc-bridge.md](../../decisions/0021-raw-pointer-scheduler-ipc-bridge.md) | `raw-pointer-scheduler-ipc-bridge-api` | +| [0022-idle-task-and-typed-scheduler-deadlock.md](../../decisions/0022-idle-task-and-typed-scheduler-deadlock.md) | `idle-task-and-typed-scheduler-deadlock-error` | +| [0024-el-drop-policy.md](../../decisions/0024-el-drop-policy.md) | `el-drop-to-el1-policy` | +| [0025-adr-governance-amendments.md](../../decisions/0025-adr-governance-amendments.md) | `adr-governance-amendments-forward-reference-contract-rider-hygiene` | +| [0026-idle-dispatch-fallback.md](../../decisions/0026-idle-dispatch-fallback.md) | `idle-dispatch-via-separate-fallback-slot-supersedes-adr-0022-option-a` | +| [0027-kernel-virtual-memory-layout.md](../../decisions/0027-kernel-virtual-memory-layout.md) | `kernel-virtual-memory-layout-b2-identity-mapped-mmu-activation` | +| [0028-address-space-data-structure.md](../../decisions/0028-address-space-data-structure.md) | `address-space-data-structure-b3-kernel-object-capability-gated-mmu-map-wrappers-activation-on-context-switch` | +| [0030-syscall-abi.md](../../decisions/0030-syscall-abi.md) | `syscall-abi-and-userspace-error-taxonomy` | +| [0031-initial-syscall-set.md](../../decisions/0031-initial-syscall-set.md) | `initial-syscall-set-b-phase` | +| [0032-endpoint-rollback-and-cancel-recv.md](../../decisions/0032-endpoint-rollback-and-cancel-recv.md) | `endpoint-state-rollback-on-ipc-recv-and-yield-deadlock-ipc-cancel-recv-primitive` | +| [0035-physical-memory-manager.md](../../decisions/0035-physical-memory-manager.md) | `physical-memory-manager-b3-prerequisite-bitmap-allocator` | +| [0036-qemu-virt-gicv2-no-iommu-v1.md](../../decisions/0036-qemu-virt-gicv2-no-iommu-v1.md) | `qemu-virt-is-gicv2-no-iommu-in-v1-corrects-gicv3-smmuv3-in-adr-0004-0006-0012` | +| [0037-el0-entry-context.md](../../decisions/0037-el0-entry-context.md) | `el0-entry-context-userspace-register-file-enter-el0-eret-path` | +| [0038-mmu-translate-and-user-access.md](../../decisions/0038-mmu-translate-and-user-access.md) | `mmu-translate-read-only-walk-per-task-user-access-translation-b6-gate-1` | +| [0039-userland-build-pipeline.md](../../decisions/0039-userland-build-pipeline.md) | `userland-build-pipeline-b6-userland-hello-tyrne-user-raw-flat-embed-orchestration` | +| [0040-phase-b2-consolidation-bridge.md](../../decisions/0040-phase-b2-consolidation-bridge.md) | `phase-b-2-consolidation-bridge-governance-gating-and-exit-criteria` | +| [0041-test-name-prefix-policy-recovery.md](../../decisions/0041-test-name-prefix-policy-recovery.md) | `test-name-prefix-policy-historical-recovery` | +| [0042-descriptive-test-names.md](../../decisions/0042-descriptive-test-names.md) | `descriptive-test-names-without-a-mandatory-prefix` | +| [0043-documentation-corpus-consistency.md](../../decisions/0043-documentation-corpus-consistency.md) | `documentation-corpus-consistency-and-planned-adr-identities` | + +## Existing metadata and supersession forms + +| Observation | Evidence and disposition | +|-------------|--------------------------| +| ADR-0023 Deferred / full prose Date | Existing deferred placeholder and B0/B1 history; preserve exact status and entire Date. Not Accepted, not a newly invented filing date or blanket malformed-date exemption. | +| ADR-0022 → 0026, partial | Older header/callout and newer Context agree: only idle-task-location superseded; typed-error axis stands. Preserve full qualification rather than collapsing it to whole-decision supersession. Target 0026 remains Accepted. | +| ADR-0041 → 0042, whole | Header/callout and new Context/References reciprocate; target 0042 Accepted, historical prefix record remains Superseded. No transition performed here. | +| Ordinary correction/implementation riders | A link to a later ADR alone does not imply supersession or require status changes. Compare explicit decision/scope before classifying it. | +| Missing slot 0034 | ADR-0027 and the index explicitly reserve kernel-section permissions. Preserve gap and all later numbers; no placeholder file fabricated. | +| Other metadata/membership defects | Initial extraction found none beyond those itemized. Unknown/missing/malformed forms must still be reported; the documented existing forms do not authorize new ones. | + +The machine-readable baseline contains every row and before/after field difference. A post-edit header comparison, scoped preservation/navigation diagnostics and actual command outcomes are recorded below after execution; neither extraction nor a link scan proves architectural correctness. + +## Executed implementation verification — 2026-10-13 + +Required cargo fmt --all -- --check, cargo host-clippy and cargo host-test all exit 0 on the recorded implementation working tree. Host tests: 46 HAL + 259 kernel + 58 test-HAL unit tests and 3 doctests = 366 passed; two HAL example doctests intentionally ignored, zero failed. No test/signature/runtime-token change; this is current execution evidence, not inferred from an older report. Exact two edited Rust-file hashes match captures. All six raw stream byte counts/SHA-256 values verify; root read the full 398-line test stdout and both nonempty stderr streams, with three empty streams retained. + +[Static preservation snapshot](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t055-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t055-verification-evidence/static-verification.json") verifies six corrected ADRs are insertion-only except the exact approved ADR-0012 sentence wrapper; all Status/Date/Deciders fields unchanged. Non-rustdoc source lines match base; ADR-0015 bytes unchanged and P7 delta is only the invisible compatibility ID. Exact 42-row header/index comparison has zero remaining mismatches, while all 35 title/slug differences and historical forms remain reported. Both whole and partial supersession pointers resolve consistently. No other executable/config/build/dependency/CI surface changed. + +[Bounded navigation snapshot](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t055-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t055-verification-evidence/navigation.json") checks 364 tracked/visible-untracked Markdown files, 6047 rendered local targets and 611 fragments with zero candidates before these final bookkeeping links. This is an existing third-party Markdown diagnostic of actual rendered forms, not complete grammar coverage or the future Python-stdlib T-056 gate. The six preflight defects are repaired without an archive exception. New tagged Markdown template fences render the two dummy paths as code, and the compatibility anchor resolves all four preserved ADR-0015 targets. + +Raw host-test stdout ends with its original blank line; preserve it byte-for-byte. Default step whitespace inspection reports that raw blank EOF; the separate non-log diff check passes. Neither this exception nor the earlier T-049 raw evidence is normalized or hidden as a clean unqualified whole-branch check. At the implementation checkpoint both fresh code/security rounds were pending; task criteria stay unchecked until canonical closure. Existing HIGH T-038 remains unresolved. + +## Round 1 confirmed corrections — 2026-10-13 + +Independent code and security contexts assessed e8104e3..f256a610 before exchanging actual reports. Both approved with one Low finding: R1-C01/S01 is the same stale timer-helper citation, counted once. Remove the nonexistent current-trait quote, explain nearest-integer resolution as an approximation that can round either way, and separate its representational floor from deadline conversion. Functions, signatures and tests remain unchanged. This also removes the helper's incorrect claim that nearest reporting never understates the hardware period; its existing 19.2 MHz example demonstrates the approximation. + +Low C-ROOT-01 was found separately by the coordinator and corroborated by the reviewers only after their independent checkpoints. Its [additional-file reason](2026-10-13-t055-adr-correction-preflight.md#round-1-additional-file-reason--recorded-before-correction) was recorded before editing propose-standard-change. Align the stale in-place amendment instruction with existing ADR-0025: preserve Accepted bodies, use dated evidence-backed factual riders, keep Proposed drafts editable, and retain explicit maintainer approval/Accepted authority before a substantive new or changed standard decision. This is the fifth demonstrated additional file, not a new rule or independent reviewer discovery. + +The earlier executed raw evidence and source hashes remain immutable and describe the implementation captured before f256a610. The timer rustdoc correction changes its current file hash without changing executable source; verify the original capture against that implementation commit, and separately verify the corrected cumulative source against the kickoff. R1 bounded fix verification and fresh R2 are still required. The stale top-level pending-verification summary has also been corrected; this bookkeeping note is not a third repository finding. + +[Correction verification](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t055-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t055-verification-evidence/r1-correction-verification.json") records actual post-fix fmt and host-clippy exits 0, cumulative append-only/non-rustdoc preservation, exact index/forms, six immutable original stream hashes and original source hashes bound to f256a610. The updated timer source hash is separate. No additional test run was needed for prose-only corrections; the primary reviewer independently reran all three checks on frozen f256a610 (366 passed/two ignored). The post-fix bounded scan found 364 Markdown files/6057 local targets/615 fragments, zero candidates before this final link. Default step diff inspection exits 2 solely for the retained raw test blank EOF; non-log inspection exits 0. Bounded reviewer verification follows the correction commit. + +## Canonical boundary — 2026-10-13 + +[Code](../reviews/code-reviews/2026-10-13-t055-adr-corrections.md) and [security](../reviews/security-reviews/2026-10-13-t055-adr-corrections.md) preserve all four complete actual reports, initial findings/verdicts and subsequent verification/reconciliation. Both rounds Approve 23391c7; two unique R1 Low findings fixed, zero new R2 or unresolved findings. R1-C01/S01 is independently corroborated; C-ROOT-01 keeps coordinator origin. Task criteria are checked and status In Review without date_done. + +The actual cumulative reviewed inventory is 28 files; the R2 assignment's 27 was corrected before assessment. The separate correction snapshot counted 27 before its own JSON was written, so it is not a final committed inventory. Original implementation snapshots/raw streams remain unchanged; later canonical publication has separate scoped diagnostics. No hosted CI, T-056 grammar certification, new runtime execution, human review or T-038 closure. Step 8/T-052/T-053 is next. + +[Canonical publication verification](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t055-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t055-verification-evidence/publication-verification.json") independently checks exact once-only retention of the four final actual reports, membership in rendered family-index tables, seven AC/five DoD boxes, In Review/no date_done, original raw/source bindings and cumulative scope/preservation. The final cumulative publication has 36 paths and 366 Markdown files/6087 local targets/615 fragments with zero candidates in the bounded diagnostic. This is coordinator bookkeeping, not another independent review or the shipped T-056 gate. + +> **Evidence migration (2026-10-16).** Raw evidence links now open the [immutable archive catalog](2026-10-16-pr49-evidence-catalog.md). Each link title retains its exact archived member path. Original verdicts, measurements, limitations and execution SHA identities remain historical; the archive bundle restores their original source. diff --git a/docs/analysis/reports/2026-10-13-t055-verification-evidence/README.md b/docs/analysis/reports/2026-10-13-t055-verification-evidence/README.md new file mode 100644 index 00000000..a38f45cb --- /dev/null +++ b/docs/analysis/reports/2026-10-13-t055-verification-evidence/README.md @@ -0,0 +1,25 @@ +# T-055 verification evidence — 2026-10-13 + +These checks execute the implementation working tree based on e8104e3, before its commit. Metadata records the exact base HEAD, dirty state, two rustdoc-file hashes, command argv/cwd/UTC intervals/exits, installed Rust/Cargo identities and raw stream SHA-256/bytes. No QEMU/Miri/coverage run is newly claimed. Runtime tokens are separately compared unchanged; these required host checks verify comment/lint/documentation compatibility, not a new runtime feature. + +- [metadata.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t055-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t055-verification-evidence/metadata.json") +- [index-baseline.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t055-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t055-verification-evidence/index-baseline.json"): exact source headers and initial index differences for all 42 records. +- [fmt.stdout.log](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t055-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t055-verification-evidence/fmt.stdout.log") +- [fmt.stderr.log](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t055-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t055-verification-evidence/fmt.stderr.log") +- [host-clippy.stdout.log](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t055-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t055-verification-evidence/host-clippy.stdout.log") +- [host-clippy.stderr.log](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t055-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t055-verification-evidence/host-clippy.stderr.log") +- [host-test.stdout.log](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t055-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t055-verification-evidence/host-test.stdout.log") +- [host-test.stderr.log](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t055-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t055-verification-evidence/host-test.stderr.log") + +Raw streams are retained without normalization, including intentionally empty captures. See the [reconciliation report](../2026-10-13-t055-adr-correction-reconciliation.md) and [preflight scope](../2026-10-13-t055-adr-correction-preflight.md). The original snapshot precedes both fresh implementation-review rounds; later checkpoints are recorded separately below. + +- [static-verification.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t055-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t055-verification-evidence/static-verification.json"): preservation/index/raw-hash checks at the implementation snapshot. +- [navigation.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t055-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t055-verification-evidence/navigation.json"): bounded existing-parser diagnostic, distinct from the future stdlib T-056 implementation. + +- [r1-correction-verification.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t055-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t055-verification-evidence/r1-correction-verification.json"): post-fix checks, original-capture binding and separate corrected source hashes; immutable initial evidence is preserved. + +**Later canonical boundary:** both fresh rounds complete, T-055 In Review. [Code](../../reviews/code-reviews/2026-10-13-t055-adr-corrections.md) and [security](../../reviews/security-reviews/2026-10-13-t055-adr-corrections.md) preserve all actual reports. Original captures/snapshots remain immutable and separate from later publication checks; no additional runtime execution is implied. + +- [publication-verification.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t055-verification-evidence "Archived member: docs/analysis/reports/2026-10-13-t055-verification-evidence/publication-verification.json"): separate canonical retention/scope/lifecycle/preservation and bounded navigation checks; original snapshots are unchanged. + +> **Evidence migration (2026-10-16).** Raw evidence links now open the [immutable archive catalog](../2026-10-16-pr49-evidence-catalog.md). Each link title retains its exact archived member path. Original verdicts, measurements, limitations and execution SHA identities remain historical; the archive bundle restores their original source. diff --git a/docs/analysis/reports/2026-10-13-t056-parser-evidence/README.md b/docs/analysis/reports/2026-10-13-t056-parser-evidence/README.md new file mode 100644 index 00000000..70efc53a --- /dev/null +++ b/docs/analysis/reports/2026-10-13-t056-parser-evidence/README.md @@ -0,0 +1,51 @@ +# T-056 parser evidence + +[source-baseline.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/source-baseline.json") records clean fd9009b before Step 11, public Markdown hashes, actual prerequisite/task metadata and seventeen historical completion-date gaps including the legacy date-extended Done status. This is inventory, not checker/fixture/hosted delivery. Existing .gitignore local-only analysis prefixes identify non-repository notes; their contents were not read or imported. All public review/archive Markdown remains in scope. Later actual captures are added separately; this baseline stays unchanged. + +[kickoff-navigation.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/kickoff-navigation.json") is the actual preparatory worktree navigation before the kickoff commit, using the existing third-party diagnostic with explicit scope/grammar limits. It is not T-056 implementation. + +[t049-quoted-evidence-repair.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/t049-quoted-evidence-repair.json") binds the T-049-owned literal-quotation clarification. Original quoted content and every other old byte are exactly preserved after reversing the explicit delimiter additions and removing the new dated annotation. Fresh Step 11 reviews remain pending. + +[implementation-verification.json](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/implementation-verification.json") binds actual local syntax/fixture/default-root/corpus execution and source/tool identities. [Raw fixtures](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/implementation-fixtures.log") and [checker JSON](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/implementation-checker.json") are separate original outputs. This is Step 11 navigation evidence, not remaining-check/CI/hosted/task delivery; original source inventory remains unchanged. + +[R1 source validation](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r1-source-validation.json") retains coordinator reproductions and tests-first identity separately from independent agent verdicts. [Correction verification](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r1-correction-verification.json"), [raw fixture result](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r1-correction-fixtures.txt"), [corpus capture](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r1-correction-checker.json") and [outside-cwd capture](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r1-correction-from-tmp.json") bind the corrected source. The [correction account](../2026-10-13-t056-parser-r1-corrections.md) explains the raw before-captures and fixture QA. These are author checks before actual R1 peer/fix verification and fresh R2; original baseline, T-049 proof and implementation captures stay unchanged. + +[ROOT-ATTR01 validation](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r1-attribute-source-validation.json") and [additional verification](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r1-attribute-verification.json") retain the later coordinator entity-context finding, tests-first failures and actual 58-fixture correction source. [Raw fixtures](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r1-attribute-fixtures.txt"), [corpus](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r1-attribute-checker.json") and [outside-cwd capture](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r1-attribute-from-tmp.json") are distinct from the unchanged earlier captures. Renewed actual R1 verification and fresh R2 remain pending at this author boundary. + +[S06 numeric validation](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r1-numeric-source-validation.json") and [numeric verification](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r1-numeric-verification.json") record the subsequent independent security finding and coordinator tests-first correction. [Before failures](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r1-before-numeric-fixtures.txt"), [62-method result](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r1-numeric-fixtures.txt"), [corpus](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r1-numeric-checker.json") and [outside-cwd capture](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r1-numeric-from-tmp.json") are new captures; every older capture retains its original bytes and source identity. No actual noncharacter filename creation is claimed on macOS; actual/decoy anchor controls avoid that restriction. Renewed R1 and fresh R2 remain pending at this author boundary. + +[Numeric compatibility verification](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r1-numeric-compat-verification.json") is the later final author boundary: actual Python 3.9 and 3.13 full-suite results after preventing HTMLParser's implicit attribute conversion. The earlier numeric capture remains an intermediate 3.9-only result with its own hashes. [Compatibility before failure](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r1-before-numeric-compat-fixture.txt") is separate; R1/R2, other families and hosted execution remain pending. + +[R2 URL/line source validation](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-url-lines-source-validation.json") retains two tests-only revisions and actual failures on the frozen 6f9 parser. [Verification](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-url-lines-verification.json") binds the subsequent 70-method dual-interpreter result and corpus/cwd captures. The [R2 correction account](../2026-10-13-t056-parser-r2-corrections.md) separates author results from still-pending HTML/table repairs, actual same-reviewer fix verification and canonical Step 11 completion. Every earlier capture remains unchanged. + +[R2 HTML validation](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-html-source-validation.json") separates validated tests-first failures from withdrawn exploratory expectations and exact-oracle QA. [HTML verification](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-html-verification.json") records the later 74-method dual-interpreter/corpus boundary; table isolation, actual frozen-fix review and delivery gates remain pending. + +[R2 table validation](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-table-source-validation.json") retains original coordinator proofs, tests-first committed-parser failures and later hash-bound boundary corrections. [Peer controls](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-table-peer-controls.json") use exact full diagnostics. [Table verification](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-table-verification.json") binds the later 87-method dual-interpreter/corpus result; actual complete frozen-fix R2 verification, canonical Step 11 filing and delivery gates remain pending. + +[R2 boundary validation](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-boundaries-source-validation.json") retains committed-eb5 eleven-method failures and the subsequent hash-bound block-container correction. [CRLF probes](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-boundaries-crlf-probes.json") and [comment probes](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-boundaries-comment-probes.json") retain actual coordinator observations before repairs. [Boundary verification](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-boundaries-verification.json") records the later 99-method dual-interpreter/corpus boundary and all 75 older captures unchanged. Prior reviewer approval/HOLD history is preserved; renewed actual same-reviewer verification and canonical Step 11 closure remain pending. + +[R2 escape/layout validation](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-escape-blank-source-validation.json") preserves isolated tests-first snapshots/fail-fast limits, reference-oracle QA and the later lazy-quote regression. [Initial coordinator cases](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-escape-blank-initial-probes.json"), [original disclosed code](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-escape-disclosed-code-cases.json") and [security cases](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-escape-disclosed-security-cases.json") retain exact attributed old outcomes. [Pre-lazy](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-escape-replays.json") and [final replays](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-escape-final-replays.json") are separate source-bound author observations; [final verification](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-escape-final-verification.json") binds final 117-method dual-interpreter/corpus checks and all 88 older captures unchanged. Actual renewed R2 verdicts/canonical Step11 and later delivery gates remain pending. + +The [earlier116-method candidate](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-escape-blank-verification.json") and [pre-ASCII replay](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-escape-replays-pre-ascii.json") remain intermediate records. Later ASCII-digit syntax and its before-captures are included in the same source-validation account; no earlier capture is relabeled as final117-source evidence. + +[R2 paragraph validation](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-paragraph-source-validation.json") binds the sixth correction's actual checkpoint chronology, twenty selected tests-first commands plus two later old-source masked-heading failures, and exact raw/snapshot identities. [Source blobs](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-paragraph-source-snapshots.json") preserve unique complete intermediate scripts as JSON, without adding live modules. [Current160](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-paragraph-current-replays.json"), [legacy144](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-paragraph-legacy-replays.json") and the [stronger legacy full-object comparison](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-paragraph-legacy-full-oracle.json") use final128 source; first127 records remain separate. [Final verification](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-paragraph-verification.json") binds full128 dual-interpreter/corpus/cwd checks and all118 earlier captures unchanged. Actual renewed R2/canonical Step11 and later delivery gates remain pending. + +[Reconstructed116 manifest](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-paragraph-reconstructed116-manifest.json"), [four exact-hash Markdown texts](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-paragraph-reconstructed116-documents.json") and [later replay](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-paragraph-reconstructed116-verification.json") close the four intermediate-document byte gaps with explicit derivation. Reconstruction happened after the original capture; the replay is not a bit-identical historical whole tree. Original raw evidence is unchanged, and three older missing intermediate source blobs remain a stated limitation. The [sixth correction account](../2026-10-13-t056-parser-r2-corrections.md#sixth-increment--paragraph-extents-and-eligible-setext-underlines) distinguishes author verification from actual independent reviewer verdicts and records the corrected peer full-read chronology. + +[R2 container/heading validation](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-container-source-validation.json") retains the seventh correction's actual completed/reconciled HOLD checkpoints, exact disclosed/root matrices, tests-first raw outputs and separate intermediate failures/controls. [Source snapshots](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-container-source-snapshots.json") bind all seven source stages without creating live modules. [Final532 replays](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-container-final-replays.json") use the final135 candidate; the [earlier496](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-container-stage3-replays.json") stays intermediate. [Final verification](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-container-verification.json") binds full135 dual-interpreter/corpus/cwd checks and all185 older captures unchanged. The [seventh account](../2026-10-13-t056-parser-r2-corrections.md#seventh-increment--structural-columns-and-visible-heading-text) records parent-level and delimiter-change QA, zero-width heading semantics and reviewer errata. Actual renewed R2/canonical Step11 and later delivery gates remain pending. + +[R2 heading source validation](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-heading-source-validation.json") binds the eighth correction's actual completed/reconciled HOLD reports, original attributed matrices, tests-first failures, oracle corrections and explicit reviewer-runtime replacement. [Snapshots](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-heading-source-snapshots.json") retain all18 bindings/nine complete script blobs, including the unexecuted candidate. [Final694](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-heading-final-replays.json") uses final140 source; earlier139/694 records remain separate. [Final author verification](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-heading-verification.json") records dual-interpreter/cwd/corpus checks and all234 earlier captures unchanged. The [eighth account](../2026-10-13-t056-parser-r2-corrections.md#eighth-increment--source-aware-heading-inline-semantics) distinguishes true defects, withdrawn leading-indent oracles and report metadata QA. Independent correction review and later delivery gates remain pending. + +[R2 original-token validation](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-tokens-source-validation.json") binds the ninth increment's actual replacement completed/reconciled HOLD reports, attributed mixed-emphasis/code-span/projection observations, tests-first failures and later autolink-label candidate regression. [Complete snapshots](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-tokens-source-snapshots.json") preserve each actual stage. [Final808](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-tokens-final-replays.json") uses final146 source; earlier145/808 remains separate. [Final author verification](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-tokens-verification.json") records dual-interpreter suites/corpus/cwd checks and all266 earlier raw captures unchanged. The [ninth account](../2026-10-13-t056-parser-r2-corrections.md#ninth-increment--original-inline-tokens-and-competing-emphasis) distinguishes supported blockers, explicitly added bounded autolinks and limited primary-oracle comparisons. Independent fix verification/canonical Step11 and later delivery gates remain pending. + +[R2 failed-search/ASCII validation](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-search-source-validation.json") binds the tenth increment's actual completed/reconciled8f HOLDs, raw-DEL and mixed-delimiter resource observations, corrected tests-first failures and explicit oracle/helper QA. [Snapshots](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-search-source-snapshots.json") retain every original/corrected source boundary. [Final842](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-search-final-replays.json") and [ten resource observations](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-search-resources.json") use corrected149 source. [Final author verification](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-search-verification.json") records full dual-interpreter/corpus/cwd checks and all303 older raw artifacts unchanged. The [tenth account](../2026-10-13-t056-parser-r2-corrections.md#tenth-increment--failed-search-bounds-and-complete-ascii-uri-controls) preserves peer discovery, root opposite-direction provenance and scope limits. Independent fix review/canonical Step11 and later delivery gates remain pending. + +## Step 11 completed review boundary — 2026-10-15 + +[Both-round code consolidation](../../reviews/code-reviews/2026-10-13-t056-parser.md) and [separate security consolidation](../../reviews/security-reviews/2026-10-13-t056-parser.md) approve frozen830de9d's selected parser scope. Full R1/SECURITY/replacement bodies are retained verbatim; the historical R2 CODE publication copy adds only the two recorded literal delimiters around an intended multiline quotation. Its full original bytes are separately retained, with exact reverse-preservation proof. Actual independent checkpoints preceded disclosure; final actual peer-reading extents/gaps, failures, withdrawals and retention limits remain explicit. No earlier pending/HOLD report is rewritten. + +[Publication manifest](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/publication-manifest.json") binds the six complete report bodies/offsets, reviewed source/scope/public-corpus identities, all342 preceding raw artifacts and copied current reviewer records. Their original TMP paths remain provenance; the manifest maps retained current records into this directory as inert text/JSON. Original source and all earlier captures stay unchanged. Fresh publication navigation is separate coordinator evidence in [publication verification](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/publication-verification.json"), with exact raw output and whitespace diagnostics; it is not another independent round or a new product-suite execution. + +The source-bound149-method dual-interpreter suites,842 full-object author/reviewer comparisons and four387/6764/786/zero corpus runs close the parser review. Finite resource/primary/differential controls retain their declared limits. T-056 remains In Progress/all16unchecked/no date_done; Step12 metadata/required-CI/hosted delivery and Step13 integrated closure proceed under the approved plan. The PR49 publication barrier and maintainer/whole-phase gates remain. + +> **Evidence migration (2026-10-16).** Raw evidence links now open the [immutable archive catalog](../2026-10-16-pr49-evidence-catalog.md). Each link title retains its exact archived member path. Original verdicts, measurements, limitations and execution SHA identities remain historical; the archive bundle restores their original source. diff --git a/docs/analysis/reports/2026-10-13-t056-parser-implementation.md b/docs/analysis/reports/2026-10-13-t056-parser-implementation.md new file mode 100644 index 00000000..3de0b679 --- /dev/null +++ b/docs/analysis/reports/2026-10-13-t056-parser-implementation.md @@ -0,0 +1,33 @@ +# T-056 Step 11 — offline navigation parser + +- **Date:** 2026-10-13. +- **Author:** Codex implementation coordinator, sole writer on development. +- **Clean step base:** fd9009bb510a8351cb3f8f404f2db9d76c978134; kickoff 9b62a06, T-049 owning quotation clarification 0c62391. +- **Authority:** [approved plan](2026-10-12-phase-b2-track2-preflight-and-plan.md), [parser preflight](2026-10-13-t056-parser-preflight.md), Accepted [ADR-0043](../../decisions/0043-documentation-corpus-consistency.md), [T-056](../tasks/phase-b2/T-056-docs-consistency-automation.md). +- **State:** In Progress/all sixteen criteria unchecked. Local parser implementation is ready for fresh paired R1/R2 after its verification/commit; no task delivery, hosted CI or reviewer/maintainer approval claimed. + +## Implemented contract + +[CLI](../../../tools/check-docs.py), [reusable parser/resolver](../../../tools/docs_consistency.py) and [isolated contract fixtures](../../../tools/test-check-docs.py) implement the local-link portion, with [usage/grammar limits](../../guides/ci.md#documentation-consistency). Python 3.9+ stdlib only, explicit UTF-8, script-relative default root, Git-free temporary-root override, sorted file:line diagnostics and nonzero invalid/inconsistent input; no network, setting/source/report write or dependency install. Output retention is explicit caller redirection. + +The lexer preserves source offsets and distinguishes actual code/comments from prose across fence types/lengths, quote/list containers and paragraph boundaries. Links/images include reference normalization/continuations, balanced/escaped/angle/empty paths and titles, and image destinations inside link labels. Undefined explicit references, duplicate definitions, interrupted definitions, unsupported nested links and excessive nesting fail visibly. Paths resolve with URL/HTML/Markdown decoding, exact case, repository-root semantics, root/private-alias protection and explicit symlink-input limits. Headings preserve code/label text and Unicode marks, allocate duplicate suffixes without custom-anchor consumption, and coexist with HTML id/name and bounded source-line references. + +All public archives/reviews/skills remain scanned. Only the three existing .gitignore local-only analysis prefixes are non-repository input; active navigation into them fails even through a symlink alias. Maximum document/label/nesting limits are explicit. This is a bounded source grammar, not full CommonMark rendering, external-link validation, Rust parsing or architectural/soundness proof. + +## Source-validated baseline and author regression work + +The first whole-corpus prototype scan yielded three candidates. One D1 candidate was a parser false positive caused by crossing a Markdown block with a code span: source stayed byte-identical and a regression fixes it. The two D2b reference examples were intended historical quotations; [T-049-owned exact preservation proof](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/t049-quoted-evidence-repair.json") verifies that explicit literal delimiters and a dated note preserve all old quoted and other source bytes. No archive exclusion or unreviewed broken-link exception was used. This owning follow-up is included in the forthcoming cumulative Step 11 reviews. + +Contract fixtures preceded implementation; the first test entry point stopped with absent parser module. Additional comment/definition precedence, images in link labels, definition paragraph boundary and empty-title cases were observed failing before correction during author development. These are author regression observations, not agent findings or an assertion of a committed before-version. Private exploratory corpus captures remain distinct from the retained final source-bound results. The prewrite seventeen-versus-sixteen status-normalization correction is recorded in the immutable source inventory; no old completion date is invented. + +## Verification and remaining gates + +[Verification identity/results](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/implementation-verification.json"), [raw fixture output](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/implementation-fixtures.log") and [whole-corpus JSON](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/implementation-checker.json") bind actual local commands to base-plus-worktree source hashes. Separate absolute-path execution from /tmp checks default-root/cwd behavior. Syntax compilation/AST checks use Python 3.9 in memory, not a formatter/linter. No repo bytecode, scratch branch, deliberate broken commit, package install or unrelated Rust/QEMU/Miri result is claimed. + +Both fresh paired rounds remain pending at this implementation boundary. All task/review/ADR/ledger/fence/audit/live checks, usage/standard integration and required existing-job wiring/exact-source hosted Linux verification belong to Step 12. Static commit-scope allowlisting remains skipped under ADR-0043. T-056 remains optional for the general phase exit but fully selected here; it cannot close by carry-forward or Acceptance alone. HIGH T-038, C/D gates, maintainer approval and PR49 publication barrier remain unchanged. + +## Subsequent R1 correction boundary + +The actual independent initial code/security reports requested source corrections after ca1f073. The [separate correction account](2026-10-13-t056-parser-r1-corrections.md) preserves both initial identities, validated findings, tests-first failures and fixture QA, including the advisory resource case. Original implementation evidence above stays unchanged. Actual R1 peer/fix verification and fresh R2 remain pending at that correction boundary; no task/CI/hosted delivery follows from author verification. + +> **Evidence migration (2026-10-16).** Raw evidence links now open the [immutable archive catalog](2026-10-16-pr49-evidence-catalog.md). Each link title retains its exact archived member path. Original verdicts, measurements, limitations and execution SHA identities remain historical; the archive bundle restores their original source. diff --git a/docs/analysis/reports/2026-10-13-t056-parser-preflight.md b/docs/analysis/reports/2026-10-13-t056-parser-preflight.md new file mode 100644 index 00000000..0afd8835 --- /dev/null +++ b/docs/analysis/reports/2026-10-13-t056-parser-preflight.md @@ -0,0 +1,29 @@ +# T-056 Step 11 — parser preflight and implementation brief + +- **Date:** 2026-10-13. +- **Author:** Codex implementation coordinator; sole writer on development. +- **Clean prerequisite boundary:** fd9009bb510a8351cb3f8f404f2db9d76c978134, T-047 canonical both-round commit. +- **Authority:** [approved plan](2026-10-12-phase-b2-track2-preflight-and-plan.md), Accepted [ADR-0043](../../decisions/0043-documentation-corpus-consistency.md), [T-056](../tasks/phase-b2/T-056-docs-consistency-automation.md). +- **State:** T-056 starts In Progress with all sixteen AC/DoD boxes unchecked. Step 11 delivers only links/parser/fixtures; indexes/ledger/fences/audit/live integration, required CI and exact-source hosted Linux evidence remain Step 12. Neither Acceptance nor parser success completes the task. + +## Reviewed sources and readiness + +The full governing agent/42-ADR/15-standard corpus, task contracts, approved plan, current/archive and previous canonical review records have been reviewed through the completed prerequisite sequence. The seven T-056 prerequisites are In Review after actual implementation/verification/two fresh rounds, permitted by ADR-0043's limited stacked-execution exception; their Informs backlinks include T-056. No new architecture decision or unresolved maintainer choice is identified for this bounded implementation. The [immutable source inventory](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/source-baseline.json") binds 382 public Markdown files, 74 tasks and seventeen historical Done records without date_done. The sixteen-count prewrite assertion caught a preparatory exact-status filter error: T-015 uses Done (2026-05-07), but has no date_done field. The assertion halted before source writes; normalization corrects the inventory without inventing an old date. + +## Public corpus and navigation boundary + +Check every public docs/**/*.md, five named root entries and .agents/skills/**/*.md, including all committed historical archives/reviews. Existing [.gitignore](../../../.gitignore) explicitly treats docs/analysis/technical-analysis/, private/ and temp/ as local-only external-code reading notes/drafts. Those exact non-repository prefixes are excluded from input enumeration, not historical broken-link exceptions; their contents are not read/imported. Active links into those local-only targets unavailable in a clean checkout must fail even if a local file exists. Document and fixture this existing ownership boundary; no archive-wide exemption or arbitrary ignore configuration is introduced. Enumeration and fixture-root execution must work without Git. Default root comes from the script, never cwd; sorted UTF-8 file:line diagnostics fail on invalid input/inconsistency without network or setting writes. + +## Bounded grammar and implementation order + +Implement reusable source-offset-aware Markdown parsing, then target/fragment resolution and CLI, with contract fixtures first. Distinguish real prose links from code fences, matched inline code and comments while preserving line numbers. Support inline/reference/collapsed/defined-shortcut links and images, escaped/balanced labels/destinations, angle paths, optional titles, UTF-8 URL decoding, same-file/root-relative targets, case-sensitive paths, directories, ATX/setext and duplicate/Unicode heading slugs, explicit HTML id/name and source-line fragments. Reference normalization preserves raw label syntax and folds case/whitespace. Duplicate definitions and undefined explicit references are diagnosed; undefined standalone bracket prose is not automatically a link. Relevant malformed/unsupported forms must fail visibly, not disappear to make the corpus green. + +Use Python 3.9+ standard library only; no package installation or invented formatter/linter. Separate source/CLI/test responsibilities so Step 12 can reuse parsed documents. No complete CommonMark/rendering/Rust-soundness claim. [CommonMark 0.31.2](https://spec.commonmark.org/0.31.2/) is the syntax reference; [GitHub section/relative/custom links](https://docs.github.com/en/get-started/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax) supply repository fragment/path behavior. A leading slash means repository root; custom anchors do not consume automatic heading suffixes. Supported limits and examples go in the existing [CI guide](../../guides/ci.md), explicitly before wiring at this boundary. + +Fixtures use temporary roots, exercise positive/negative grammar and false-positive controls plus CLI/root/cwd/UTF-8/determinism/no-write behavior. Compile with local Python 3.9 without repository bytecode output, run fixtures and the actual stabilized public corpus, then commit before fresh independent paired R1/R2. Real baseline defects return to named owners with bounded repair and review, never suppression. Original snapshots remain separate from later captures. Scope is tools/parser/CLI/fixture files, existing usage guide and necessary task/current/track/evidence/review files; no runtime/config/ADR/audit-log/CI setting changes in Step 11. PR49 remains open at the latest read-only check; keep implementation local until the approved publication barrier clears. + +## Source-validated baseline follow-up + +The first actual parser scan produced three candidates. D1 line 69 was a parser false positive: code spans crossed a new block; an isolated contract regression fixes it and the source stays untouched. D2b-007 contains two intended historical quoted reference examples, now explicitly literal under [T-049](../tasks/phase-b2/T-049-review-indices-sync.md). The [exact preservation proof](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/t049-quoted-evidence-repair.json") verifies no historical words, finding, severity or verdict changes. This bounded owning-task repair adds the D2b archive surface and T-049 history to Step 11 scope, with both fresh paired rounds still required; it is not an archive exclusion or unreviewed broken-link exception. + +> **Evidence migration (2026-10-16).** Raw evidence links now open the [immutable archive catalog](2026-10-16-pr49-evidence-catalog.md). Each link title retains its exact archived member path. Original verdicts, measurements, limitations and execution SHA identities remain historical; the archive bundle restores their original source. diff --git a/docs/analysis/reports/2026-10-13-t056-parser-r1-corrections.md b/docs/analysis/reports/2026-10-13-t056-parser-r1-corrections.md new file mode 100644 index 00000000..9e5d57ec --- /dev/null +++ b/docs/analysis/reports/2026-10-13-t056-parser-r1-corrections.md @@ -0,0 +1,71 @@ +# T-056 Step 11 — R1 source corrections + +- **Date:** 2026-10-13. +- **Author:** Codex implementation coordinator, sole repository writer on development. +- **Reviewed implementation:** ca1f0735bed114228a4b8a165162e27fbacd67b3; clean step base fd9009bb510a8351cb3f8f404f2db9d76c978134. +- **Authority:** [approved plan](2026-10-12-phase-b2-track2-preflight-and-plan.md), [Accepted ADR-0043](../../decisions/0043-documentation-corpus-consistency.md), [T-056](../tasks/phase-b2/T-056-docs-consistency-automation.md), [implementation account](2026-10-13-t056-parser-implementation.md). +- **Boundary:** author-validated R1 corrections, before actual peer cross-read/fix verification and the fresh R2 pair. No agent approval, canonical review completion, hosted result or task delivery is asserted. + +## Independent initial checkpoints + +Both actual initial reports completed before either reviewer received the other's outcomes. The coordinator fully read both, preserved byte-identical initial copies and independently reproduced every blocker. Code R1 is 363 lines / 40,116 bytes, SHA-256 `7218828f499353beae1b99c7b08c47c4fe8dd66c6189c8510e45e34a8718160e`; security R1 is 448 lines / 35,420 bytes, SHA-256 `df1f4a6cd75393767a09062b71ce0564d472a06d6ff2ba189d68c9d45a0c4a08`. Their immutable bodies remain under the respective `/tmp/tyrne-b22-step11-r1-{code,security}.initial.md` paths until the coordinator's later verbatim canonical filing. No future review template or approval was substituted for actual reports. + +Code reported C01–C07/C09 as blockers and C08 as advisory; security reported S01–S05 as blockers. C01/S01 identify the same input-root defect. All reported items, including C08, are addressed in this correction increment. The code report discloses that its complete prerequisite corpus was finished after the first source/test inspection, before the initial verdict; the coordinator retains that process limitation. Both reviewers actually completed all mandatory texts, recovered truncations and issued no verdict at their prerequisite-only checkpoints. Their first default-location synthetic temporary roots were removed; subsequent runs used explicit reviewer-owned `/tmp` locations. These facts are retained rather than rewritten as perfect chronology. + +## Source validation and corrections + +| Reported item | Source-validated behavior and retained regression | +|---|---| +| C01 / S01 | Enumeration starts and every source path component are checked for symlinks before walking/opening. Dangling/loop starts, the `.agents` ancestor, outside-root starts and aliases to each of the three local-only prefixes fail without invoking the canary reader. The shared reader verifies resolved containment/local-only ownership and regular-file type. | +| C02 | Actual HTML/comment extraction excludes Markdown destinations/titles. Titles cannot fabricate an anchor or path finding; HTML attributes containing comment markers do not erase unrelated prose. Root validation also found escaped HTML/comment openers leaking into the HTML stream; odd/even escape controls now preserve actual HTML while rejecting fabricated anchors. | +| C03 | Container prefixes are blanked with source offsets intact for reference continuation parsing; consumed continuation lines must remain in their original quote/list container. Positive wrapped destination/title and negative missing-target/container-exit cases retain their original diagnostic lines. | +| C04 / S02 | Ordered quote/list state persists through fences and continuations; closing indentation is measured relative to the list content. Mixed quote/list prefixes, relative closing indent 0–3 and links immediately after closure are tested. Excess marker padding retains indented code. | +| C05 | The image marker uses preceding-backslash parity. An escaped backslash before an image is accepted inside a link label; an escaped exclamation mark leaves a genuine nested link, still diagnosed. | +| C06 | A consumed explicit empty-angle reference destination is distinct from missing syntax and resolves to the same document. Empty-angle definitions with/without titles pass; actually missing destinations fail. | +| C07 | Document and source-line reads reject FIFOs/nonregular files before blocking I/O. Both synthetic FIFO cases return a nonzero structured finding within the subprocess safety deadline. No special file is committed or recursively hashed. | +| C09 | Generic `.git`, `.venv` and `__pycache__` basename pruning is removed from public prefixes. Broken public Markdown under each name is detected. The three existing exact local-only analysis prefixes remain the only ownership exclusions; no actual private contents were read/imported. | +| S03 | Link records retain Markdown versus HTML origin. HTMLParser attribute entities are not decoded twice or subjected to Markdown backslash rules. Both href/src, decoy versus actual entity spellings, literal backslashes and UTF-8 percent fragments are tested. | +| S04 | Heading extraction recognizes code/escapes/entities before stripping actual HTML/emphasis. HTML-looking code, literal/escaped underscores, strong emphasis and duplicate suffixes have positive and incorrect-fragment controls. | +| S05 / C08 | Title scanning uses indexed matching without full-tail copies; equal backtick runs/block boundaries are indexed per mask, and unmatched runs are consumed once. The suite covers a two-million-character valid title and 1,000 distinct unmatched runs followed by a real broken link. Standard subprocess deadlines guard termination; no host-specific timing assertion is used. | + +These are bounded parser/input repairs under the approved contract. No new architecture choice, dependency, runtime behavior, ADR, audit entry, CI identity or setting mutation is introduced. Real public documentation remains unchanged apart from the existing usage/tracking/evidence surfaces; no new baseline source defect or owning-task repair was needed. The T-049 literal clarification and all original captures remain unchanged. + +## Tests-first evidence and fixture quality + +The first added-regression run used the original ca1f073 parser/CLI with tests-only working-tree changes: 53 tests, 20 failures and two errors in 22.396 seconds, exit 1. The errors were deliberately bounded subprocess timeouts for the large title and FIFO. The large-test method stopped at its title case in that failing run; the separate earlier root/agent probes supply the unmatched-run before-behavior. [Source validation and tests-first identity](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r1-source-validation.json") retain source hashes, actual outputs and the distinction between independent reviewer and coordinator observations. + +Before parser edits, coordinator fixture QA corrected an inadequate canary comparison between macOS temporary-path aliases, added a real `.agents/skills` canary and all three exact local-only-prefix aliases. The strengthened selected tests failed against the original parser (two methods, six subcase failures); their raw capture remains separate. No source-boundary pass is claimed from the inadequate original guard. + +During correction, an existing mixed fence/list fixture was independently checked against [CommonMark list-item rules, including Example 270](https://spec.commonmark.org/0.31.2/#example-270): four absolute spaces after a two-column list marker form prose, while code needs six. The fixture now uses six for literal code, retains standalone indented-code coverage and adds the four-space real-link negative control. This corrects a mistaken fixture expectation rather than weakening the parser contract. A later symlink-loop regression first raised RuntimeError, and an escaped-HTML regression first accepted a fabricated anchor; both were observed in the uncommitted correction worktree before fixing. Their raw outputs are retained without claiming a committed before-version or a contemporaneous complete source hash for those intermediate runs. + +The final increment has 54 fixture methods with additional positive/negative subcases. [Correction verification](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r1-correction-verification.json") binds the final actual syntax/fixture/cwd/corpus commands to current source hashes. Original implementation captures keep their original 0c62391-plus-worktree identity; correction captures do not relabel them. No formatter/linter, dependency installation, Rust/QEMU/Miri rerun, hosted Linux result or agent verdict is inferred from these author checks. + +## Remaining execution boundary + +R1 actual full peer cross-read and fix verification, then a fresh independent paired R2, remain required before canonical Step 11 completion. T-056 remains In Progress with every AC/DoD unchecked and no date_done. The other check families, optional-live disposition, infrastructure/Required documentation and existing-job wiring/exact-source hosted Linux evidence belong to Step 12. PR49 was read-only checked at 2026-10-13 06:23:34 UTC: OPEN, development head 7d48f50603fa0d30464ea7b032f4f0fb82c3964c, no merge date. No push, PR mutation or external message occurred. HIGH T-038 and all C/D/phase-exit and maintainer gates remain in force. + +## Additional coordinator finding before R1 closure — ROOT-ATTR01 + +At clean correction commit 49a28a51c5238265586f4a9025bc4ba12ce7d013, both reviewers actually cross-read the complete immutable peer initial and independently verified the original corrections. Before R1 closure, coordinator probing found another Medium false-success case: Python HTMLParser decodes attribute references with text-context semantics. A known semicolon-less prefix followed by ASCII alphanumeric or equals must remain literal in an HTML attribute under the [HTML named-character-reference state](https://html.spec.whatwg.org/multipage/parsing.html#named-character-reference-state). With only decoy files `a¬it;.md` and `a©x.md`, `href="a¬it;.md"` / `src="a©x.md"` incorrectly passed; the actual literal target files were rejected. The [bound reproduction](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r1-attribute-source-validation.json") is a coordinator observation, not an invented independent agent finding. The security checkpoint temporarily called this same item R1-R10; ROOT-ATTR01 is its common identifier. + +Both reviewers held approval. Their append-only 49a checkpoints retain the completed original-finding closure and explicitly supersede any provisional scoped approval with this unresolved item. The code agent's first follow-up attempt failed for model capacity and supplied no verification; its retry actually performed the recorded work. Its append-only self-check also corrects an inaccurate quoted fix-commit subject/trailer in its draft. Neither process fact changes an original initial or substitutes for source verification. + +Tests preceded this additional parser change: two methods on the original 49a parser produced seven failures, including the HTML source-line expectation. The source-line assertion stopped its method before the duplicate-attribute case; no duplicate before-result is inferred from that run. Subsequent attribute controls exposed a separate Markdown-context error in the same destination boundary: complete entity names/semicolons, numeric limits and escaped ampersands were not preserved. Its selected regression first failed with contemporaneous hashes of the 49a-plus-dirty attribute worktree recorded separately. All raw before outputs remain unchanged. + +The correction reads raw attributes through the public HTMLParser start-tag-text API and applies attribute-specific longest-name decoding once; common URI processing no longer reparses those values. Relevant duplicate attributes fail visibly while first-value behavior is retained. Attribute line offsets, case, boolean/unquoted/quoted values and quoted `>` are tested. Markdown destinations and heading entities use exact complete-name/numeric grammar and a single nonrecursive escape/entity pass. Positive actual-target, negative decoy-target, href/src, literal-prefix/equals, numeric/full-name and escaped-ampersand controls bring the fixture count to 58. The first additional whole-corpus scan reported eight parser false positives on non-navigation template/archive placeholders. Attribute syntax validation now requires a relevant link/anchor attribute; a dedicated positive/negative fixture retains unrelated real-link checking. All affected public source documents stay byte-identical. This is an input-parser correction under ADR-0043; no new architecture/dependency/ADR or real corpus ownership defect is introduced. + +[Additional correction verification](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r1-attribute-verification.json") records actual code/public-Markdown hashes and local syntax/58-fixture/corpus/outside-cwd results. All original implementation and 54-test correction captures remain unchanged with their actual historical identities. Actual renewed R1 verification and fresh R2 still remain pending at this additional author boundary; T-056 stays In Progress/all sixteen unchecked, with no CI/hosted/task delivery or publication. + +## Subsequent R1 finding before closure — S06 numeric scalar loss + +At frozen f5487984c5beeec9eed0322b4b8a1f39191cff58, renewed security verification independently found Medium S06: generic `html.unescape` deletes some valid noncharacters/controls. A numeric spelling containing U+FDD0 incorrectly accepts an ordinary filename with that character removed; id/name anchors likewise falsely accept the shortened fragment and reject the actual scalar. Named-reference ROOT-ATTR01 was independently closed, but both reviewers held overall approval for S06. Their unchanged f548 checkpoints are code 538 lines / 69,934 bytes, SHA-256 `356eadd199677219b52cbe464621eeed099fb47494f8d76dc8aa455a40e6329e`, and security 745 lines / 82,332 bytes, SHA-256 `8629be049fcb3812f4b3b47a1822e1fce90a983b3a00330f170887560466ff51`; both preserve every earlier checkpoint as an exact prefix. The peer's 103 probe records mean 100 executions, seven mismatches and three explicitly unexecuted actual-filename cases: macOS rejects noncharacter filenames with EILSEQ. Anchor controls prove actual/decoy behavior without that filesystem limitation. + +The coordinator actually read the [WHATWG numeric-end algorithm](https://html.spec.whatwg.org/multipage/parsing.html#numeric-character-reference-end-state) and [CommonMark numeric rules](https://spec.commonmark.org/0.31.2/#entity-and-numeric-character-references), confirmed the source defect and added four regression methods before changing the parser. That exact f548-parser/tests-only run produced 25 failures across four methods, exit 1; the long-reference method passed. The C1 method stopped at its first legacy-value mismatch, so no later before-result is inferred. [Numeric source validation](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r1-numeric-source-validation.json") binds the contemporaneous code hashes and [raw before output](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r1-before-numeric-fixtures.txt"). + +Numeric conversion now preserves valid scalars, replaces null/surrogate/out-of-range values and applies the documented legacy table only in HTML context. Leading zeros are stripped and significant-digit count bounded before integer conversion; the existing Markdown spelling limits remain distinct. End-to-end fixtures cover href/src/inline/reference decoy paths, id/name actual-versus-shortened fragments, decimal/hex noncharacters and unmapped controls, replacement boundaries and distinct HTML/Markdown C1 values. A subprocess deadline guards two 100,000-digit HTML cases without claiming a global HTMLParser work bound. No actual noncharacter filename success is claimed on macOS. These additions bring the suite to 62 methods. + +[Numeric correction verification](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r1-numeric-verification.json") binds final author syntax/fixture/corpus/outside-cwd execution and checks every earlier capture against f548 Git blobs. Earlier evidence and provisional/withdrawn judgments remain historical. Actual renewed R1 verification and fresh R2 remain required; T-056 is still In Progress/all sixteen unchecked, with remaining families/CI/hosted execution in Step 12. No new ADR, runtime change, exception or publication is introduced. + +Coordinator compatibility follow-through then ran the new long-reference fixture on the installed Python 3.13 interpreter. It failed in both subcases before the HTML callback: HTMLParser still performed its own integer conversion, subject to the [Python integer-string limit](https://docs.python.org/3.13/library/stdtypes.html#integer-string-conversion-length-limitation). The [documented attribute callback](https://docs.python.org/3.13/library/html.parser.html#html.parser.HTMLParser.handle_starttag) receives already-converted values. A same-length ampersand mask now prevents that implicit conversion; public tag position/length APIs recover the original spelling for the existing raw-attribute reader. Physical offsets and source-specific decoding are retained, with no private parser override or process-wide limit change. [Compatibility verification](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r1-numeric-compat-verification.json") preserves the contemporaneous failing source identity, separate before output, full 62-method results on actual Python 3.9 and 3.13, and latest corpus/cwd captures. The earlier 3.9-only numeric record is retained with its actual earlier source hashes; it is not the final compatibility result. R1/R2 and subsequent delivery gates remain pending. + +> **Evidence migration (2026-10-16).** Raw evidence links now open the [immutable archive catalog](2026-10-16-pr49-evidence-catalog.md). Each link title retains its exact archived member path. Original verdicts, measurements, limitations and execution SHA identities remain historical; the archive bundle restores their original source. diff --git a/docs/analysis/reports/2026-10-13-t056-parser-r2-corrections.md b/docs/analysis/reports/2026-10-13-t056-parser-r2-corrections.md new file mode 100644 index 00000000..c692af35 --- /dev/null +++ b/docs/analysis/reports/2026-10-13-t056-parser-r2-corrections.md @@ -0,0 +1,160 @@ +# T-056 Step 11 — R2 source corrections + +- **Date:** 2026-10-13. +- **Author:** Codex implementation coordinator, sole repository writer on development. +- **Frozen INITIAL source:** 6f9f6d5053aefae3528bba4410023e4830bcebcf; cumulative step base fd9009bb510a8351cb3f8f404f2db9d76c978134. +- **Authority:** [approved plan](2026-10-12-phase-b2-track2-preflight-and-plan.md), [Accepted ADR-0043](../../decisions/0043-documentation-corpus-consistency.md), [T-056](../tasks/phase-b2/T-056-docs-consistency-automation.md). +- **Boundary:** author corrections during R2; actual same-reviewer frozen-fix verification and canonical Step 11 closure remain pending. T-056 stays In Progress, all sixteen criteria unchecked, without date_done. Step 12/hosted/maintainer/publication gates are not delivered here. + +## Independent initial reports and disclosure + +Both fresh R2 reviewers completed their independent INITIALs before peer or actual R1 report disclosure. The coordinator preserved and fully read both: code 577 lines / 67,441 bytes, SHA-256 `05e93b93aca3913776ffda5ae920699afa00a15930e1f4e9efda2884c014c4a7`; security 576 lines / 62,890 bytes, SHA-256 `f94398fab8140c6e9903d599db7ee930f6a9460962e27717bd70a381cf53a7c5`. Code requests changes for Major R2-C01 (multiline HTML metadata); security requests changes for Medium R2-SF01/SF02 (target identity/physical lines). All fifty code-ledger and 115 security-ledger source hashes/sizes matched the frozen source. Prerequisite checkpoints and the code review's early ADR exposure plus corrective full ordered reread remain historical, not rewritten as perfect chronology. + +The coordinator additionally disclosed Medium ROOT-R2-TABLE01 only after both INITIALs were preserved: missing GFM cell/row isolation lets backticks/comments hide real links, HTML fabricate an anchor and link labels span cells. This is a coordinator finding, not an invented independent agent observation. Both reviewers now have the full peer INITIAL and both actual R1 finals for complete cross-reading; no future peer-final agreement is asserted. The HTML and table repairs remain open at this first correction increment. + +## First increment — R2-SF01 and R2-SF02 + +The coordinator verified the reported behavior against [Python's documented URL normalization changes](https://docs.python.org/3.13/library/urllib.parse.html#urllib.parse.urlsplit), [CommonMark physical lines](https://spec.commonmark.org/0.31.2/#characters-and-lines) and [HTML URL input cleanup](https://url.spec.whatwg.org/#concept-basic-url-parser). Markdown angle/numeric-reference destinations must retain the selected source contract's decoded characters consistently across supported interpreters. HTML href/src cleanup has a separate explicit context; HTML tabs/newlines being removed is specified behavior, not itself a decoder finding. No universal renderer/browser parity is claimed. + +Eight new fixture methods precede the parser changes. The first six-method tests-only revision on the frozen parser produced 24 failures on actual Python 3.9.6 and 36 on actual Python 3.13.14. A subsequent tests-only revision separated physical diagnostics from the earlier CR reference assertion and added invalid-UTF-8 offsets: its two selected methods produced two CR-only failures on 3.9. Earlier subtests stop at their first failed assertion; later positive/control behavior is not inferred from those failing runs. [Tests-first source validation](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-url-lines-source-validation.json") binds both actual uncommitted test revisions and their raw outputs to the unchanged frozen parser/CLI hashes. + +Local URL delimiters are split without implicit normalization. Markdown retains leading spaces/C0 and decoded tab/newline scalars; HTML href/src explicitly trims leading/trailing C0/space then removes ASCII tab/CR/LF, before external classification and percent decoding. Percent-encoded characters remain distinct and are never trimmed again. Actual-versus-decoy inline/image/reference/HTML and percent-encoding controls cover these boundaries. + +A shared LF/CR/CRLF iterator replaces Unicode `splitlines` in blocks, code-span boundaries, container/reference continuation, headings and source-line bounds. Lone CR becomes LF in the parsing view at the same character offset; CRLF retains its length, the original document text remains available, and HTMLParser's LF positions agree with physical diagnostics. Invalid-UTF-8 locations use the same three byte-level endings. Eight other Unicode/control separators cannot manufacture headings or source lines. Real LF/CR/CRLF headings, references/fences, source-line bounds and Markdown/HTML/error diagnostic locations are exercised. + +[Author verification](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-url-lines-verification.json") records actual syntax, full 70-method suites on both installed interpreters, full corpus/cwd output, source identities and preservation of all earlier captures. These are author results, not agent approval. R2-C01, ROOT-R2-TABLE01, actual peer reconciliation/fix verification and canonical filing remain required before Step 11 completion. No new ADR, dependency, runtime/unsafe change, CI/context/settings mutation, historical-document repair or publication is introduced by this increment. + +## Second increment — R2-C01 multiline HTML metadata + +The URL/line increment was committed as f7af125. Both same R2 reviewers then completed full peer INITIAL and both R1-final cross-reads, independently reproducing every disclosed group against extracted frozen 6f9 source. Their append-only CROSS-READ checkpoints preserve the exact INITIAL prefixes: code 666 lines / 82,868 bytes, SHA-256 `aa15412c4f46809edd86902c9df9ca7d668eb177ebf1a97b206812e3793fb5e7`; security 689 lines / 82,491 bytes, SHA-256 `34514ddab7fcb584eda0d47e5ea04d255624ddc78cab85abba54b5c0ec56e679`. The coordinator fully read and preserved both. Approval remains held; neither has verified a complete correction freeze. Security's retained shallow diagnostic comparison was strengthened and fully rerun after it missed the wrong-target line-8 versus line-5 distinction; its final counts refer to that stronger oracle. + +Four validated HTML regression methods were added before this parser change and produced eight failures on each interpreter. An earlier exploratory five-method revision included an interrupting heading/fence inside a purported multiline link title; its expected behavior was ambiguous/incorrect under block precedence. It was removed before parser edits, with the actual earlier 11-failure outputs retained separately. During correction, exact-path/line assertions exposed fixture expectations that omitted the docs/ source parent and counted a line-4 href as line 5. Their five-failure intermediate capture and contemporaneous hashes are retained; the assertions now require the correct full target message and physical line, rather than weakening the oracle. [HTML source validation](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-html-source-validation.json") records all these boundaries without promoting fixture QA into source defects. + +The block walker now discovers complete prose HTML tags outside actual code, inline-code/comment literals and link metadata. A tag's quoted attribute continuation cannot open a fence or container. Definition parsing masks those tag spans, and heading extraction masks recognized tags while the actual HTML anchor/link pass retains raw attributes and physical offsets. Escaped tags and HTML-looking fenced/inline code retain their existing behavior. Regressions cover false headings/suffixes, reference-like metadata, both fence characters and Markdown/HTML real links followed by actual literal fences, actual id/href attributes and original source lines. + +[HTML verification](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-html-verification.json") binds the resulting 74-method dual-interpreter suites and corpus/cwd runs to source hashes, and checks every older capture unchanged. ROOT-R2-TABLE01 is still open; subsequent table isolation and actual same-reviewer frozen-fix verification remain required. These author checks do not grant canonical Step 11 completion, whole-task/hosted/CI delivery or publication. + +## Third increment — ROOT-R2-TABLE01 cell and row isolation + +The multiline-HTML increment was committed as 944cc0f before adding table regressions. Ten new table methods on that unchanged parser produced ten failing subcases on each interpreter. Two additional tests on the hash-bound uncommitted first implementation then produced three failures: long backtick runs were treated as block fences despite a backtick in the info string, and surplus source cells had been discarded. A final primary-source start-rule reconciliation test produced six failures before its repair (search/source, CDATA and tag delimiter/raw-tag distinctions). [Table source validation](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-table-source-validation.json") keeps committed versus intermediate identities and raw before outputs separate. No subtest outcome after a failed assertion is inferred. + +The block walker recognizes tables before their cell content reaches whole-document code/comment/HTML processing, using matching header/delimiter counts, escaped-pipe parity, optional edges/alignment and quote/list continuation. It records original row/cell ranges and header width. Each rendered cell is parsed in its own inline context with the document's global reference map and physical source line; escaped pipes are removed before that inline phase, including raw HTML attributes and reference labels. Cross-cell/row code, comments, HTML ids and labels can no longer hide real targets or manufacture navigation. Block headings/definitions are unavailable inside cells. Surplus body cells are retained in source metadata for future index validation but excluded from navigation according to [GFM table semantics](https://github.github.com/gfm/#tables-extension-), rather than treated as a blanket corpus exception. A shared opening-fence predicate and the [CommonMark block-start rules](https://spec.commonmark.org/0.31.2/#html-blocks) preserve real table termination. The pipe phase was also checked against the official [cmark-gfm table implementation](https://github.com/github/cmark-gfm/blob/master/extensions/table.c) and [scanner grammar](https://github.com/github/cmark-gfm/blob/master/extensions/ext_scanners.re); no renderer/dependency was installed or executed. + +The resulting suite has 87 methods. Positive/negative controls include same-cell and ordinary pipe code, mismatched headers, escaped/even-backslash pipes, actual/fabricated HTML anchors, global references, surplus/short rows, literal block-looking cells, quote/list offsets, following real fenced literals, source ranges and long backtick runs. [Full-diagnostic peer controls](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-table-peer-controls.json") reproduce the actual disclosed security matrix as coordinator verification: all 28 cases on both interpreters match expected path, line, code, message and exit. These are attributed post-disclosure controls, not new independent reviewer findings or approvals. + +[Table verification](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-table-verification.json") records exact-source syntax/87-method dual-interpreter/corpus/cwd results and preservation of all sixty earlier captures. All four R2 finding groups have author corrections; actual same-reviewer complete frozen-fix verification, append-only final verdicts and canonical Step 11 filing remain required. T-056 stays In Progress/all sixteen unchecked; no Step 12 checks/CI/hosted result, maintainer promotion or publication is claimed. + +## Fourth increment — physical continuation and comment boundaries + +Both same-reviewer actual eb5 verification checkpoints were preserved and fully read before new counterexample disclosure: code 883 lines / 113,964 bytes, SHA-256 `1dbc450070599a4fc23fdf0568c1cff2e169ed7e04c70234f324933e763f6e19`; security 1,139 lines / 123,066 bytes, SHA-256 `c7667d2de0b19904be1de3370475ee99ce597a5f9eb89b2f869bf3700b7ff256`. Code requests changes for continued SF02 CRLF continuation/blank boundaries and TABLE01 parent-comment state. Security independently reached a scoped approval on its then-known controls before receiving those new cases; its actual result and subsequent-notification boundary remain preserved. No pair closure was granted. After preservation, both received the full peer checkpoint and attributed coordinator reproductions; renewed actual verification is required. + +The coordinator's [30 physical-line executions](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-boundaries-crlf-probes.json") reproduced ten CRLF mismatches on eb5. The [40 comment executions](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-boundaries-comment-probes.json") include twenty eb5 and twenty extracted 6f9 observations: twelve and ten mismatches respectively. Supplemental incomplete/short inline-comment failures are not all new regressions. The strongest pure-text-table case checks the real line-7 link on 6f9 but silently succeeds on eb5. Exact findings matter when a table target is already broken: a nonzero exit alone misses the lost later target. + +Eleven new methods were added before changing the committed eb5 parser/CLI, producing 28 failing subcases on each actual interpreter. A twelfth method then found two failures on the first hash-bound boundary implementation: list-like text inside a real block comment was changing its own saved container. [Tests-first validation](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-boundaries-source-validation.json") binds these separate raw captures and complete temporary snapshots. Later assertions after an earlier subtest failure are not inferred; no fixture failure or intermediate source is presented as a final pass. + +Continuation whitespace and blank-line matching now accept CRLF without moving offsets, consistent with the existing LF/lone-CR parsing view. A shared indexed inline-comment closer respects block/cell boundaries and [CommonMark's complete/short comment grammar](https://spec.commonmark.org/0.31.2/#raw-html). An incomplete inline opener remains literal; only its `<` is hidden from the HTML-parser input to prevent that parser from swallowing later real HTML, while heading text remains intact. The block walker separately owns real block-start comments and their fixed quote/list container through closure or container/document end. Comment content cannot open a nested container, and the comment-local character index no longer replaces the block walker's absolute source offset. Indexed closers avoid repeated suffix searches for many incomplete openers. + +The resulting 99-method suite includes valid inline/reference continuations, blank-separated titles/labels, three line endings, exact before/inside/after-table targets, complete/incomplete/short comments, escaped/code/attribute/title controls, heading/fence/quote/list boundaries, real block-comment container/content behavior, later multiline HTML metadata, and 100,000 incomplete openers followed by a real broken link under a deadline. [Boundary verification](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-boundaries-verification.json") records actual dual-interpreter suites, whole-corpus/cwd runs, source hashes and preservation of all 75 older captures. These author results precede renewed same-reviewer verdicts and canonical filing. T056 remains In Progress/all sixteen unchecked; Step 12, actual hosted verification, maintainer review and publication remain pending. + +## Fifth increment — shared paragraph layout and raw HTML tails + +Both actual completed f811 checkpoints were preserved and fully read before new disclosure: code 1,066 lines / 144,447 bytes, SHA-256 `60cbcc9cf79084c1340cd93f1be921717636e45043fcb797c68c7d3dd5c81d0c`; security 1,725 / 175,827 / `e70d126c42553bcd01d0f13515591ffb21a08c3cb8584ea3f3f356cf6087b37c`. Code retained SF02 for a backslash skipping a physical blank boundary. Security independently found Medium SF03 (closing-line real HTML hidden by synthetic indentation, also eb5) and SF04 (soft ordered 2. continuation splits a complete comment and fabricates an anchor, new at f811). Neither approved. Both then fully cross-read the actual peer checkpoint and coordinator cases, independently reproduced the disclosed outcomes and supplied read-only repair advice; the root remains sole writer. Their append-only reconciliations were also preserved and fully read: code 1,154 / 163,779 / `83f2cdbde4d5dd0718e67becb479511e5689d4b9acd93962c35e1cca7c0874c6`; security 1,762 / 184,913 / `bc598666c9460c1179b58a3bb04fa92b26257b0fcc7ece8838003e2a24b82aa4`. These are historical HOLD checkpoints, not future fix approvals. + +The coordinator's [84-case source validation](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-escape-blank-initial-probes.json") reproduced 76 semantic mismatches: escaped physical boundaries, invalid angle/bare destination continuations/ASCII space, and nine nonblank Unicode/control scalars incorrectly becoming comment boundaries. Both reviewers independently reproduced these actual outcomes; security also confirmed the scalar-boundary regression with hidden-anchor false greens. [Original code cases](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-escape-disclosed-code-cases.json") and [original security cases](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-escape-disclosed-security-cases.json") are retained byte-identically and attributed to their actual reviewer/freeze. Reproduction of faulty output is distinct from a semantic pass, and overlapping matrices are not summed into unique defects. + +Ten new methods were first executed outside the repository against exact f811 snapshots, separately with unittest fail-fast on both interpreters: twenty actual first failures. Three additional raw-HTML/list methods likewise produced six separate first failures before source repair. No later subcase or post-failure assertion is inferred. [Source validation](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-escape-blank-source-validation.json") binds full temporary snapshots, commands and raw captures. A bare reference destination validly ends at its first physical line; an intermediate test incorrectly expected a syntax error for the following prose. Its three actual assertion failures are preserved as fixture-oracle QA, not parser defects. The corrected test requires the true first-line destination and exact missing-target messages, then proves success with that actual file. A later shared-layout lazy-quote control produced one separate fail-fast failure on each interpreter before repair; its complete intermediate sources remain retained. An additional ASCII-digit marker/source-line fixture produced one separate first failure per interpreter before replacing Unicode digit classes with ASCII decimal syntax; its complete before sources and the earlier 116-method candidate are retained. Three further positive interaction methods cover quoted multiline attributes, ordered delimiters/long indentation and raw HTML independence from preliminary inline state. + +Every relevant Markdown escape consumer now recognizes the existing ASCII-punctuation escape grammar. Backslashes before LF/CR/CRLF or ASCII space remain literal and cannot bypass title/label/destination restrictions. Raw bare ASCII controls are rejected independently of path existence; non-ASCII whitespace remains filename content. Numeric-reference decoding still follows its already tested source-specific contract. [CommonMark escape](https://spec.commonmark.org/0.31.2/#backslash-escapes), [destination/title](https://spec.commonmark.org/0.31.2/#links) and [physical/blank-line](https://spec.commonmark.org/0.31.2/#characters-and-lines) rules were actually checked. Structural blank/marker predicates use ASCII space/tab; HTML-specific and emphasis-specific whitespace semantics remain separate. + +A shared bounded BlockLayout records physical line start/end, actual container body offset, container parts and boundary. Preliminary HTML/code discovery uses the same pure transition helpers; the block walker supplies final events after real HTML/literal/table decisions. Comment/code indexes, container-aware metadata, definitions and headings consume those final offsets instead of stripping every syntactic marker anew. Ordered non-1 text stays inside an open paragraph; outdented existing-list siblings and post-blank/new-block starts remain real items. Lazy quote/list continuations preserve context, including missing quote markers; a dropped quote cannot authorize a non-1 interruption. Long ordered-item indentation remains available after a fenced literal. This is a bounded acyclic source checker, not a renderer or an implementation of every CommonMark state. The [ordered-item rule](https://spec.commonmark.org/0.31.2/#list-items) and quote-laziness rules support the tested distinctions. + +Block-comment closing physical lines retain a separate raw-HTML channel under the [HTML-block rule](https://spec.commonmark.org/0.31.2/#html-blocks). The parser masks that range from Markdown definition/heading/inline/fence interpretation and restores its unchanged fragment only into HTML navigation processing. Raw discovery bypasses Markdown backtick/escape/link-title precedence, retains actual multiline tag spans and clears prior Markdown protection. Erased comment bytes cannot create source indentation. Mixed controls require only the real HTML target beside a literal Markdown label, and raw backticks/backslashes cannot conceal a real href/id. Actual comments remain excluded and original physical diagnostic offsets remain intact. + +The resulting suite has 117 methods. [Final replays](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-escape-final-replays.json") execute 144 coordinator checks: 84 attributed coordinator cases, 36 current-source security cases (historical duplicate-version cases omitted), and 24 code cases. Each checks the declared exact oracle; security cases compare complete finding objects, while code/coordinator cases compare code/line and additionally require the real downstream missing-target message. All match on the final source. The [116-method candidate verification](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-escape-blank-verification.json") and [pre-ASCII replays](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-escape-replays-pre-ascii.json") retain their exact intermediate source identities separately. The earlier [pre-lazy replay](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-escape-replays.json") remains separately source-bound; its 115-method test snapshot was exactly reconstructed by reversing the sole later method insertion, with the recorded SHA verified. It is not mislabeled as a contemporaneous retained snapshot or another independent review. + +[Final author verification](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-escape-final-verification.json") records actual full 117-method dual-interpreter suites, four whole-corpus/cwd runs, compatible syntax/source identities and preservation of all 88 older captures. No new ADR/decision, dependency, runtime/unsafe/CI/context/settings mutation or baseline-document suppression is introduced. Actual same-reviewer renewed verification and canonical Step11 closure remain required. T056 stays In Progress/all sixteen unchecked; Step12/hosted, maintainer review, HIGH T038/whole-phase C–D and the PR49 publication barrier remain pending. + +## Sixth increment — paragraph extents and eligible setext underlines + +Both actual completed 4573176 checkpoints were preserved and fully read before new disclosure: code 1,541 lines / 219,608 bytes, SHA-256 `893aab09b8b0aebc747e9c5e1331c2ec52cade2272734a2bbfc7e50d5bc57c93`; security 1,921 / 212,206 / `30f001633db34cf4f57d8e1f8749209cf90b8439356bdef3aa6132af0df683de`. Code retained HOLD for C02 setext extent and SF04 nested lazy-quote composition. Security independently reached a scoped approval before receiving those new cases, then reopened HOLD. The coordinator preserved that actual chronology. Both later reconciliation appendices were also retained and fully read before changing source: code 1,637 / 237,777 / `c5bce15cb7dbe55a1784ec65a90b4a3ae758a85a3ce09c02bea6f1b73debae23`; security 2,050 / 231,996 / `96d855546e827b2e1e435c89f1d3572770499253e95638f81e7db67f5489caa3`. These are actual historical results, not approval of this increment. + +Read-provenance correction: the coordinator had overstated the extent of two earlier peer full reads based on identity/narrative inspection. Security's actual previous full code read ended at line 1,066; it subsequently read 1,067–1,541, including the missing 88-line reconciliation. Code's actual previous full security read ended at 1,725; it subsequently read 1,763–1,921 and then correctively 1,726–1,762. Both completed checkpoints are now consumed. Their later reconciliation appendices were supplied for the next actual verification, without claiming an already completed reciprocal read. The original report prefixes and QA history remain preserved. + +[Source validation](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-paragraph-source-validation.json") binds exact attributed matrices, original outputs, source snapshots and chronology. Code's 108 setext executions and 96 nested-quote executions expose prior-heading/list/quote contamination and a dropped inner quote changing an inline comment/code boundary. Coordinator reproductions include 44 setext, all 96 disclosed nested cases and 72 lazy-underline executions. A bare `===` on a lazy continuation cannot terminate the paragraph and expose literal navigation; an eligible explicitly prefixed underline or actual source blank remains a real boundary. Command counts overlap in subject matter and do not count unique defects. Separate descriptive 200/400-heading timings and the 5,000-heading fixture expose the old backward-rescanning resource problem without introducing a universal performance threshold. + +Ten new setext/nested/lazy methods were added before this parser change. Twenty selected dual-interpreter commands produced sixteen first failures, two positive passes and two `TimeoutExpired` resource errors on extracted 457 source. Fail-fast commands do not establish outcomes for later assertions. An additional masked-comment heading method was added after the first 127-method implementation, then independently run against extracted old 457 source, where both interpreters failed. Its actual placement is retained rather than retroactively calling it an earlier test. Full intermediate and final candidate source blobs are retained by hash in JSON; they are not additional live parser modules. + +The shared layout now classifies actual paragraph identity, container and leaf kind once. A setext underline consumes only its eligible open paragraph; completed headings, thematic breaks, list siblings and new quote containers cannot be pulled into a later heading. `_headings` makes one forward pass instead of repeatedly walking backward. Lazy nested continuation retains the full active container chain, and bare lazy `===` stays paragraph content. Code spans and definitions consume actual source events; masked inline-comment/HTML bytes cannot manufacture a blank line or a heading boundary. Positive controls preserve multiline headings, duplicate suffixes and comment-masked continuation on LF, CR and CRLF. These changes refine the approved bounded grammar rather than adding a renderer or new policy. + +The earlier 116-method corpus evidence had four intermediate Markdown blobs whose bytes were not retained contemporaneously. They were [exactly reconstructed](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-paragraph-reconstructed116-manifest.json") by bounded reversal of later bookkeeping edits, matching all four recorded hashes and the complete 387-document map. [Reconstructed documents](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-paragraph-reconstructed116-documents.json") retain their text as JSON to avoid creating duplicate corpus inputs. A [later replay](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-paragraph-reconstructed116-verification.json") uses tracked 457 export, those overlays, retained 116 scripts and the restored old JSON navigation name. Both 116-method suites pass and four corpus outputs exactly match the original 387 files / 6,695 local targets / 776 fragments / zero findings. This is a qualified later reconstruction, not a contemporaneous or bit-identical snapshot of the entire historical tree. Three older unavailable intermediate source blobs remain an explicit limitation. + +The first 127-method implementation and candidate 128-method suites are separate immutable records. On the final 128-method source, [160 current full-diagnostic replays](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-paragraph-current-replays.json") match all attributed expected findings and the earlier corrected complete reports. [144 legacy replays](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-paragraph-legacy-replays.json") also match; their [additional full-object comparison](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-paragraph-legacy-full-oracle.json") checks complete report, exit and stderr against the original corrected observations. It strengthens current verification without rewriting the older weaker declared oracles. These are coordinator executions, not independent reviewer findings or approvals. + +[Final author verification](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-paragraph-verification.json") records the actual final dual-interpreter suites, four corpus/cwd runs, source/syntax identities and preservation of all 118 earlier raw captures. No new ADR, dependency, runtime/unsafe, CI/context/settings mutation or baseline suppression is introduced. Actual same-reviewer frozen-fix verification and canonical Step11 closure remain required. T056 stays In Progress/all sixteen unchecked/no date_done; Step12, hosted delivery, maintainer review and the PR49 publication barrier remain pending. + +## Seventh increment — structural columns and visible heading text + +Both actual completed e018285 checkpoints were preserved and fully read before new disclosure or source edits: code 1,894 lines / 266,213 bytes, SHA-256 `52d3f5140a095d2027b9e8a83d72cdf50aae8ee78c1aa8b683da4f2d332f86b7`; security 2,204 / 256,237 / `5cca0fc0ee650411c3b568aca2d89262e9b3daf5d230bac926f22919481e6ea6`. Both completed all required current coverage and retained HOLD. Code independently found retained SF04 outer-list sibling loss and C02 heading-text mask errors, including a new multiline phantom-anchor admission. Security independently found a tab/container heading regression. Their original checkpoints do not claim to know the then-unseen peer result. + +After that preservation boundary, root released the worktree for tests-first repair while both reviewers reconciled actual peer/coordinator evidence on immutable e018/457 snapshots. Both completed reconciliations were subsequently retained and fully read: code 2,113 / 289,523 / `af780dd80d50ebcbe13973c338077bdb855c2cf0ab5b487419e90ad2ba97d744`; security 2,338 / 276,226 / `b02c3bd8d910409d1f320bac66ad3d5fdcad405549ea81c0714f6e56a493da25`. Both confirmed the disclosed failures and controls. Neither inspected mutable author code or approved a future fix. Code's append-only errata correct its reconciliation shorthand's checklist mapping and an abbreviated path message; actual execution objects/oracles and verdicts remain unchanged. + +[Source validation](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-container-source-validation.json") binds all exact matrices, raw captures and [complete source variants](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-container-source-snapshots.json"). The coordinator reproduced all 72 security tab observations and all 264 code sibling/heading observations, plus 48 separately attributed tab/comment/code/phantom/outdent compositions. Both revisions, both interpreters and LF/CR/CRLF remain explicit. A tabbed marker followed by a four-space underline newly fails at e018; tabbed comment/code continuation also newly exposes literal navigation or fabricates an HTML anchor. Some continuation-tab and heading-mask failures already exist at 457. The outdented two-space underline is an opposite control that e018 improves. Command counts overlap and do not count unique defects. + +Six new methods were added before changing e018 parser source. Twelve selected commands produced ten first failures and two separately executed literal/escape positive passes; later assertions after a fail-fast failure are not inferred. The first structural-only candidate passed six selected commands, with heading repair still pending. The subsequent complete 134-method candidate failed six existing unmatched-outer-quote subcases on each interpreter. Their exact source and full raw failures remain retained. Matching the actual parent level repaired those controls, and both 134-method suites plus 496 full-object replays passed on that intermediate source. + +A later coordinator reconciliation with [CommonMark list semantics and Example 302](https://spec.commonmark.org/0.31.2/#lists) caught an over-restrictive same-delimiter assumption in that intermediate implementation. A 135th regression method was added first and failed on both interpreters. The final correction permits a different-delimiter list after an existing item when its ancestors remain matched, while preserving lazy continuation when an outer quote is missing. These two intermediate implementation regressions are not mislabeled as defects in committed e018, hidden failures or independent reviewer discoveries. + +Structural indentation now uses four-column tab stops with an explicit mapping back to original source offsets. Preliminary/final paragraph events share the same column-based container widths; table boundaries also use structural indentation. Original inline text, URL/HTML values and diagnostic positions remain source-based. The outdent decision retains which parent level is actually matched: an existing list can open its next item or a new-delimiter list before inner-quote lazy fallback, while a list beneath an unmatched ancestor quote cannot do so. + +Heading input separately retains zero-width provenance for actual ignored HTML/comment spans, including their internal line endings. Source offsets remain available, but ignored bytes no longer become slug spaces or hyphens. Genuine outside spaces and soft breaks, duplicate suffixes, protected code and escaped text preserve their meanings. ATX closing markers are recognized from original source syntax before projecting heading content. This keeps the forward paragraph-extent scan and avoids global whitespace collapse or source tab rewriting. + +Both final 135-method suites pass. [Final replays](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-container-final-replays.json") execute 532 full report/exit/stderr comparisons: 304 earlier corrected objects, 192 current variants of the new tab/sibling/heading groups and 36 delimiter-change/ancestor controls. All match. The separate [496-replay record](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-container-stage3-replays.json") stays bound to its earlier 134-method source. Original legacy oracle declarations remain unchanged; synthetic non-Markdown decoy variations and every intermediate source boundary are explicit. These are author checks, not independent reviewer approval. + +[Final author verification](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-container-verification.json") records exact final syntax/source identities, full dual-interpreter suites, four corpus/cwd runs and all 185 earlier raw captures unchanged. No new ADR, dependency, runtime/unsafe, CI/context/settings mutation or corpus exception is introduced. Actual renewed same-reviewer frozen-fix verification and canonical Step11 filing remain required. T056 remains In Progress/all sixteen unchecked/no date_done; Step12, hosted delivery, maintainer review and the PR49 publication barrier remain pending. + + +## Eighth increment — source-aware heading inline semantics + +**Correction and verification resumed 2026-10-15; no task delivery or independent fix approval is claimed.** Both actual completed8ed HOLD reports were preserved and fully read before author repair. Their later actual peer reconciliations were also preserved/read. The independent CODE and SECURITY matrices confirm retained real-anchor rejection and newly accepted phantom underscore anchors when HTML/comments disappear before emphasis parsing; SECURITY additionally confirms retained multiline-code trailing-space loss. [Source validation](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-heading-source-validation.json") binds the actual report identities, read extents and attributed evidence. The [original CODE](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-heading-disclosed-code.json") and [original SECURITY](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-heading-disclosed-security.json") observations remain unchanged. + +Four regression methods were added before the heading parser edit. Six selected commands reached a first failure and two literal-token controls passed across both interpreters. The [original coordinator42 record](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-heading-root-original-code-edge.json") contains twelve incorrect leading/combined-indent expectations: paragraph-leading indentation is removed before inline parsing. Those expectations were explicitly withdrawn after primary-source verification; original observations remain intact. Their later wrong unit subcases were not reached by the fail-fast commands. The initial unexecuted patch and original test draft are retained separately. Corrected139 suites passed before a fifth source-whitespace regression exposed Python isspace being wider than CommonMark's class; both selected first VT failures preceded that classifier correction. [Complete snapshots](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-heading-source-snapshots.json") bind all18 stage/file associations and nine distinct script blobs without inventing execution of the unexecuted candidate. + +The repair carries original source offsets through heading projection and inline interpretation. Underscore runs cannot merge across removed markup, and their flanking uses original punctuation and Markdown whitespace classes. Matched inline-code spans preserve trailing spaces across physical breaks; paragraph-leading/container indentation is removed at the earlier block stage. Protected code, escaped/entity/link-label text, actual spaces/soft breaks, duplicate anchors and source-based ATX closers retain their meanings. Both140-method author suites pass, and [all694 final full-object CLI comparisons](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-heading-final-replays.json") match: previous532,60 CODE,60 SECURITY and42 coordinator observations with explicitly corrected semantic oracles. The earlier139/694 captures remain separate source-bound records. + +Review-record QA stays explicit. SECURITY corrected the generic long-backtick fixture description while preserving its correct original source hash and outcomes. CODE's final post-disclosure role table inadvertently used security role names, although its earlier completed table correctly assessed the five CODE roles. Root requested an append-only correction; that agent turn failed on an unsupported hosted search tool, so no reviewer erratum is fabricated. On October15 neither old reviewer runtime remained available. New independent reviewers must verify this committed correction and explicitly assess Correctness, Style, Test coverage, Documentation and Integration, with reviewer replacement disclosed. Historical report bodies and limitations remain intact. + +[Final author verification](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-heading-verification.json") records stabilized syntax, dual-interpreter suites/corpus/cwd runs and preservation of all234 earlier captures. No new ADR, dependency, runtime/unsafe, CI/context/settings change or corpus exception is introduced. Actual independent frozen-fix verification and canonical Step11 filing remain required. T056 remains In Progress/all16unchecked/no date_done; Step12, hosted delivery, maintainer review and the PR49 publication barrier remain pending. + + +## Ninth increment — original inline tokens and competing emphasis + +**2026-10-15; author correction, independent frozen-fix verification still pending.** Both actual completed replacement R2 reports at7b44 were preserved and fully read before source changes; their later actual cross-read/reconciliation appends were also preserved and read. CODE independently found crossing star/underscore precedence (CODE-R2-REPL-C01); SECURITY independently found separate code spans joining after zero-width markup removal (R2-RESUME-SEC01). Root independently reproduced48 mixed-emphasis and108 code-span observations on exact parent/current scripts. Root additionally confirmed72 observations in six composition families; reviewers later corroborated the five supported entity/link/reference/literal-tag/phantom-id families. URI-autolink Example481 was correctly retained as contract-adjacent exploratory evidence at the old freeze, rather than retroactively declared a supported-grammar blocker. + +[Source validation](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-tokens-source-validation.json") binds the completed and reconciled report identities, distinct source/oracle meanings, original attributed observations and root reproductions. Both review HOLDs remain historical. Reviewer command counts overlap and are not unique-defect counts. Completed-prefix hashes and append-only counting/fixture/setup QA remain explicit; no unseen peer read, blind discovery, old-reviewer erratum or dirty-candidate approval is inferred. + +Five new methods were added before changing7b44 parser source. Both selected five-method runs fail with63 subtest failures; the original full streams and complete script snapshots are retained. The first145-method candidate then passes on both interpreters and matches808 full-object CLI controls. A sixth bounded-autolink label method subsequently exposes brackets inside a literal URI being mistaken for the outer label closer: three subtest failures on each interpreter precede the shared lexical protection fix. Those are author-discovered candidate failures, not defects newly attributed to the reviewers or hidden failures of the final source. Both final146-method candidate suites pass. + +The repair resolves star and underscore delimiters in a shared source-aware stack. Heading extraction consumes actual source-parsed code/link token extents; zero-width projection no longer reparses newly joined code runs, link/reference suffixes, entities or tags. HTML navigation recognizes original source tags and prevents literal less-than text from being promoted by comment masking. Literal code, escapes, entity values, link labels, source-based whitespace/ATX syntax, physical diagnostics and container/table boundaries retain their established behavior. Bounded angle URI/email support is explicitly added to the guide and fixtures; URI punctuation remains literal in headings and link labels, with no external fetch or complete-renderer claim. This is a documented grammar extension under the existing fixture-first procedure and Accepted ADR-0043, not a new architectural/process decision. + +[Final808 replays](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-tokens-final-replays.json") bind previous694 qualified controls plus24 CODE,54 SECURITY and36 root current cases. Each complete report, counter, physical finding, exit and stderr must match. The earlier145/808 source remains a distinct intermediate capture. A separate primary-oracle exploratory check projects131 eligible single-paragraph emphasis examples from CommonMark0.31.2 into256 ATX/setext observations per interpreter; all match on final source, with multi-paragraph Example354 explicitly unscored. This is limited adjacent coverage, not full CommonMark/GFM validation. The original official corpus and full raw analysis stay outside the repository; retained summary binds version/input/source/output hashes and outcomes without importing that corpus. An earlier analysis helper wrongly included the outer HTML paragraph newline; those withdrawn exploratory mismatches remain outside the repository and are not product findings. + +[Final author verification](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-tokens-verification.json") follows document stabilization and binds actual dual-interpreter suites, four default-root/cwd corpus runs, all266 prior raw captures unchanged and complete inert stage snapshots. No dependency, runtime/unsafe, CI/context/settings change or corpus exclusion is introduced. Actual independent committed-fix verification and canonical Step11 filing remain required. T056 remains In Progress/all16unchecked/no date_done; Step12/13, exact-source hosted delivery, maintainer review and the approved PR49 publication barrier remain pending. + + +## Tenth increment — failed-search bounds and complete ASCII URI controls + +**2026-10-15; author correction, independent committed-fix verification pending.** Both actual completed8f replacement R2 checkpoints were preserved and fully read before new tests or parser changes: CODE652 lines and SECURITY810. Their later actual focused reconciliations (CODE690, SECURITY861) were also preserved and fully read before this commit. [Source validation](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-search-source-validation.json") binds exact identities, root read extents and original observations. Both reviewers verify the previous mixed-emphasis/code-span/five supported projection repairs at8f, while identifying two new Medium regressions: CODE C02 raw-DEL autolink recognition and SECURITY SEC02 repeated failed mixed-delimiter searches. Their HOLDs are not rewritten into approval by author passes. + +CODE C02 admits U+007F despite the selected ASCII-control exclusion. It invents/prohibits heading anchors and, more directly, hides a real missing-file link inside an invalid angle candidate. Root reproduced48 parent/current heading objects and12 embedded-file objects exactly; parent controls pass. Valid percent-encoded/non-ASCII URI bodies remain distinct. SECURITY SEC02 scans32,000 incompatible openers for32,000 closers on a192003-byte flat input: parent finishes below0.3s and both current interpreters exceed10s. Root independently reproduced the exact four cases and independently generated the opposite marker orientation before peer disclosure, preserving its separate24-case scaling/deadline provenance. Timeouts have no observed product exit/JSON report, rather than fabricated normal failures. Local timing/concurrency limits are explicit. + +Three methods were added first on unchanged8f parser source. The initial test draft incorrectly expected an actual ASCII space in a literal title to disappear; that one false oracle per interpreter was withdrawn and corrected before the parser edit. Original draft/source/streams remain retained. Corrected selected runs produce ten genuine assertion failures and two resource timeout errors per interpreter. The two small matching controls and every completed subtest remain distinct from the timeouts. [Complete snapshots](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-search-source-snapshots.json") preserve original/corrected before-tests and corrected-parser stages without relabeling any failure or execution. + +The shared URI class now excludes raw DEL without stripping input or banning percent-encoded/non-ASCII bodies. The emphasis stack retains failed-search lower bounds in twelve marker/closer-class contexts, keyed by opening ability and original run length modulo three. Stable positions and monotonic bounds preserve intervening removals and future eligible openers. The [primary parsing strategy](https://spec.commonmark.org/0.31.2/#an-algorithm-for-parsing-nested-emphasis-and-links) supports this repair; no new grammar restriction, dependency or architectural/process decision is introduced. Both selected three-method corrected runs pass. [Final842 semantic replays](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-search-final-replays.json") match every full report/status/stderr: previous808 plus24 CODE heading, six current embedded-file and four encoded/non-ASCII controls. + +[Current resource verification](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-search-resources.json") records ten full CLI observations across both interpreters, the two previously failing orientations and neighboring same-marker/modulo searches. All return the expected complete report within their10-second deadlines. The192003-byte SECURITY fixture and192021-byte opposite-direction fixture now complete in finite local subsecond observations; this is not a universal runtime/memory proof. Limited256 primary emphasis projections per interpreter still match, with Example354 unscored. Reusing the prior temporary primary-output path produced byte-identical results; their old hashes were verified unchanged and separate current copies retained. Namespace-like Example609 remains the previously qualified HTML-profile/conformance limit; no complete renderer parity is claimed. + +Focused review QA remains visible. CODE's completed-report criterion matcher initially rejected present DoD rows because of optional spacing; SECURITY's reconciliation metadata helper lost an unretained first60 command streams before a corrected64-record rerun. Their actual read/command/retention limits and prefixes remain intact. Root's guessed metadata filenames/schema were corrected by discovery without a product/source/evidence mutation. These are distinct from confirmed product defects and are not counted as semantic approval. + +[Final author verification](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-13-t056-parser-evidence "Archived member: docs/analysis/reports/2026-10-13-t056-parser-evidence/r2-search-verification.json") follows document stabilization and binds full149 dual-interpreter suites, four corpus/cwd runs,842 semantic objects, resource observations and all303 prior raw artifacts unchanged. Actual independent committed-fix verification and canonical Step11 filing remain required. No runtime/unsafe/CI/context/settings/exclusion change; T056 In Progress/all16unchecked/no date_done. Step12/13, exact-source hosted delivery, maintainer review and the approved PR49 publication barrier remain pending. + +> **Evidence migration (2026-10-16).** Raw evidence links now open the [immutable archive catalog](2026-10-16-pr49-evidence-catalog.md). Each link title retains its exact archived member path. Original verdicts, measurements, limitations and execution SHA identities remain historical; the archive bundle restores their original source. diff --git a/docs/analysis/reports/2026-10-15-phase-b2-track2-completion-readiness.md b/docs/analysis/reports/2026-10-15-phase-b2-track2-completion-readiness.md new file mode 100644 index 00000000..dc37eedd --- /dev/null +++ b/docs/analysis/reports/2026-10-15-phase-b2-track2-completion-readiness.md @@ -0,0 +1,117 @@ +# Track B. 2-2 — integrated verification and maintainer readiness + +- **Status:** Implementation and both fresh review rounds complete; maintainer PR/SECURITY wording review and merge remain. PR #49 records final publication-tip CI before handoff. +- **Date:** 2026-10-15. +- **Implementation baseline:** `ab847eee5e736566dd0db8d62caa9a3c9f768843` plus the six entry-document updates in this step. +- **Authority:** [approved 13-step plan](2026-10-12-phase-b2-track2-preflight-and-plan.md), Accepted ADR-0040/0042/0043, explicit maintainer choice to combine into [PR49](https://github.com/HodeTech/Tyrne/pull/49) on development. +- **Delivery boundary:** all twelve selected tasks In Review; no date_done or maintainer approval invented. This track does not close Phase B. 2 or start T-038. + +## All 58 opening findings + +The [original opening observations](../../roadmap/phases/phase-b2.md#opening-baseline-1) remain historical. This primary-owner ledger counts 57 task-owned findings plus the living-document note already fixed at kickoff. T-029 item28 also has T-048 task-file work; T-056 is selected polish, not a59th opening finding. [Full original blocks, current target hashes and source comparison](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-phase-b2-track2-final-evidence "Archived member: docs/analysis/reports/2026-10-15-phase-b2-track2-final-evidence/dispositions-and-freshness.json") retain the exact opening text and explicit B6 item48 ownership correction to T-047. + +| Item | Primary owner | Current target | Recorded disposition | +|---|---|---|---| +| 1 | T-045 | [overview.md](../../architecture/overview.md) | Current Phase B closure, active B. 2 and gated C; closure freshness hook added. | +| 2 | T-045 | [task-loader.md](../../architecture/task-loader.md) | Real hello loading, Task minting, scheduling and EL0 execution described; placeholder retained only as historical. | +| 3 | T-046 | [exceptions.md](../../architecture/exceptions.md) | Live EL0 entry and SVC path described across HAL/scheduler/exceptions; unexercised IRQ/idle limits remain explicit. | +| 4 | T-046 | [security-model.md](../../architecture/security-model.md) | Five implemented capability kinds and current rights distinguished from planned kinds. | +| 5 | T-045 | [overview.md](../../architecture/overview.md) | Five-call ABI and debug-only console gate match ADR-0030/0031 and decoder. | +| 6 | T-045 | [README.md](../../architecture/README.md) | Nine coverage rows distinguish implementation coverage, edit provenance and source freshness. | +| 7 | T-046 | [memory-management.md](../../architecture/memory-management.md) | Landed high-half conversion and frame-pointer helpers replace future-helper wording. | +| 8 | T-046 | [boot.md](../../architecture/boot.md) | Actual reset/high-half/load/caller-table/register/EL0/completion sequence replaces stale banner and nonexecution claims. | +| 9 | T-046 | [boot.md](../../architecture/boot.md) | Memory layout uses a table with source-qualified values; architectural flow is Mermaid. | +| 10 | T-046 | [ipc.md](../../architecture/ipc.md) | Live source navigation uses the repository-relative IPC target. | +| 11 | T-046 | [ipc.md](../../architecture/ipc.md) | Volatile IPC line-count claim removed. | +| 12 | T-045 | [README.md](../../architecture/README.md) | Status prose agrees with nine existing Accepted chapters and two unwritten planned chapters. | +| 13 | T-047 | [current.md](../../roadmap/current.md) | Delimited live state distinguishes historical T-029, merged T-030–037 and selected documentation tasks. | +| 14 | T-048 | [README.md](../../analysis/tasks/phase-b/README.md) | All 23 Phase B tasks appear exactly once with reconciled merged states. | +| 15 | T-048 | [README.md](../../analysis/tasks/phase-b/README.md) | B6 membership/status reconciled with the full23-row inventory. | +| 16 | T-048 | [README.md](../../analysis/tasks/phase-b/README.md) | All ten T-020–029 closures reconciled against actual merged history, including previously contradictory status text. | +| 17 | T-047 | [phase-c.md](../../roadmap/phases/phase-c.md) | Four distinct source-backed C carry-forwards recorded, with correct triggers and Phase B. 2 gate retained. | +| 18 | T-049 | [README.md](../../analysis/reviews/README.md) | Five omitted canonical closing reviews restored to family discovery. | +| 19 | T-049 | [README.md](../../analysis/reviews/README.md) | Business/security/performance inventories now include the closing batch. | +| 20 | T-050 | [README.md](../../guides/README.md) | Current phase language and all four existing guides replace stale architecture-phase inventory. | +| 21 | Already repaired before selected track; T-047 verifies preservation | [README.md](../../roadmap/phases/README.md) | Already repaired before this track; preserved living-document note verified byte-identical at preparation baseline. | +| 22 | T-049 | [2026-06-01-B6-closure.md](../../analysis/reviews/performance-optimization-reviews/2026-06-01-B6-closure.md) | Dated structural rider restores six-section/master acceptance visibility while preserving original measurements/verdict. | +| 23 | T-049 | [README.md](../../analysis/reviews/README.md) | Master-review family and run inventory made discoverable. | +| 24 | T-049 | [2026-10-13-t049-coverage-rerun.md](../../analysis/reports/2026-10-13-t049-coverage-rerun.md) | Fresh actual source-bound coverage/Miri records added; historical reports retained. | +| 25 | T-049 | [README.md](../../analysis/reviews/README.md) | Retired skill navigation repaired with verified immutable historical permalinks; quoted old-path evidence preserved. | +| 26 | T-048 | [T-029-perf-microbench.md](../../analysis/tasks/phase-b/T-029-perf-microbench.md) | B6 Milestone metadata added without reauthoring task implementation history. | +| 27 | T-050 | [README.md](../../../README.md) | Current boot excerpt matches retained real trace; removed image-loaded banner absent. | +| 28 | T-047 | [current.md](../../roadmap/current.md) | Historical T-029 completion and both merged PRs recorded; task metadata handled by T-048. | +| 29 | T-050 | [README.md](../../../README.md) | Unsafe summary includes guarded copy-from/to-user operation and links the audit log without a soundness guarantee. | +| 30 | T-047 | [current.md](../../roadmap/current.md) | PR43 recorded as merged closure; old dated snapshots moved intact to archive. | +| 31 | T-051 | [SECURITY.md](../../../SECURITY.md) | Current five-syscall/EL0 boundary and explicit limits documented; CONTRIBUTING reflects live workflow. Maintainer SECURITY wording review remains pending before merge. | +| 32 | T-052 | [testing.md](../../standards/testing.md) | Descriptive implemented test naming adopted under Accepted ADR-0042; ADR-0041 recovered/superseded atomically and References updated. | +| 33 | T-052 | [error-handling.md](../../standards/error-handling.md) | Actual PanicInfo/message/location behavior documented; no invented saved-register dump or automatic follow-up obligation. | +| 34 | T-053 | [error-handling.md](../../standards/error-handling.md) | Target rustflags panic=abort and dev-only host profile behavior described, including target-built userland. | +| 35 | T-053 | [code-review.md](../../standards/code-review.md) | Live required CI and its enforcement replace planned-tooling claims. | +| 36 | T-052 | [error-handling.md](../../standards/error-handling.md) | todo deny versus unimplemented behavior stated without changing lint levels. | +| 37 | T-052 | [logging-and-observability.md](../../standards/logging-and-observability.md) | Designed logging facade explicitly marked planned; current direct diagnostics and limits distinguished. | +| 38 | T-052 | [error-handling.md](../../standards/error-handling.md) | Actual crate-local/workspace lint enforcement distinguished from desired kernel/HAL/userspace policy. | +| 39 | T-053 | [commit-style.md](../../standards/commit-style.md) | Scope history/prior-use/review-extension convention reconciled; approved static scope gate explicitly skipped. | +| 40 | T-053 | [code-style.md](../../standards/code-style.md) | Current workspace/kernel lint inventory and missing-doc warning enforcement reconciled. | +| 41 | T-053 | [bsp-boot-checklist.md](../../standards/bsp-boot-checklist.md) | PID-suffixed smoke log and actual runner commands documented. | +| 42 | T-053 | [commit-style.md](../../standards/commit-style.md) | All three named standards opening fences tagged; whole standards fence gate now checks recurrence. | +| 43 | T-053 | [testing.md](../../standards/testing.md) | Existing test-hal crate and executable commands replace future-workspace wording. | +| 44 | T-053 | [release.md](../../standards/release.md) | Tyrne-specific article corrected. | +| 45 | T-055 | [0008-cpu-trait.md](../../decisions/0008-cpu-trait.md) | Dated evidence correction retracts unverified generalized vtable rationale; IrqGuard rustdoc aligned without runtime change. | +| 46 | T-055 | [0033-kernel-high-half-migration.md](../../decisions/0033-kernel-high-half-migration.md) | Reader-facing append-only pointer directs readers to the corrected one-offset model. | +| 47 | T-054 | [phase-c.md](../../roadmap/phases/phase-c.md) | All 32 live planned decisions use unique stable milestone-purpose identities; 74 live links cascaded semantically across C–I. | +| 48 | T-047 | [phase-b.md](../../roadmap/phases/phase-b.md) | B6 sequence reconciled with merged task states and historical status language disambiguated. | +| 49 | T-055 | [0011-irq-controller-trait.md](../../decisions/0011-irq-controller-trait.md) | Append-only reader pointer links ADR-0036 GIC correction. | +| 50 | T-055 | [0012-boot-flow-qemu-virt.md](../../decisions/0012-boot-flow-qemu-virt.md) | EL-drop question marked resolved with ADR-0024 under approved append-only/strikethrough exception. | +| 51 | T-046 | [security-model.md](../../architecture/security-model.md) | Cross-table revocation open question links Deferred ADR-0023 option catalogue and keeps unresolved status. | +| 52 | T-055 | [0018-badge-scheme-and-reply-recv-deferral.md](../../decisions/0018-badge-scheme-and-reply-recv-deferral.md) | Dated options trade-off rider added without changing Accepted decision/status. | +| 53 | T-048 | [T-004-cooperative-scheduler.md](../../analysis/tasks/phase-a/T-004-cooperative-scheduler.md) | Both Phase A source paths repaired to correct repository depth. | +| 54 | T-048 | [T-011-missing-tests-bundle.md](../../analysis/tasks/phase-b/T-011-missing-tests-bundle.md) | Coverage-baseline relative target repaired. | +| 55 | T-050 | [glossary.md](../../glossary.md) | PMM/AddressSpace plus related maintained terms added with stable anchors and source-aligned definitions. | +| 56 | T-050 | [glossary.md](../../glossary.md) | Alphabetical ordering restored and uniqueness checked. | +| 57 | T-050 | [SKILL.md](../../../.agents/skills/add-bsp/SKILL.md) | Source-qualified current smoke example and safe new-BSP workflow replace stale round-robin trace. | +| 58 | T-050 | [NOTICE](../../../NOTICE) | NOTICE/LICENSE both use maintainer-selected HodeTech, Cemil ILIK and Tyrne Contributors. | + +## Twelve task contracts + +[All 156 literal AC/DoD entries](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-phase-b2-track2-final-evidence "Archived member: docs/analysis/reports/2026-10-15-phase-b2-track2-final-evidence/task-criterion-traceability.json") retain source lines/text/hashes and owning canonical review. 155 are checked; T-051’s human SECURITY wording criterion alone is pending. This is traceability to implemented/reviewed evidence, not an automatic assertion that checkboxes grant acceptance. Owning reviews retain actual commands, findings/fixes and limitations. + +| Task | State | Checked / total | Two-round evidence | +|---|---|---:|---| +| [T-045](../tasks/phase-b2/T-045-docs-overview-taskloader-arch-index.md) | In Review | 14 / 14 | [Canonical review](../reviews/code-reviews/2026-10-13-t045-architecture-entry-points.md) | +| [T-046](../tasks/phase-b2/T-046-docs-subsystem-chapters-refresh.md) | In Review | 15 / 15 | [Canonical review](../reviews/code-reviews/2026-10-13-t046-subsystem-architecture.md) | +| [T-047](../tasks/phase-b2/T-047-roadmap-state-and-phase-index-sync.md) | In Review | 11 / 11 | [Canonical review](../reviews/code-reviews/2026-10-13-t047-roadmap-state-reconciliation.md) | +| [T-048](../tasks/phase-b2/T-048-phase-b-task-corpus-sync.md) | In Review | 11 / 11 | [Canonical review](../reviews/code-reviews/2026-10-13-t048-phase-b-task-reconciliation.md) | +| [T-049](../tasks/phase-b2/T-049-review-indices-sync.md) | In Review | 14 / 14 | [Canonical review](../reviews/code-reviews/2026-10-13-t049-review-corpus-reconciliation.md) | +| [T-050](../tasks/phase-b2/T-050-entry-docs-and-glossary-sync.md) | In Review | 15 / 15 | [Canonical review](../reviews/code-reviews/2026-10-13-t050-entry-document-refresh.md) | +| [T-051](../tasks/phase-b2/T-051-contributing-and-security-status.md) | In Review | 11 / 12 | [Canonical review](../reviews/code-reviews/2026-10-13-t051-contribution-security-status.md) | +| [T-052](../tasks/phase-b2/T-052-standards-docs-reality-sync.md) | In Review | 12 / 12 | [Canonical review](../reviews/code-reviews/2026-10-13-t052-t053-standards-reconciliation.md) | +| [T-053](../tasks/phase-b2/T-053-standards-docs-mechanical-fixes.md) | In Review | 13 / 13 | [Canonical review](../reviews/code-reviews/2026-10-13-t052-t053-standards-reconciliation.md) | +| [T-054](../tasks/phase-b2/T-054-adr-ledger-renumbering-cascade.md) | In Review | 11 / 11 | [Canonical review](../reviews/code-reviews/2026-10-13-t054-planned-adr-identities.md) | +| [T-055](../tasks/phase-b2/T-055-adr-append-only-corrections.md) | In Review | 12 / 12 | [Canonical review](../reviews/code-reviews/2026-10-13-t055-adr-corrections.md) | +| [T-056](../tasks/phase-b2/T-056-docs-consistency-automation.md) | In Review | 16 / 16 | [Canonical review](../reviews/code-reviews/2026-10-15-t056-integration.md) | + +## Architecture freshness and runtime boundaries + +All nine existing whole-chapter source/date/owner markers remain unchanged. Each marker baseline was compared to the Step 13 implementation baseline: only hal/src/cpu.rs and hal/src/timer.rs doc-comment changes, with every changed line beginning `///`; no executable Rust/assembly/manifest/lock/toolchain/config delta. This source-equivalence re-verification does not backdate a new whole-chapter reading or runtime run. T-045/T-046 own the full chapter reviews; T-055 owns the two comment corrections. Exact patches and marker bytes are in the freshness evidence. + +[Downloaded hosted smoke evidence](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-phase-b2-track2-final-evidence "Archived member: docs/analysis/reports/2026-10-15-phase-b2-track2-final-evidence/hosted-smoke-preparation-verification.json") and [complete original artifact text files](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-phase-b2-track2-final-evidence "Archived member: docs/analysis/reports/2026-10-15-phase-b2-track2-final-evidence/hosted-smoke-0033-originals.json") bind to 0033d63/push 38782332799, not a newly relabeled Step 13 run. Root personally read both full production traces: exactly two SVC/all-exception events each, EL1→EL0 transition and userspace exit/completion in both; greeting present only in debug, no panic/fault markers. 23 rejection/control results were mechanically checked; not every raw probe trace was manually reread. QEMU 8.2.2 Ubuntu and pinned rustc1.94.0-nightly86a49fd71/LLVM21.1.8 are retained. Elapsed observations are not a new performance baseline. + +## CI, policy and publication + +T-056 source 4044b79 passes 161 navigation/124 metadata methods on local Python 3.9.6/3.13.14, both exact-source hosted PR/push runs and six required app15368 contexts; [full original checkpoint](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/fourth-hosted-checkpoint.json") retains Linux 393/7047/925/zero. Later document census is separately measured. The [read-only live main policy comparison](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-phase-b2-track2-final-evidence "Archived member: docs/analysis/reports/2026-10-15-phase-b2-track2-final-evidence/live-main-policy-verification.json") taken during preparation matches the versioned full definition; no settings were applied. Final publication-tip CI and PR readiness will be verified after the two Step 13 rounds, without claiming first-main execution before merge. + +## What remains + +The phase inventory is 46: 8 Done, 12 In Review, 19 Ready and7 Draft. Twelve implemented documentation tasks await maintainer review/merge; 26 others remain unimplemented, so38 are not Done. Next implementation is HIGH T-038 (Ready/unstarted), followed by its own mandatory verification/security/audit work. T-039/T-040 and other Draft decision-bearing tasks keep their ADR preconditions; T-074 readiness and T-075 whole-phase closure remain. C/D stay gated. + +For this track, implementation and both fresh Step 13 rounds are complete. Maintainer PR/SECURITY wording review and merge remain; PR #49 records the final published tip’s hosted checks before handoff. No known implementation finding is deferred. Automatic Done promotion, merge or policy mutation is not authorized by this record. + +## Integrated review and publication + +[Both fresh code rounds](../reviews/code-reviews/2026-10-15-phase-b2-track2-integration.md) and [separate security rounds](../reviews/security-reviews/2026-10-15-phase-b2-track2-integration.md) Approve cumulative ab847ee..7d1eca0. One R1 Low, SECURITY-R1-01, affected two README links that resolved to the documentation index. Root independently compared all 58 displayed targets, fixed both in7d1eca0 and obtained actual committed-fix verification; different fresh R2 verifies the full scope with zero new findings. No unresolved implementation finding remains. + +[Five complete original report checkpoints](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-phase-b2-track2-final-evidence "Archived member: docs/analysis/reports/2026-10-15-phase-b2-track2-final-evidence/complete-review-reports.json") and [lossless bounded review evidence](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-phase-b2-track2-final-evidence "Archived member: docs/analysis/reports/2026-10-15-phase-b2-track2-final-evidence/review-publication-manifest.json") preserve actual procedure/reading/helper limits. R1’s late prerequisite recovery is disclosed; R2 completes every mandatory prerequisite before scope. These are two fresh rounds with one committed-fix followup, not five independent rounds. + +[Reviewed-source hosted proof](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-phase-b2-track2-final-evidence "Archived member: docs/analysis/reports/2026-10-15-phase-b2-track2-final-evidence/reviewed-source-hosted-checkpoint.json") binds7d1eca0 to PR38799120651/push38799110080: seven successful jobs each, all six app15368 required contexts, Linux161/124 fixture methods and397/7163/925/zero. Later canonical filing changes the document census; [publication verification](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-phase-b2-track2-final-evidence "Archived member: docs/analysis/reports/2026-10-15-phase-b2-track2-final-evidence/publication-verification.json") separately binds final local target/criterion/status checks. PR #49 records exact final-tip CI after the filing commit; no source checkpoint is relabeled as a later tip or first-main run. + +> **Evidence migration (2026-10-16).** Raw evidence links now open the [immutable archive catalog](2026-10-16-pr49-evidence-catalog.md). Each link title retains its exact archived member path. Original verdicts, measurements, limitations and execution SHA identities remain historical; the archive bundle restores their original source. diff --git a/docs/analysis/reports/2026-10-15-phase-b2-track2-final-evidence/README.md b/docs/analysis/reports/2026-10-15-phase-b2-track2-final-evidence/README.md new file mode 100644 index 00000000..75860411 --- /dev/null +++ b/docs/analysis/reports/2026-10-15-phase-b2-track2-final-evidence/README.md @@ -0,0 +1,18 @@ +# Track B. 2-2 final integrated evidence + +Source-bound implementation evidence for the [integrated readiness record](../2026-10-15-phase-b2-track2-completion-readiness.md); The original implementation checkpoint is followed by the additive completed-review/publication records below; final-tip hosted results are recorded in PR #49 before handoff. + +- [All 58 original findings and source-freshness proof](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-phase-b2-track2-final-evidence "Archived member: docs/analysis/reports/2026-10-15-phase-b2-track2-final-evidence/dispositions-and-freshness.json"), [original inventory](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-phase-b2-track2-final-evidence "Archived member: docs/analysis/reports/2026-10-15-phase-b2-track2-final-evidence/opening-finding-inventory.json") and [capture source](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-phase-b2-track2-final-evidence "Archived member: docs/analysis/reports/2026-10-15-phase-b2-track2-final-evidence/capture-freshness.py.txt"). +- [All 156 literal criteria and canonical ownership](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-phase-b2-track2-final-evidence "Archived member: docs/analysis/reports/2026-10-15-phase-b2-track2-final-evidence/task-criterion-traceability.json"):155 checked; one maintainer-owned SECURITY wording review pending. +- [Live full-policy read-only comparison](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-phase-b2-track2-final-evidence "Archived member: docs/analysis/reports/2026-10-15-phase-b2-track2-final-evidence/live-main-policy-verification.json") and [captured policy](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-phase-b2-track2-final-evidence "Archived member: docs/analysis/reports/2026-10-15-phase-b2-track2-final-evidence/live-main-policy.json"), preparation checkpoint; no mutation. +- [Downloaded0033 hosted smoke verification](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-phase-b2-track2-final-evidence "Archived member: docs/analysis/reports/2026-10-15-phase-b2-track2-final-evidence/hosted-smoke-preparation-verification.json") and [all original artifact text files](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-phase-b2-track2-final-evidence "Archived member: docs/analysis/reports/2026-10-15-phase-b2-track2-final-evidence/hosted-smoke-0033-originals.json"), exact original source/run and SHA bindings. Not a new Step 13 runtime execution. + +Further review/publication checkpoints are additive; original source stages, dates, findings and read limits remain historical. + +## Completed integrated review records + +[Canonical code](../../reviews/code-reviews/2026-10-15-phase-b2-track2-integration.md) and [separate security](../../reviews/security-reviews/2026-10-15-phase-b2-track2-integration.md) complete both fresh rounds at7d1eca0. [Five full original reports](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-phase-b2-track2-final-evidence "Archived member: docs/analysis/reports/2026-10-15-phase-b2-track2-final-evidence/complete-review-reports.json") preserve four initial independent reports and the actual R1 committed-fix followup, including one Low, exact repair and all reading/procedure limits. [Publication manifest](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-phase-b2-track2-final-evidence "Archived member: docs/analysis/reports/2026-10-15-phase-b2-track2-final-evidence/review-publication-manifest.json") binds their original bytes and [R1](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-phase-b2-track2-final-evidence "Archived member: docs/analysis/reports/2026-10-15-phase-b2-track2-final-evidence/r1-retained/manifest.json")/[R2](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-phase-b2-track2-final-evidence "Archived member: docs/analysis/reports/2026-10-15-phase-b2-track2-final-evidence/r2-retained/manifest.json") lossless archives:40 and22 regular files/unique objects, respectively, one shard each and no exclusions. Every decoded object was actually verified before publication; the existing [recovery helper](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/read-retained-evidence.py.txt") supports explicit-file recovery. + +[Root correction proof](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-phase-b2-track2-final-evidence "Archived member: docs/analysis/reports/2026-10-15-phase-b2-track2-final-evidence/r1-correction-verification.json") retains exactly two original valid-but-wrong README targets and zero remaining among all 58. [Reviewed-source hosted checkpoint](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-phase-b2-track2-final-evidence "Archived member: docs/analysis/reports/2026-10-15-phase-b2-track2-final-evidence/reviewed-source-hosted-checkpoint.json") and [collector source](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-phase-b2-track2-final-evidence "Archived member: docs/analysis/reports/2026-10-15-phase-b2-track2-final-evidence/capture-hosted.py.txt") bind7d1eca0 PR/push seven-job/six-app-context success and161/124/397/7163/925/zero. These later root-hosted records are separate from the reviewers’ offline404 inspection. [Final local publication verification](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-phase-b2-track2-final-evidence "Archived member: docs/analysis/reports/2026-10-15-phase-b2-track2-final-evidence/publication-verification.json") is a subsequent documentation checkpoint; original captures remain unchanged. PR #49 records actual final publication-tip hosted results before handoff. + +> **Evidence migration (2026-10-16).** Raw evidence links now open the [immutable archive catalog](../2026-10-16-pr49-evidence-catalog.md). Each link title retains its exact archived member path. Original verdicts, measurements, limitations and execution SHA identities remain historical; the archive bundle restores their original source. diff --git a/docs/analysis/reports/2026-10-15-t056-integration-evidence/README.md b/docs/analysis/reports/2026-10-15-t056-integration-evidence/README.md new file mode 100644 index 00000000..5e11a185 --- /dev/null +++ b/docs/analysis/reports/2026-10-15-t056-integration-evidence/README.md @@ -0,0 +1,105 @@ +# T-056 Step 12 integration evidence + +This directory retains actual implementation captures under the [integration preflight](../2026-10-15-t056-integration-preflight.md), Accepted [ADR-0043](../../../decisions/0043-documentation-corpus-consistency.md) and [T-056](../../tasks/phase-b2/T-056-docs-consistency-automation.md). Captures describe their own source boundaries; they are not independent review, required-CI or hosted delivery. + +## Shared-reader foundation + +[Foundation verification](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/corpus-verification.json") binds actual Python3.9/3.13 syntax/suites/default-root/cwd runs and source identity. [Source snapshots](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/corpus-source-snapshots.json") preserve complete distinct stages as inert JSON. [Chronology and raw bindings](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/corpus-source-validation.json") distinguish nine initially absent API/property errors, first158 passes and later three focused error/exclusion controls: one report-list alias assertion, one filename-less directory exception and one passing generated-boundary control. The corrected eleven new reader/label tests pass; the complete suite has160 methods, including all149 original parser fixtures. + +The shared Corpus keeps filesystem/UTF8/regular-file/private/symlink guards independent of selected link grammar, caches source/parsed documents and supports guarded dynamic source enumeration. Explicit caller roots retain existing canonicalization. Only exact member-relative generated paths can be excluded; an actual src/target module remains input. Link labels preserve real usage, definition-versus-label distinction and image identity. The links-only API/report/default CLI behavior remains intact at this internal boundary. + +Original first158 captures remain separate from corrected160 and later documentation-publication navigation. The filename-less directory error is injected, not an actual host permission denial. No universal filesystem race, memory/resource, renderer or unsafe-soundness claim follows from these fixtures. No package/network/Git/settings/runtime/CI mutation is delivered by this foundation. + +Task/review/ADR/planned/fence/audit/live families, all/subset CLI, required existing-job wiring, fresh full-Step12 paired R1/R2 and exact-source hostedLinux verification remain pending. T-056 stays In Progress/all sixteen criteria unchecked/no date_done; this focused commit is not the Step12 review boundary. + +## Task and ADR index implementation increment + +[Metadata verification](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/metadata-verification.json") records22 isolated fixtures on Python3.9/3.13 and equal zero-finding tasks/adrs API results against the391-file public corpus. The original160 parser/reader fixtures and CLI source are byte-identical to the foundation commit; they were not relabelled as a new execution. The CLI remains links-only while this internal API implements explicit selected families. + +Task checks join exact phase-local file targets and normalized lifecycle states, detect project-global duplicate IDs, validate real completion dates and preserve only the seventeen exact missing-date legacy destinations. Empty future inventories require their pending row. ADR checks join actual header number/title/status/full Date with exact canonical membership, preserving Deferred, partial supersession, descriptive-title/slug differences and reserved0034 without inventing a file. Inventory rows require the declared width and one canonical record link; inline/reference/shortcut task IDs use original visible-label provenance. Images are not canonical record links. + +The [complete captured stages](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/metadata-source-snapshots.json") and raw failures distinguish initial19 success from later shortcut/date-token/prose/Unicode/literal-code regressions and corrections. Calendar tokens cannot hide extra digits/letters; title comparison preserves literal code escapes rather than decoding them as ordinary prose. No fixture oracle was withdrawn. One short-lived Unicode-only pre-title module was not captured in full; its actual failing stream remains. A separately labelled later replay on the complete captured initial19 module reproduces the same title defect; it is not the missing intermediate or a contemporaneous observation. + +Full-Step12 review rounds, review/planned/fence/audit/live families, final CLI/CI wiring and exact-source hostedLinux delivery remain pending. Earlier paragraphs retain their own foundation boundary; this increment does not check off full-task criteria or promote task status. + +## Review index implementation increment + +[Review verification](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/reviews-verification.json") binds41 isolated metadata methods on Python3.9/3.13 and matching391-file tasks/adrs/reviews API results with zero findings. [Complete source stages](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/reviews-source-snapshots.json") retain the absent-API tests-first boundary, initial implementation and final seven additional controls. Raw streams include the initial34-method pass and final41-method runs; no fixture oracle was withdrawn. Earlier parser/reader/CLI sources remain unchanged. + +Event indexes use the File cell's first canonical report link; later evidence links and Scope citations retain their distinct roles. Exact top-level membership, duplicates, dates and row widths are checked. Only explicit same-family Companion plans declarations with canonical owners exempt plans from canonical membership. Nested evidence must be reachable through actual file or strict-descendant directory navigation; family-root/backlinks cannot blanket-own the archive. Master runs require valid calendar/time identities, exact consolidated pointers, coverage and nonempty Markdown tracks, with supporting discovery. Unknown family/layout Markdown is diagnosed. Historical mixed-case filenames and unsorted dates remain valid. + +The two retained preparatory notes are bounded immutable-source inventories, not formal Step12 review rounds or execution of the evolving checker. Fixtures cover reference-label provenance, supporting links, missing/extra/duplicate records, companion ambiguity/cycles/literal examples, nested orphan/root-directory cases, master identity/layout and source aliases without links selected. This proves bounded metadata/discovery behavior, not review authenticity or semantic correctness. + +Planned/fence/audit/live families, all/subset CLI, required-CI wiring, both fresh full-Step12 rounds and exact-source hosted Linux delivery remain pending. T-056 remains In Progress/all16unchecked/no date_done. + +## Planned ADR and standard-fence implementation increment + +[Planned/fence verification](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/planned-verification.json") binds54 metadata methods and equal source-stable five-family391-file corpus results on Python3.9/3.13. [Complete stages](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/planned-source-snapshots.json") retain the absent-API boundary, initial53-method implementation and final human-label/unknown-anchor control. The latter was added with the tightening; no failing pre-fix execution is claimed. No oracle was withdrawn. Review directory expansions are now memoized. + +Definitions come from real phase-ledger table rows with explicit purpose anchors and matching phase/milestone. Duplicate live definitions fail independently of repeated prose links; two purposes in F2 remain separate. Future numeric ledger allocations fail even when a number is already filed. Historical Phase-A/B ledgers, dated numeric notes and explicit none/future/unallocated rows remain valid. Purpose-labelled links and purpose-shaped fragment links must target their unique ledger definition or its explicitly linked filed record. A filed record retains the purpose alias in non-fenced text; this is a lexical alias check, not semantic review. The inventory is dynamic, without a fixed32-definition assertion. + +Standards use the shared block parser's actual opening fences, respecting length, closing fences and containers. Untagged archived evidence is outside this tag policy. All public Markdown remains navigation input. Fixtures cover missing/duplicate/misdirected purpose definitions/references, file/alias migration, code-formatted reference labels, historical/unallocated controls, nested fences and original diagnostic lines. Audit/live/CLI/required-CI/fresh full-Step12 rounds/hosted delivery remain pending; T-056 remains In Progress/all16unchecked/no date_done. + +## Unsafe-reference implementation increment + +[Audit verification](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/audit-verification.json") and [complete source stages](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/audit-source-snapshots.json") retain the absent-API74 boundary, initial false positives, later scope/reference false greens, actual10-second nested-annotation timeout and corrected81-method dual-interpreter results. Both six-family391-file corpus results agree with zero findings. No source/log baseline was rewritten to satisfy the tool and no fixture oracle was withdrawn. + +The bounded stdlib Cargo profile handles literal arrays/tables, quoted/dotted keys, inherited workspace path dependencies and all explicit/in-root path members independently of default-members. Recursively stored Rust/assembly/build/tests/examples/benches/custom sources are checked, with only exact package-relative target output excluded. Unsupported syntax, globs, exclusions, explicit workspace redirection and missing/outside-package custom targets diagnose. Shared guards precede manifest/source opening, even with links deselected. + +A monotonic lexical pass separates comments from normal/raw/byte/C strings and characters while preserving lifetimes, nested Rust comments, assembly immediates and physical lines. Full IDs and slash shorthand resolve separately from explicit Audit/audited-under lists. Parenthetical/historical references cannot satisfy Active entries; Removed active annotations fail. Wrapped safe0016 and historical0012 are supported. Existing qualified Active/Removed statuses remain accepted. Recognized include!/include_str!/path/assembly-include redirection is restricted to stored .rs/.s/.S in the enumerated workspace (Rust include!/path require .rs); dynamic/raw/unsupported forms diagnose. include_bytes data is outside source expansion. + +Resource controls are finite timeout-bounded regressions, not universal complexity/memory proof. Source redirection checks stored inventory independently of traversal order; this is reference reconciliation, not a Rust AST, complete unsafe coverage, macro expansion or soundness proof. Live-state/all-subset CLI/required CI/fresh full-Step12 paired rounds/exact-source hosted delivery remain pending; T-056 stays In Progress/all16unchecked/no date_done. + +## Delimited live-state implementation increment + +[Live verification](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/live-verification.json") and [complete stages](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/live-source-snapshots.json") retain the absent-API90 boundary, first90 pass, actual complementary Python3.9 zero-count and Python3.13 overlong-integer failures, and corrected92-method dual-interpreter results. Seven metadata-family391-file corpus results match with zero findings. Explicit zero-count normalization and nine-digit count bounds keep interpreter behavior consistent without weakening or changing task states. + +Only one exact ordered current-state:start/end full-line marker pair in current.md supplies live claims; a single real calendar Live state heading is required. Active phase/selected track/task fields, exact selected-task membership/status and phase-wide normalized census join actual task files. Missing/extra/duplicate selected rows, ambiguous fields, stale pointers and wrong counts diagnose at original lines. Explicit None is permitted only without selected In Progress work. Historical text outside the region is ignored by this state check while remaining navigation input. Fenced fake tables cannot supply live membership. Static commit-scope allowlisting remains deliberately skipped under ADR0043. + +The checker does not infer semantic planning correctness from prose, require the banner date to equal the machine clock or promote work. All/subset CLI/required CI/fresh full-Step12 paired rounds/exact-source hosted delivery remain pending. T-056 remains In Progress/all16unchecked/no date_done; earlier evidence retains its own boundaries. + +## All-family CLI and required-job integration + +[CLI verification](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/cli-verification.json") binds final160 navigation/reader and99 metadata/CLI methods on both local interpreters, plus eight actual whole-corpus CLI runs with empty PATH. Default all and explicitall from another cwd agree at391 Markdown files,7012 local targets,918 fragments,zero findings. Links-only and seven-metadata-family subsets also pass. Public Markdown and nine source/document/workflow checksum inventories remain fixed during that verification. These are macOS author results, not independent or hosted evidence. + +[Complete source stages](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/cli-source-snapshots.json") and raw streams preserve four tests-first selection failures, initial98 pass, one missed legacy direct parser CLI callsite, subsequent160/98 full success, both invalid-scalar before traces, the99th regression and corrected160/99 final results. Both parser fixture subprocess callsites now explicitly select links; heading/fragment expectations remain intact. Invalid decoded manifest scalars produce a structured unsafe-scope finding rather than breaking JSON output. No oracle was withdrawn. Resource subprocesses explicitly disable bytecode creation. + +The default command runs all eight named families; explicit distinct comma subsets retain selection order, while empty/duplicate/unknown/mixedall arguments exit2. Temporary-root CLI controls verify metadata cannot silently disappear and fixture bytes stay unchanged. Required fixtures and the default corpus command are two failing steps before Rust setup in the existing lint job. Exact insertion comparison preserves every older step/job; the versioned policy is byte-identical with all six app15368 bindings. This is source validation, not a YAML-parser or hosted-result claim. Guide/infrastructure changes minimally implement already Accepted ADR0043 and distinguish reference reconciliation from manual unsafe coverage/soundness. + +Full-Step12 fresh paired R1/fixes/different fresh R2/fixes, exact-source hosted Linux execution and Step13 integrated closure remain pending. PR49 still owns the remote development branch; the approved publication barrier applies. T-056 remains In Progress/all16unchecked/no date_done. Earlier paragraphs retain their own source/chronology boundaries. + +One raw unittest assertion stream contains original trailing whitespace. Its [lossless JSON envelope](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/cli-before.stderr.json") preserves exact recoverable UTF-8 bytes and payload hash without introducing artifact whitespace errors; the original raw TMP stream is unchanged. This is encoding, not a diagnostic/oracle rewrite. + +## First-round integration corrections + +[Six-group correction evidence](r1-fixes.md) retains the actual tests-first failures, intermediate coordinator mistakes, complete source stages, lossless raw outputs and final161/111-method dual-runtime author results. R1 committed-fix verification and a different fresh R2 remain pending. The maintainer explicitly authorized combined publication into existing PR49; exact-source hosted execution is still required. Earlier paragraphs retain their original chronology and publication boundary. + +[Subsequent same-round repairs](r1-fixes.md#subsequent-same-round-residual-corrections) preserve raw-identifier, unsupported-resource and additional HTML context/termination controls, actual161/115-method author verification and the separately source-bound successful first hosted checkpoint. Earlier scoped approvals/HOLDs remain historical; no final review/delivery closure is inferred. + +[Strict custom-tag correction](r1-fixes.md#strict-custom-tag-correction-within-r1) retains RV-S01's same-group regression, the eight-then-twelve actual tests-first failures, author161/118 success and the separately successful0033d63 hosted checkpoint. R1 verification/R2/final delivery remain pending. + +## Completed R1 boundary and current hosted checkpoint + +Both same-context R1 reviewers independently verified committed770d86b, froze their reports before disclosure and completed authorized peer reconciliation. All six groups, including S05's RV-S01, are scoped closed with no unresolved contradiction. The [sixteen complete original reports](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/r1-original-reports.json") preserve earlier findings, severities, HOLDs, read boundaries and final scoped Approves. Verification and cross-read checkpoints are not extra independent rounds. Different fresh CODE/SECURITY R2 is now active against the full cumulative Step12 range91a64b5..770d86b; T-056 remains In Progress/all16unchecked/no date_done. + +[Retained scratch manifest](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/r1-retained/manifest.json") maps19,100 original regular files to1,560 lossless content-addressed objects in three inert JSON shards, including complete source exports, fixtures, reviewer scripts and full raw outputs. Repeated bytes are deduplicated, including the70,545,019-byte failure reports; no diagnostic is truncated. Four generated compiler/bytecode files are explicitly inventoried as omitted. Symlinks and special nodes are recorded without following/opening them. [Packaging source](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/retain-review-evidence.py.txt") and [verification/recovery source](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/read-retained-evidence.py.txt") record the encoding and recovery procedure; all1,560 decoded objects were actually hash/size-verified. TMP paths are provenance, not live navigation. + +The [third hosted checkpoint](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/third-hosted-checkpoint.json") binds [PR CI38785378766](https://github.com/HodeTech/Tyrne/actions/runs/38785378766) and [push CI38785374006](https://github.com/HodeTech/Tyrne/actions/runs/38785374006) to770d86b. Each has seven successful jobs and six exact required app15368 successes; both new documentation steps pass. Actual Linux output is161 navigation/118 metadata methods and392 Markdown files/7029 targets/922 fragments/zero findings. The complete924,208-byte push log is losslessly retained. No exact hosted Python version is inferred. [Capture/validation source](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/capture-hosted.py.txt") records the checks. This source-bound checkpoint supports the corrected implementation; later canonical filing and final PR-tip verification remain separate, as do fresh R2, Step13 and maintainer approval. + +[Coordinator publication verification](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/r1-record-publication-verification.json") separately binds the later R1-record documentation worktree: both local runtimes return392 Markdown files/7039 local targets/925 fragments/zero findings, with unchanged public inputs and six Python files during execution. This later census does not replace the frozen770d86b reviewer/hosted census and claims no repeated suite or new independent round. This final explanatory link was added after that capture and is checked in subsequent publication verification. + +## R2 metadata-context corrections + +[Correction account](../2026-10-15-t056-integration-r2-corrections.md) records two independently frozen INITIALs, three reconciled Medium groups, tests-first harness QA and the shared original-context projection repair. [Complete INITIALs](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/r2-initial-reports.json") and [authorized cross-reads](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/r2-cross-read-reports.json") preserve HOLDs and actual read/procedure/retention limits. [Lossless author evidence](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/r2-corrections-verification.json") retains all original root validations,41-failure draft versus38-genuine-failure corrected layout, source snapshots, final161/124 dual-runtime suites, eight source-stable corpus commands (default/all/links392/7040/925/zero; metadata392/0/0/zero) and48 current default/subset replays. All118 original metadata methods and navigation/parser source remain unchanged. Actual same-R2 committed verification/reconciliation and repaired-source hosted delivery remain pending; no finding is closed by author green alone. + +## Completed Step12 and both-round boundary + +Both fresh R1 and different fresh R2, each with a separate security context, completed independent committed verification and authorized peer reconciliation. [Canonical code](../../reviews/code-reviews/2026-10-15-t056-integration.md) and [security](../../reviews/security-reviews/2026-10-15-t056-integration.md) Approve scoped integration at4044b79; all nine groups are closed. Earlier pending/HOLD statements remain dated historical boundaries. + +[Complete24 original reports](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/complete-review-reports.json") retain16 R1 and8 R2 bodies byte-exact, with [publication hashes](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/review-publication-manifest.json"). These are two rounds with checkpoints, not24 rounds. [R2 retained archive](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/r2-retained/manifest.json") preserves11694 regular files as1524 unique lossless objects in9 inert JSON shards; all1524 decoded objects were actually verified before publication. No generated R2 file was excluded. The same [recovery helper](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/read-retained-evidence.py.txt") verifies or recovers an explicit original path to a user-chosen file. No fixture evidence becomes executable navigation or a Markdown-wide exclusion. + +[Fourth hosted checkpoint](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/fourth-hosted-checkpoint.json"), captured by [retained source](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/capture-hosted-repair.py.txt"), binds4044b79 to PR38792307745 and push38792298087: seven successful jobs each; six app15368 required contexts each two exact-head successes; actual Linux161/124 methods and393/7047/925/zero. Complete927185-byte push log SHA256 is e32c0d73bfc0c53351adcdb6768c2571f604151398cb0540afd676031f6c2ddb. Both final reviewers verified this root-captured artifact offline after their independent fix reports froze; this is not their own hosted execution. No exact hosted Python version is inferred. + +T056 stops In Review/all16checked/no date_done. Step13, later publication-census/final-tip verification, maintainer SECURITY wording review and merge remain. Earlier source-stable reviewer/hosted counts are not overwritten by later documentation additions. + +> **Evidence migration (2026-10-16).** Raw evidence links now open the [immutable archive catalog](../2026-10-16-pr49-evidence-catalog.md). Each link title retains its exact archived member path. Original verdicts, measurements, limitations and execution SHA identities remain historical; the archive bundle restores their original source. diff --git a/docs/analysis/reports/2026-10-15-t056-integration-evidence/r1-fixes.md b/docs/analysis/reports/2026-10-15-t056-integration-evidence/r1-fixes.md new file mode 100644 index 00000000..16a67683 --- /dev/null +++ b/docs/analysis/reports/2026-10-15-t056-integration-evidence/r1-fixes.md @@ -0,0 +1,71 @@ +# T-056 integration — first-round correction evidence + +The implementation coordinator prepared these repairs after both independent R1 INITIALs and their authorized peer cross-reads were frozen against f4e11d9. This is author verification awaiting the same reviewers' committed-fix verification; it is not a fresh round, approval or task delivery certification. + +## Six reconciled groups + +| Group | R1 ownership | Repair and regression controls | +|---|---|---| +| Review discovery | CODE C01 / SECURITY S04 | Unused Markdown definitions and images grant no discovery; actual full/collapsed/shortcut references and HTML links still do. Ordinary link validation still checks unused definitions. Event and master-run negatives are covered. | +| Explanatory annotations | CODE C02, later replayed by SECURITY | A monotonic explanation boundary suppresses inner annotation starts without suppressing reference resolution. Nested/wrapped explanations, Removed history, explicit later list members and real parenthesized safe assertions are covered. | +| Source-redirection syntax | CODE C03 / SECURITY S01 / coordinator corroboration | Whitespace/comment-separated macro tokens and all three delimiters are recognized. Direct/nested conditional path attributes are inspected separately from cfg predicates. Supported stored literals remain accepted; dynamic/outside paths diagnose. String/comment/include_bytes controls remain inert. | +| Redirection lookup work | CODE C04 / SECURITY S03 | A sorted string-offset index replaces repeated prefix scans; repeated literal destinations share guarded resolution. A 24,000-constant whole-command regression checks practical resource behavior. This finite ten-second watchdog is not a universal CPU/memory bound. | +| Cargo overrides | CODE C05 / SECURITY S02 | Root patch/replace local paths, including virtual-root and URL-keyed tables, enter the existing transitive member inventory. Missing/malformed/private/outside/aliased paths diagnose; default-members never narrows scope. | +| Live block context | SECURITY S05, later replayed by CODE | Exact delimiters must be standalone top-level comments. Original parsed rows, block context and globally defined references are retained rather than reparsing a slice. Outer/split fences, enclosing comments and HTML attributes cannot authorize the region. Raw pre/script/style/textarea blocks retain literal context through their closing line, including embedded fence text; real later state and inner examples remain valid. | + +The raw HTML variant was independently found by the coordinator while validating S05's boundary and belongs to that same group. No finding is closed by this author document; reviewer verification remains required. These changes implement already Accepted [ADR-0043](../../../decisions/0043-documentation-corpus-consistency.md), with no new runtime Rust, unsafe block, dependency or policy decision. + +## Executed chronology and retained limits + +[Verification records](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/r1-fixes-verification.json"), [complete source stages](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/r1-fixes-source-snapshots.json") and [lossless raw streams](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/r1-fixes-streams.json") are coordinator-generated evidence, with exact payload hashes and recoverable original UTF-8 bytes. Escaped stream envelopes preserve whitespace without editing failed output. The source stages are inert data, not imported programs. Commands use own-TMP scratch directories and explicitly disable bytecode creation. + +- Eleven new metadata methods ran before repairs on both interpreters: 42 failed assertions on each; Python3.9 also hit the ten-second redirection-resource watchdog. Python3.13 completed that finite workload, so no timeout is claimed there. The additional full-document reference control exposed loss of definitions outside the extracted region. +- The first repair run failed: the coordinator initially attempted to mutate immutable BlockLine records; 35 errors and five assertions are retained. This was corrected with record replacement. The new alias control's expected family was corrected to the existing input diagnostic, and the unused-definition control's mistaken diagnostic name was corrected to path. Existing fixture expectations were preserved. +- The second repair run had only the new incorrect destination-diagnostic assertion remaining. After its correction, all160/110 methods passed on both runtimes; these first-green results and source remain a separate stage. +- A subsequent raw-HTML probe falsely accepted all four literal block forms. Its tests-first four failures are preserved. Block parsing now prevents literal HTML contents from manufacturing fences, live comments or Markdown headings, while preserving actual HTML navigation. The navigation regression was added with that fix; no failing-before run is claimed for that additional navigation method. +- Final source-bound runs pass **161 navigation and111 metadata methods** on both Python3.9.6 and3.13.14. Eight CLI corpus runs pass: default/all from another cwd/links/seven metadata families on each runtime, all with empty PATH. Full/links counters are391 public Markdown files,7017 local targets,919 fragments,zero findings. Metadata-only counters are391/0/0/zero. These counts precede this evidence document's publication, which changes the public corpus. + +The final executed six Python files remained byte-identical after execution; syntax parses with the Python3.9 grammar and compiles in memory. These are macOS author runs, not hosted/Linux evidence. Prior INITIALs, their severities, independent execution boundaries and disclosed scratch-location corrections remain unchanged. No semantic regression expectation was withdrawn to obtain success. + +## Publication and remaining work + +The maintainer explicitly selected combined publication into [PR #49](https://github.com/HodeTech/Tyrne/pull/49) on2026-10-15; the [plan](../2026-10-12-phase-b2-track2-preflight-and-plan.md#publication-and-remaining-phase-work) records that authorization. Development remains the only working/source branch. Exact-source hosted gates, R1 committed-fix verification, different fresh R2 reviewers and Step13 closure are still required. T-056 remains In Progress/all16 criteria unchecked/no date_done; T-051 wording review and maintainer merge authorization remain separate. + +## Syntax references + +- [Cargo root patch/replace override semantics](https://doc.rust-lang.org/cargo/reference/overriding-dependencies.html#the-patch-section). +- [Rust conditional attribute expansion and nested cfg_attr](https://doc.rust-lang.org/reference/conditional-compilation.html#the-cfg_attr-attribute). + +These primary references support scope syntax, not a claim that this bounded checker evaluates Cargo feature/dependency resolution or implements a Rust AST. + +## Subsequent same-round residual corrections + +Both reviewers independently froze their committed0ae222d verification before peer disclosure. CODE verified the original correctness cases but retained C04/S03 for unsupported arguments copying a distant source suffix; SECURITY verified the original supported lookup workload but retained C03/S01 for raw identifiers and S05 for additional HTML contexts/cross-name termination. Their later authorized cross-reads agree: C01/S04, C02 and C05/S02 are scoped closed; the other three groups need further repair. These are the same six groups within R1, not extra rounds or contradictory universal approvals. Full original reports remain unchanged for canonical filing. + +The coordinator independently reproduced CDATA/processing/declaration authority before reading the new SECURITY report. Two tests-first methods then produced three context assertion failures and one384k unsupported-redirection ten-second watchdog error on each interpreter. The first residual repair replaces slicing with an anchored whitespace fullmatch using offsets/endpos, and keeps persistent HTML contexts literal. Author161/113 suites and both corpus runs pass at that intermediate source; those captures remain distinct. + +After reading both frozen verification reports, the coordinator added direct/nested raw-identifier and blank-ended/cross-name HTML controls: nine new assertions fail on each interpreter before their repair. Raw path/cfg_attr spellings now receive the same attribute handling, while raw predicate keys remain predicates. HTML state now uses the [CommonMark start/end rules](https://spec.commonmark.org/0.31.2/#html-blocks), including any four-tag closing name, ASCII-letter declarations, PI/CDATA terminators, blank-ended generic blocks and type7 paragraph non-interruption. The [Rust identifier reference](https://doc.rust-lang.org/reference/identifiers.html#raw-identifiers) supplies raw-prefix equivalence. These primary rules were directly consulted; the coordinator does not claim a new whole-parser conformance proof or a local compiler rerun of SECURITY's retained syntax probes. + +[Residual verification](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/r1-residual-verification.json") retains both tests-first increments, full source stages, lossless original streams and actual161/115-method dual-runtime success. Existing test expectations remain unchanged. The unsupported384k/7.296MB negative-path regression checks every expected unsafe-scope diagnostic under a finite ten-second subprocess watchdog, separately from supported literals; no universal CPU/memory limit is claimed. Same-reviewer committed-fix verification and different fresh R2 still remain required. + +The [first hosted checkpoint](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/first-hosted-checkpoint.json") preserves complete push logs, both workflow/job responses and actual check-run/app bindings for0ae222d: [PR CI38779569388](https://github.com/HodeTech/Tyrne/actions/runs/38779569388) and [push CI38779564762](https://github.com/HodeTech/Tyrne/actions/runs/38779564762) each pass all seven jobs, including both new failing documentation steps on Ubuntu24.04 image20261012.334.1. Six exact required contexts are successful for both events and bound to app15368. Hosted fixtures161/111 and corpus392/7023/920/zero belong to that earlier source, which still had the three residual groups. They do not certify these newer repairs or final delivery. No exact hosted Python semantic version is inferred from a command name or image label. + +## Strict custom-tag correction within R1 + +At0033d63, CODE's independent residual verification closed its six reported groups within its exercised scope; SECURITY independently found RV-S01, a new Medium regression in the same S05 HTML-context repair. Both reports were frozen, fully read by the coordinator, then disclosed for authorized cross-read. Both contexts corroborated that permissive custom-tag attributes could hide real Markdown links and standards fences. Five groups remained scoped closed; S05 stayed open. The original Low S05 rating and every earlier scoped approval/HOLD remain unchanged; this is neither a seventh group nor a fresh review round. + +The coordinator's first tests-first draft produced eight failures on each runtime. Its first link assertion prevented the same subcase from reaching its fence assertion; no fence execution is claimed from that draft. Before repairing source, the checks were split into three methods: link, fence and valid/invalid live-context controls. This expanded before run produced twelve failures on each runtime and actually exercised both missing-link and untagged-fence boundaries. Both drafts, complete source stages and lossless outputs remain in [type7 verification](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/r1-type7-verification.json"). + +A dedicated monotonic complete-tag predicate now validates custom tag names, attribute separation and quoted/nonempty-unquoted values. Attribute matching uses original-string offsets without repeated suffix allocation. Type6 structural prefixes, paragraph/blank/container handling and permissive HTML navigation extraction retain their separate contracts. The [primary complete-tag rules](https://spec.commonmark.org/0.31.2/#raw-html) were directly consulted. Existing test expectations were preserved; author161 navigation/118 metadata methods and both whole-corpus runs pass on Python3.9.6/3.13.14. Same-context committed verification and different fresh R2 remain pending; author green results alone do not close RV-S01. + +The separately retained [second hosted checkpoint](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/second-hosted-checkpoint.json") binds [PR CI38782343042](https://github.com/HodeTech/Tyrne/actions/runs/38782343042) and [push CI38782332799](https://github.com/HodeTech/Tyrne/actions/runs/38782332799) to0033d63: seven jobs each, six exact app15368 required successes for each event, actual Linux161/115 and392/7026/921/zero. This is before the strict custom-tag correction and cannot certify its future source or final delivery. + +## Actual R1 completion at770d86b + +Both independent strict-tag committed verifications and subsequent authorized peer reconciliations are complete. The coordinator personally read all four complete reports; both contexts give same-R1 scoped Approve. All six groups, including RV-S01 within S05, are closed in the inspected/executed scope; no unresolved contradiction remains. The [complete originals](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/r1-original-reports.json") preserve all sixteen initial/follow-up/reconciliation bodies without rewriting any historical verdict. The [retained evidence](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/r1-retained/manifest.json") preserves their complete streams, inputs, scripts and exported source, with explicit generated-output exclusions. + +Both reviewers independently execute161/118-method suites per local runtime and matching392/7029/922/zero corpus modes. Their additional populations and peer-reading extents remain separately attributed in the originals; finite scaling controls are not universal complexity or memory guarantees. The [actual770d86b Linux checkpoint](../2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/third-hosted-checkpoint.json") subsequently confirms both new steps and all required contexts for PR/push. No earlier source census is relabeled as current. + +Different fresh paired R2 now reviews the full cumulative91a64b5..770d86b implementation. Canonical both-round filing, Step13 and final PR-tip hosted verification remain required; T-056 stays In Progress/all16unchecked/no date_done. Combined PR49 publication is authorized, while T-051 wording and maintainer merge remain pending. + +> **Evidence migration (2026-10-16).** Raw evidence links now open the [immutable archive catalog](../2026-10-16-pr49-evidence-catalog.md). Each link title retains its exact archived member path. Original verdicts, measurements, limitations and execution SHA identities remain historical; the archive bundle restores their original source. diff --git a/docs/analysis/reports/2026-10-15-t056-integration-preflight.md b/docs/analysis/reports/2026-10-15-t056-integration-preflight.md new file mode 100644 index 00000000..563d51c2 --- /dev/null +++ b/docs/analysis/reports/2026-10-15-t056-integration-preflight.md @@ -0,0 +1,49 @@ +# T-056 Step 12 — metadata and required CI integration preflight + +- **Date:** 2026-10-15. +- **Author:** Codex implementation coordinator, sole repository writer on development. +- **Clean prerequisite:** 91a64b5df2e1228221ba653c2ad5402474b5229d, the actual Step 11 canonical review/publication commit. +- **Authority:** [approved 13-step plan](2026-10-12-phase-b2-track2-preflight-and-plan.md), Accepted [ADR-0043](../../decisions/0043-documentation-corpus-consistency.md), [T-056](../tasks/phase-b2/T-056-docs-consistency-automation.md). +- **State:** T-056 remains In Progress/all sixteen criteria unchecked/no date_done. This is implementation preparation, not checker/CI/hosted delivery or a new decision requiring Acceptance. + +## Actual prerequisite boundary + +[Both code rounds](../reviews/code-reviews/2026-10-13-t056-parser.md) and [separate security rounds](../reviews/security-reviews/2026-10-13-t056-parser.md), including explicitly attributed replacement R2 committed-fix verification, approve parser source830de9d. All verified source findings are closed. Full original reports, exact current reviewer evidence, disclosed oracle/read/retention limits and the T-049-owned delimiter-only publication repair are retained. The actual later publication checks pass on both local interpreters:389 public Markdown files,6980 local targets,911 fragments,zero findings. This is separate from the original frozen387/6764/786 corpus and does not recertify historical runtime claims. + +The governing agent/ADR/standard corpus and task contracts were read throughout the approved sequence. This continuation rechecks Accepted ADR-0043, the full T-056 contract, approved Step12/13 boundaries, actual task/review/ADR/planned table shapes, current live delimiters and CI/standard procedures. Existing read-only design inventories are preparation, not executed new checker families. No new architecture/policy decision or maintainer choice is identified. + +## Focused implementation order + +1. Extract a shared safe Corpus and retain the links-only API/report contract. Add source-label provenance to real inline/reference/image/table links without treating reference-definition keys as visible labels. Verify meaningful direct-reader/alias/error/selection controls and existing parser fixtures before metadata implementation. +2. Add task, review and ADR inventory joins against actual rendered table rows and Markdown headers. Preserve exact canonical/companion/nested/master-run distinctions; diagnose malformed inventory tables, duplicates, missing and extra records. +3. Add planned-purpose definitions/references and standard opening-fence checks. Definitions are dynamic, not a hard-coded32; historical aliases/filed ADRs/unallocated planning remain distinct. +4. Add bidirectional unsafe-reference metadata checking and reliable delimited live-state consistency. Use bounded Git-free workspace discovery, guarded Rust/assembly/manifest reads and explicit active-versus-historical annotation treatment. This is not Rust parsing, complete unsafe coverage or soundness proof. +5. Stabilize all-family/default/subset CLI and isolated positive/negative/false-positive fixtures, then run the whole public corpus. Return real defects to their existing owners rather than adding suppressions. +6. Add both failing commands to the existing lint-and-host-test job, with unchanged job/check identity, all six app15368 bindings and no setting mutation. Update existing guide/infrastructure minimally under already Accepted ADR-0043, following propose-standard-change and preserving adjacent rules. +7. Commit reviewable focused changes; run fresh independent paired R1, verified corrections/commits, then different fresh paired R2 and verified corrections/commits. Complete actual local and exact-source hosted Linux verification before delivery certification; Step13 integrated closure follows. + +Large parts may use focused commits inside this approved step; no internal commit substitutes for either full-step review round. Root remains sole writer; reviewers use their own temporary paths and read-only repository/Git/remote access. + +## Metadata and input contracts + +- Caller-selected root is canonicalized, as in the existing command. Public source-prefix/ancestor/leaf aliases, dangling/loop aliases, private destinations and nonregular/invalid-UTF8/oversized sources must fail before content opening. Every metadata family uses the shared guards even when links are deselected or fail; no cwd/Git/network/write dependency is introduced. +- Task IDs remain project-global; phase-local indexes have exact T-file membership and normalized seven-state lifecycle agreement. Validate every present real calendar date_done, reject completion dates while open, and exempt only the seventeen exact recorded legacy paths from a missing completion date. Created backdating is no bypass and no historical date is invented. +- Review/ADR indexes reconcile actual canonical membership, explicit companion ownership, nested reports and master-run consolidated/coverage/tracks. ADR title/status/full Date match authoritative headers, including Deferred/prose dates/partial supersession; reserved0034 needs no file. Existing title/filename-slug differences are preserved. +- Planned identities use milestone-plus-purpose definitions and exact anchors, with visible link-label provenance including code-formatted labels. Repeated references are not duplicate definitions; tentative numeric live definitions and unresolved/misdirected purpose references fail. Future filed records preserve the purpose alias. +- Standards fences use actual opening fences/character/length/tag/container syntax. Historical review fences are still navigation inputs without a new archive-wide tag rule. +- Unsafe metadata distinguishes every source reference from explicit active Audit/audited-under annotations. Every reference resolves, every Active log entry has an active annotation, and Removed historical mentions differ from active Removed annotations. Bounded workspace syntax/unsupported forms and generated-output boundaries are documented and fixture-tested. +- Live checking uses only the exact current-state delimiters, selected-task table, phase census and active task pointer. Dated archives retain navigation checks. Static commit-scope allowlisting remains skipped for ADR-0043's stated reason. + +## Verification and publication limits + +Use Python3.9+ stdlib only, in-memory syntax compilation and temporary-root fixtures; no installation or fictitious formatter/linter. Preserve exact raw output/source/interpreter/cwd identity and distinguish author checks from independent reviews. Record baseline defects/false-positive fixes explicitly. Default all/subset selection must enforce the selected families, with deterministic sorted file:line findings and nonzero invalid/inconsistent exits. + +The [approved publication barrier](2026-10-12-phase-b2-track2-preflight-and-plan.md#publication-and-remaining-phase-work) remains: keep implementation local until PR49 merges or the maintainer explicitly chooses combined publication. Prepare concrete reviewable local work before requesting that choice if still needed; elapsed time is not approval. No new branch, main mutation, remote review/comment/settings change or hosted result is implied. T-051 wording review, T-038 HIGH and whole-phase C/D gates remain separate. + +## Unsafe-reference implementation profile + +The preparatory source inventory is retained as inert evidence in the integration directory. The initial supported Cargo profile is literal basic/literal strings, booleans/integers, arrays, inline tables, ordinary/dotted keys and table/array-table declarations. All six members are in scope independently of default-members. Parse workspace/package/dependency and explicit target/build paths; diagnose unsupported scope syntax, globs, nonempty workspace exclusions, out-of-root/private/aliased paths and custom source outside its package. In-root path dependencies must be reconciled as members or diagnosed; they cannot silently disappear. Enumerate stored .rs/.s/.S recursively, including build/tests/examples/benches/custom subdirectories; exclude only exact package-relative target output. Macro expansion/generated output is not source completeness or unsafe soundness. Recognized unsupported dynamic source redirection must diagnose. + +Extract actual Rust/assembly comments with source offsets while excluding quoted/raw/byte/C strings and character literals; distinguish Rust lifetimes and nested block comments. Assembly supports C-style blocks and // line comments; # remains an immediate marker. Adjacent decorated line comments may continue an annotation across exactly one physical newline, never across code or a blank source gap. Resolve every full ID and immediately slash-chained same-year four-digit suffix in real comments. Explicit Audit: and audited-under lists supply active annotations; allow wrapped whitespace, ID backticks, plus/slash/comma separators and parenthetical explanations, stopping at ordinary prose/sentence boundaries. IDs inside explanations still resolve but do not become list members. Ordinary historical mentions do not satisfy Active entries; active Removed annotations fail. This supports the safe0016 assertion and historical0012 without requiring unsafe adjacency or inventing a semantic prose classifier. + +Parse actual level-three log records and one bounded Active/Removed Status per record; reject duplicate/malformed IDs and metadata. Use shared guarded reads regardless of selected families. These are bounded grammar choices under already Accepted ADR0043, not a new unsafe policy or permission to omit unsupported relevant forms. Meaningful isolated lexical/scope/annotation/guard fixtures precede full-Step12 independent review. diff --git a/docs/analysis/reports/2026-10-15-t056-integration-r2-corrections.md b/docs/analysis/reports/2026-10-15-t056-integration-r2-corrections.md new file mode 100644 index 00000000..5839805c --- /dev/null +++ b/docs/analysis/reports/2026-10-15-t056-integration-r2-corrections.md @@ -0,0 +1,37 @@ +# T056 Step12 — R2 metadata-context corrections + +- **Date:** 2026-10-15. +- **Author:** Codex implementation coordinator; sole repository writer on development. +- **Independent reviewed source:** 770d86b4fd5360773ec4b441913d65e86c88a9ad; cumulative base91a64b5df2e1228221ba653c2ad5402474b5229d. +- **Author repair base:** 54d603b73738e006787b8ea386cbb14e3046f1cb; the intervening commit retains R1 evidence/status only. +- **State:** author repair verified; actual same-R2 committed-fix verification and reconciliation remain pending. T-056 stays In Progress/all16unchecked/no date_done. This is not a new ADR, review round, task delivery or merge approval. + +## Independent findings and disclosure + +Different fresh CODE and SECURITY contexts independently froze their [complete original INITIAL reports](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/r2-initial-reports.json") before disclosure. Root personally read both in full, then authorized cross-reading. Both complete cross-read reports were also read. Their original HOLDs and procedural/read/retention limitations remain unchanged; the CODE review's late mandatory-context reading is explicitly disclosed, not backdated as compliant preflight. + +| Reconciled group | Severity and independently validated defect | +|---|---| +| CODE R2-C01 | Medium: live headings/fields inside multiline inline-HTML attributes incorrectly supply state; hidden duplicate fields incorrectly reject real state. | +| CODE R2-C02 / SECURITY R2-S01 | Medium, one overlapping group: shared record-header scanning accepts task/ADR metadata inside indented fences or HTML attributes, also affecting live task joins. | +| ROOT-R2-COMPANION01 | Medium, root-attributed after initials: hidden companion headings/ownership bullets exempt an unindexed plan; a hidden unrelated heading can disable genuine ownership. Both reviewers independently validate/replay this additional consumer. | + +Root reproduced all three on immutable770d86b, with valid all-family fixtures and missing/ordinary controls. The first live draft lacked Cargo/log inputs for all-family checking; its read errors remain retained and are not used as all-family proof. The corrected default-all fixture reproduces the live false greens on both runtimes. Root's Note-wrapped header example belongs to the shared-header group, not a fourth finding. Earlier six R1 groups and RV-S01 retain their historical scoped closure and original severities. + +## Tests-first chronology + +Six new metadata methods separately test rejection of hidden authority and preservation of real authority across record headers, live state and companion sections. Task/ADR forms, one-/three-space fences, a/span/div attributes, hidden unrelated headings and LF/CRLF/CR live forms are covered. Every original118 metadata method remains byte-identical; navigation tests and parser implementation are unchanged. + +The first scratch layout put the six tools directly in its root. It produced41 failures per runtime:38 genuine new assertion failures plus three existing resource-test import failures caused by that incorrect layout. Before any implementation edit, the same source and unchanged test expectations were rerun in a repository-like tools directory. Both runtimes then produce exactly38 new assertion failures, with all118 old methods passing. Both raw stages and all source snapshots remain in [lossless author evidence](2026-10-16-pr49-evidence-catalog.md#dataset-2026-10-15-t056-integration-evidence "Archived member: docs/analysis/reports/2026-10-15-t056-integration-evidence/r2-corrections-verification.json"). No fixture oracle was withdrawn or weakened. The exact124-method before file was subsequently applied to the repository. + +## Repair and verified behavior + +A shared metadata projection starts from original block-masked text and erases actual inline HTML tag spans at their original offsets. Record-header field eligibility uses that projection while its raw first-H1/leading-header/body boundary remains intact. Companion section headings and ownership bullets use the same projection. Live masking occurs on the complete original document before region slicing, preserving global reference definitions and original physical-line interpretation. + +This changes three metadata consumers, without changing permissive actual HTML navigation, block classification, source/audit scope, parser grammar, lifecycle policy, index requirements, required-check identity or branch settings. Fences/comments/raw HTML and tag attributes cannot supply metadata or duplicate authority. Real missing/duplicate fields and real companion section changes remain errors. The guide records this existing context contract; Accepted ADR0043 already governs the repair. + +Actual Python3.9.6 and3.13.14 author checks pass:161 navigation methods and124 metadata methods per runtime; default all, explicit all from another cwd, links-only and seven-family subset. The source-stable corpus is392 Markdown files/7040 local targets/925 fragments/zero findings; metadata-only navigation counters are zero. Six Python files accept Python3.9 grammar and compile in memory. Forty-eight original root default-all/subset reproductions now match intended rejection/pass outcomes on both runtimes. Complete commands, environments, streams, inputs and before/after public/source hashes are retained in the linked evidence. These are author checks, not reviewer executions or universal grammar/resource proof. + +Later publication prose changes the navigation census and is verified separately. The previous770d86b Linux checkpoint does not certify this new repair. Actual same-reviewer committed verification, authorized peer-fix reconciliation, exact repaired-source hosted execution, canonical both-round filing and Step13 remain required. Combined publication into PR49 is authorized; maintainer SECURITY wording review, task promotion and merge remain separate. + +> **Evidence migration (2026-10-16).** Raw evidence links now open the [immutable archive catalog](2026-10-16-pr49-evidence-catalog.md). Each link title retains its exact archived member path. Original verdicts, measurements, limitations and execution SHA identities remain historical; the archive bundle restores their original source. diff --git a/docs/analysis/reports/2026-10-16-pr49-evidence-catalog.json b/docs/analysis/reports/2026-10-16-pr49-evidence-catalog.json new file mode 100644 index 00000000..b32e971c --- /dev/null +++ b/docs/analysis/reports/2026-10-16-pr49-evidence-catalog.json @@ -0,0 +1,301 @@ +{ + "schema_version": 1, + "purpose": "PR49 immutable evidence archive", + "generated_by": { + "asset": "provenance.tar.gz", + "member": "migrate-citations.py", + "original_script_sha256": "3954232d9e7c06f1e04bc89b13d126409f34eb235514383c7764822c28375630", + "correction_record": "docs/analysis/reports/2026-10-16-pr49-evidence-migration.md", + "corrected_script_sha256": "337ace0b3dba02eca903e9e357865eef232ec2733650c76efe138fb0544a4308" + }, + "release": { + "id": 414293393, + "tag": "evidence-pr-49-2026-10-16", + "url": "https://github.com/HodeTech/Tyrne/releases/tag/evidence-pr-49-2026-10-16", + "immutable": true, + "main_anchor": "c16997e003fbd1726d1205734380394781c52002" + }, + "original_executed_tip": "97dbcd16f1d9ed1f6e620bc17aa5349fe907c1a4", + "pre_rewrite_tip": "6c84f0d51820f858b31789ad51ecb612ed74e186", + "trial_filtered_tip": "32bdc16e4f19a654fda19abc202d3b4ad496d406", + "original_pr_commits": 145, + "pre_rewrite_commits": 151, + "commit_map": { + "0033d63e3d6cf070ac2dfb082242e29086e4178c": "45ef6d05e9548f8909405ff2609e93269be3690d", + "007e67ce385d54dae41da62ad03bb0ed4a31f142": "26ce16bf2bde0056a86ab12113a57454999a137f", + "054e13e2a368bb6699657ebc5b58e4daf98a23f1": "7b99e258194be96c4f54af18620813e443b96814", + "05f1736e3d7f2473eba890e83d70da1143739afc": "05f1736e3d7f2473eba890e83d70da1143739afc", + "0613f9b67cfc03b9c0b8d477740e2f915da29c4c": "0613f9b67cfc03b9c0b8d477740e2f915da29c4c", + "07449f19bbe957ea3649724d8f3786947ae881cb": "07449f19bbe957ea3649724d8f3786947ae881cb", + "09e35bc980c3fbd688d98b1bf8e4fb5b7aa1feec": "09e35bc980c3fbd688d98b1bf8e4fb5b7aa1feec", + "0ab0ba427ae97d5233afd01dfe7205b1ae8bc0c3": "9ca92fe894e036e44324dbf5bf4861c8ab2e2f2a", + "0acf0cdaaf2b8502465d813fa82e0c347a2f70b0": "0acf0cdaaf2b8502465d813fa82e0c347a2f70b0", + "0ae222dc8115bcb810519627a23ab8c662012f91": "6131464f1edd7411d3bd575965e5034617817779", + "0c62391caaae254459d090b20b45d328417115e1": "6ffb78f16d5a8185a27e26531aa17242a8ecfed8", + "0c86c3dcc4088d463f82ba5f7352d1939b2cfb49": "0c86c3dcc4088d463f82ba5f7352d1939b2cfb49", + "114be856a3012e4e006ddcbefa7ad84bfd63723e": "114be856a3012e4e006ddcbefa7ad84bfd63723e", + "1cb3526fcc2be18b107da1e2a500f8d38687a4bc": "1cb3526fcc2be18b107da1e2a500f8d38687a4bc", + "1e281ac89d791dc3c6920a038ec26381a49623f3": "1e281ac89d791dc3c6920a038ec26381a49623f3", + "20a0d25e69a0ce9872ee9dd58e7bd994f22230e1": "94c44d2933dcba2e3eee3d48acd30789ba790f3d", + "23391c705ddba04793512fc44d37103b09467826": "f74e05f53c28e4e5a58db8c32c9fbf1ba9039d7f", + "289f461f430bde2b33da7e9c7fadc1dbebd1a7a3": "289f461f430bde2b33da7e9c7fadc1dbebd1a7a3", + "2a23cb5e13faad58ded950ee524328c0591b7642": "2a23cb5e13faad58ded950ee524328c0591b7642", + "2b62391386c7d0d90e41abb86348c2d1d1506eb6": "0000000000000000000000000000000000000000", + "2d4d21ea828a385a1e113f21701c16f1bce862b3": "2d4d21ea828a385a1e113f21701c16f1bce862b3", + "2f963e228686cb4f3db3ef5f653d2241a18e5fcd": "2f963e228686cb4f3db3ef5f653d2241a18e5fcd", + "364b74626d54fffd5a73d6bec833877308eb5285": "364b74626d54fffd5a73d6bec833877308eb5285", + "38e14663e981753d4c3027539403182a477b534d": "b9f8f1266668b7b2d01347b5387f406a14158553", + "3a7c264e0ff296a866eb221ffc48d1ffefbe2603": "3a7c264e0ff296a866eb221ffc48d1ffefbe2603", + "4044b79e274f3fd824c2b11197b1fed7eaa0dc3f": "83ac9af7218e08ba97d901ee64add645f9d6c911", + "41679c1bc2f21033e1e1b43472043da3c077ff0c": "41679c1bc2f21033e1e1b43472043da3c077ff0c", + "41d96824d791167dc1f22beb8a9d13cb8f3c879d": "41d96824d791167dc1f22beb8a9d13cb8f3c879d", + "45731762bb167ab86ab88f4ec118c4edcf29d79e": "6f8d2ebf07ca79d78054ebdcde090bfe123eb744", + "468812b8e765f655edcfcfca161586e609d2478f": "5f9cf58bdef7d2306e1580a7ebf24b5e57b77c8b", + "49a28a51c5238265586f4a9025bc4ba12ce7d013": "69053f0a9bef0ba8dbff746bbc78fd1ca44dc91d", + "49c7cb43970d59db0803fe3f78c1cf18d2855b66": "49c7cb43970d59db0803fe3f78c1cf18d2855b66", + "4ad0b3d8a9d43310fcd937013131bffadcc803d7": "4ad0b3d8a9d43310fcd937013131bffadcc803d7", + "4ad9294b10d718b2052ead85f8d8ac5c880f6cd2": "7575b934c9f42491fd59e9e41d1466783ad0c156", + "4b336072bd9c28d786e46cb9c205c6eac73a1f41": "661abf931a383215e015cbbf83951fc98dfc3e68", + "4f2c38c6a8fdf221e00a0f0cb461303ed0b74b55": "4f2c38c6a8fdf221e00a0f0cb461303ed0b74b55", + "4ffda151ca7a1c438b9fa8a855db2584cc476409": "4ffda151ca7a1c438b9fa8a855db2584cc476409", + "50ab72bf2c15a4d34be25a1491a357313e50390a": "50ab72bf2c15a4d34be25a1491a357313e50390a", + "50f21ca7070eb14d2bb52d19972a3978ef666975": "50f21ca7070eb14d2bb52d19972a3978ef666975", + "519501f8d827eb436ea2ab060a30fc2681f636fd": "519501f8d827eb436ea2ab060a30fc2681f636fd", + "523615603f87f6f11f2030db4d6d974c38330f0d": "8301076ba4483462f3da57810608531abcb3cef4", + "528893f354af9e80e09d928173e0bc3268b92824": "528893f354af9e80e09d928173e0bc3268b92824", + "54d603b73738e006787b8ea386cbb14e3046f1cb": "54de2e64812085e102c5573c490d101b36561442", + "54e8f77d28638daaa60a1d1ae30a3d0a89404f3b": "54e8f77d28638daaa60a1d1ae30a3d0a89404f3b", + "550500f3080179fdb9b7254f64ea6fc48bf636d0": "fe2a813ccc59739fc4d72a2d0741cd2bbf4f7be5", + "5816c934a4d28fa66774b73b46047bd0d652b724": "5816c934a4d28fa66774b73b46047bd0d652b724", + "5c95cd3ab2bd97847ef3951b16c59d47563588e3": "5c95cd3ab2bd97847ef3951b16c59d47563588e3", + "5cd9ee8a01ac523e48146e2224284b871e3619ab": "5cd9ee8a01ac523e48146e2224284b871e3619ab", + "5d77d89c81841c3457951ddd2217b109f12daf2e": "be1a8e17f44f9a7ae63690a4b8464323a253e4fe", + "5e191ad4b475fa17ce45e0d4387ccd4c3c66e649": "4d4791f37be9a1d5c7dbb8fdddb78fa14cd7a1b7", + "5f809bfa580277df6903cfd57b0643ba7797508e": "5f809bfa580277df6903cfd57b0643ba7797508e", + "613e6985c820cd98ba995fe1b9f04e0a354840ae": "613e6985c820cd98ba995fe1b9f04e0a354840ae", + "64500055f24dd72283582ec339dee8318de96a86": "64500055f24dd72283582ec339dee8318de96a86", + "646ba33052632d5afda1e206007ed9bc334e8e3a": "646ba33052632d5afda1e206007ed9bc334e8e3a", + "667dca8d7059c300b3cf16796db68d01bdc18189": "667dca8d7059c300b3cf16796db68d01bdc18189", + "67f8c9bc652620fc18ee7da02b5b558013392d3c": "67f8c9bc652620fc18ee7da02b5b558013392d3c", + "683965b5aa2f5da2e11429aa42803bb3a5fa6f60": "683965b5aa2f5da2e11429aa42803bb3a5fa6f60", + "69a4109e12ad814cec9a1fe9cfef3070155b852b": "69a4109e12ad814cec9a1fe9cfef3070155b852b", + "69ac515393f8f20ff0a11587a309182388bcde51": "69ac515393f8f20ff0a11587a309182388bcde51", + "69afa33f67ea9dd7e97c127841222d2edc5c9f00": "0ad18a98faef6b4feee847a43b63e5187a7cfc8c", + "6c84f0d51820f858b31789ad51ecb612ed74e186": "32bdc16e4f19a654fda19abc202d3b4ad496d406", + "6e191e229d932ea7a3e330cfa55e9e0dc981f4e8": "6e191e229d932ea7a3e330cfa55e9e0dc981f4e8", + "6f9f6d5053aefae3528bba4410023e4830bcebcf": "b660b28a715ee6ad0dc25bc4a2a460ab08ecca93", + "714c74bdc3d2f615767e841c19dc985199a347c8": "714c74bdc3d2f615767e841c19dc985199a347c8", + "74944ee11b1806232b3235a5cf0a8ef5cc8a61ef": "4a9ab2272ae33c20895d33e86641d91ae74c9725", + "74f8e837bd13e10b71f517446ae0d108c5215e42": "7fa4e1b15980f8fedfe9c51f4c9aa2127c6a47d0", + "75de2ba90e151bae33e14d2db4a8278837e7775d": "2e0a7e5a3c1e913c3d3c8b2b252833e24f8c8f5a", + "770d86b4fd5360773ec4b441913d65e86c88a9ad": "cf00acd8fbec98a3dc2f0a2f449781e1c31ba01f", + "77865821c53dfeabd34f5726644736771429f865": "77865821c53dfeabd34f5726644736771429f865", + "7b1b380aab09c360dde2e8619f0ee7aaf3f3e515": "cf253e3cf88fc7195068d50f150195712480d875", + "7b44ce91e1be0944583abf2de0da3c4a6346e0bb": "9b42b9ed8b0beacb20d6583f5017053558e6203c", + "7bde23e33254532af67924cfccf0be3d9d433720": "bd3d35449f93b15b7664be957be95bb54744b9f5", + "7ccdde49aa77b35f181349adae4425bc68eb8801": "7ccdde49aa77b35f181349adae4425bc68eb8801", + "7d1eca0cd24b4750818de682ffc6007dae93ca50": "58ce8d7ef7e6dabac27f13deb5c4c8b3b0e578cc", + "7d48f50603fa0d30464ea7b032f4f0fb82c3964c": "7d48f50603fa0d30464ea7b032f4f0fb82c3964c", + "7deb16eae6274d48391c6c6525515a4e8bbdd66f": "7deb16eae6274d48391c6c6525515a4e8bbdd66f", + "82d1c42c25d2f245001e3dbfcaeb9e899277f2f4": "82d1c42c25d2f245001e3dbfcaeb9e899277f2f4", + "830de9d075aeabe5461b7aca204acfb5fc1507ba": "5723a8a4edb0a3e7c8f8297f58ee0c55640229b2", + "8437158245be4ec67a1293d8e7310c3041e83642": "8437158245be4ec67a1293d8e7310c3041e83642", + "8591cebab4d74abc49d0dd9c84eb85b1817b3e55": "8591cebab4d74abc49d0dd9c84eb85b1817b3e55", + "862bfb62cf56df560b43524aeb9c038897a3b0c8": "862bfb62cf56df560b43524aeb9c038897a3b0c8", + "8a89fd24a083a93fe6739a6cffce17dfb49fb769": "eedeec8f523e952815d02e952a1b0003b5ca2e3a", + "8ba9b61ddaa6f83f4638448e24a962fa578985c2": "97406429a814356833298c37238affb8c4e833ba", + "8d2c013c9b80a04814c40412dde8223bef393424": "8d2c013c9b80a04814c40412dde8223bef393424", + "8d6fab558be8c4643edd7442bddaeeb8302702fd": "8d6fab558be8c4643edd7442bddaeeb8302702fd", + "8dfa7ad0837050b13d944a9503fa92cf75d52763": "7f2eba366f4fc90230418c3052ada1b1d1876ab4", + "8ed03cf0a03e87e87dedbfce3464b699d74f9e83": "e08a86a35dbcb1b70df5e547b5432e0ecb313123", + "8f7505a9d97b1937392123f53396bba8260e3538": "8eea75e5eb7e985db24d77033431711305040ae1", + "9092581f1363c19cd3943c4d3a95a0d0c8634540": "9092581f1363c19cd3943c4d3a95a0d0c8634540", + "91a64b5df2e1228221ba653c2ad5402474b5229d": "b332ad74571e5ed58d93673f254c0b0bc55ed2e0", + "944cc0fb62354f580dabd450d31af40d98f7fc46": "11cc382294e04f7f996e38ea403764def77e74b7", + "946f45f34f7eac90164adccfcd71e4c7f77c1f8e": "e17636a02f881f790d55618f431bf4ff76fae3ce", + "94fd86c8328ff6951aa61b06444d17f8ccefe25d": "5275edee066cc056e8e7ad1ccbfbf20fd478a62e", + "960bdefb3630d1d0829906a0a2ab42a1932d1083": "960bdefb3630d1d0829906a0a2ab42a1932d1083", + "97a6c836e6180b2e61f1242560977ee21995258d": "97a6c836e6180b2e61f1242560977ee21995258d", + "97dbcd16f1d9ed1f6e620bc17aa5349fe907c1a4": "54581e1e3746d4416a55c83105b4fe4c2a3f3ce0", + "98378b5add44755f7cbab6e8bc96337accf0574a": "dba18193cc257f24aaedb0850029f3e63f1cc436", + "9b62a0641f10f4d8f6b357f6b33d881c7d492910": "0832a36740322cf4eb2f13dba9ae63e238893d3b", + "9c5191cfb8ced7e99e1afe459bb02852fde1a14b": "9c5191cfb8ced7e99e1afe459bb02852fde1a14b", + "9fcbdd58652bb19286373b2dade94af4a0b5cffd": "6df06409ad96dec882c444a300c3e01005995a00", + "a191a2f1d0667a613fc0a45caf08c58a58bf4c89": "342317398d79c75d16b311d8511d777d60e87078", + "a1eb406576f4984f563bc45ee5650c2aff0d8f2c": "a1eb406576f4984f563bc45ee5650c2aff0d8f2c", + "a214532483e899fbb25bace0a8c1cdcac37355fe": "f96e9f341fa2df5921767fb924118dacd901dff2", + "a50f94ab7d8a28d67e3527be6ad0504ca0ca21d1": "7345bcdb5039410f750a2d63c4f67926c65e2fa4", + "a72bea88334c0b787c6169451e9a6b40a5b7a2f0": "a72bea88334c0b787c6169451e9a6b40a5b7a2f0", + "a93926b3836e5e661495ed53356f1ded04dc216d": "076aa83f11c3ac89a2f78c541be4dfa7119779a0", + "aa37e2cff3eada2e20ccb13efc6a0bb2267201d4": "0d7cbff410e12593cb7fda6effdc33a55a34a312", + "ab042d6f2d4e7095b491a1225a378b8fd5ea251f": "7e0dc0e7efe0095ab32f9f38aa4089dff8115296", + "ab847eee5e736566dd0db8d62caa9a3c9f768843": "8f522c281f3febc467021806c1d66b92e3300f33", + "acd00133742235f02dae54e5f3f02116b4a02cfa": "acd00133742235f02dae54e5f3f02116b4a02cfa", + "aff9ff4aa6eee8607c1a74efd4bcd5e699da6f3d": "aff9ff4aa6eee8607c1a74efd4bcd5e699da6f3d", + "b6572cc65857b99f3ac3661b99cea809a7b12e88": "b6572cc65857b99f3ac3661b99cea809a7b12e88", + "b8ad56f4a9e49f82c7adfebb6f4afe48a86e8f5d": "b8ad56f4a9e49f82c7adfebb6f4afe48a86e8f5d", + "bd27fe599c80ef47e5891225e2be134f052c2a0e": "bd27fe599c80ef47e5891225e2be134f052c2a0e", + "bf20ec9739db635183b1b930f4da9f2c2b6813bf": "bf20ec9739db635183b1b930f4da9f2c2b6813bf", + "c3f32c848f5f3bc8617f316163cc802eac260488": "c3f32c848f5f3bc8617f316163cc802eac260488", + "c508fa62fd00913bc711d85d8976c981a9cf64a7": "41bea6326981b8aee4611aaca152a04bef0ad89e", + "c716ae3d312b1a6213ec35346a87940a79af3465": "c716ae3d312b1a6213ec35346a87940a79af3465", + "c79407733d895a809eac48a431b12781291ddf72": "c79407733d895a809eac48a431b12781291ddf72", + "c989237a6a2b0a7ef946d1fbed5621b5e0c71941": "c0811a9e420df1e45fa0010b689189d350ac5fda", + "ca1f0735bed114228a4b8a165162e27fbacd67b3": "a47736e5472eb7a201d124569476e0a228cd2fe5", + "cbd4cd15798e0580fe11efff8c4ce2f1a15a3bf3": "c9ee6e50dbff7ed79830f0f0991cd34ab0d04b34", + "ce4f999db9cbfcb64516394cc5c0042d9b98ede1": "ce4f999db9cbfcb64516394cc5c0042d9b98ede1", + "cfc8872f85fca6c48d31dbc1bb5cf7dbe174c251": "cfc8872f85fca6c48d31dbc1bb5cf7dbe174c251", + "d3177375b598946fbe9d8960ab5d3a8cb750eec8": "d9ca0d81101be785265cbbc10a66ab6707258f04", + "d553efe90ded0698f220a13b67fd9289864f85d0": "a7ae1b6d4986f6c739324908bd0cdb0605e61acf", + "d5c13a046db2e8a90d339f39efb651ed4c3bed9e": "d5c13a046db2e8a90d339f39efb651ed4c3bed9e", + "d6cb853f5889f5051386dbaa57ff0cabc7b26d97": "d6cb853f5889f5051386dbaa57ff0cabc7b26d97", + "d71aa4a0ddcdbdca4089ba5ccd2d949ec4367e48": "dd5891cea6f1be931d3c3e02fad605af616591fe", + "da18ed5c2a2d8b3d61f82337a9da021d05d73451": "85f02f24f1f4db1a27556fe697974b6832cd549c", + "da4bbe6ebed92dd079bca5d206267db3b744737b": "2adf97c4a65110794bf3b4e1751123a231e646c7", + "deec107185da8856a2ab2d9fd32540073bc15cf3": "596b935307d1c0102a5bcceebce5795035c510fe", + "e018285a98c3800415f6dd861de296a20db6a92b": "e5f24340eeeed6bf00e41435dc629413598971f7", + "e79e10a5dbe2ea9cd69d714e7f4338372066e788": "e79e10a5dbe2ea9cd69d714e7f4338372066e788", + "e8104e3ffb30bd808ebd7a5d318b4922c0adce66": "6497779ec92ada62651cbf43af7c2232b9437053", + "e8739957ea0a2ceabb33fa7519cadb1a1d2be57e": "e8739957ea0a2ceabb33fa7519cadb1a1d2be57e", + "eb5d84b251815ee86d11843ba08a3b06e6a5a00e": "3bc202dab94cf886daae55fb2d12a0b7a26460d6", + "eede01c2dd8b368c729720eab6f712bf7bcd1263": "eede01c2dd8b368c729720eab6f712bf7bcd1263", + "f256a610e1ddb7582e12ecda07928a15079e2bb6": "6bfc586efd4b19d5a60d96b2a89493cd8f5fd835", + "f2758e3808c0c47b105ad3e13417dbe789cefff7": "f2758e3808c0c47b105ad3e13417dbe789cefff7", + "f2d577f96b4c98f3c0998f538304e38d4232d409": "f2d577f96b4c98f3c0998f538304e38d4232d409", + "f4e11d9577b471fcbac56717836311de620353f9": "6dfaac6cd010e1d9458ed05b241ba5bdb2223faf", + "f5487984c5beeec9eed0322b4b8a1f39191cff58": "9890f3fce7a1590fc594467f2e4264208be937d5", + "f573ae1d39271da4ea4ded57c1252abb29630683": "dd16eb7e07c36720b407d3ab8e805eac28a1cf42", + "f7af125df7122246247ef11a6e793cf1a9e26422": "25feeb366acbcbc25e9ee587e260af3b2a833640", + "f81113f9a7f1a714979a726d1623774e8eb86dda": "c995e5fc225b3fe99f7edbc38dec0b3e5948472d", + "f8c7e1f70e93e9cea4fef67c2b2077769bc9996d": "6bcb14a7735dce7c45a1d0263228d9aeaad0df14", + "f8c9b7f34a28d0974cbc9e03f1ef8355dc2df4f3": "a0e201f9938e55febd020bf94f01b4c1326b0f06", + "fac9047fa401c84e756f94e96cb23c6e4fb17af1": "fac9047fa401c84e756f94e96cb23c6e4fb17af1", + "fb23823793b821b70f1252e16bb1b482f72fe1fe": "fb23823793b821b70f1252e16bb1b482f72fe1fe", + "fd9009bb510a8351cb3f8f404f2db9d76c978134": "978396d5d1071437750ee5823e54c3283493ed06" + }, + "payload_files": 804, + "payload_bytes": 134293614, + "payload_groups": { + "2026-10-13-t045-architecture-evidence": { + "files": 7, + "bytes": 13260, + "anchor": "dataset-2026-10-13-t045-architecture-evidence" + }, + "2026-10-13-t047-verification-evidence": { + "files": 7, + "bytes": 39314, + "anchor": "dataset-2026-10-13-t047-verification-evidence" + }, + "2026-10-13-t049-review-evidence": { + "files": 7, + "bytes": 763979, + "anchor": "dataset-2026-10-13-t049-review-evidence" + }, + "2026-10-13-t050-entry-document-evidence": { + "files": 17, + "bytes": 23487, + "anchor": "dataset-2026-10-13-t050-entry-document-evidence" + }, + "2026-10-13-t052-t053-verification-evidence": { + "files": 8, + "bytes": 111524, + "anchor": "dataset-2026-10-13-t052-t053-verification-evidence" + }, + "2026-10-13-t054-verification-evidence": { + "files": 11, + "bytes": 165130, + "anchor": "dataset-2026-10-13-t054-verification-evidence" + }, + "2026-10-13-t055-verification-evidence": { + "files": 12, + "bytes": 59971, + "anchor": "dataset-2026-10-13-t055-verification-evidence" + }, + "2026-10-13-t056-parser-evidence": { + "files": 473, + "bytes": 21792904, + "anchor": "dataset-2026-10-13-t056-parser-evidence" + }, + "2026-10-15-phase-b2-track2-final-evidence": { + "files": 19, + "bytes": 2152075, + "anchor": "dataset-2026-10-15-phase-b2-track2-final-evidence" + }, + "2026-10-15-t056-integration-evidence": { + "files": 243, + "bytes": 109171970, + "anchor": "dataset-2026-10-15-t056-integration-evidence" + } + }, + "assets": { + "candidate-files.json": { + "id": 645229556, + "bytes": 201510, + "sha256": "84b694430893470c42558f24f74e396a2eb3eb185dc26b4ccc3a6e417118eb19", + "url": "https://github.com/HodeTech/Tyrne/releases/download/evidence-pr-49-2026-10-16/candidate-files.json" + }, + "commit-map.txt": { + "id": 645229561, + "bytes": 12427, + "sha256": "8a768c3f5158efc8a7cb6cf8a2d9d95eb92237574cdb151b3fcac226a977888e", + "url": "https://github.com/HodeTech/Tyrne/releases/download/evidence-pr-49-2026-10-16/commit-map.txt" + }, + "manifest.json": { + "id": 645250317, + "bytes": 1447, + "sha256": "e16420553ed7ec8b5f6903eb81a84a7945ed818a5c650607fb86ea3ca7cb6320", + "url": "https://github.com/HodeTech/Tyrne/releases/download/evidence-pr-49-2026-10-16/manifest.json" + }, + "payloads.tar.gz": { + "id": 645229558, + "bytes": 66475418, + "sha256": "032b586ec81c38d37d45f5076c628707a3b35484da4388499f1d9896c44e3117", + "url": "https://github.com/HodeTech/Tyrne/releases/download/evidence-pr-49-2026-10-16/payloads.tar.gz" + }, + "pre-rewrite-development.bundle": { + "id": 645229599, + "bytes": 63861764, + "sha256": "4a1bd4f426eddb9301062a5a8f136311983ef7a1cf342f1535d4133ca6e7c73c", + "url": "https://github.com/HodeTech/Tyrne/releases/download/evidence-pr-49-2026-10-16/pre-rewrite-development.bundle" + }, + "provenance.tar.gz": { + "id": 645250316, + "bytes": 716265, + "sha256": "eeea6dd85889480d9a6841784c58afa0ec2073267f4d0f811bceaebb0b0f1587", + "url": "https://github.com/HodeTech/Tyrne/releases/download/evidence-pr-49-2026-10-16/provenance.tar.gz" + }, + "recovery.txt": { + "id": 645233338, + "bytes": 3408, + "sha256": "1ad0ebdf695b669ed1271c9143d261278982e0a709e1e03ad373d5c957ae0b98", + "url": "https://github.com/HodeTech/Tyrne/releases/download/evidence-pr-49-2026-10-16/recovery.txt" + }, + "SHA256SUMS": { + "id": 645250313, + "bytes": 678, + "sha256": "516025119ccb184a22b8c64719d20e4f522b60daafb6178393b921c5384e5b93", + "url": "https://github.com/HodeTech/Tyrne/releases/download/evidence-pr-49-2026-10-16/SHA256SUMS" + }, + "trial-validation.json": { + "id": 645229606, + "bytes": 1169, + "sha256": "bad883f58ef929cfa5d60398c678d91fd0d09638da6e68a4f20a6cbace01d92a", + "url": "https://github.com/HodeTech/Tyrne/releases/download/evidence-pr-49-2026-10-16/trial-validation.json" + } + }, + "public_recovery_verification": { + "download": "public-download", + "assets": 9, + "recovered_tip": "6c84f0d51820f858b31789ad51ecb612ed74e186", + "payloads_tar_and_recovered_clone_verified": 804, + "payload_bytes": 134293614, + "complete_bundle_fsck_pass": true, + "original_executed_tip_recoverable": true + }, + "citation_migration": { + "links": 348, + "documents": 46, + "exact_reverse_checks": 46, + "source": "trial-filtered tip plus committed citation migration; not a current-file hash claim" + } +} diff --git a/docs/analysis/reports/2026-10-16-pr49-evidence-catalog.md b/docs/analysis/reports/2026-10-16-pr49-evidence-catalog.md new file mode 100644 index 00000000..860507c3 --- /dev/null +++ b/docs/analysis/reports/2026-10-16-pr49-evidence-catalog.md @@ -0,0 +1,95 @@ +# Recover PR #49 review evidence + +Readers of historical review/task records can recover exact raw evidence and original source from the verified immutable archive. Canonical Markdown reports remain in Git; their findings, verdicts, measurements, procedural limits and original execution SHA identities are preserved. + +## Archive and source identities + +The [evidence-only release](https://github.com/HodeTech/Tyrne/releases/tag/evidence-pr-49-2026-10-16) is immutable, prerelease and not latest. Its tag anchors clean main `c16997e`; GitHub's automatic source ZIP/tar describes that main anchor. Use the attached **pre-rewrite-development.bundle** for original development. No Tyrne product version or maintainer-key signature is asserted. + +Original executed PR tip: `97dbcd16f1d9ed1f6e620bc17aa5349fe907c1a4`. Governance-inclusive archive tip: `6c84f0d51820f858b31789ad51ecb612ed74e186`. Trial filtered tip: `32bdc16e4f19a654fda19abc202d3b4ad496d406`. The [compact machine catalog](2026-10-16-pr49-evidence-catalog.json) pins every asset ID, size and SHA-256 and all 151 commit mappings. An all-zero new hash denotes the one removed evidence-only commit. Later maintenance commits are not rewritten by this map. + +Historical SHA literals remain original execution identities. A mapped commit is not a claim that a historical test ran on the mapped hash. Restore the bundle and use `git show :` for original evidence, including reports whose live navigation was migrated. The [recovery guide](../../guides/review-evidence.md) provides tested commands and contributor synchronization guidance. + +## Verified assets + +All nine assets were downloaded without repository credentials after publication, digest checked, and used to recover the complete old source plus all 804 payloads (134,293,614 bytes). The recovered bundle passes full Git integrity checks. This does not promise GitHub hidden-ref/cache erasure. + +| Asset | Bytes | SHA-256 | +|---|---:|---| +| [SHA256SUMS](https://github.com/HodeTech/Tyrne/releases/download/evidence-pr-49-2026-10-16/SHA256SUMS) | 678 | `516025119ccb184a22b8c64719d20e4f522b60daafb6178393b921c5384e5b93` | +| [candidate-files.json](https://github.com/HodeTech/Tyrne/releases/download/evidence-pr-49-2026-10-16/candidate-files.json) | 201510 | `84b694430893470c42558f24f74e396a2eb3eb185dc26b4ccc3a6e417118eb19` | +| [commit-map.txt](https://github.com/HodeTech/Tyrne/releases/download/evidence-pr-49-2026-10-16/commit-map.txt) | 12427 | `8a768c3f5158efc8a7cb6cf8a2d9d95eb92237574cdb151b3fcac226a977888e` | +| [manifest.json](https://github.com/HodeTech/Tyrne/releases/download/evidence-pr-49-2026-10-16/manifest.json) | 1447 | `e16420553ed7ec8b5f6903eb81a84a7945ed818a5c650607fb86ea3ca7cb6320` | +| [payloads.tar.gz](https://github.com/HodeTech/Tyrne/releases/download/evidence-pr-49-2026-10-16/payloads.tar.gz) | 66475418 | `032b586ec81c38d37d45f5076c628707a3b35484da4388499f1d9896c44e3117` | +| [pre-rewrite-development.bundle](https://github.com/HodeTech/Tyrne/releases/download/evidence-pr-49-2026-10-16/pre-rewrite-development.bundle) | 63861764 | `4a1bd4f426eddb9301062a5a8f136311983ef7a1cf342f1535d4133ca6e7c73c` | +| [provenance.tar.gz](https://github.com/HodeTech/Tyrne/releases/download/evidence-pr-49-2026-10-16/provenance.tar.gz) | 716265 | `eeea6dd85889480d9a6841784c58afa0ec2073267f4d0f811bceaebb0b0f1587` | +| [recovery.txt](https://github.com/HodeTech/Tyrne/releases/download/evidence-pr-49-2026-10-16/recovery.txt) | 3408 | `1ad0ebdf695b669ed1271c9143d261278982e0a709e1e03ad373d5c957ae0b98` | +| [trial-validation.json](https://github.com/HodeTech/Tyrne/releases/download/evidence-pr-49-2026-10-16/trial-validation.json) | 1169 | `bad883f58ef929cfa5d60398c678d91fd0d09638da6e68a4f20a6cbace01d92a` | + +## Find an archived member + +Each migrated link title gives its full original repository member path. The [full per-file manifest](https://github.com/HodeTech/Tyrne/releases/download/evidence-pr-49-2026-10-16/candidate-files.json) contains all paths, sizes and SHA-256 values. Download payloads.tar.gz and inspect that member with the recovery guide. Older revisions remain in the Git bundle. + + + +### 2026-10-13-t045-architecture-evidence + +7 archived files, 13260 bytes. Use the link title's exact member path and the full manifest; the archive preserves every original byte. + + + +### 2026-10-13-t047-verification-evidence + +7 archived files, 39314 bytes. Use the link title's exact member path and the full manifest; the archive preserves every original byte. + + + +### 2026-10-13-t049-review-evidence + +7 archived files, 763979 bytes. Use the link title's exact member path and the full manifest; the archive preserves every original byte. + + + +### 2026-10-13-t050-entry-document-evidence + +17 archived files, 23487 bytes. Use the link title's exact member path and the full manifest; the archive preserves every original byte. + + + +### 2026-10-13-t052-t053-verification-evidence + +8 archived files, 111524 bytes. Use the link title's exact member path and the full manifest; the archive preserves every original byte. + + + +### 2026-10-13-t054-verification-evidence + +11 archived files, 165130 bytes. Use the link title's exact member path and the full manifest; the archive preserves every original byte. + + + +### 2026-10-13-t055-verification-evidence + +12 archived files, 59971 bytes. Use the link title's exact member path and the full manifest; the archive preserves every original byte. + + + +### 2026-10-13-t056-parser-evidence + +473 archived files, 21792904 bytes. Use the link title's exact member path and the full manifest; the archive preserves every original byte. + + + +### 2026-10-15-phase-b2-track2-final-evidence + +19 archived files, 2152075 bytes. Use the link title's exact member path and the full manifest; the archive preserves every original byte. + + + +### 2026-10-15-t056-integration-evidence + +243 archived files, 109171970 bytes. Use the link title's exact member path and the full manifest; the archive preserves every original byte. + +## Generation and policy + +Generated by the archived `migrate-citations.py` plus the [reproducible correction](2026-10-16-pr49-evidence-migration.md); both original and corrected script digests are bound in the machine catalog. It used the production Markdown reader, changed 348 recognized destinations in 46 documents, added exact member titles and dated notices, and verified exact reversal to each original document. No historical SHA or verdict text was replaced. [ADR-0044](../../decisions/0044-review-evidence-retention.md) governs storage; [ADR-0043](../../decisions/0043-documentation-corpus-consistency.md) retains corpus/attribution authority. diff --git a/docs/analysis/reports/2026-10-16-pr49-evidence-cleanup.md b/docs/analysis/reports/2026-10-16-pr49-evidence-cleanup.md new file mode 100644 index 00000000..df098f92 --- /dev/null +++ b/docs/analysis/reports/2026-10-16-pr49-evidence-cleanup.md @@ -0,0 +1,148 @@ +# PR #49 evidence cleanup — approval package + +Maintainer approved option B and the attached ADR policy on 2026-10-16. This record preserves the measured 2026-10-15 baseline and execution gates. Implementation and publication are recorded incrementally below; approval alone does not claim delivery. + +## Frozen analysis basis + +- Repository: HodeTech/Tyrne, public; PR49 development → main. +- Main: c16997e003fbd1726d1205734380394781c52002. +- Development: 97dbcd16f1d9ed1f6e620bc17aa5349fe907c1a4; clean and equal to origin/development. +- PR: 1,008 changed files, +956,905 / -3,003. +- Candidate migration: exactly804 non-Markdown report files introduced in this PR,134,293,614 current-tree bytes,+927,770 lines. No extra historical-only non-Markdown report path was found in the145-commit range. +- Projection after that migration alone:204 changed files,+29,135/-3,003. Policy, catalogs, citation edits and cleanup reviews will add their own small diff. Working delivery budget: fewer than250 changed files and40,000 additions; report actual counts before publication instead of treating this projection as a guarantee. +- Remaining complete tracked tree before new policy changes:10,697,725 bytes. Reports subtree:478,307 bytes. Largest retained blob:576,155 bytes. +- Existing packed Git object store:63.50MiB. This is compressed history, not the134MB current payload size. +- Dependency analysis:348 recognized local links from46 Markdown documents point to the804 candidates.131 Markdown documents contain1,830 occurrences of129 distinct original unmerged commit identities. Preserve original identities with provenance/recovery mapping; do not replace all1,830 literals with rewritten hashes. +- Repository API: squash/rebase/merge methods enabled; development unprotected; no releases; release immutability disabled. Actions retention90days; smoke/performance workflow artifacts explicitly14days. No retention/branch protection change is proposed except explicit release immutability below. + +The exact804-file path/size/SHA256 inventory is the external per-file candidate inventory. the external dependency inventory contains the actual link and source-identity occurrences. Neither file is committed; they are analysis inputs for the approval package. + +## Alternatives + +A. Durable archive + normal deletion commit. Removes bulk from the PR's final diff without a force push. Squash merging a clean final tree can keep the old unmerged commits out of main ancestry, but development remains a published ref carrying the bulk, so ordinary full clones still receive that ancestry. + +B. Durable archive + narrow rewrite of unmerged development history — recommended. Removes bulk from both the PR diff and advertised development ancestry. Original history survives in an external, verified bundle; meaningful commit ordering is retained, with empty evidence-only commits handled explicitly. Requires one-time development-only force-with-lease authorization and collaborator synchronization. + +C. Git LFS migration. Adds contributor/storage tooling obligations and still needs old Git-history handling. It is unnecessary for archival review streams and is not recommended here. + +GitHub PR refs/caches may retain previous objects even after optionB. Server-side physical erasure or immediate repository-size-accounting reduction is not promised. The measurable acceptance criterion is clean advertised branch/tag ancestry and a fresh ordinary clone, not inaccessible GitHub internal storage. + +## Proposed durable delivery and policy + +Keep all canonical Markdown reports/reviews, original findings/verdicts/severities/measurements, all six checker/test files, source comments, CI behavior and compact archive metadata in Git. Move the804 payloads byte-for-byte. The full archive includes raw originals, intermediate stages, previous source exports, decoder scripts and existing encoded bundles; do not discard unique evidence merely because it is redundant for everyday review. + +Create a dedicated GitHub evidence release, draft first, prerelease and not latest, plus a verified independent local copy outside the repository. Suggested tag: evidence-pr-49-2026-10-16, pointing only to already-clean main c16997e. Its automatic source archive is that main anchor; the attached Git bundle is the authoritative old development source. Do not tag the bloated original tip. + +The evidence-only release is archival hosting under [ADR-0044](../../decisions/0044-review-evidence-retention.md), with no product version, image, ABI/support claim, first product release or maintainer-key signature assertion. Its contract is immutable bytes, digests, historical provenance and verified restoration. Product release gates/signing remain mandatory; a minimal [release-standard](../../standards/release.md) scope pointer follows Acceptance and precedes publication. + +Enable repository release immutability before publication. This applies to future releases; there are currently none. Upload all assets before publication, verify download digests and restoration, publish, then verify immutable status and tag anchor. Any unavailable immutable publication or failed restoration stops removal/ref replacement; do not fall back silently to expiring Actions artifacts. + +Proposed in-Git limits:1MiB per tracked blob;512KiB aggregate non-Markdown content under docs/analysis/reports/;128KiB archive catalog. Add a separate footprint command/test in the existing lint job, leaving check-docs.py's offline/no-Git contract and all six required app15368 context identities intact. One-time maintenance tooling outside project dependencies may be needed: git-filter-repo is currently not installed. Pin and verify its primary-source version/digest before isolated use. + +The complete proposed decision is [ADR-0044](../../decisions/0044-review-evidence-retention.md). It is filed Proposed with this plan; a separate Acceptance commit follows both fresh review rounds. Execution will record approved maintenance criteria under existingT049/T056, and preserve ADR0043. The package adds no phase task, does not implementT038 and does not promote tasks toDone. + +## Ordered approved execution + +1. **Freeze and create tested local recovery.** Recheck clean worktree, exact local/remote development tip, advertised main and all advertised refs. Record the unchanged pre-existing local main separately; it is not the remote PR base. Stop on drift. Create a self-contained original development bundle and payload manifests outside the working tree; verify bundle integrity, clone/recover original source and all804 payloads, and hash-check every recovered file. Save PR metadata and original final CI/API/log proof before retention expiry. No new backup branch/tag in the source remote. + +2. **File and settle the approved decision.** Commit the proposed ADR separately from Acceptance, complete the deliberate reread and required review discipline, then record approved followup criteria forT049/T056 and operative roadmap state. Material proposal changes return for approval. No standard/guard implementation precedes the accepted decision. + +3. **Prepare the archive and trial rewrite without replacing published refs.** Freeze the post-governance tipA. Create a self-contained pre-rewrite bundle ofA, which includes original97 and the approved governance commits. This bundle is independent of the later in-Git catalog, avoiding self-referential hashes. In an isolated copy using the same development name, filter only the enumerated804 paths in main-base..A; never rewrite main or unrelated refs. Generate the original-to-proposed commit map, compare every noncandidate path at mapped trees, inspect empty-commit handling and confirm the main anchor unchanged. Package the bundle, original payload snapshot, full external per-file manifest, map, provenance and recovery instructions. + +4. **Publish and verify the durable archive.** Create the draft evidence release at the clean main anchor, upload the complete assets, download all assets to a distinct location, verify hashes and restore old source/individual evidence from the downloaded copy. Publish only once complete, confirm immutable assets/tag and retain a second local copy outside Git. Do not replace actual development refs or remove payloads before this gate succeeds. + +5. **Apply the bounded rewrite locally and reconcile citations.** Only after verified archival, adopt the trial-filtered development tip locally; do not switch to another branch. Immediately repair the348 citations/46 documents to the archive catalog/verified external destinations, preserving old text in the archive and dating migration notices. Preserve historical SHA literals and provide their recovery/map context. Add compact catalog and restore instructions. No broken intermediate local state is pushed. New maintenance commits/reviews occur after the rewrite, so their source hashes will not themselves be rewritten later. + +6. **Prevent recurrence and review the new work.** Add the separate footprint check, meaningful small temporary-fixture negative/positive tests, existing-lint-job wiring, minimal standards/skill guidance and correct current-state updates. Verify all804 archived/recovered bytes, retained source/fixture blobs against original97, original historical assertions and all new citations. Run the existing161/124 fixture suites and whole docs corpus on both supported local runtimes, the new guard tests/negative probes, appropriate syntax checks and diff checks. Each implementation step follows commit → fresh complementaryR1 → validated fixes/commit → different freshR2 → validated fixes/commit. Review records/essential summaries stay within the approved budget; scratch exports go outside Git. + +7. **Validate the final candidate before remote replacement.** Confirm no migrated payload path remains reachable through the proposed development ancestry; inspect retained blob size limits, compact catalog, full file membership, source equivalence,145-original-commit provenance and unchanged main/other refs. Use clean isolated clones/copies for recovery and object inventory; do not expire reflogs, prune backups or run aggressive GC in the maintainer's working repository. Freeze new tipF. + +8. **Publish exactly development with a lease, then verify final hosted gates.** Recheck that origin/development is still the approved original97. Publish F using an explicit refs/heads/development lease expecting97; no mirror/blanket force push and no main/other-ref change. A lease mismatch stops. Verify PR49 remains development→main, updated diff/budget, all seven hosted jobs and six exact app-bound required contexts, new footprint rejection controls, unchanged protection and a fresh ordinary remote clone. Record actual final source/results in PR49; tasks return InReview. Maintainer SECURITY wording review and merge remain separate. + +## Recovery and approval boundary + +Before publication, restore from the verified original/pre-rewrite bundle if a local ref/tree operation fails. The remote remains original97 until step8. After publication, ordinary fix commits are preferred for a CI defect; a necessary emergency rollback to original97 is restricted to development and an exact lease on the observed new tip. The proposed authorization includes that narrowly scoped rollback, not arbitrary future force pushes. Keep the verified archive/backups until the maintainer confirms the resulting PR and recovery path. + +Approval of optionB includes the attached ADR policy,804-file relocation/citation migration, dedicated public evidence release and immutable-release setting, one-time bounded development rewrite/lease publication and scoped rollback, separate footprint guard, and the original two-round review discipline. It excludes mergingPR49, changing main/protection/other refs, deleting canonical verdicts, claiming historical tests ran on rewritten hashes, accessing private notes, or starting later phase work. + +## Primary references + +- Git bundle: https://git-scm.com/docs/git-bundle +- git-filter-repo: https://github.com/newren/git-filter-repo/blob/main/Documentation/git-filter-repo.txt +- GitHub release immutability: https://docs.github.com/en/code-security/how-tos/secure-your-supply-chain/establish-provenance-and-integrity/prevent-release-changes +- Managing release assets: https://docs.github.com/en/repositories/releasing-projects-on-github/managing-releases-in-a-repository +- Actions retention: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository +- GitHub old-ref/cache limits: https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository + +## Execution checkpoints + +### Recovery baseline — 2026-10-16 + +At original `97dbcd16f1d9ed1f6e620bc17aa5349fe907c1a4`, the clean development worktree and open PR #49 match the frozen source. A self-contained bundle was verified and independently cloned; all 804 payloads were SHA-256 checked both from the tar archive and recovered clone. The protected main definition and original hosted proof are retained outside Git. + +| Asset | Bytes | SHA-256 | +|---|---:|---| +| Original development bundle | 63841865 | `a622d9e31929132c547d7b1a32a56aba31523338e81762c4004d64c8a6f5d0f9` | +| Payload archive | 66475418 | `032b586ec81c38d37d45f5076c628707a3b35484da4388499f1d9896c44e3117` | + +Local recovery is verified; durable public publication, history migration, footprint guard, hosted final-tip checks and maintainer review remain pending. Implementation review units are governance/recovery (steps 1–2), archive/migration/citations (steps 3–5), and prevention/final validation (steps 6–8). Each unit has its own committed source, two different fresh complementary rounds, validated correction commits and explicit disposition before the next unit. Publication is gated by completed local reviews. + +### Governance R1 correction — 2026-10-16 + +Both independent first-round reviewers requested one Medium clarification (GR1-C01 / INT-R1-01): define evidence hosting relative to the product-release signing/gates standard. The Proposed ADR and plan now define the approved evidence-only profile and ground its post-Acceptance standard pointer in T-056. No signature, product release or broadened remote-ref authorization is claimed. Independent committed-fix verification and a different fresh second round remain required before Acceptance. + +### Governance/recovery review boundary — 2026-10-16 + +[Both fresh complementary rounds](../reviews/code-reviews/2026-10-16-pr49-evidence-governance.md) close the single Medium release-scope group at94fd86c; all six complete initial/fix reports and digests are preserved. Deliberate end-to-end reread confirms actual task dependencies, costs and ADR-0043 compatibility. Separate Acceptance and dependent implementation follow; no public archive, migration or new hosted result is yet claimed. + +### Decision Acceptance — 2026-10-16 + +ADR-0044 is Accepted in a separate commit after the actual reread and both fresh complementary review rounds. The maintainer approved this policy and bounded execution in chat. This records decision authority only; the archive/migration/prevention delivery gates remain pending. + +### Archival execution starts — 2026-10-16 + +T-049/T-056 are In Progress for approved maintenance; the task index, delimited live state and track pointer agree. The narrow release-standard scope pointer follows actual Acceptance and precedes publication. The next frozen pre-rewrite source includes these governance/status changes; no payload removal or remote development replacement has occurred. + +### Durable archive and local migration — 2026-10-16 + +The [actual migration record](2026-10-16-pr49-evidence-migration.md) binds immutable publication, both downloaded recovery checks,150 mapped-tree comparisons, exact local-only adoption and348/46 reversible citation repair. The original generator failure and complete reproducible correction are explicit. Remote development remains original97; both migration rounds, footprint implementation and final hosted publication remain pending. + +### Migration R1 correction — 2026-10-16 + +Fresh CODE R1 reported Low MRC1-01: current/phase pointers still described actual completed archival/local migration as pending. Complementary integrity R1 independently approved archive/map/citation integrity. Live pointers now separate completed immutable publication/local migration from review/prevention/remote lease/hosted gates; guide status avoids a stale per-round claim. The initial byte-reversal proof remains bound to migration commit86484e6; this later status-only correction is explicit. Original reports/verdicts remain unchanged. + +An ordinary full Git-transport clone of86484e6 with local object-store copying disabled has no candidate paths in any fetched ref, passes full Git integrity, and uses a5.93MiB pack (original measured pack63.50MiB). Full docs output is identical on Python3.9/3.13:405 files/7285 targets/1273 fragments/zero findings. This is a local source-clone result; final ordinary remote clone and hosted source remain pending. + +### Archive/citation unit closes — 2026-10-16 + +[All six complete reports](../reviews/code-reviews/2026-10-16-pr49-evidence-migration.md) preserve both fresh complementary rounds and Low MRC1-01 fix verification at3a17c3d. No unresolved finding. T-049 maintenance criteria are checked and it returns In Review; T-056 remains In Progress. The separate footprint guard/CI/review/final lease/hosted/remote-clone gates are next. No extra rewrite or merge is performed by this closure. + +### Prevention/final-validation preflight — 2026-10-16 + +The approved limits will cover indexed blobs and every complete HEAD-history snapshot, so adding an oversized artifact and deleting it in a later commit cannot evade delivery checks. Report aggregate is512KiB per snapshot; each Markdown/JSON evidence-catalog pair totals at most128KiB; each tracked blob at most1MiB. Gitlinks store only an external commit identity and are not parent-repository blobs. The separate Git/stdlib command reads objects, ignores untracked/worktree-only content and refuses shallow/promisor inputs instead of silently reducing history or lazily fetching. The existing lint checkout gains full history; no required context/app identity, runtime dependency, admin credential or check-docs contract changes. + +Meaningful temporary Git fixtures will cover inclusive boundaries, aggregate/pair limits, commit-then-delete history, staging versus worktree, symlinks/Gitlinks, invalid roots/unmerged index and incomplete history, deterministic JSON/default root behavior and offline failure. No alternate project branch or committed negative probe. Documentation/standards/common review skill receive minimal Accepted ADR-0044 guidance. Both fresh prevention review rounds, final exact-lease publication, all hosted gates and ordinary remote clone remain required. + + +### Prevention implementation validation — 2026-10-16 + +At preflight HEAD803ff08 with the staged prevention change, both Python3.9.6 and3.13.14 pass the existing161 navigation/reader and124 metadata methods. The separate footprint suite passes21 real temporary-Git methods on each runtime. Author self-review reproduced a legacy info/grafts false green: an oversized committed-then-deleted artifact became hidden. Its new isolated regression first failed (exit0 instead of2), then passes after explicit graft-file rejection; original replacement-object suppression remains independently tested. This is new author verification, not a claim about historical execution or a substitute for either fresh review round. + +The guard streams one complete tree at a time, caches unique blob sizes, reads indexed objects and rejects incomplete/alternate ancestry views. Existing lint checkout gains full history and two failing footprint steps; credentials remain unpersisted and permissions/job identities unchanged. Minimal Accepted ADR-0044 guidance is wired into documentation/infrastructure standards, the CI guide and common review skill. No production Rust, unsafe, dependency, parser or branch-protection change. Both fresh prevention rounds and final candidate/remote lease/hosted/ordinary remote-clone gates remain required; T-056 stays In Progress. + + +### Prevention R1 correction — 2026-10-16 + +Both fresh independent initials at2d83602 requested the same Low group (PRC1-01/PIR1-01): Python3.9 Path.resolve raises RuntimeError for a symlink-loop root, escaping the documented invalid-input JSON/exit2 boundary. Coordinator independently reproduced3.9 exit1/traceback and3.13 exit2, then added a real public-CLI regression which failed before the repair. The narrow root-resolution boundary now converts that exception to InputError; both runtimes pass all22 footprint methods. Existing policy findings retain exit1 and no storage limit or ancestry check is weakened. Actual same-context committed-fix verification/peer reconciliation, a different fresh full second round and final publication/hosted/clone gates remain pending. Initial verdicts and original failed-before observations remain preserved. + + +### Prevention R2 correction — 2026-10-16 + +Different fresh CODE R2 initially approvedfb9e4b9 with zero findings; fresh integrity R2 independently requested one Medium PIR2-01. A checksum-valid inconsistent commit-graph cache truncates cached HEAD parents, hiding an oversized committed-then-deleted ancestor. Coordinator independently reproduced both-runtime exit0 (one cached commit versus three raw commits), with Git's cache verifier reporting inconsistency. The first scratch mutation needed owner-write permission on the disposable cache; no project cache was touched. New public-CLI regression fails againstfb9e4b9 on both runtimes before the fix. + +The Git read wrapper now explicitly sets core.commitGraph=false, so ancestry/tree metadata comes from actual commit objects. The regression constructs the documented Git cache format with a valid checksum and inconsistent parents, without altering stored commits; source attribution must still identify the original oversized commit. This does not claim normal tracked PR content can install a cache on clean CI, or introduce an object-authenticity guarantee. [Git configuration](https://git-scm.com/docs/git-config) and [cache format](https://git-scm.com/docs/gitformat-commit-graph) ground the narrow remedy/fixture. Both supported local runtimes pass all23 footprint methods after the repair. Actual same-R2 committed-fix verification and post-freeze peer reconciliation remain required; the initial Approve/Request changes are preserved, and final lease/hosted/clone gates remain pending. + + +### Prevention review boundary — 2026-10-16 + +[All eight complete original reports](../reviews/code-reviews/2026-10-16-pr49-evidence-prevention.md) and their independently verified digests preserve both fresh complementary rounds, Low `fb9e4b9` and Medium `588edbf` actual committed-fix/peer reconciliation. Both groups are closed; zero unresolved. Current guide/standards/skill and full-history required-job wiring implement Accepted ADR-0044. Final candidate validation, exact development-only lease, actual hosted gates and ordinary remote clone remain; T-056 stays In Progress until those delivery gates pass. No further rewrite is planned for new maintenance commits. diff --git a/docs/analysis/reports/2026-10-16-pr49-evidence-migration.md b/docs/analysis/reports/2026-10-16-pr49-evidence-migration.md new file mode 100644 index 00000000..8a697184 --- /dev/null +++ b/docs/analysis/reports/2026-10-16-pr49-evidence-migration.md @@ -0,0 +1,83 @@ +# PR49 evidence archive and citation migration + +This records the actual archive/recovery gates, bounded local history adoption and lossless navigation migration under Accepted ADR-0044. It preserves the initial generator failure and its reproducible correction; both fresh complementary migration review rounds and the prevention/final hosted unit remain pending. + +## Verified boundaries + +- Original executed tip: `97dbcd16f1d9ed1f6e620bc17aa5349fe907c1a4`; main anchor: `c16997e003fbd1726d1205734380394781c52002`. +- Governance-inclusive archival tip: `6c84f0d51820f858b31789ad51ecb612ed74e186`; trial/adopted local tip: `32bdc16e4f19a654fda19abc202d3b4ad496d406`. +- [Immutable evidence release](https://github.com/HodeTech/Tyrne/releases/tag/evidence-pr-49-2026-10-16), release ID414293393, nine assets. GitHub reports immutable:true, draft:false, prerelease:true; the evidence tag points only to clean main. Product release/version/signature claims remain outside this archive profile. +- Complete draft download and a separate post-publication download from all browser asset URLs without credentials/cookies/Authorization headers pass published-size and SHA-256 checks. Each downloaded bundle independently clones/restores the governance-inclusive tip, passes full Git integrity checks and recovers original97; all804 tar members and recovered payload files match the original manifest,134293614 bytes. Original local bundle and independent local copies remain outside Git. +- Isolated filtering covered151 commits (145 original plus six governance);150 retained mapped trees equal the original tree minus only804 approved paths. Messages/authors/committers are unchanged. One evidence-only commit `2b62391386c7d0d90e41abb86348c2d1d1506eb6` became empty; main's object/tree remains unchanged. No candidate path is reachable through filtered development. +- Only after verified immutable publication/public recovery was filtered development adopted locally. Other local heads/tags remain unchanged; remote development remains original97. No reflog expiry, aggressive GC, remote backup ref or hidden GitHub object-purge claim. + +## Citation preservation + +The [catalog](2026-10-16-pr49-evidence-catalog.md) and [machine catalog](2026-10-16-pr49-evidence-catalog.json) provide asset IDs/digests, all151 mappings, ten dataset groups and exact-member recovery. Production Markdown-reader enumeration identifies348 links in46 documents. Every destination now reaches its catalog group; link titles retain the complete original member path. Each document has a dated migration notice. + +All46 documents were reversed by removing exactly that notice and replacing the new destination/title on its original line; every original byte is recovered. Original verdicts, severities, measurements, limitations and SHA literals are unchanged. No performance-review narrative or Accepted ADR body is part of those46 files. The six existing checker/fixture blobs and both Rust doc-comment files remain byte-equal to original97. The [recovery guide](../../guides/review-evidence.md) and guide/review indexes make recovery discoverable. The catalog pair totals26796 bytes before later reviewed corrections, below128KiB; the full804-file inventory stays external. + +## Generator correction and reproducibility + +The archived initial `migrate-citations.py` used the ordinary local-target resolver after approved payload removal. That resolver correctly rejected a now-missing archived path, so the helper stopped before changing any document. The pre-migration full checker reported348 missing local targets; its tool output was truncated, so only the reported count is retained here, not a claim to have independently read a complete initial diagnostic stream. No broken intermediate source was pushed. + +The corrected generator uses the ordinary resolver first. On its missing-target error, it lexically normalizes the destination and permits only exact membership in the already-approved804-path inventory; any other failure is re-raised. This only identifies citations for migration; it does not alter or bypass the delivered documentation checker. The complete patch below also makes generator provenance honest: original archived source plus this committed correction, each digest-bound in the machine catalog. + +- Original archived script SHA-256: `3954232d9e7c06f1e04bc89b13d126409f34eb235514383c7764822c28375630`. +- Corrected script SHA-256: `337ace0b3dba02eca903e9e357865eef232ec2733650c76efe138fb0544a4308`. + +The patch was generated with Python difflib and applied to an independent original-script copy with the system patch tool; the reconstructed bytes exactly equal the executed corrected script. The archive remains immutable; its original script was not overwritten. This report contains the full correction, not a new source-tree export. + +````diff +--- migrate-citations.py ++++ migrate-citations.py +@@ -7,6 +7,7 @@ + import hashlib + import json + import os ++import posixpath + from pathlib import Path + import re + import subprocess +@@ -54,7 +55,15 @@ + continue + target = value.partition("#")[0].partition("?")[0] + if target: +- resolved = resolve_path(ROOT, source, unquote(target)).as_posix() ++ try: ++ resolved = resolve_path(ROOT, source, unquote(target)).as_posix() ++ except ValueError: ++ # Only the exact approved missing archival paths are eligible. ++ decoded = unquote(target) ++ resolved = posixpath.normpath(decoded.lstrip("/") if decoded.startswith("/") ++ else posixpath.join(posixpath.dirname(source), decoded)) ++ if resolved not in paths: ++ raise + if resolved in paths: + assert link.kind == "markdown" + links[(source, link.line, value, resolved)] += 1 +@@ -99,7 +108,9 @@ + mapping = dict(line.split() for line in (ARCHIVE / "commit-map.txt").read_text().splitlines()[1:]) + catalog = {"schema_version": 1, "purpose": "PR49 immutable evidence archive", + "generated_by": {"asset": "provenance.tar.gz", "member": "migrate-citations.py", +- "script_sha256": hashlib.sha256(Path(__file__).read_bytes()).hexdigest()}, ++ "original_script_sha256": hashlib.sha256((ARCHIVE / "migrate-citations.py").read_bytes()).hexdigest(), ++ "correction_record": "docs/analysis/reports/2026-10-16-pr49-evidence-migration.md", ++ "corrected_script_sha256": hashlib.sha256(Path(__file__).read_bytes()).hexdigest()}, + "release": {"id": release["id"], "tag": TAG, "url": release["html_url"], "immutable": True, + "main_anchor": "c16997e003fbd1726d1205734380394781c52002"}, + "original_executed_tip": ORIGINAL, "pre_rewrite_tip": PRE, "trial_filtered_tip": FILTERED, +@@ -125,7 +136,7 @@ + text += "\n## Find an archived member\n\nEach migrated link title gives its full original repository member path. The [full per-file manifest](" + asset_rows["candidate-files.json"]["url"] + ") contains all paths, sizes and SHA-256 values. Download payloads.tar.gz and inspect that member with the recovery guide. Older revisions remain in the Git bundle.\n\n" + for dataset, group in sorted(groups.items()): + text += '\n\n### ' + dataset + "\n\n" + str(group["files"]) + " archived files, " + str(group["bytes"]) + " bytes. Use the link title's exact member path and the full manifest; the archive preserves every original byte.\n\n" +-text += "## Generation and policy\n\nGenerated by `migrate-citations.py`, retained as an inspectable member of provenance.tar.gz and digest-bound in the machine catalog. It used the production Markdown reader, changed 348 recognized destinations in 46 documents, added exact member titles and dated notices, and verified exact reversal to each original document. No historical SHA or verdict text was replaced. [ADR-0044](../../decisions/0044-review-evidence-retention.md) governs storage; [ADR-0043](../../decisions/0043-documentation-corpus-consistency.md) retains corpus/attribution authority.\n" ++text += "## Generation and policy\n\nGenerated by the archived `migrate-citations.py` plus the [reproducible correction](2026-10-16-pr49-evidence-migration.md); both original and corrected script digests are bound in the machine catalog. It used the production Markdown reader, changed 348 recognized destinations in 46 documents, added exact member titles and dated notices, and verified exact reversal to each original document. No historical SHA or verdict text was replaced. [ADR-0044](../../decisions/0044-review-evidence-retention.md) governs storage; [ADR-0043](../../decisions/0043-documentation-corpus-consistency.md) retains corpus/attribution authority.\n" + (ROOT / catalog_path).write_text(text, encoding="utf-8") + assert (ROOT / catalog_path).stat().st_size + (ROOT / catalog_json_path).stat().st_size <= 128 * 1024 + guide = """# Recover archived review evidence +```` + +## Pending review and delivery + +The current source is the adopted filtered tip plus this committed migration. Archive/citation review R1 and different fresh R2, validated corrections and their canonical record follow. T-049/T-056 remain In Progress. The separate footprint guard, final clean clone, exact lease publication and final hosted source are still pending; no Done or merge is claimed. diff --git a/docs/analysis/reports/perf-baseline-2026-10-12-t035-main-dispatch-check.md b/docs/analysis/reports/perf-baseline-2026-10-12-t035-main-dispatch-check.md new file mode 100644 index 00000000..2f4e5821 --- /dev/null +++ b/docs/analysis/reports/perf-baseline-2026-10-12-t035-main-dispatch-check.md @@ -0,0 +1,102 @@ +# Boot-to-end perf baseline — 2026-10-12 — ci-nightly + +Generated by `tools/perf-harness.sh` — multi-run aggregation of the kernel's +`boot-to-end elapsed = X ns` emission (P10 from the [2026-05-06 Track D +review](../reviews/code-reviews/2026-05-06-full-tree/track-d-performance.md)). + +## Inputs + +| Field | Value | +|-------|-------| +| Run timestamp (UTC) | `2026-10-12T07:27:40Z` | +| Iterations requested | 20 | +| Iterations valid | 20 | +| Iterations failed | 0 | +| Per-run timeout | 5 s | +| Build profile | debug | +| Kernel ELF | `target/aarch64-unknown-none/debug/tyrne-bsp-qemu-virt` | +| Git HEAD | `c16997e003fbd1726d1205734380394781c52002` on `main` | +| Tracked worktree | clean | +| Rust compiler | `rustc 1.94.0-nightly (86a49fd71 2026-01-14)` | +| Active toolchain | `nightly-2026-01-15-x86_64-unknown-linux-gnu` | +| QEMU | `QEMU emulator version 8.2.2 (Debian 1:8.2.2+ds-0ubuntu1.18)` | +| Host OS / release / machine | `Linux 6.17.0-1022-azure x86_64` | +| Wall-clock (full harness run) | 101 s | + +## Methodology + +Each iteration invokes `tools/run-qemu.sh` under a per-run watchdog; +QEMU emits the boot trace through to `tyrne: all tasks complete` plus +the `boot-to-end elapsed = X ns` line, then keeps spinning. The watchdog +kills the QEMU process after the per-run timeout (the kernel never +exits on its own). The integer ns delta is parsed out of stdout. + +Counter source: the kernel's `now_ns()` (`hal::Timer`) reads the EL1 +virtual generic-timer counter and converts to nanoseconds via the +cached `CNTFRQ_EL0` resolution. Under QEMU TCG the counter advances +based on emulated instructions rather than wall-clock time, so +variance reflects translation-cache behaviour and host scheduler +jitter, not real hardware performance. + +Statistics are computed across the valid samples only. Percentile +convention is *nearest-rank* (1-indexed; `idx = ceil(p/100 * n)`). +Stddev is the population formula (`n` divisor) — descriptive. + +**Note on p99 at small `n`.** Under nearest-rank, `p99 = a[ceil(0.99 * +n)]`; for any `n < 100` the index rounds up to `n` and `p99 == max` +by construction. The number is reported as-computed (matching p10 / +p50 / p90's convention) but readers should not over-read it as a +tail-latency signal at small `n`. At `n = 100`, rank 99 selects +the second-highest sample. For `n >= 100`, the selected rank is +below `n`; tied values can still equal the maximum. This rank +transition alone establishes no statistical reliability. Interpret +tail estimates with the sample count and measurement context. + +## Metric — boot-to-end elapsed (nanoseconds) + +| Statistic | ns | ms | +|-----------|---:|---:| +| min | 8,350,400 | 8.350 | +| p10 | 8,470,496 | 8.470 | +| p50 | 9,079,824 | 9.080 | +| p90 | 10,252,512 | 10.253 | +| p99 | 12,763,984 | 12.764 | +| max | 12,763,984 | 12.764 | +| mean | 9,423,170 | 9.423 | +| stddev | 1,036,612 | 1.037 | + +## Raw samples + +One ns value per line, in iteration order (NOT sorted): + +```text +8350400 +10701952 +9442768 +9958032 +9079824 +8495392 +9565600 +8470496 +8513552 +10151040 +9725456 +9919664 +8985040 +8682704 +8530160 +9680112 +12763984 +10252512 +8580624 +8614080 +``` + +## Verdict + +Baseline only — no proposal under measurement. Cite the band above +(p10 / p50 / p90) when comparing later changes against this snapshot. +Single-run boot-to-end claims in PR bodies should be replaced with a +fresh harness run when a non-trivial perf-relevant change lands; see +[`docs/standards/infrastructure.md`](../../standards/infrastructure.md) +§"Performance harness". diff --git a/docs/analysis/reviews/README.md b/docs/analysis/reviews/README.md index 13b6f9a9..90962427 100644 --- a/docs/analysis/reviews/README.md +++ b/docs/analysis/reviews/README.md @@ -1,10 +1,10 @@ # Reviews -Tyrne runs four kinds of reviews, each addressing a distinct concern. Each review type has its own folder with a master plan describing the multi-agent procedure and a log of dated review artifacts. +Tyrne has four event-triggered review types and an on-demand whole-tree master-review family. The four types have master plans and dated canonical artifacts; master reviews use a timestamped run layout with a consolidated report and supporting tracks. Reviews are **event-triggered**, not calendar-triggered. See each type's README for its specific triggers. -## The four types +## Review families | Type | Folder | Concern | Trigger | |------|--------|---------|---------| @@ -12,10 +12,11 @@ Reviews are **event-triggered**, not calendar-triggered. See each type's README | **Code** | [`code-reviews/`](code-reviews/) | Per-change code quality: correctness, style, test coverage, documentation. | Per non-trivial PR / change (once PR flow begins). | | **Security** | [`security-reviews/`](security-reviews/) | Deep security pass on changes that touch capabilities, IPC, syscalls, memory, boot, crypto, `unsafe`, or security-sensitive dependencies. | Per change that hits the triggers in [`../../standards/security-review.md`](../../standards/security-review.md). | | **Performance optimization** | [`performance-optimization-reviews/`](performance-optimization-reviews/) | Hypothesis-driven performance cycles: baseline → hotspot → proposal → measurement → regression check. | Periodic or on concern (user-reported slowness, scaling limits). | +| **Master reviews** | [Master-review README](master-review/README.md) | Whole-tree audit with consolidated findings, coverage manifest and per-track evidence. | On demand, maintainer-initiated whole-tree sweep. | ## Per-type structure -Every review-type folder has the same three things: +Each of the four event-triggered review-type folders has these three things: 1. **`README.md`** — what this review type is, when to conduct one, how the output differs from a task artifact. 2. **`master-plan.md`** — the procedure, written to be **parallelizable across multiple AI agents**. Enumerates agent roles, each role's checklist, and the merge step that combines their outputs. @@ -23,6 +24,8 @@ Every review-type folder has the same three things: The master plan is a living document. It is amended as the project learns how to review itself better; the amendments are recorded inline. +The [master-review family](master-review/README.md#run-layout) instead stores each run in a timestamped directory: `consolidated.md`, `00-coverage-manifest.md` and `tracks/`. Start with the consolidated report, then follow its explicit evidence links. There is no separate master-plan file in that family. + ## Multi-agent review Each master plan describes **agent roles**. For a single-maintainer solo phase, these roles can all be played by the same person (or the same AI) in sequence. The value of naming them separately is twofold: @@ -34,10 +37,14 @@ The procedure does not *require* multiple agents; the single-agent sequential pa ## Producing a review -Use the [`conduct-review`](../../../.agents/skills/conduct-review/SKILL.md) skill with the review type as an argument. The skill loads the type's master plan and walks through its steps. +For the four event-triggered types, use the [`conduct-review`](../../../.agents/skills/conduct-review/SKILL.md) skill with the review type as an argument. The skill loads that type's master plan. On-demand whole-tree audits follow the [master-review procedure](master-review/README.md#how-it-is-run). For code and security reviews specifically, the execution skills [`perform-code-review`](../../../.agents/skills/perform-code-review/SKILL.md) and [`perform-security-review`](../../../.agents/skills/perform-security-review/SKILL.md) describe how to *do* the review during development; they produce the artifact in the corresponding folder as their final step. +## Historical evidence recovery + +[The evidence catalog](../reports/2026-10-16-pr49-evidence-catalog.md) and [recovery guide](../../guides/review-evidence.md) restore original execution SHA/source and raw payloads from the verified immutable PR49 archive. Canonical reports remain readable in Git; original verdicts and limitations are preserved. Original SHA literals identify historical executions, including when a later bounded storage migration changes commit identities. + ## See also - [ADR-0013 — Roadmap and planning process](../../decisions/0013-roadmap-and-planning.md). diff --git a/docs/analysis/reviews/business-reviews/2026-05-07-B1-closure.md b/docs/analysis/reviews/business-reviews/2026-05-07-B1-closure.md index 4b459259..e6cad845 100644 --- a/docs/analysis/reviews/business-reviews/2026-05-07-B1-closure.md +++ b/docs/analysis/reviews/business-reviews/2026-05-07-B1-closure.md @@ -107,7 +107,7 @@ That reasoning is **correct only when idle is the sole Ready task.** The coopera The bug is exactly what a four-row table of `(queue-state-pre, action, queue-state-post)` walked through `unblock_receiver_on` + `yield_now` would have surfaced before the ADR Accept. ADR-0022 didn't write that table; ADR-0026 §Decision outcome does, as the central evidence for why Option B is the correct shape. **The same critique fits every multi-step state-machine ADR the project has shipped:** ADR-0014 cap-derivation tree (had its bug-discoveries via riders post-Accept rather than via simulation pre-Accept), ADR-0017 IPC primitive set (same), ADR-0019 scheduler shape (same), ADR-0022 idle-location (this one). -Adjustment: extend the [`write-adr` skill](../../../../.claude/skills/write-adr/SKILL.md) with a *Simulation* check item. For every multi-step state-machine ADR (capability flows, IPC handshakes, scheduler dispatch, exception entry, etc.), the body must include a 3-5 row table walking the worst-case interaction through. The simulation table is a *structural discipline* on the body, not a stylistic suggestion. B2 prep adopts this for ADR-0027 onwards. +Adjustment: extend the [`write-adr` skill](https://github.com/HodeTech/Tyrne/blob/8dad9abab21ce2b9b6ded464bab23420072c6157/.claude/skills/write-adr/SKILL.md) with a *Simulation* check item. For every multi-step state-machine ADR (capability flows, IPC handshakes, scheduler dispatch, exception entry, etc.), the body must include a 3-5 row table walking the worst-case interaction through. The simulation table is a *structural discipline* on the body, not a stylistic suggestion. B2 prep adopts this for ADR-0027 onwards. ### The third new test (`unblock_after_yield_dispatches_unblocked_receiver_not_idle`) is the empirical form of ADR-0026's simulation table diff --git a/docs/analysis/reviews/business-reviews/2026-05-09-B2-closure.md b/docs/analysis/reviews/business-reviews/2026-05-09-B2-closure.md index b18acdb9..5e7e2cd2 100644 --- a/docs/analysis/reviews/business-reviews/2026-05-09-B2-closure.md +++ b/docs/analysis/reviews/business-reviews/2026-05-09-B2-closure.md @@ -23,7 +23,7 @@ T-013 / T-012 / T-014 / T-015 remain `Done` (promoted by prior closure trios + p | ADR | Action | Notes | |-----|--------|-------| -| [ADR-0027 — Kernel virtual memory layout](../../../decisions/0027-kernel-virtual-memory-layout.md) | **Accepted 2026-05-08** (Propose + careful-re-read separate-commit pair per [`write-adr` skill §10](../../../../.claude/skills/write-adr/SKILL.md)) | Settles B2's three sub-decisions: (a) identity-only mapping with kernel in `TTBR0_EL1` and `TTBR1_EL1` reserved for the future high-half ADR-0033 placeholder; (b) `MAIR_EL1` indices 0 (device-nGnRnE) / 1 (normal cached, WB+WA, inner-shareable); (c) `MapperFlush` typed flush-token discipline at the `Mmu` trait surface (additive return-type change). Includes a five-row §Simulation table walking the SCTLR.M=1 transition end-to-end — the **first non-recovery-primitive state-machine ADR drafted under [`write-adr` skill §Simulation](../../../../.claude/skills/write-adr/SKILL.md) discipline** (ADR-0026 was the empirical retro-source for the rule; ADR-0032 was the first application but its subject is a recovery primitive). | +| [ADR-0027 — Kernel virtual memory layout](../../../decisions/0027-kernel-virtual-memory-layout.md) | **Accepted 2026-05-08** (Propose + careful-re-read separate-commit pair per [`write-adr` skill §10](https://github.com/HodeTech/Tyrne/blob/6f7ac3d7a35363e4c797600bc40ec657fea8125c/.claude/skills/write-adr/SKILL.md)) | Settles B2's three sub-decisions: (a) identity-only mapping with kernel in `TTBR0_EL1` and `TTBR1_EL1` reserved for the future high-half ADR-0033 placeholder; (b) `MAIR_EL1` indices 0 (device-nGnRnE) / 1 (normal cached, WB+WA, inner-shareable); (c) `MapperFlush` typed flush-token discipline at the `Mmu` trait surface (additive return-type change). Includes a five-row §Simulation table walking the SCTLR.M=1 transition end-to-end — the **first non-recovery-primitive state-machine ADR drafted under [`write-adr` skill §Simulation](https://github.com/HodeTech/Tyrne/blob/6f7ac3d7a35363e4c797600bc40ec657fea8125c/.claude/skills/write-adr/SKILL.md) discipline** (ADR-0026 was the empirical retro-source for the rule; ADR-0032 was the first application but its subject is a recovery primitive). | | [ADR-0009 — `Mmu` HAL trait signature (v1)](../../../decisions/0009-mmu-trait.md) | **§Revision notes rider added 2026-05-08** (additive `MapperFlush` return-type) | Records that `Mmu::map` and `Mmu::unmap` now return a typed `MapperFlush` token, mirroring the [ADR-0017 §Revision rider for `ipc_cancel_recv`](../../../decisions/0017-ipc-primitive-set.md) precedent. Additive — does not supersede ADR-0009's v1 commitments. | | ADR-0033 — Kernel high-half migration (placeholder) | **Slot reserved** in [ADR-0027 §Decision outcome (a)](../../../decisions/0027-kernel-virtual-memory-layout.md) | Named-but-unallocated forward-flag per [ADR-0025 §Rule 1](../../../decisions/0025-adr-governance-amendments.md) — no T-NNN today; opens when B5 surfaces the per-task `TTBR0_EL1` swap requirement. | | ADR-0034 — Kernel-image section permissions (placeholder) | **Slot reserved** in [ADR-0027 §Decision outcome (a)](../../../decisions/0027-kernel-virtual-memory-layout.md) | Named-but-unallocated. v1 maps the entire 128 MiB RAM as kernel R/W/X via 2 MiB blocks; finer-grained `.text` RX / `.rodata` R / `.bss` RW awaits B5+ when the first attacker-observable execution context lands. | @@ -151,7 +151,7 @@ The [2026-05-07 B1 closure retrospective](2026-05-07-B1-closure.md#adjustments) | B1 Adjustment | Status (2026-05-09) | Closing reference | |---|---|---| -| Codify "no closure-trio without recorded smoke" as a B-phase milestone-closure rule | **Closed** | This closure-trio embeds the verbatim release-build smoke trace + harness band as load-bearing artefacts (per the [§"Test counts at B2 closure"](#test-counts-at-b2-closure) section above; the [security review](../security-reviews/2026-05-09-B2-closure.md#axis-3--memory-safety) and [perf baseline](../performance-optimization-reviews/2026-05-09-B2-closure.md#metric-3--boot-to-end-timing) cite the same trace). The discipline is now codified by use. | +| Codify "no closure-trio without recorded smoke" as a B-phase milestone-closure rule | **Closed** | This closure-trio embeds the verbatim release-build smoke trace + harness band as load-bearing artefacts (per the [§"Test counts at B2 closure"](#test-counts-at-b2-closure) section above; the [security review](../security-reviews/2026-05-09-B2-closure.md#3-memory-safety) and [perf baseline](../performance-optimization-reviews/2026-05-09-B2-closure.md#metric-3--boot-to-end-timing) cite the same trace). The discipline is now codified by use. | | Extend `write-adr` skill with a Simulation check | **Closed** | ADR-0027's five-row §Simulation table is the rule's first productive use; the rule is now load-bearing for state-machine ADRs (ADR-0028 / ADR-0030 will both need it). Pattern-of-record at three data points (ADR-0026 retro-source / ADR-0032 recovery primitive / ADR-0027 productive design). | | Add Track K — Live execution to the comprehensive-review template | **Open (deferred trigger)** | No comprehensive review has been commissioned during the B1 → B2 arc; the B2 closure was settled by the per-PR review-rounds + this closure-trio. Trigger remains "next maintainer-initiated full-tree review". Codification deferred. | | B2 prep — ADR-0027 (kernel virtual memory layout) drafting | **Closed** | ADR-0027 `Accepted` 2026-05-08 (PR #22). | @@ -166,7 +166,7 @@ Net: 1 of 7 still trigger-deferred (Track K — Live execution); 6 closed. Track - [ ] **B3 PMM (Physical Memory Manager) bring-up.** [phase-b.md §B2 sub-breakdown item 5](../../../roadmap/phases/phase-b.md): "Physical-frame allocator (PMM) — separate B-phase task (post-T-016)". The `Mmu::map`'s `&mut dyn FrameProvider` parameter is PMM-ready; v1 has no kernel caller exercising it. PMM is the natural B3 first task — it makes runtime mappings reachable and unlocks per-task stack guards, kernel-image section permissions (ADR-0034 placeholder), and userspace bring-up (ADR-0033 placeholder). Trigger: opens with the next ADR-prep arc (likely ADR-0028 frame-allocation discipline + a T-NNN PMM implementation task). - [ ] **B-phase BSP task — proper PL011 init.** Clears the pre-existing "data written to disabled UART" guest-errors noise (358 → 0 instances) so future `-d guest_errors` runs surface real anomalies. Trigger: opens any time before B5+ when userspace bring-up demands a clean MMIO baseline. - [ ] **`MmuError::BlockMapped` variant.** [`bsp-qemu-virt/src/mmu.rs::walk_or_alloc_table`](../../../../bsp-qemu-virt/src/mmu.rs) currently returns `MmuError::AlreadyMapped` for both "leaf-collision" and "block-collision" cases (T-016 §Out of scope explicitly defers block-split). When the first B3+ caller surfaces the need, introduce `MmuError::BlockMapped` to disambiguate so the caller can drive the block-split logic. Trigger: opens with the first B3+ caller that needs sub-2-MiB granularity inside a bootstrap block. -- [ ] **Codify "ADR §Simulation row → host-test or audit-log line" mapping discipline.** Extend [`write-adr` skill](../../../../.claude/skills/write-adr/SKILL.md) with a §Simulation-Tests step: the implementing task's host tests + audit-log entries should mechanically replay every simulation row. Trigger: drafted alongside ADR-0028 (address-space data structure) so the rule lands with its first user. The pattern is now stable at three data points (T-014, T-015, T-016). +- [ ] **Codify "ADR §Simulation row → host-test or audit-log line" mapping discipline.** Extend [`write-adr` skill](https://github.com/HodeTech/Tyrne/blob/6f7ac3d7a35363e4c797600bc40ec657fea8125c/.claude/skills/write-adr/SKILL.md) with a §Simulation-Tests step: the implementing task's host tests + audit-log entries should mechanically replay every simulation row. Trigger: drafted alongside ADR-0028 (address-space data structure) so the rule lands with its first user. The pattern is now stable at three data points (T-014, T-015, T-016). - [ ] **High-half kernel migration (ADR-0033 placeholder).** The slot is reserved in [ADR-0027 §Decision outcome (a)](../../../decisions/0027-kernel-virtual-memory-layout.md). Opens when B5 surfaces the per-task `TTBR0_EL1` swap requirement. The §Simulation table for that ADR will walk the high-half migration's own multi-step transition (build TTBR1_EL1 high-half tables → enable EPD1=0 → jump to high-half via absolute load → null TTBR0_EL1 / EPD0=1 → continue at high-half). - [ ] **Kernel-image section permissions (ADR-0034 placeholder).** The slot is reserved in [ADR-0027 §Decision outcome (a)](../../../decisions/0027-kernel-virtual-memory-layout.md). Opens with the first B-phase task whose threat model includes a kernel R/W of `.text` as a meaningful surface — likely paired with the B5+ first userspace destroy that introduces an attacker-controlled execution context. diff --git a/docs/analysis/reviews/business-reviews/2026-10-12-phase-b2-track1-completion.md b/docs/analysis/reviews/business-reviews/2026-10-12-phase-b2-track1-completion.md new file mode 100644 index 00000000..ea36deed --- /dev/null +++ b/docs/analysis/reviews/business-reviews/2026-10-12-phase-b2-track1-completion.md @@ -0,0 +1,242 @@ +# Business review 2026-10-12 — Phase B.2 Track B.2-1 completion + +Track B.2-1 is Done after the maintainer merged PR48, authorized the eight task promotions and the remaining first-main/dispatch acceptance evidence passed. +This review records deliveries, lessons and the remaining Phase B.2 work; it closes neither the phase nor any other track. + +- **Trigger:** maintainer-initiated, following Track B.2-1 completion; bridge tracks are distinct from numbered milestones. +- **Scope:** Track B.2-1, including optional T-036 and sole cross-track prerequisite T-037; PR48 follow-ups A/B and post-merge evidence. +- **Period:** 2026-10-11 approved kickoff (`960bdef`) → 2026-10-12 merge and verification (`c16997e`). This is the first business review of this track; the prior [Phase B retrospective](2026-06-01-phase-b-closure.md) was read for context and remains historical. +- **Participants:** @cemililik (review, merge and explicit Done authorization); Codex as scribe, executing all five business-review roles sequentially. A separate agent supplies a bounded bookkeeping check, not a new promotion/code/security verdict. + +## What landed + +**Commits:** The reviewed development tip is `f2758e3808c0c47b105ad3e13417dbe789cefff7`; the maintainer merged [PR48](https://github.com/HodeTech/Tyrne/pull/48) at `c16997e003fbd1726d1205734380394781c52002`, 2026-10-12 07:24:09 UTC. +The complete approved-implementation history below retains individual source/evidence identities rather than relabeling every review as the squash commit. +Task associations come from task IDs in subjects, task files changed by the commit or the original step ownership; an unassigned row advances integration/governance or shared evidence. + +
+All 47 commits in 960bdef^..f2758e3, oldest first + +- `9e17d04` (2026-10-11) — docs(roadmap): make Phase B.2 a mandatory gate before Phase C (ADR-0040) and open its 46 tasks (#47); T-030, T-031, T-032, T-033, T-034, T-035, T-036, T-037, T-038, T-039, T-040, T-041, T-042, T-043, T-044, T-045, T-046, T-047, T-048, T-049, T-050, T-051, T-052, T-053, T-054, T-055, T-056, T-057, T-058, T-059, T-060, T-061, T-062, T-063, T-064, T-065, T-066, T-067, T-068, T-069, T-070, T-071, T-072, T-073, T-074, T-075. +- `960bdef` (2026-10-11) — docs(adr): accept ADR-0040 and Track B.2-1 policy; T-035, T-036. +- `f2d577f` (2026-10-11) — fix(userspace): restrict syscall shims to bare metal; T-037. +- `69a4109` (2026-10-12) — docs(userspace): reconcile T-037 review records; T-037. +- `3a7c264` (2026-10-12) — docs(userspace): record second T-037 review round; T-037. +- `54e8f77` (2026-10-12) — feat(tooling): validate QEMU core count and timeout arguments; T-033. +- `d5c13a0` (2026-10-12) — docs(tooling): record T-033 implementation gates; T-033. +- `eede01c` (2026-10-12) — docs(tooling): record first T-033 review round; T-033. +- `05f1736` (2026-10-12) — docs(tooling): correct completion state after T-033 review; T-033. +- `82d1c42` (2026-10-12) — ci: lint userland and tooling scripts; T-031. +- `1cb3526` (2026-10-12) — docs(standards): enforce userland and shell lint gates; T-031. +- `0acf0cd` (2026-10-12) — fix(ci): support hosted ShellCheck trap analysis; T-031. +- `e79e10a` (2026-10-12) — docs(standards): reconcile first T-031 review findings; T-031. +- `8437158` (2026-10-12) — docs(analysis): complete second T-031 review round; T-031. +- `b8ad56f` (2026-10-12) — ci: enforce release and perf build contracts; T-030. +- `c716ae3` (2026-10-12) — docs(standards): enforce release and perf verification gates; T-030. +- `364b746` (2026-10-12) — docs(analysis): record hosted T-030 gate evidence; T-030. +- `5cd9ee8` (2026-10-12) — docs(analysis): record first T-030 review round; T-030. +- `8591ceb` (2026-10-12) — docs(analysis): complete second T-030 review round; T-030. +- `c3f32c8` (2026-10-12) — fix(bsp-qemu-virt): enforce panic-family lint boundaries; T-032. +- `b6572cc` (2026-10-12) — docs(analysis): reconcile T-032 audit and evidence state; T-032. +- `4f2c38c` (2026-10-12) — docs(analysis): record hosted T-032 gate evidence; T-032. +- `6e191e2` (2026-10-12) — docs(analysis): record first T-032 review round; T-032. +- `07449f1` (2026-10-12) — docs(analysis): record second T-032 review round; T-032. +- `6450005` (2026-10-12) — ci: gate debug and release EL0 smoke under QEMU; T-034. +- `41d9682` (2026-10-12) — docs(analysis): record hosted T-034 guest proof; T-034. +- `97a6c83` (2026-10-12) — fix(ci): preserve QEMU smoke failures through logging; T-034. +- `9092581` (2026-10-12) — docs(analysis): verify hosted T-034 pipeline correction; T-034. +- `0c86c3d` (2026-10-12) — docs(analysis): record second T-034 review round; T-034. +- `9c5191c` (2026-10-12) — docs(ci): record required QEMU check registration; T-034. +- `bf20ec9` (2026-10-12) — ci: require native ARM64 workspace checks and Miri; T-036. +- `5c95cd3` (2026-10-12) — docs(analysis): record first T-036 review and ARM evidence; T-036. +- `2d4d21e` (2026-10-12) — docs(analysis): record second T-036 review round; T-036. +- `69ac515` (2026-10-12) — docs(ci): record required native ARM check registration; T-036. +- `e873995` (2026-10-12) — ci: add weekly performance reports and versioned merge policy; T-035, T-036. +- `7deb16e` (2026-10-12) — fix(ci): accept both proven ARM cfg rejection diagnostics; T-035, T-036. +- `cfc8872` (2026-10-12) — chore(ci): reconcile merged kickoff ancestry; shared integration/governance or evidence. +- `67f8c9b` (2026-10-12) — docs(analysis): record final Track B.2-1 review round; T-035, T-036. +- `bd27fe5` (2026-10-12) — docs(roadmap): reconcile Track B.2-1 implementation status; shared integration/governance or evidence. +- `acd0013` (2026-10-12) — docs(roadmap): reconcile final Track B.2-1 documentation; shared integration/governance or evidence. +- `1e281ac` (2026-10-12) — docs(roadmap): record green Track B.2-1 PR evidence; T-034, T-035, T-036. +- `50ab72b` (2026-10-12) — fix(ci): strengthen PR review probes and report metadata; T-034, T-035, T-036. +- `683965b` (2026-10-12) — docs(analysis): record PR48 tooling review and correction; T-034, T-035, T-036. +- `a1eb406` (2026-10-12) — docs(analysis): record fresh PR48 tooling round two; T-034, T-035, T-036. +- `5816c93` (2026-10-12) — docs(ci): reconcile PR48 review claims and current guidance; T-034, T-035. +- `646ba33` (2026-10-12) — docs(analysis): correct PR48 review wording and record round one; T-035. +- `f2758e3` (2026-10-12) — docs(analysis): publish PR48 follow-up completion and hosted evidence; T-035. + +
+ +The post-merge development ancestry commit `0613f9b67cfc03b9c0b8d477740e2f915da29c4c` records the squash without changing the tree or switching branches. +This prevents subsequent development PRs from replaying the already merged implementation. + +**ADRs:** + +- [ADR-0040](../../../decisions/0040-phase-b2-consolidation-bridge.md), *Phase B.2 consolidation bridge*, Accepted by the maintainer on 2026-10-11 before implementation. Its existing CI/ARM/performance/classic-protection decisions govern this work; no new decision is introduced by completion bookkeeping. Accepted-body SHA-256 remains `5b82f632157033d193e64ac554390bacb9944fcd7a79fac9760a666c5f02ff2c`. + +**Tasks closed (all date_done 2026-10-12):** + +- [T-037](../../tasks/phase-b2/T-037-userland-bare-metal-cfg-gate.md): architecture-plus-target-OS gates restore native ARM workspace/Miri and preserve the recorded initial bare-metal image. +- [T-033](../../tasks/phase-b2/T-033-qemu-tooling-smp-and-timeout.md): validated SMP overrides, precedence and missing-value handling; 59 controlled cases, without implementing SMP. +- [T-031](../../tasks/phase-b2/T-031-ci-userland-clippy-and-shellcheck.md): bare-metal userland clippy and ShellCheck with isolated rejection controls. +- [T-030](../../tasks/phase-b2/T-030-ci-release-profile-gate.md): release build/lint/host tests, both named release-only syscall guards and debug perf-bench build/lint. +- [T-032](../../tasks/phase-b2/T-032-panic-family-denies-hal-bsp.md): HAL/BSP panic-family denies, scoped justified boot exceptions and reviewed unmap audit amendment. +- [T-034](../../tasks/phase-b2/T-034-ci-qemu-smoke-job.md): required real debug/release EL0 smoke, fault/profile checks, failure-preserving log pipelines and downloadable diagnostics. +- [T-036](../../tasks/phase-b2/T-036-ci-arm64-host-check-job.md): required native Linux ARM check/clippy/test/Miri, isolated regression rejection and architecture-separated caches; optional for the phase exit but delivered here. +- [T-035](../../tasks/phase-b2/T-035-ci-hygiene-tail.md): weekly/on-demand informational 20-run reporting and complete classic-main protection JSON with fail-closed export/check/local apply; default-branch dispatch criterion now complete. + +Each implementation step completed two fresh independent rounds; security-sensitive steps received distinct security review. +Both supplied-review follow-up steps also completed two fresh rounds, with their second rounds reporting zero new findings and verifying first-round corrections. +The [implementation/review map](../../../roadmap/phases/phase-b2.md#implementation-status-2026-10-12) and [17-item reconciliation](../../reports/2026-10-12-pr-48-supplied-review-reconciliation.md) retain full reports, verified fixes, qualified claims and exact-source limits. +Done promotion rests on the maintainer's merge and explicit instruction, with acceptance evidence checked below; this retrospective is not an independent approval review. + +### Post-merge evidence + +| Evidence | Observed result | +|----------|-----------------| +| [First main CI 38217531542](https://github.com/HodeTech/Tyrne/actions/runs/38217531542) | Push event, full merged `c16997e003fbd1726d1205734380394781c52002`, all seven jobs success | +| [Native ARM job 114705667835](https://github.com/HodeTech/Tyrne/actions/runs/38217531542/job/114705667835) | Check/clippy/test/Miri pass, 101 s job; native/Miri each 366 pass, two ignored HAL doctests; clean control passes, private arch-only probe rejected with exit 101/E0152 | +| Downloaded smoke evidence | Clean tracked source `c16997e`, correct production debug/release traces; 23/23 controls (20 synthetic, three actual private kernels); 119 s evidence interval | +| [Main performance dispatch 38217799773](https://github.com/HodeTech/Tyrne/actions/runs/38217799773) | Actual workflow_dispatch on clean full merged main source, registered active workflow; 20 requested/20 valid/0 failed, 101 s harness/132 s evidence | +| [Exact-byte main report](../../reports/perf-baseline-2026-10-12-t035-main-dispatch-check.md) | Raw nearest-rank p10/p50/p90 = 8,470,496 / 9,079,824 / 10,252,512 ns; p99 = max = 12,763,984 ns at n=20; file SHA-256 `de2f838bfdd4b6bb2b1ec4c4a22fcdd630c2d24dac5d8eb3323daa588f4b0974` | +| Full live protection read-back | Read-only check matches committed definition: six exact required names bound to Actions app 15368, strict checking; all other policy values preserved | + +The coordinator retrieved the run summaries, downloaded artifacts, read the complete production traces/performance report and recomputed report arithmetic/digests. +These are actual hosted executions and locally inspected downloads, not a new local Rust/QEMU/Miri rerun. +This documentation-only update needs link/status/preservation checks; source and workflow behavior are unchanged. +Performance artifact 11732776508 is 4,183 bytes, expires 2026-10-26; archive SHA-256 `599dbded6a4d138f5986cd7270382248db052179fd00c736e9e3591b0cf03b95` is service-reported, not locally recomputed. +Smoke artifact 11733175759 is 24,124 bytes; archive SHA-256 `7488747dda638ebea5906b33995d9ee9c6358b8973ef9ea1b3d816460dedaa22` is likewise service-reported. +The exact report file is retained in Git independently of artifact expiry; earlier measurement snapshots remain byte-identical. +The live policy still permits administrator bypass and requires zero approvals; producer app identity does not certify workflow body integrity. +Performance and coverage remain informational. No timing band here proves a cross-host regression or calibrated tail reliability. +Weekly Monday 03:17 UTC reporting is configured and active; this evidence verifies manual dispatch, not execution of a future cron tick. + +### Captured production QEMU traces + +These are verbatim complete downloaded production traces from the first merged-main run, including completion, boot-to-end timing and expected watchdog termination. +The smoke command uses `-d int,unimp`, which records exactly two SVC exception events in each profile and no other exception event in these traces. +`guest_errors` is not enabled by this command, so no guest_errors count is claimed. +Debug source-trace SHA-256 is `94091361df6cb9d3983d99d52f48cac254e6d386f92510582ec2dce881d4994f`; release is `225f6778bf249db1f3e12411f3cb7b74378f8ece34cec6272a8e0af28b6b0acf`. +The debug greeting is present; release correctly lacks it while completing the userspace task and IPC demo. + +Debug: + +```text +tyrne: hello from kernel_main +tyrne: mmu activated +tyrne: high-half active +tyrne: pmm initialized (32593 frames available; 175 reserved) +tyrne: address-space-arena ready (1 / 8 slots used; bootstrap AS root = 0x40099000) +tyrne: timer ready (62500000 Hz, resolution 16 ns) +tyrne: starting cooperative scheduler +tyrne: task B — waiting for IPC +tyrne: task A -- sending IPC +Exception return from AArch64 EL1 to AArch64 EL0 PC 0x800000 +Taking exception 2 [SVC] on CPU 0 +...from EL0 to EL1 +...with ESR 0x15/0x56000000 +...with ELR 0x800034 +...to EL1 PC 0xffffffff40080c00 PSTATE 0x3c5 +hello from userspace +Exception return from AArch64 EL1 to AArch64 EL0 PC 0x800034 +Taking exception 2 [SVC] on CPU 0 +...from EL0 to EL1 +...with ESR 0x15/0x56000000 +...with ELR 0x80005c +...to EL1 PC 0xffffffff40080c00 PSTATE 0x3c5 +tyrne: userspace task exited +tyrne: task B — received IPC (label=0xaaaa); replying +tyrne: task A — received reply (label=0xbbbb); done +tyrne: all tasks complete +tyrne: boot-to-end elapsed = 15449264 ns +qemu-system-aarch64: terminating on signal 15 from pid 4052 (timeout) +``` + +Release: + +```text +tyrne: hello from kernel_main +tyrne: mmu activated +tyrne: high-half active +tyrne: pmm initialized (32598 frames available; 170 reserved) +tyrne: address-space-arena ready (1 / 8 slots used; bootstrap AS root = 0x40094000) +tyrne: timer ready (62500000 Hz, resolution 16 ns) +tyrne: starting cooperative scheduler +tyrne: task B — waiting for IPC +tyrne: task A -- sending IPC +Exception return from AArch64 EL1 to AArch64 EL0 PC 0x800000 +Taking exception 2 [SVC] on CPU 0 +...from EL0 to EL1 +...with ESR 0x15/0x56000000 +...with ELR 0x800020 +...to EL1 PC 0xffffffff40080c00 PSTATE 0x3c5 +Exception return from AArch64 EL1 to AArch64 EL0 PC 0x800020 +Taking exception 2 [SVC] on CPU 0 +...from EL0 to EL1 +...with ESR 0x15/0x56000000 +...with ELR 0x80002c +...to EL1 PC 0xffffffff40080c00 PSTATE 0x3c5 +tyrne: userspace task exited +tyrne: task B — received IPC (label=0xaaaa); replying +tyrne: task A — received reply (label=0xbbbb); done +tyrne: all tasks complete +tyrne: boot-to-end elapsed = 4856160 ns +qemu-system-aarch64: terminating on signal 15 from pid 4183 (timeout) +``` + +## What changed in the plan + +- The Accepted full-Phase-B.2 scope and C/D gates remain intact. The approved execution order included cross-track T-037 first and optional T-036; it did not complete the rest of Track B.2-3. +- The twelve Track B.2-1 opening findings are delivered through the task map. Release kernel clippy and real release EL0 smoke were included before implementation; the original baseline remains historical. +- All eight task headers now say Done with date_done, and current roadmap/index pointers supersede pre-merge In Review and pending-main/dispatch states. Existing review verdicts, unsuccessful evidence and exact-byte captures keep their original identities. +- No new task, ADR, dependency, security policy or runtime behavior is introduced by this update. The complete phase still has 38 tasks outstanding. +- ADR-0040's full scope checkpoint follows CI and HIGH-correctness work; completion of this CI wave alone does not satisfy that checkpoint. A switch to the narrower scope would still require a superseding ADR. + +## What we learned + +A negative probe must distinguish the intended regression from an already-broken baseline. +The ARM assertion now runs the identical command on clean private source before six cfg mutations, requires the observed exit/diagnostic contract and accepts both proven Cargo diagnostic classes. +Its real hosted race showed why an E0152-only assumption was too narrow even when the original defect was real. + +Log capture is part of a gate's correctness. +The first smoke review found that a logging pipeline could mask rejection; explicit pipefail and a matching pipeline negative control make the actual workflow enforce the intended result. +Separate production traces, synthetic fixtures and private actual-kernel probes make the evidence interpretable. + +Recorded source identity matters as much as a green badge. +Optional tool metadata can fail without invalidating valid timing samples, while required measurement failures remain errors. +Nearest-rank p99 changes rank at n=100 but that fact alone says nothing about statistical reliability; the generator and new main report say so explicitly. +Historical captured bytes remain preserved with a dated superseding interpretation, rather than silently rewriting measurements. +The prior Phase B retrospective's same-host comparison caution still applies. + +Host tests, Miri and smoke are complementary signals, not a proof of every inline-assembly contract. +HIGH T-038 is still open: the userspace declaration treats x2 as input-only while the kernel overwrites it on syscall return. +Completing T-037 and the CI gates makes that focused fix ready and verifiable; it does not clear it by implication. + +## Adjustments + +- [ ] Pick up HIGH [T-038](../../tasks/phase-b2/T-038-console-write-x2-clobber.md) next, retaining its Ready state until implementation begins. Trigger: the next explicitly started development task. Its contract requires no new ADR, but does require the append-only UNSAFE-2026-0033 amendment, separate security review, userland lint/build/smoke and disassembly/image evidence. +- [ ] Then prioritize remaining small correctness fixes T-041–T-044 and high-visibility T-051 under the existing [recommended waves](../../tasks/phase-b2/README.md#recommended-order). Trigger: completion of the preceding task; this retrospective starts none of them. +- [ ] Prepare and obtain maintainer approval for recorded decisions before implementing decision-bearing T-039/T-040 and the other identified decision tasks. Trigger: their own preflight; do not use a status update to settle architectural choices. +- [ ] Complete the documentation, quality and unsafe-audit work before [T-074 readiness](../../tasks/phase-b2/T-074-phase-c-readiness-sweep.md) and [T-075 closure](../../tasks/phase-b2/T-075-phase-b2-closure.md). Trigger: their dependency/exit criteria. Preserve the full B.2 gate before C/D. + +Remaining primary task ownership (shared documentation work in T-064 is counted once): + +| Scope | Remaining tasks | Count | +|-------|-----------------|------:| +| B.2-2 documentation cascade | T-045–T-056 | 12 | +| B.2-3 correctness and robustness | T-038–T-044 | 7 | +| B.2-4 code quality and API design | T-057–T-068 | 12 | +| B.2-5 unsafe-audit and doc comments | T-069–T-072 | 4 | +| B.2-6 performance decisions | T-073 | 1 | +| Readiness and closure | T-074, T-075 | 2 | +| **Total** | **30 Ready, 8 Draft** | **38** | + +Of the original 46 tasks, eight are Done. Of the 38 remaining, T-056 is optional polish and the other 37 retain their individual phase-exit criteria. +The existing full-scope decision and each task's permitted evidence-based deferral rules remain unchanged; no deferral is invented here. + +## Next + +- Active phase: B.2, still Active; Phase C and D remain gated. +- Active milestone: no numbered milestone is opened; Track B.2-1 is Done, correctness Track B.2-3 is the next recommended focus. +- Active task: none In Progress; T-038 is the next Ready candidate and has not started. +- Next review trigger: T-038 implementation and its required code/security rounds; the full scope checkpoint follows CI and HIGH-correctness work, with phase readiness/closure later at T-074/T-075. diff --git a/docs/analysis/reviews/business-reviews/README.md b/docs/analysis/reviews/business-reviews/README.md index 0327b8f4..5afc85e9 100644 --- a/docs/analysis/reviews/business-reviews/README.md +++ b/docs/analysis/reviews/business-reviews/README.md @@ -36,3 +36,5 @@ A business review may point at outcomes from those other reviews as part of "wha | 2026-05-14 | B3 closure retrospective — Address-space abstraction (T-017 PMM + T-018 `AddressSpace` kernel object); ADR-0035 + ADR-0028; five-round PR #28 review arc + cross-cutting `MmuError::BlockMapped` + `.claude/skills/` → `.agents/skills/` migration | [2026-05-14-B3-closure.md](2026-05-14-B3-closure.md) | | 2026-05-28 | B4 closure retrospective — Task loader (T-019 `load_image` → `LoadedImage`); ADR-0029 + the 2026-05-22 master-review interlude (4 Blocker / 18 Major full-tree audit) + PR #32 remediation closing all 24 verified findings (MR-009's exit-bar half closed in-branch here); ADR-0036 supersession of GICv3/SMMUv3; UNSAFE-2026-0027 + 0028 added, 0025/0026 lifted; HodeTech org migration | [2026-05-28-B4-closure.md](2026-05-28-B4-closure.md) | | 2026-05-29 | B5 closure retrospective — Syscall boundary (T-020 error taxonomy + T-021 EL0→EL1 SVC dispatch); ADR-0030 + ADR-0031; one-day milestone via the pure-Rust/hardware-boundary split; adversarial pass + Miri corrected a copy-user soundness over-claim; same-host perf control; UNSAFE-2026-0029/0030 (audit log 30 / 29 Active); B6 + Phase B retrospective next | [2026-05-29-B5-closure.md](2026-05-29-B5-closure.md) | +| 2026-10-12 | Track B.2-1 completion after PR48: eight tasks Done, first-main CI and main dispatch verified; 38 B.2 tasks remain, HIGH T-038 Ready next; phase stays Active | [2026-10-12-phase-b2-track1-completion.md](2026-10-12-phase-b2-track1-completion.md) | +| 2026-06-01 | Phase B closure (B0–B6): first EL0 task, closure-trio findings and Phase C carry-forwards | [2026-06-01-phase-b-closure.md](2026-06-01-phase-b-closure.md) | diff --git a/docs/analysis/reviews/business-reviews/master-plan.md b/docs/analysis/reviews/business-reviews/master-plan.md index a76c7d2b..fef8870e 100644 --- a/docs/analysis/reviews/business-reviews/master-plan.md +++ b/docs/analysis/reviews/business-reviews/master-plan.md @@ -34,7 +34,7 @@ A single reviewer can cover all roles sequentially; the benefit of naming them i **Task:** enumerate how the plan itself changed. -- Diff [`../../roadmap/phases/`](../../roadmap/phases/) between the previous review and today. +- Diff [`../../roadmap/phases/`](../../../roadmap/phases) between the previous review and today. - Identify: added / removed / reordered milestones, added / deprecated tasks at the phase level, wording changes to acceptance criteria, any structural changes. - Cross-check against the decision log: ADRs that superseded earlier ones or amended the roadmap belong here. @@ -85,6 +85,8 @@ When roles are run in parallel, combine outputs by pasting each role's section i - [ ] Each role's output has been produced by the maintainer or an agent; notes are traceable. - [ ] The index in [`README.md`](README.md) has a new row for this review. - [ ] [`../../../roadmap/current.md`](../../../roadmap/current.md) is updated to match the Pathfinder's output. +- [ ] **For phase-closure triggers:** re-verify every existing `docs/architecture/` chapter against the closure source, update each source/date/task freshness marker, and reconcile the architecture README's coverage and document-edit Status cells in the same closure batch. Record the source and verification evidence; an older Accepted label alone is insufficient. See the [architecture conventions](../../../architecture/README.md#conventions). +- [ ] **For milestone-completion and phase-closure triggers:** perform a closure-batch index sweep. Every canonical review in the batch is listed in its family README; companion plans, nested tracks and master-review run evidence have explicit discovery links from their proper surfaces. Reconcile the family navigation in [reviews/README.md](../README.md). Copy original dates/verdicts; do not re-judge them while indexing. - [ ] **For *milestone-completion* and *phase-closure* triggers only:** the *What landed* section includes a verbatim copy of the most recent QEMU smoke trace (full serial output through the milestone's success marker, plus the `boot-to-end elapsed = ... ns` line if the BSP emits it) and an `-d int,unimp,guest_errors` event count. A milestone cannot promote past `In Review` to `Done` without this evidence; *narrative* claims of smoke-pass are insufficient. Codified after the [2026-05-06 B1 smoke-regression mini-retro](2026-05-06-B1-smoke-regression.md) and the [2026-05-07 B1 closure retrospective](2026-05-07-B1-closure.md) §"What we learned" — host tests + miri + paper-review can pass a kernel that hangs at runtime; the smoke is the project's only end-to-end liveness oracle. Maintainer-initiated mini-retros and adhoc reviews are exempt (no closure semantics). ## Output template @@ -135,3 +137,5 @@ When roles are run in parallel, combine outputs by pasting each role's section i This master plan is a living document. When the process evolves, amend the relevant sections and note the change at the bottom here. - _2026-04-20_ — initial version; scaffolded by [ADR-0013](../../../decisions/0013-roadmap-and-planning.md). + +- _2026-10-13_ — [T-049](../../tasks/phase-b2/T-049-review-indices-sync.md) adds the approved closure-batch discovery sweep and corrects roadmap navigation under [ADR-0043](../../../decisions/0043-documentation-corpus-consistency.md); historical review verdicts and measurements remain unchanged. diff --git a/docs/analysis/reviews/code-reviews/2026-05-06-full-tree-comprehensive-review-plan.md b/docs/analysis/reviews/code-reviews/2026-05-06-full-tree-comprehensive-review-plan.md index f19ba075..f05c8ad8 100644 --- a/docs/analysis/reviews/code-reviews/2026-05-06-full-tree-comprehensive-review-plan.md +++ b/docs/analysis/reviews/code-reviews/2026-05-06-full-tree-comprehensive-review-plan.md @@ -110,7 +110,7 @@ Each track agent must: **Inputs:** -- [hal/src/lib.rs](../../../../hal/src/lib.rs), [console.rs](../../../../hal/src/console.rs), [cpu.rs](../../../../hal/src/cpu.rs), [context_switch.rs](../../../../hal/src/context_switch.rs), [mmu.rs](../../../../hal/src/mmu.rs), [timer.rs](../../../../hal/src/timer.rs), [irq_controller.rs](../../../../hal/src/irq_controller.rs) +- [hal/src/lib.rs](../../../../hal/src/lib.rs), [console.rs](../../../../hal/src/console.rs), [cpu.rs](../../../../hal/src/cpu.rs), [context_switch.rs](../../../../hal/src/context_switch.rs), [mmu.rs](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/hal/src/mmu.rs), [timer.rs](../../../../hal/src/timer.rs), [irq_controller.rs](../../../../hal/src/irq_controller.rs) - [test-hal/src/lib.rs](../../../../test-hal/src/lib.rs) and the five fakes (console, cpu, mmu, timer, irq_controller) - [hal/Cargo.toml](../../../../hal/Cargo.toml), [test-hal/Cargo.toml](../../../../test-hal/Cargo.toml) @@ -215,7 +215,7 @@ Each track agent must: - *Standards:* every standards doc still describes what the project actually does. unsafe-policy.md is the most load-bearing — verify every recent UNSAFE-2026-NNNN entry follows it. - *Audit log:* one row per `unsafe` block / impl in the source. Run a grep diff: every `// SAFETY:` block in source must trace to a UNSAFE-2026-NNNN tag, and every UNSAFE-2026-NNNN must have a live `// SAFETY:` block (or be marked Removed with a removal commit SHA). - *Glossary:* every term used in three or more docs is defined once; entries are alphabetical; no orphaned entries from the umbrix→tyrne rename. -- *Root docs:* CLAUDE.md / AGENTS.md / README.md / SECURITY.md / CONTRIBUTING.md still resolve every link they cite; no umbrix references remain (the [10e3351](../../../../docs/) sweep should have closed this — verify). +- *Root docs:* CLAUDE.md / AGENTS.md / README.md / SECURITY.md / CONTRIBUTING.md still resolve every link they cite; no umbrix references remain (the [10e3351](https://github.com/HodeTech/Tyrne/commit/10e3351d59d1d31357661251e83d72bb431bb34c) sweep should have closed this — verify). - *Guides:* `two-task-demo.md` execution trace still matches main.rs's actual `writeln!` / `write_bytes` sites; `run-under-qemu.md` matches `.cargo/config.toml`'s runner; `ci.md` matches the (still-absent) workflow files or is honest about the absence. **Output:** sub-artifact `track-e-docs.md` — flat list of drift findings with `path:line` references. @@ -224,7 +224,7 @@ Each track agent must: **Agent:** one agent. -**Inputs:** every `#[cfg(test)]` block across the workspace, the [coverage-baseline report](../../reports/2026-04-23-coverage-baseline.md), the [coverage-rerun report](../../reports/2026-04-23-miri-validation.md and 2026-04-27-coverage-rerun.md), the `run-qemu.sh` smoke harness, and the QEMU expected-output table in two-task-demo.md. +**Inputs:** every `#[cfg(test)]` block across the workspace, the [coverage-baseline report](../../reports/2026-04-23-coverage-baseline.md), the [Miri-validation report](../../reports/2026-04-23-miri-validation.md) and [coverage-rerun report](../../reports/2026-04-27-coverage-rerun.md), the `run-qemu.sh` smoke harness, and the QEMU expected-output table in two-task-demo.md. **Checklist:** @@ -270,7 +270,7 @@ Each track agent must: - [Cargo.toml](../../../../Cargo.toml) (workspace), per-crate `Cargo.toml`, [Cargo.lock](../../../../Cargo.lock), [rust-toolchain.toml](../../../../rust-toolchain.toml), [rustfmt.toml](../../../../rustfmt.toml), [clippy.toml](../../../../clippy.toml), [.cargo/config.toml](../../../../.cargo/config.toml). - [.github/](../../../../.github/) (whatever lives there now). -- [.gitignore](../../../../.gitignore), [.gitattributes](../../../../.gitattributes) if present. +- [.gitignore](../../../../.gitignore), `.gitattributes` if present. - [tools/](../../../../tools/) (the `run-qemu.sh` and any helpers). **Checklist:** @@ -401,3 +401,7 @@ Single-agent fallback: walk the tracks sequentially in the order listed (A → J - _2026-05-06_ — initial version; authored by Claude planner agent at maintainer's request, run targeting `214052d`. - _2026-05-06 (post-execution amendment)_ — **§5 Track H's "CI absence" framing is stale.** The plan was written assuming no CI workflow existed at HEAD; Track H's actual run discovered [`.github/workflows/ci.yml`](../../../../.github/workflows/ci.yml) was added on 2026-04-23 (covers fmt / clippy / host-test / kernel-build / kernel-clippy / miri / coverage). The plan's prose at §5 Track H (*"CI absence: no GitHub Actions / circle / etc. workflow at HEAD. **This is the largest documented gap in the project.**"*) and §11 (*"A formal `cargo-vet` or `cargo-deny` configuration does not exist; the workspace's zero-extern-deps stance makes it unnecessary today, but flag for revisit when ADR-0027 / Phase C drivers might pull crates in."*) describe a pre-2026-04-23 state. The actual remaining gap is narrower: CI exists but does **not** run [`cargo audit`](../../../standards/infrastructure.md) or `cargo vet check`, both of which `infrastructure.md` lists as required merge-blocker gates; and the `supply-chain/config.toml` / `supply-chain/audits.toml` / `.github/dependabot.yml` config files `infrastructure.md` mentions are not on disk. See [`2026-05-06-full-tree-comprehensive.md`](2026-05-06-full-tree-comprehensive.md)'s *Plan-level amendments worth recording* in the verdict for the same correction in artefact form. This amendment is appended here so future readers of the plan find the update without cross-referencing the merged artefact. + +## Navigation reconciliation — 2026-10-13 + +The original `.gitattributes` optional-input item says “if present”. No such path exists in the working tree or available `git log --all -- .gitattributes` history; it is now explicit filename data rather than a false navigation target. Removed `hal/src/mmu.rs` navigation uses the reviewed May-6 source, not a later replacement module. The original report identities and review instructions are retained. diff --git a/docs/analysis/reviews/code-reviews/2026-05-06-full-tree-comprehensive.md b/docs/analysis/reviews/code-reviews/2026-05-06-full-tree-comprehensive.md index 67e2bf72..598ee024 100644 --- a/docs/analysis/reviews/code-reviews/2026-05-06-full-tree-comprehensive.md +++ b/docs/analysis/reviews/code-reviews/2026-05-06-full-tree-comprehensive.md @@ -17,27 +17,27 @@ Synthesis of [Track A — Kernel correctness](2026-05-06-full-tree/track-a-kerne - **Capabilities ([`kernel/src/cap/`](../../../../kernel/src/cap/)):** `cap_copy` peer-depth, `cap_derive` saturating depth cap, `cap_revoke` BFS reachability under release-mode `break`, `cap_take` ordering vs `free_slot`, `CapRights::from_raw` reserved-bit masking, `CapabilityTable::new` build-time capacity assertion — every Phase A invariant still holds. The `Capability` type remains move-only at the type level (no `Copy`, no `Clone`; verified by Track C §1). - **Kernel objects ([`kernel/src/obj/`](../../../../kernel/src/obj/)):** `Arena::new` is correct for `N == 0`; generation reuse exercised by `free_then_allocate_bumps_generation`; `destroy_*` reachability contract documented as caller-enforced via `CapabilityTable::references_object` (kernel-side enforcement remains a Phase B follow-up). Test handles correctly `#[cfg(test)] + pub(crate)`. - **IPC ([`kernel/src/ipc/mod.rs`](../../../../kernel/src/ipc/mod.rs)):** cap-take-before-state-mutation atomicity preserved; `ReceiverTableFull` pre-flight covered by `recv_with_full_table_preserves_pending_cap` (closes the Phase A test gap); `IpcQueues::reset_if_stale_generation` `debug_assert!` catches `Some(cap)` payload drops in tests but in release leaks silently — acceptable until userspace destroy paths land. `ipc_notify` correctly takes `&CapabilityTable` (immutable). v2 `Reply` / `ReplyRecv` (ADR-0018) verified absent. -- **Scheduler ([`kernel/src/sched/mod.rs`](../../../../kernel/src/sched/mod.rs)):** `SchedQueue<0>` structurally legal but type-level invariant unstated (Phase A non-blocker still applies). `yield_now` raw-pointer split-borrow correctness via `ctx_ptr.add(idx)` confirmed; `IrqGuard` held across `cpu.context_switch` (UNSAFE-2026-0008). `ipc_recv_and_yield` Phase 1/2/3 separation verified; the post-resume re-call now returns the typed `Err(SchedError::Ipc(IpcError::PendingAfterResume))` per ADR-0022 (the Phase A `debug_assert!(!Pending)` recommendation is **superseded** at [`kernel/src/sched/mod.rs:820-826`](../../../../kernel/src/sched/mod.rs#L820)). `unblock_receiver_on` is single-waiter by `return` after first match — correct for v1 depth-1 endpoints; multi-waiter remains an ADR-0019 open question. The Deadlock rollback restores `s.current` and `s.task_states[current_idx]` but does **not** reverse the endpoint state from `RecvWaiting` to `Idle` — benign in v1 because the path is structurally unreachable with idle registered, queue an ADR for "endpoint rollback / `ipc_cancel_recv`" before B2. -- **Top-level lib ([`kernel/src/lib.rs:38-43`](../../../../kernel/src/lib.rs#L38)):** kernel-stricter denylist (`clippy::panic`, `unwrap_used`, `expect_used`, `todo`, `arithmetic_side_effects`, `float_arithmetic`) layers cleanly on the workspace `[lints]` set without redundant re-statement. Phase A "double-stated" nit effectively resolved. +- **Scheduler ([`kernel/src/sched/mod.rs`](../../../../kernel/src/sched/mod.rs)):** `SchedQueue<0>` structurally legal but type-level invariant unstated (Phase A non-blocker still applies). `yield_now` raw-pointer split-borrow correctness via `ctx_ptr.add(idx)` confirmed; `IrqGuard` held across `cpu.context_switch` (UNSAFE-2026-0008). `ipc_recv_and_yield` Phase 1/2/3 separation verified; the post-resume re-call now returns the typed `Err(SchedError::Ipc(IpcError::PendingAfterResume))` per ADR-0022 (the Phase A `debug_assert!(!Pending)` recommendation is **superseded** at [`kernel/src/sched/mod.rs:820-826`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/sched/mod.rs#L820)). `unblock_receiver_on` is single-waiter by `return` after first match — correct for v1 depth-1 endpoints; multi-waiter remains an ADR-0019 open question. The Deadlock rollback restores `s.current` and `s.task_states[current_idx]` but does **not** reverse the endpoint state from `RecvWaiting` to `Idle` — benign in v1 because the path is structurally unreachable with idle registered, queue an ADR for "endpoint rollback / `ipc_cancel_recv`" before B2. +- **Top-level lib ([`kernel/src/lib.rs:38-43`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/lib.rs#L38)):** kernel-stricter denylist (`clippy::panic`, `unwrap_used`, `expect_used`, `todo`, `arithmetic_side_effects`, `float_arithmetic`) layers cleanly on the workspace `[lints]` set without redundant re-statement. Phase A "double-stated" nit effectively resolved. ### HAL & test-HAL (Track B) -- All five HAL traits (`Console`, `Cpu`, `ContextSwitch`, `Timer`, `IrqController`) match their ADRs (ADR-0007/0008/0010/0011/0020). `Mmu` ([`hal/src/mmu.rs`](../../../../hal/src/mmu.rs)) has a complete v1 trait surface but no production impl yet — dormant for B2 / ADR-0027. -- **`ContextSwitch` lacks `Send + Sync` bound** ([`hal/src/context_switch.rs:25`](../../../../hal/src/context_switch.rs#L25)): every other HAL trait carries `Send + Sync`, this one does not. Adding `: Send + Sync` matches the ADR-0020 "compiler-checked, so multi-core safety is not left to convention" discipline. Non-blocker. -- **`FakeCpu` does not implement `ContextSwitch`** ([`test-hal/src/cpu.rs:94`](../../../../test-hal/src/cpu.rs#L94)): the test-HAL claims "all five fakes present" but kernel scheduler tests reimplement a parallel local `FakeCpu` + `FakeTaskContext` at [`kernel/src/sched/mod.rs:850-908`](../../../../kernel/src/sched/mod.rs#L850). ADR-0020 §"`TestHal` fake" sketches the correct shape; lifting `FakeTaskContext` into `tyrne-test-hal` is the highest-value Track B follow-up. -- **`IrqState(pub usize)` synthetic-construction** ([`hal/src/cpu.rs:22`](../../../../hal/src/cpu.rs#L22)): widened in usage — two test-only `Cpu` impls in the kernel construct `IrqState(0)` directly. Phase A non-blocker still applies; either widen the doc-comment or narrow the field to `pub(crate)` with a `BspConstruct` helper. -- The Phase A `IrqGuard` post-mortem comment ([`hal/src/cpu.rs:86-91`](../../../../hal/src/cpu.rs#L86)) is preserved verbatim into the B1 era; no `&dyn Cpu` regression. +- All five HAL traits (`Console`, `Cpu`, `ContextSwitch`, `Timer`, `IrqController`) match their ADRs (ADR-0007/0008/0010/0011/0020). `Mmu` ([`hal/src/mmu.rs`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/hal/src/mmu.rs)) has a complete v1 trait surface but no production impl yet — dormant for B2 / ADR-0027. +- **`ContextSwitch` lacks `Send + Sync` bound** ([`hal/src/context_switch.rs:25`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/hal/src/context_switch.rs#L25)): every other HAL trait carries `Send + Sync`, this one does not. Adding `: Send + Sync` matches the ADR-0020 "compiler-checked, so multi-core safety is not left to convention" discipline. Non-blocker. +- **`FakeCpu` does not implement `ContextSwitch`** ([`test-hal/src/cpu.rs:94`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/test-hal/src/cpu.rs#L94)): the test-HAL claims "all five fakes present" but kernel scheduler tests reimplement a parallel local `FakeCpu` + `FakeTaskContext` at [`kernel/src/sched/mod.rs:850-908`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/sched/mod.rs#L850). ADR-0020 §"`TestHal` fake" sketches the correct shape; lifting `FakeTaskContext` into `tyrne-test-hal` is the highest-value Track B follow-up. +- **`IrqState(pub usize)` synthetic-construction** ([`hal/src/cpu.rs:22`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/hal/src/cpu.rs#L22)): widened in usage — two test-only `Cpu` impls in the kernel construct `IrqState(0)` directly. Phase A non-blocker still applies; either widen the doc-comment or narrow the field to `pub(crate)` with a `BspConstruct` helper. +- The Phase A `IrqGuard` post-mortem comment ([`hal/src/cpu.rs:86-91`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/hal/src/cpu.rs#L86)) is preserved verbatim into the B1 era; no `&dyn Cpu` regression. - Production builds cannot pull in fakes — `tyrne-test-hal` is `[dev-dependencies]`-only on the kernel and absent from BSP `Cargo.toml`. ### BSP & boot path (Track G) -- All six rows of [`bsp-boot-checklist.md`](../../../standards/bsp-boot-checklist.md) pass: EL2→EL1 drop with HCR_EL2/SPSR_EL2 literals; `msr daifset, #0xf` as the literal first instruction at [`boot.s:47`](../../../../bsp-qemu-virt/src/boot.s#L47); `CPACR_EL1.FPEN = 0b11` + ISB after the EL drop; VBAR install before GIC init; SP 16-byte aligned at first `bl`; BSS zeroed with 8-byte stride; `context_switch_asm` `#[unsafe(naked)]` per checklist item 6. -- Boot ordering at [`bsp-qemu-virt/src/main.rs:526-598`](../../../../bsp-qemu-virt/src/main.rs#L526): banner → VBAR_EL1 install → ISB → GIC `new` + `init` → `daifclr #0x2`. Reordering would silently hang; current order is safe-by-construction. +- All six rows of [`bsp-boot-checklist.md`](../../../standards/bsp-boot-checklist.md) pass: EL2→EL1 drop with HCR_EL2/SPSR_EL2 literals; `msr daifset, #0xf` as the literal first instruction at [`boot.s:47`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/boot.s#L47); `CPACR_EL1.FPEN = 0b11` + ISB after the EL drop; VBAR install before GIC init; SP 16-byte aligned at first `bl`; BSS zeroed with 8-byte stride; `context_switch_asm` `#[unsafe(naked)]` per checklist item 6. +- Boot ordering at [`bsp-qemu-virt/src/main.rs:526-598`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/main.rs#L526): banner → VBAR_EL1 install → ISB → GIC `new` + `init` → `daifclr #0x2`. Reordering would silently hang; current order is safe-by-construction. - GIC v2 driver ([`bsp-qemu-virt/src/gic.rs`](../../../../bsp-qemu-virt/src/gic.rs)): `GIC_MAX_IRQ = 1020` range-asserted in `enable`/`disable` (line 78, 318, 344); `acknowledge` folds `INTID 1023` to `None` per spec; `end_of_interrupt` writes raw IRQ ID. Each `acknowledge`→`end_of_interrupt` pairing upheld by every branch of `irq_entry`. -- `arm_deadline` / `cancel_deadline` ([`bsp-qemu-virt/src/cpu.rs:484-554`](../../../../bsp-qemu-virt/src/cpu.rs#L484)) order is correct (CVAL before CTL before GIC enable; symmetric for cancel). `CurrentEL` self-check at [`cpu.rs:135-139`](../../../../bsp-qemu-virt/src/cpu.rs#L135) is now load-bearing post-condition of the EL drop per ADR-0024. +- `arm_deadline` / `cancel_deadline` ([`bsp-qemu-virt/src/cpu.rs:484-554`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/cpu.rs#L484)) order is correct (CVAL before CTL before GIC enable; symmetric for cancel). `CurrentEL` self-check at [`cpu.rs:135-139`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/cpu.rs#L135) is now load-bearing post-condition of the EL drop per ADR-0024. - Three Track G non-blockers worth listing: - - `irq_entry` spurious branch's `compiler_fence(Ordering::SeqCst)` is structurally redundant ([`exceptions.rs:166-174`](../../../../bsp-qemu-virt/src/exceptions.rs#L166)) — drop it or document as defence-in-depth. - - The IRQ trampoline saves into a 192-byte `TrapFrame` whose Rust-side size is guarded by `const _: () = assert!(size_of::() == 192)`; the asm side has no parallel guard ([`vectors.s:114-147`](../../../../bsp-qemu-virt/src/vectors.s#L114)). + - `irq_entry` spurious branch's `compiler_fence(Ordering::SeqCst)` is structurally redundant ([`exceptions.rs:166-174`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/exceptions.rs#L166)) — drop it or document as defence-in-depth. + - The IRQ trampoline saves into a 192-byte `TrapFrame` whose Rust-side size is guarded by `const _: () = assert!(size_of::() == 192)`; the asm side has no parallel guard ([`vectors.s:114-147`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/vectors.s#L114)). - `kernel_entry`'s call to `start(...)` is `-> !` but lacks a defensive `loop { spin_loop }` after — current code is correct under the contract; belt-and-braces would catch a refactor regression. ### Security correctness (Track C, full eight-axis sweep) @@ -56,24 +56,24 @@ Every "OK" in [Track C](2026-05-06-full-tree/track-c-security.md) is justified b ### Performance correctness (Track D, paper review) -[Track D](2026-05-06-full-tree/track-d-performance.md) finds **no correctness regressions**. Eleven proposals (P1–P11) queued; P3 (const-eval invariant migration) **already complete** (the Phase A `const { assert!(...) }` recommendation has been applied at [`kernel/src/cap/table.rs:105`](../../../../kernel/src/cap/table.rs#L105), [`kernel/src/obj/arena.rs:90-95`](../../../../kernel/src/obj/arena.rs#L90), [`bsp-qemu-virt/src/exceptions.rs:77`](../../../../bsp-qemu-virt/src/exceptions.rs#L77)). Asm hand-checks (BSS-zero loop, vectors 16×0x80, callee-save set d8–d15) all verify correct. +[Track D](2026-05-06-full-tree/track-d-performance.md) finds **no correctness regressions**. Eleven proposals (P1–P11) queued; P3 (const-eval invariant migration) **already complete** (the Phase A `const { assert!(...) }` recommendation has been applied at [`kernel/src/cap/table.rs:105`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/cap/table.rs#L105), [`kernel/src/obj/arena.rs:90-95`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/obj/arena.rs#L90), [`bsp-qemu-virt/src/exceptions.rs:77`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/exceptions.rs#L77)). Asm hand-checks (BSS-zero loop, vectors 16×0x80, callee-save set d8–d15) all verify correct. ## Style -- [`kernel/src/cap/table.rs:105`](../../../../kernel/src/cap/table.rs#L105) — `CAP_TABLE_CAPACITY <= Index::MAX` uses `const _: () = assert!(...)`, not the inline `const { assert!(...) }` form used in `Arena::new`. Phase A non-blocker still applies (Track A). -- [`kernel/src/sched/mod.rs:48`](../../../../kernel/src/sched/mod.rs#L48) — `SchedQueue<0>` should carry a build-time `const { assert!(N > 0, ...) }` rather than relying on implicit short-circuit semantics (Track A). -- [`bsp-qemu-virt/src/console.rs:71-78`](../../../../bsp-qemu-virt/src/console.rs#L71) — `Pl011Uart::write_bytes` uses plain `+` for `self.base + offset` rather than `wrapping_add`. Phase A non-blocker still applies; no overflow possible at base `0x0900_0000` with offsets ≤ `0x18` (Track G). -- [`bsp-qemu-virt/src/main.rs:484`](../../../../bsp-qemu-virt/src/main.rs#L484) — `extern "C" { static tyrne_vectors: u8; }` uses legacy edition-2021 block syntax while `irq_entry` / `panic_entry` / `context_switch_asm` were converted to `unsafe extern "C" fn` in PR #10 R2; FFI-surface stylistic discipline drifted at this one site. Resolution: bump to edition 2024 + convert, or add a one-line comment justifying the legacy form (Track I). -- [`bsp-qemu-virt/src/exceptions.rs:142-145`](../../../../bsp-qemu-virt/src/exceptions.rs#L142) — `irq_entry`'s `_frame` parameter exists only for the trampoline calling convention; current doc hints at this in passing but does not explicitly justify the unused parameter (Track G). -- [`docs/analysis/tasks/phase-b/T-009-...md`](../../../tasks/phase-b/T-009-timer-init-cntvct.md) and seven other committed English docs use the Turkish severity adjective `Yüksek` while [`docs/standards/security-review.md`](../../../standards/security-review.md) and [`docs/standards/code-review.md`](../../../standards/code-review.md) use English severity labels (Critical / High / Medium / Low) (Track J §J-NB2). -- Three test modules ([`kernel/src/obj/task.rs:104`](../../../../kernel/src/obj/task.rs#L104), [`obj/endpoint.rs:96`](../../../../kernel/src/obj/endpoint.rs#L96), [`obj/notification.rs:111`](../../../../kernel/src/obj/notification.rs#L111)) omit `clippy::expect_used` and `clippy::panic` from their `#[allow(...)]` blocks — the rest of the kernel allows the trio together (Track F §F-3). +- [`kernel/src/cap/table.rs:105`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/cap/table.rs#L105) — `CAP_TABLE_CAPACITY <= Index::MAX` uses `const _: () = assert!(...)`, not the inline `const { assert!(...) }` form used in `Arena::new`. Phase A non-blocker still applies (Track A). +- [`kernel/src/sched/mod.rs:48`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/sched/mod.rs#L48) — `SchedQueue<0>` should carry a build-time `const { assert!(N > 0, ...) }` rather than relying on implicit short-circuit semantics (Track A). +- [`bsp-qemu-virt/src/console.rs:71-78`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/console.rs#L71) — `Pl011Uart::write_bytes` uses plain `+` for `self.base + offset` rather than `wrapping_add`. Phase A non-blocker still applies; no overflow possible at base `0x0900_0000` with offsets ≤ `0x18` (Track G). +- [`bsp-qemu-virt/src/main.rs:484`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/main.rs#L484) — `extern "C" { static tyrne_vectors: u8; }` uses legacy edition-2021 block syntax while `irq_entry` / `panic_entry` / `context_switch_asm` were converted to `unsafe extern "C" fn` in PR #10 R2; FFI-surface stylistic discipline drifted at this one site. Resolution: bump to edition 2024 + convert, or add a one-line comment justifying the legacy form (Track I). +- [`bsp-qemu-virt/src/exceptions.rs:142-145`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/exceptions.rs#L142) — `irq_entry`'s `_frame` parameter exists only for the trampoline calling convention; current doc hints at this in passing but does not explicitly justify the unused parameter (Track G). +- [`docs/analysis/tasks/phase-b/T-009-...md`](../../tasks/phase-b/T-009-timer-init-cntvct.md) and seven other committed English docs use the Turkish severity adjective `Yüksek` while [`docs/standards/security-review.md`](../../../standards/security-review.md) and [`docs/standards/code-review.md`](../../../standards/code-review.md) use English severity labels (Critical / High / Medium / Low) (Track J §J-NB2). +- Three test modules ([`kernel/src/obj/task.rs:104`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/obj/task.rs#L104), [`obj/endpoint.rs:96`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/obj/endpoint.rs#L96), [`obj/notification.rs:111`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/obj/notification.rs#L111)) omit `clippy::expect_used` and `clippy::panic` from their `#[allow(...)]` blocks — the rest of the kernel allows the trio together (Track F §F-3). ## Test coverage Synthesis of [Track F — Tests & coverage](2026-05-06-full-tree/track-f-tests.md) (Approve) and Track A's test-coverage routing. - **Per-error-variant matrix:** 23 variants reviewed; **17 covered** by in-tree tests; **6 documented-unreachable / no-producer** (`SchedError::QueueFull`, `ObjError::StillReachable`, `MmuError::{MisalignedAddress, OutOfFrames, InvalidFlags}`). -- **Phase A code-review's named gap (`IpcError::ReceiverTableFull`) is closed by T-011** at [`kernel/src/ipc/mod.rs:1004`](../../../../kernel/src/ipc/mod.rs#L1004) — `assert_eq!(err, IpcError::ReceiverTableFull)` plus a recovery half asserting the in-flight cap survived the failed recv. +- **Phase A code-review's named gap (`IpcError::ReceiverTableFull`) is closed by T-011** at [`kernel/src/ipc/mod.rs:1004`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/ipc/mod.rs#L1004) — `assert_eq!(err, IpcError::ReceiverTableFull)` plus a recovery half asserting the in-flight cap survived the failed recv. - **`SchedError::Deadlock` and `IpcError::PendingAfterResume`** (the typed-error replacements per ADR-0022) covered by `ipc_recv_and_yield_returns_deadlock_when_ready_queue_empty` and `ipc_recv_and_yield_resume_pending_returns_typed_err`. **`start_prelude` empty-queue panic** covered by `start_prelude_panics_on_empty_ready_queue`. The three Phase A test gaps are closed. - **Per-subsystem coverage thresholds:** every kernel-core file is comfortably above the [`testing.md`](../../../standards/testing.md) 80 % soft floor at the 2026-04-27 rerun (sched 93.97 %, ipc 97.86 %, cap/table 97.46 %, cap/mod 89.47 %, obj/* 93.75–100 %, cap/rights 97.50 %); 9 days stale, monotonic-up trend, recommend rerun at B2 entry. - **Miri:** at HEAD pre-flight reports 149 / 149 pass clean; Track F's background capture only got the doc-test trailer, but the surface is the same Miri already covered (143/143 post-T-011 plus six tests at the same surface). Expected-clean. @@ -81,7 +81,7 @@ Synthesis of [Track F — Tests & coverage](2026-05-06-full-tree/track-f-tests.m - **`should_panic` discipline:** every `should_panic` in the workspace carries `expected = "..."` (5/5). - **Test-helper hygiene:** every test helper is `#[cfg(test)] + pub(crate)`; `EndpointHandle::test_handle` and `NotificationHandle::test_handle` carry `#[allow(dead_code, reason = "symmetric with TaskHandle::test_handle")]` — verified accurate. No test helper leaks into release. - **Smoke-as-regression gap (§F-1):** `tools/run-qemu.sh` is maintainer-launched; no `qemu-smoke` job in [`.github/workflows/ci.yml`](../../../../.github/workflows/ci.yml). The "Pending QEMU smoke verification" notes on UNSAFE-2026-0019/0020/0021 cannot self-clear; the two-task-demo's six-line expected-output table is a regression contract nothing exercises. Recommend a B2-prep task to add a `qemu-smoke` CI job. -- **`ObjError::StillReachable` has no producer (§F-2):** declared at [`kernel/src/obj/mod.rs:68`](../../../../kernel/src/obj/mod.rs#L68); per [`testing.md`](../../../standards/testing.md) the rule is "every variant has a test that provokes it". Two acceptable resolutions: delete the variant (rely on `#[non_exhaustive]`) or extend the standard with a "documented future variant" exception. +- **`ObjError::StillReachable` has no producer (§F-2):** declared at [`kernel/src/obj/mod.rs:68`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/obj/mod.rs#L68); per [`testing.md`](../../../standards/testing.md) the rule is "every variant has a test that provokes it". Two acceptable resolutions: delete the variant (rely on `#[non_exhaustive]`) or extend the standard with a "documented future variant" exception. ## Documentation @@ -105,7 +105,7 @@ Seven blocker-class doc drift items. Each is a factual statement that has fallen - **`Yüksek` in eight committed English docs** — Turkish severity term in seven non-quoted references and one quoted commit-subject reference; standards use English (Critical / High / Medium / Low) (Track J §J-NB2). - **`docs/decisions/README.md` ADR index** jumps 0022 → 0024; `phase-b.md` ADR ledger lists ADR-0023 as Deferred. Pick one indexing convention (Track I). - **`docs/glossary.md`** dead link pattern (also blocker #5 below) is the place where the chain walk breaks at one end (Track I §Non-blocking #2). -- **`Aarch64TaskContext` lacks compile-time size guard** ([`bsp-qemu-virt/src/cpu.rs:305`](../../../../bsp-qemu-virt/src/cpu.rs#L305)) — its sibling `TrapFrame` has one; PR #10 R2 added the latter but did not back-fill the older site (Track I §Non-blocking #3). +- **`Aarch64TaskContext` lacks compile-time size guard** ([`bsp-qemu-virt/src/cpu.rs:305`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/cpu.rs#L305)) — its sibling `TrapFrame` has one; PR #10 R2 added the latter but did not back-fill the older site (Track I §Non-blocking #3). ### Audit-log integrity (Track E + Track H + Track I) @@ -125,13 +125,13 @@ Synthesis of [Track I — Cross-track integration](2026-05-06-full-tree/track-i- ### ABI boundary (Track I) -- Three `#[repr(C)]` structs cross the kernel/BSP ↔ asm boundary: `Aarch64TaskContext` (168 B, **no compile-time size guard** — non-blocker), `TrapFrame` (192 B, guarded at [`exceptions.rs:77`](../../../../bsp-qemu-virt/src/exceptions.rs#L77)), `TaskStack` (alignment-only, no field offsets). +- Three `#[repr(C)]` structs cross the kernel/BSP ↔ asm boundary: `Aarch64TaskContext` (168 B, **no compile-time size guard** — non-blocker), `TrapFrame` (192 B, guarded at [`exceptions.rs:77`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/exceptions.rs#L77)), `TaskStack` (alignment-only, no field offsets). - Field-offset audit `Aarch64TaskContext` ↔ `context_switch_asm` (offsets 0/80/88/96/104) and `TrapFrame` ↔ `vectors.s` (0x00..0xC0) — both match. ### Symbol mangling (Track I) -- `kernel_entry` / `irq_entry` / `panic_entry` / `context_switch_asm` carry the expected `#[unsafe(no_mangle)]` + `unsafe extern "C"` attributes per PR #10 R2; `kernel_entry` remains `pub extern "C" fn` (no `unsafe` qualifier). The `extern "C" { static tyrne_vectors: u8; }` import at [`bsp-qemu-virt/src/main.rs:484`](../../../../bsp-qemu-virt/src/main.rs#L484) uses legacy edition-2021 block syntax — see Style above. -- Linker-exported symbols (`tyrne_vectors`, `_start`, `__bss_start`, `__bss_end`, `__stack_top`) all resolve. `tyrne_vectors_end` is exported but unreferenced (defensive / objdump convenience; documented at [`vectors.s:194`](../../../../bsp-qemu-virt/src/vectors.s#L194)). +- `kernel_entry` / `irq_entry` / `panic_entry` / `context_switch_asm` carry the expected `#[unsafe(no_mangle)]` + `unsafe extern "C"` attributes per PR #10 R2; `kernel_entry` remains `pub extern "C" fn` (no `unsafe` qualifier). The `extern "C" { static tyrne_vectors: u8; }` import at [`bsp-qemu-virt/src/main.rs:484`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/main.rs#L484) uses legacy edition-2021 block syntax — see Style above. +- Linker-exported symbols (`tyrne_vectors`, `_start`, `__bss_start`, `__bss_end`, `__stack_top`) all resolve. `tyrne_vectors_end` is exported but unreferenced (defensive / objdump convenience; documented at [`vectors.s:194`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/vectors.s#L194)). ### Phase ↔ ADR ↔ task ↔ audit chain (Track I) @@ -146,7 +146,7 @@ Synthesis of [Track I — Cross-track integration](2026-05-06-full-tree/track-i- - `lint-and-host-test` and `kernel-build` jobs install stable Rust then implicitly defer to `rust-toolchain.toml`'s nightly pin — works but pollutes cache key; fix by switching to `dtolnay/rust-toolchain@stable` honouring the toolchain file. - The linker rustflag `-T/linker.ld` lives in [`bsp-qemu-virt/build.rs`](../../../../bsp-qemu-virt/build.rs) (not in [`.cargo/config.toml`](../../../../.cargo/config.toml)) — intentional design for absolute-path resolution; well-commented; the plan checklist already anticipated this. - `[workspace.lints]` matches `code-style.md §Lints` exactly; no per-crate file silently relaxes a workspace deny. `Cargo.lock` contains exactly four in-tree workspace crates (zero externals). All five Cargo aliases resolve. `default-members` correctly excludes `bsp-qemu-virt`. -- Skill index ↔ disk: 15 skills in [`.claude/skills/README.md`](../../../../.claude/skills/README.md) match exactly 15 `SKILL.md` files on disk. No orphans, no broken cross-links. +- Skill index ↔ disk: 15 skills in [`.claude/skills/README.md`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/.claude/skills/README.md) match exactly 15 `SKILL.md` files on disk. No orphans, no broken cross-links. ### Inter-crate dependency graph (Track I) @@ -165,25 +165,25 @@ Per the [code-review master plan §Merge step](master-plan.md#merge-step), any s 1. **Doc drift — GIC version (overview.md)** — [`docs/architecture/overview.md:77`](../../../architecture/overview.md) BSP table claims `bsp-qemu-virt` uses **GICv3**, but T-012 shipped a GIC v2 driver ([`bsp-qemu-virt/src/gic.rs`](../../../../bsp-qemu-virt/src/gic.rs); ADR-0011 + `exceptions.md` + UNSAFE-2026-0019 all say "GIC v2"). **Resolution:** correct the GIC version in the BSP table row. 2. **Doc drift — GIC version (hal.md Mermaid box)** — [`docs/architecture/hal.md:50`](../../../architecture/hal.md) BSP layering Mermaid box reads `BIrq["GICv3 / GIC-400 impl"]`. There is no GICv3 impl in tree. **Resolution:** swap the box label to `"GICv2 / GIC-400 impl"`. 3. **Doc drift — GIC version (hal.md table)** — [`docs/architecture/hal.md:181`](../../../architecture/hal.md) `bsp-qemu-virt` table row "Interrupt controller | GICv3" duplicates the same drift; the `bsp-pi4` row at line 198 correctly notes GIC-400 (v2 subset). **Resolution:** correct the `bsp-qemu-virt` row to `GICv2`. -4. **Doc drift — Timer trait status** — [`docs/architecture/hal.md:126`](../../../architecture/hal.md) Timer subsection still says `arm_deadline` / `cancel_deadline` are `unimplemented!()`. T-012 implemented them under UNSAFE-2026-0021 (bodies at [`cpu.rs:492`](../../../../bsp-qemu-virt/src/cpu.rs#L492) / [`:511`](../../../../bsp-qemu-virt/src/cpu.rs#L511)); ADR-0010 §Revision notes already records this. **Resolution:** flip the subsection prose, cite ADR-0010 §Revision notes 2026-04-28. -5. **Doc drift — scheduler idle path** — [`docs/architecture/scheduler.md:11`](../../../architecture/scheduler.md) and [`scheduler.md:73`](../../../architecture/scheduler.md) still describe idle's body as `core::hint::spin_loop()` with the `wait_for_interrupt` form framed as a future T-012 deliverable. T-012 landed 2026-04-28; [`bsp-qemu-virt/src/main.rs:276`](../../../../bsp-qemu-virt/src/main.rs#L276) shows `cpu.wait_for_interrupt();` in `idle_entry`. **Resolution:** update the idle-loop description in both passages and cite UNSAFE-2026-0021. -6. **Doc drift — security-model DAIF question** — [`docs/architecture/security-model.md:330`](../../../architecture/security-model.md) Open-question bullet still says v1's `boot.s` does not explicitly `msr daifset, #0xf` before stack/BSS setup. T-013 (commit `f289d4d`, ADR-0024, audited under UNSAFE-2026-0017) added exactly this `msr daifset, #0xf` as the first instruction of `_start` ([`boot.s:84`](../../../../bsp-qemu-virt/src/boot.s#L84)). **Resolution:** close the question with a citation to T-013 / ADR-0024 / UNSAFE-2026-0017, or convert the bullet to a closure-rider note. +4. **Doc drift — Timer trait status** — [`docs/architecture/hal.md:126`](../../../architecture/hal.md) Timer subsection still says `arm_deadline` / `cancel_deadline` are `unimplemented!()`. T-012 implemented them under UNSAFE-2026-0021 (bodies at [`cpu.rs:492`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/cpu.rs#L492) / [`:511`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/cpu.rs#L511)); ADR-0010 §Revision notes already records this. **Resolution:** flip the subsection prose, cite ADR-0010 §Revision notes 2026-04-28. +5. **Doc drift — scheduler idle path** — [`docs/architecture/scheduler.md:11`](../../../architecture/scheduler.md) and [`scheduler.md:73`](../../../architecture/scheduler.md) still describe idle's body as `core::hint::spin_loop()` with the `wait_for_interrupt` form framed as a future T-012 deliverable. T-012 landed 2026-04-28; [`bsp-qemu-virt/src/main.rs:276`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/main.rs#L276) shows `cpu.wait_for_interrupt();` in `idle_entry`. **Resolution:** update the idle-loop description in both passages and cite UNSAFE-2026-0021. +6. **Doc drift — security-model DAIF question** — [`docs/architecture/security-model.md:330`](../../../architecture/security-model.md) Open-question bullet still says v1's `boot.s` does not explicitly `msr daifset, #0xf` before stack/BSS setup. T-013 (commit `f289d4d`, ADR-0024, audited under UNSAFE-2026-0017) added exactly this `msr daifset, #0xf` as the first instruction of `_start` ([`boot.s:84`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/boot.s#L84)). **Resolution:** close the question with a citation to T-013 / ADR-0024 / UNSAFE-2026-0017, or convert the bullet to a closure-rider note. 7. **Glossary dangling link to ADR-0023** — [`docs/glossary.md:25`](../../../glossary.md) links `(decisions/0023-cross-table-capability-revocation-policy.md)` which does not exist (ADR-0023 reserved-empty). Every other reference to ADR-0023 (`phase-b.md`, `security-model.md`, B0/B1 closure reviews) is prose-only without a hyperlink. **Resolution:** drop the markdown link wrapping (keep prose "see ADR-0023 (deferred per Phase B0 closure)"), or write the deferred placeholder ADR-0023 file with a `Status: Deferred` body. ### Non-blocking follow-ups (clustered) #### Kernel correctness (Track A) -- Migrate `CAP_TABLE_CAPACITY <= Index::MAX` to inline `const { assert!(...) }` form ([`kernel/src/cap/table.rs:105`](../../../../kernel/src/cap/table.rs#L105)). -- Add `const { assert!(N > 0, ...) }` at the top of `SchedQueue::new` ([`kernel/src/sched/mod.rs:48`](../../../../kernel/src/sched/mod.rs#L48)). +- Migrate `CAP_TABLE_CAPACITY <= Index::MAX` to inline `const { assert!(...) }` form ([`kernel/src/cap/table.rs:105`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/cap/table.rs#L105)). +- Add `const { assert!(N > 0, ...) }` at the top of `SchedQueue::new` ([`kernel/src/sched/mod.rs:48`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/sched/mod.rs#L48)). - File an ADR introducing `IpcError::WrongObjectKind` / `IpcError::MissingRight` (and symmetric transfer variants) before B2 begins. -- Queue an ADR for "endpoint rollback / `ipc_cancel_recv`" before Phase B2 to address the Deadlock-rollback endpoint-state asymmetry at [`sched/mod.rs:773-778`](../../../../kernel/src/sched/mod.rs#L773). +- Queue an ADR for "endpoint rollback / `ipc_cancel_recv`" before Phase B2 to address the Deadlock-rollback endpoint-state asymmetry at [`sched/mod.rs:773-778`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/sched/mod.rs#L773). - Route `Some(cap)` payloads in `IpcQueues::reset_if_stale_generation` through the destroyer's table for graceful drain when endpoint destruction lands. -- Add a one-line comment at [`kernel/src/cap/table.rs:329-336`](../../../../kernel/src/cap/table.rs#L329) explaining the "descendants fit because every live node appears at most once" size proof. +- Add a one-line comment at [`kernel/src/cap/table.rs:329-336`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/cap/table.rs#L329) explaining the "descendants fit because every live node appears at most once" size proof. #### HAL contracts (Track B) -- Add `: Send + Sync` to the `ContextSwitch` trait declaration ([`hal/src/context_switch.rs:25`](../../../../hal/src/context_switch.rs#L25)). +- Add `: Send + Sync` to the `ContextSwitch` trait declaration ([`hal/src/context_switch.rs:25`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/hal/src/context_switch.rs#L25)). - Lift `FakeCpu` / `FakeTaskContext` from `kernel/src/sched/mod.rs` into `tyrne-test-hal::cpu` so `FakeCpu: ContextSwitch` per ADR-0020. - Either widen the `IrqState(pub usize)` doc-comment to acknowledge "BSP impls and test-only Cpu impls" or narrow the field to `pub(crate)` with a `BspConstruct` helper. @@ -216,17 +216,17 @@ Per the [code-review master plan §Merge step](master-plan.md#merge-step), any s - **§F-1** wire QEMU smoke into CI as a `qemu-smoke` job (closes the "Pending QEMU smoke verification" self-clear gap on UNSAFE-2026-0019/0020/0021; future-proofs against new `unsafe` blocks accumulating their own notes). - **§F-2** decide `ObjError::StillReachable`: delete + rely on `#[non_exhaustive]`, or extend [`testing.md`](../../../standards/testing.md) with a "documented future variant" exception. -- **§F-3** roll-up cleanup: add `clippy::expect_used` + `clippy::panic` to the allow-blocks in [`obj/task.rs:104`](../../../../kernel/src/obj/task.rs#L104), [`obj/endpoint.rs:96`](../../../../kernel/src/obj/endpoint.rs#L96), [`obj/notification.rs:111`](../../../../kernel/src/obj/notification.rs#L111). +- **§F-3** roll-up cleanup: add `clippy::expect_used` + `clippy::panic` to the allow-blocks in [`obj/task.rs:104`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/obj/task.rs#L104), [`obj/endpoint.rs:96`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/obj/endpoint.rs#L96), [`obj/notification.rs:111`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/obj/notification.rs#L111). - **§M-2** open a B2-or-later roadmap task to add `proptest` (or `bolero`) under `[dev-dependencies]` of `tyrne-kernel` and write **one** property test against `CapabilityTable`'s derivation-tree invariants. - **§M-3** rerun `cargo llvm-cov` at next phase-boundary closure (B2 entry); name the artifact `docs/analysis/reports/-coverage-rerun.md`. #### BSP & boot (Track G) -- Drop the redundant `compiler_fence(Ordering::SeqCst)` in `irq_entry`'s spurious-IRQ branch ([`exceptions.rs:166-174`](../../../../bsp-qemu-virt/src/exceptions.rs#L166)) or document as defence-in-depth. -- Add a comment cross-reference in `vectors.s` pointing at the [`exceptions.rs:77`](../../../../bsp-qemu-virt/src/exceptions.rs#L77) `TrapFrame` size assertion so the asm/Rust frame-size contract is paired in the maintainer's mental model. -- Append a defensive `loop { core::hint::spin_loop(); }` after `start(SCHED.as_mut_ptr(), cpu);` in `kernel_entry` ([`main.rs:716-721`](../../../../bsp-qemu-virt/src/main.rs#L716)). +- Drop the redundant `compiler_fence(Ordering::SeqCst)` in `irq_entry`'s spurious-IRQ branch ([`exceptions.rs:166-174`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/exceptions.rs#L166)) or document as defence-in-depth. +- Add a comment cross-reference in `vectors.s` pointing at the [`exceptions.rs:77`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/exceptions.rs#L77) `TrapFrame` size assertion so the asm/Rust frame-size contract is paired in the maintainer's mental model. +- Append a defensive `loop { core::hint::spin_loop(); }` after `start(SCHED.as_mut_ptr(), cpu);` in `kernel_entry` ([`main.rs:716-721`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/main.rs#L716)). - Add `// Receives the saved-frame pointer in x0 even though v1 ignores it; future arcs will read e.g. ELR/SPSR.` before `irq_entry` to justify the unused `_frame` parameter. -- Add `const _: () = assert!(core::mem::size_of::() == 168);` immediately after the type definition at [`bsp-qemu-virt/src/cpu.rs:305`](../../../../bsp-qemu-virt/src/cpu.rs#L305) to mirror the `TrapFrame` discipline (Track I §Non-blocking #3). +- Add `const _: () = assert!(core::mem::size_of::() == 168);` immediately after the type definition at [`bsp-qemu-virt/src/cpu.rs:305`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/cpu.rs#L305) to mirror the `TrapFrame` discipline (Track I §Non-blocking #3). #### Infra / CI (Track H, routed to Track E for doc-side resolution) @@ -239,12 +239,12 @@ Per the [code-review master plan §Merge step](master-plan.md#merge-step), any s #### Hygiene / URLs / `Yüksek` labels (Track J) - **§J-NB1** — 64 stale `cemililik/TyrneOS` URLs across 27 files. Resolve canonical repo URL first (`git remote -v` says `UmbrixOS`, four newest docs say `Tyrne`, 64 older references say `TyrneOS`), then sweep with a single `docs(refs):` commit similar in shape to `10e3351`. Cross-coordinated with Tracks A / G / H / B. -- **§J-NB2** — replace `Yüksek` with `High` in seven non-quoted committed English docs ([T-009-...md:109/110](../../../tasks/phase-b/T-009-timer-init-cntvct.md), [B0-closure (business)](../business-reviews/2026-04-27-B0-closure.md), [B0-closure (security)](../security-reviews/2026-04-27-B0-closure.md), [security-reviews/README.md:35](../security-reviews/README.md), [unsafe-log.md:263 + :271](../../../audits/unsafe-log.md)). Two commit-message-quoted instances are immutable. +- **§J-NB2** — replace `Yüksek` with `High` in seven non-quoted committed English docs ([T-009-...md:109/110](../../tasks/phase-b/T-009-timer-init-cntvct.md), [B0-closure (business)](../business-reviews/2026-04-27-B0-closure.md), [B0-closure (security)](../security-reviews/2026-04-27-B0-closure.md), [security-reviews/README.md:35](../security-reviews/README.md), [unsafe-log.md:263 + :271](../../../audits/unsafe-log.md)). Two commit-message-quoted instances are immutable. - **§J-OBS1** — consider lifting `#![deny(clippy::todo)]` from `kernel/src/lib.rs` to `[workspace.lints.clippy]` so `hal`, `test-hal`, `bsp-qemu-virt` carry the same posture. #### Integration drifts (Track I) -- Decide edition-2021 vs edition-2024 for the `extern "C" { static tyrne_vectors: u8; }` block at [`bsp-qemu-virt/src/main.rs:484`](../../../../bsp-qemu-virt/src/main.rs#L484); either bump + convert both the block and `kernel_entry` to `unsafe extern "C"`, or leave at edition 2021 with a one-line comment justifying the legacy form. +- Decide edition-2021 vs edition-2024 for the `extern "C" { static tyrne_vectors: u8; }` block at [`bsp-qemu-virt/src/main.rs:484`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/main.rs#L484); either bump + convert both the block and `kernel_entry` to `unsafe extern "C"`, or leave at edition 2021 with a one-line comment justifying the legacy form. - Decide ADR-0023 indexing: `docs/decisions/README.md` ADR index jumps 0022 → 0024 while `phase-b.md`'s ADR ledger lists ADR-0023 as Deferred; pick one indexing convention and apply everywhere (closes the doc-glossary blocker #7 in the same edit). - The plan's prose at §5 Track I ("`tyrne-test-hal` is dev-dep on `tyrne-kernel`") inverts the actual edge direction. Code is correct; only plan prose is loose. @@ -259,3 +259,9 @@ Per the [code-review master plan §Merge step](master-plan.md#merge-step), any s - **Performance review:** see [`track-d-performance.md`](2026-05-06-full-tree/track-d-performance.md) — Iterate. 11 proposals queued; P1 / P10 / P4 highest-ROI near-term picks; P3 already complete. - **Per-track artefacts:** [a-kernel](2026-05-06-full-tree/track-a-kernel.md) (Approve), [b-hal](2026-05-06-full-tree/track-b-hal.md) (Comment), [c-security](2026-05-06-full-tree/track-c-security.md) (Approve), [d-performance](2026-05-06-full-tree/track-d-performance.md) (Iterate), [e-docs](2026-05-06-full-tree/track-e-docs.md) (Request changes), [f-tests](2026-05-06-full-tree/track-f-tests.md) (Approve), [g-bsp](2026-05-06-full-tree/track-g-bsp.md) (Approve), [h-infra](2026-05-06-full-tree/track-h-infra.md) (Approve), [i-integration](2026-05-06-full-tree/track-i-integration.md) (Approve), [j-hygiene](2026-05-06-full-tree/track-j-hygiene.md) (Comment). - **Pre-flight:** [`00-preflight.md`](2026-05-06-full-tree/00-preflight.md) — gate clean. + +## Source-line navigation reconciliation — 2026-10-13 + +The 47 original local line citations now open immutable historical source `214052d1bbcb0943ecdb236e7929f4698bac351a`. Explicit 214052d review/plan/preflight header; original review evidence, not later current state. Original fragments and labels remain historical evidence; source bounds and navigation relevance do not independently re-prove each original claim or run. + +- **Original-range precision:** `../../../../bsp-qemu-virt/src/boot.s#L84`. Original L84 is the SPSR_EL2 D-bit comment, not the first _start instruction; retain the original range and append an explicit navigation correction. [Supplementary source region](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/boot.s#L45-L47). The original citation and finding remain preserved. diff --git a/docs/analysis/reviews/code-reviews/2026-05-06-full-tree/00-preflight.md b/docs/analysis/reviews/code-reviews/2026-05-06-full-tree/00-preflight.md index 5932299a..aedfbbc5 100644 --- a/docs/analysis/reviews/code-reviews/2026-05-06-full-tree/00-preflight.md +++ b/docs/analysis/reviews/code-reviews/2026-05-06-full-tree/00-preflight.md @@ -52,12 +52,12 @@ This matches the count recorded in [`docs/roadmap/current.md`](../../../../roadm ### Audit log -- **21 entries** in [`docs/audits/unsafe-log.md`](../../../audits/unsafe-log.md): UNSAFE-2026-0001 through UNSAFE-2026-0021. UNSAFE-2026-0012 is `Removed` (removal commit `f9b72f8`); the remaining 20 are Active. +- **21 entries** in [`docs/audits/unsafe-log.md`](../../../../audits/unsafe-log.md): UNSAFE-2026-0001 through UNSAFE-2026-0021. UNSAFE-2026-0012 is `Removed` (removal commit `f9b72f8`); the remaining 20 are Active. - Numbering has no gaps (0001–0021 contiguous; 0012 retained as a removed-but-archived marker). ### ADRs -- **25 ADRs** in [`docs/decisions/`](../../../decisions/) (0001–0025; 0023 reserved-empty, no file present at HEAD). +- **25 ADRs** in [`docs/decisions/`](../../../../decisions) (0001–0025; 0023 reserved-empty, no file present at HEAD). - ADR-0018 (badge scheme + reply-recv) is `Deferred`; remainder are `Accepted`. ### Documentation diff --git a/docs/analysis/reviews/code-reviews/2026-05-06-full-tree/track-b-hal.md b/docs/analysis/reviews/code-reviews/2026-05-06-full-tree/track-b-hal.md index 544c534a..f4be5f32 100644 --- a/docs/analysis/reviews/code-reviews/2026-05-06-full-tree/track-b-hal.md +++ b/docs/analysis/reviews/code-reviews/2026-05-06-full-tree/track-b-hal.md @@ -12,47 +12,47 @@ ### Non-blocking -- [test-hal/src/cpu.rs:94](../../../../../test-hal/src/cpu.rs#L94) `FakeCpu` does not implement `ContextSwitch`, so the kernel's scheduler tests cannot use the test-HAL's `FakeCpu` and have grown a parallel local `FakeCpu` inside `kernel/src/sched/mod.rs:850-908` that re-implements both `Cpu` and `ContextSwitch` (with associated `FakeTaskContext`). This is the exact "generation drift / fake behind its real-trait counterpart" footgun the Track B brief calls out: ADR-0020 §"`TestHal` fake" sketches a `FakeCpu: ContextSwitch` impl with a `FakeTaskContext { switched_to: usize }`, but `tyrne-test-hal` was never updated. Concrete consequence — every scheduler test reimplements a no-op switch by hand, and the fake exported as the canonical "Cpu fake for host tests" omits the operation that is *the* hot path of the kernel under test. - - Suggested resolution: lift the `FakeCpu`/`FakeTaskContext` from `kernel/src/sched/mod.rs` into `tyrne-test-hal::cpu`, make the `FakeTaskContext` capture the `switched_to` index per ADR-0020, and have the kernel's sched tests import it. Tracked as a follow-up; do **not** ship test-HAL as the documented "all five fakes present" ([test-hal/src/lib.rs:18-20](../../../../../test-hal/src/lib.rs#L18)) while the most important behavioural axis (context switch) lives elsewhere. +- [test-hal/src/cpu.rs:94](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/test-hal/src/cpu.rs#L94) `FakeCpu` does not implement `ContextSwitch`, so the kernel's scheduler tests cannot use the test-HAL's `FakeCpu` and have grown a parallel local `FakeCpu` inside `kernel/src/sched/mod.rs:850-908` that re-implements both `Cpu` and `ContextSwitch` (with associated `FakeTaskContext`). This is the exact "generation drift / fake behind its real-trait counterpart" footgun the Track B brief calls out: ADR-0020 §"`TestHal` fake" sketches a `FakeCpu: ContextSwitch` impl with a `FakeTaskContext { switched_to: usize }`, but `tyrne-test-hal` was never updated. Concrete consequence — every scheduler test reimplements a no-op switch by hand, and the fake exported as the canonical "Cpu fake for host tests" omits the operation that is *the* hot path of the kernel under test. + - Suggested resolution: lift the `FakeCpu`/`FakeTaskContext` from `kernel/src/sched/mod.rs` into `tyrne-test-hal::cpu`, make the `FakeTaskContext` capture the `switched_to` index per ADR-0020, and have the kernel's sched tests import it. Tracked as a follow-up; do **not** ship test-HAL as the documented "all five fakes present" ([test-hal/src/lib.rs:18-20](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/test-hal/src/lib.rs#L18)) while the most important behavioural axis (context switch) lives elsewhere. -- [hal/src/context_switch.rs:25](../../../../../hal/src/context_switch.rs#L25) `ContextSwitch` lacks a `Send + Sync` bound. `Cpu` is `Send + Sync` ([hal/src/cpu.rs:44](../../../../../hal/src/cpu.rs#L44)), and every current consumer in the kernel writes `C: ContextSwitch + Cpu` so the Cpu side carries the auto-traits, but the trait alone does not encode the multi-core invariant the rest of HAL is consistent about. This is the kind of drift that bites when a future caller bounds on `` alone (e.g. a bring-up test or a future per-core scheduler initialiser). +- [hal/src/context_switch.rs:25](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/hal/src/context_switch.rs#L25) `ContextSwitch` lacks a `Send + Sync` bound. `Cpu` is `Send + Sync` ([hal/src/cpu.rs:44](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/hal/src/cpu.rs#L44)), and every current consumer in the kernel writes `C: ContextSwitch + Cpu` so the Cpu side carries the auto-traits, but the trait alone does not encode the multi-core invariant the rest of HAL is consistent about. This is the kind of drift that bites when a future caller bounds on `` alone (e.g. a bring-up test or a future per-core scheduler initialiser). - Suggested resolution: add `: Send + Sync` to the trait declaration, matching the discipline ADR-0020 §Decision-drivers calls "compiler-checked, so multi-core safety is not left to convention." Same convention `Cpu`, `Console`, `Timer`, `IrqController`, `Mmu` already carry. -- [hal/src/cpu.rs:22](../../../../../hal/src/cpu.rs#L22) `IrqState(pub usize)` synthetic-construction concern, recheck: the Phase A review flagged this as non-blocking; it is still non-blocking, but with one new fact worth recording. Two test-only `Cpu` impls in the kernel now construct `IrqState(0)` directly ([kernel/src/sched/mod.rs:868](../../../../../kernel/src/sched/mod.rs#L868) and [kernel/src/sched/mod.rs:1174](../../../../../kernel/src/sched/mod.rs#L1174)) — i.e. the `pub` field is being exercised by safe code, not just by the BSP per the doc-comment's "BSP implementations can construct the value from raw architecture bits" intent. Either the doc-comment widens to acknowledge "BSP impls and test-only Cpu impls" or the field eventually narrows to `pub(crate)` with a `BspConstruct` helper as the Phase A review suggested. Either is fine; today's drift is documentation lagging usage by a notch. +- [hal/src/cpu.rs:22](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/hal/src/cpu.rs#L22) `IrqState(pub usize)` synthetic-construction concern, recheck: the Phase A review flagged this as non-blocking; it is still non-blocking, but with one new fact worth recording. Two test-only `Cpu` impls in the kernel now construct `IrqState(0)` directly ([kernel/src/sched/mod.rs:868](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/sched/mod.rs#L868) and [kernel/src/sched/mod.rs:1174](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/sched/mod.rs#L1174)) — i.e. the `pub` field is being exercised by safe code, not just by the BSP per the doc-comment's "BSP implementations can construct the value from raw architecture bits" intent. Either the doc-comment widens to acknowledge "BSP impls and test-only Cpu impls" or the field eventually narrows to `pub(crate)` with a `BspConstruct` helper as the Phase A review suggested. Either is fine; today's drift is documentation lagging usage by a notch. -- [hal/src/timer.rs](../../../../../hal/src/timer.rs#L31) The Track B per-trait checklist names the `Timer` methods as `now_ticks` / `freq_hz` / `arm_deadline` / `cancel_deadline`, but the trait surface as landed in T-009/T-012 is `now_ns` / `arm_deadline` / `cancel_deadline` / `resolution_ns` (no `now_ticks`, no `freq_hz`). This is benign — ADR-0010 §Decision-outcome unambiguously chose nanoseconds at the trait boundary and pushed ticks into BSP-internal helpers (`ticks_to_ns` / `ns_to_ticks` / `resolution_ns_for_freq`) — but the plan's drafting had an outdated tick-shaped vocabulary. Flagging so the merge step does not chase a phantom regression. The actual landed trait matches ADR-0010 cleanly. +- [hal/src/timer.rs](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/hal/src/timer.rs#L31) The Track B per-trait checklist names the `Timer` methods as `now_ticks` / `freq_hz` / `arm_deadline` / `cancel_deadline`, but the trait surface as landed in T-009/T-012 is `now_ns` / `arm_deadline` / `cancel_deadline` / `resolution_ns` (no `now_ticks`, no `freq_hz`). This is benign — ADR-0010 §Decision-outcome unambiguously chose nanoseconds at the trait boundary and pushed ticks into BSP-internal helpers (`ticks_to_ns` / `ns_to_ticks` / `resolution_ns_for_freq`) — but the plan's drafting had an outdated tick-shaped vocabulary. Flagging so the merge step does not chase a phantom regression. The actual landed trait matches ADR-0010 cleanly. -- [hal/src/irq_controller.rs:37](../../../../../hal/src/irq_controller.rs#L37) Same drafting-vs-landed gap on `IrqController`: the Track B checklist names `enable_irq` / `disable_irq` / `claim` / `complete` / `set_priority`, but the trait surface per ADR-0011 §Decision-outcome is `enable` / `disable` / `acknowledge` / `end_of_interrupt`. There is **no** `set_priority` on the trait — ADR-0011 §Open-questions explicitly defers priority configuration to a future ADR, and §Negative consequences notes "all IRQs are delivered at the BSP's default priority." So the checklist's "verify `GIC_MAX_IRQ` range check lives in BSP impl, not the trait" question has the obvious answer — the only check that *could* live on the trait is for a method that does not exist. The actual `GIC_MAX_IRQ` check is at [bsp-qemu-virt/src/gic.rs:78](../../../../../bsp-qemu-virt/src/gic.rs#L78) and is asserted inside `enable`/`disable` impls (lines 318, 344). That is the right place. +- [hal/src/irq_controller.rs:37](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/hal/src/irq_controller.rs#L37) Same drafting-vs-landed gap on `IrqController`: the Track B checklist names `enable_irq` / `disable_irq` / `claim` / `complete` / `set_priority`, but the trait surface per ADR-0011 §Decision-outcome is `enable` / `disable` / `acknowledge` / `end_of_interrupt`. There is **no** `set_priority` on the trait — ADR-0011 §Open-questions explicitly defers priority configuration to a future ADR, and §Negative consequences notes "all IRQs are delivered at the BSP's default priority." So the checklist's "verify `GIC_MAX_IRQ` range check lives in BSP impl, not the trait" question has the obvious answer — the only check that *could* live on the trait is for a method that does not exist. The actual `GIC_MAX_IRQ` check is at [bsp-qemu-virt/src/gic.rs:78](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/gic.rs#L78) and is asserted inside `enable`/`disable` impls (lines 318, 344). That is the right place. -- [hal/src/cpu.rs:44](../../../../../hal/src/cpu.rs#L44) The Track B checklist mentions an `enable_irqs` method on `Cpu`. That method does not exist; the trait is intentionally `disable_irqs` + `restore_irq_state` only, because the `IrqGuard` RAII pattern and the symmetric "save-prev-then-restore" idiom make a free-standing `enable_irqs` redundant (and dangerous — it would let callers stomp a saved mask). ADR-0008 settled this. Flagging as drafting drift in the plan, not a code finding. +- [hal/src/cpu.rs:44](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/hal/src/cpu.rs#L44) The Track B checklist mentions an `enable_irqs` method on `Cpu`. That method does not exist; the trait is intentionally `disable_irqs` + `restore_irq_state` only, because the `IrqGuard` RAII pattern and the symmetric "save-prev-then-restore" idiom make a free-standing `enable_irqs` redundant (and dangerous — it would let callers stomp a saved mask). ADR-0008 settled this. Flagging as drafting drift in the plan, not a code finding. ### Observation -- [hal/src/cpu.rs:86-91](../../../../../hal/src/cpu.rs#L86) The `IrqGuard<'a, C: Cpu>` post-mortem comment from Phase A is preserved verbatim ("Dynamic dispatch (`&dyn Cpu`) is also avoided because coercing a concrete type to a trait object at certain inlining depths can produce vtable references that alias unrelated data in `.rodata`; using a concrete type parameter eliminates the coercion site entirely"). Confirms the maintainer's request that this comment survive into the B1 era. It does. +- [hal/src/cpu.rs:86-91](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/hal/src/cpu.rs#L86) The `IrqGuard<'a, C: Cpu>` post-mortem comment from Phase A is preserved verbatim ("Dynamic dispatch (`&dyn Cpu`) is also avoided because coercing a concrete type to a trait object at certain inlining depths can produce vtable references that alias unrelated data in `.rodata`; using a concrete type parameter eliminates the coercion site entirely"). Confirms the maintainer's request that this comment survive into the B1 era. It does. -- [hal/src/console.rs:34](../../../../../hal/src/console.rs#L34) `Console` trait surface: one method (`write_bytes(&self, &[u8])`), `Send + Sync` bound at the trait level, contract spelled out (synchronous, infallible, no allocation, best-effort under contention). `FmtWriter<'a>(pub &'a dyn Console)` provides `core::fmt::Write` without forcing the HAL to depend on it. Matches ADR-0007 exactly. The `FakeConsole` ([test-hal/src/console.rs:58](../../../../../test-hal/src/console.rs#L58)) preserves byte-level fidelity (Mutex-protected `Vec` capture, `captured_str()` UTF-8 decode for assertion ergonomics). No drift. +- [hal/src/console.rs:34](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/hal/src/console.rs#L34) `Console` trait surface: one method (`write_bytes(&self, &[u8])`), `Send + Sync` bound at the trait level, contract spelled out (synchronous, infallible, no allocation, best-effort under contention). `FmtWriter<'a>(pub &'a dyn Console)` provides `core::fmt::Write` without forcing the HAL to depend on it. Matches ADR-0007 exactly. The `FakeConsole` ([test-hal/src/console.rs:58](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/test-hal/src/console.rs#L58)) preserves byte-level fidelity (Mutex-protected `Vec` capture, `captured_str()` UTF-8 decode for assertion ergonomics). No drift. -- [hal/src/context_switch.rs:25-69](../../../../../hal/src/context_switch.rs#L25) The ADR-0020 split is real: `Cpu` is object-safe (no associated types), `ContextSwitch` carries the associated `TaskContext: Default + Send`. The two `unsafe fn` methods (`context_switch`, `init_context`) carry tight `# Safety` blocks: interrupts-disabled invariant, `current` validity, `next` initialisation invariant for switch; stack-top alignment + size + lifetime, `entry: fn() -> !` non-return invariant for init. An adversarial impl could of course do anything (the trait does not enforce save-restore symmetry), but every callsite in the kernel passes the impl through an `unsafe fn` already and the BSP's `Aarch64TaskContext` impl is the only production target. The contract is as tight as a non-`unsafe trait` can be without crossing into unfriendly-API territory. Note: the checklist phrases this as "the `unsafe` trait split"; the trait is not `unsafe trait`, only its methods are `unsafe fn`. That matches ADR-0020 §"`unsafe` placement" Option E. +- [hal/src/context_switch.rs:25-69](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/hal/src/context_switch.rs#L25) The ADR-0020 split is real: `Cpu` is object-safe (no associated types), `ContextSwitch` carries the associated `TaskContext: Default + Send`. The two `unsafe fn` methods (`context_switch`, `init_context`) carry tight `# Safety` blocks: interrupts-disabled invariant, `current` validity, `next` initialisation invariant for switch; stack-top alignment + size + lifetime, `entry: fn() -> !` non-return invariant for init. An adversarial impl could of course do anything (the trait does not enforce save-restore symmetry), but every callsite in the kernel passes the impl through an `unsafe fn` already and the BSP's `Aarch64TaskContext` impl is the only production target. The contract is as tight as a non-`unsafe trait` can be without crossing into unfriendly-API territory. Note: the checklist phrases this as "the `unsafe` trait split"; the trait is not `unsafe trait`, only its methods are `unsafe fn`. That matches ADR-0020 §"`unsafe` placement" Option E. -- [hal/src/mmu.rs:208](../../../../../hal/src/mmu.rs#L208) `Mmu` is a *real* trait with a complete v1 surface (associated `AddressSpace`, `create_address_space` `unsafe`, `address_space_root`, `activate`, `map`, `unmap`, `invalidate_tlb_address`, `invalidate_tlb_all`, `MmuError`, `FrameProvider`, `MappingFlags`, `PhysFrame::from_aligned`). Phase A review described it as "placeholder"; that was true at A6. The current surface is fully fleshed out per ADR-0009. **Crucial: no real BSP impl exists yet** — `grep "impl Mmu"` against the BSP and kernel source returns zero hits; only `tyrne_test_hal::FakeMmu` implements it. So the Track B brief's worry "if any A6/B-era code accidentally consumed it, that's a finding" — checked, no consumption. The trait is dormant, ready for B2 / ADR-0027 work, and the fake is functional enough to gate the kernel tests that B2 will add. +- [hal/src/mmu.rs:208](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/hal/src/mmu.rs#L208) `Mmu` is a *real* trait with a complete v1 surface (associated `AddressSpace`, `create_address_space` `unsafe`, `address_space_root`, `activate`, `map`, `unmap`, `invalidate_tlb_address`, `invalidate_tlb_all`, `MmuError`, `FrameProvider`, `MappingFlags`, `PhysFrame::from_aligned`). Phase A review described it as "placeholder"; that was true at A6. The current surface is fully fleshed out per ADR-0009. **Crucial: no real BSP impl exists yet** — `grep "impl Mmu"` against the BSP and kernel source returns zero hits; only `tyrne_test_hal::FakeMmu` implements it. So the Track B brief's worry "if any A6/B-era code accidentally consumed it, that's a finding" — checked, no consumption. The trait is dormant, ready for B2 / ADR-0027 work, and the fake is functional enough to gate the kernel tests that B2 will add. -- [hal/src/timer.rs:31-55](../../../../../hal/src/timer.rs#L31) `Timer` surface (`now_ns`, `arm_deadline`, `cancel_deadline`, `resolution_ns`) lines up with ADR-0010 §Decision-outcome and with the BSP impl at [bsp-qemu-virt/src/cpu.rs:484](../../../../../bsp-qemu-virt/src/cpu.rs#L484) (`arm_deadline` → `ns_to_ticks` → `MSR CNTV_CVAL_EL0` + `MSR CNTV_CTL_EL0` + GIC `enable(TIMER_IRQ)`). The BSP correctly uses the host-testable `ns_to_ticks` from the HAL. +- [hal/src/timer.rs:31-55](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/hal/src/timer.rs#L31) `Timer` surface (`now_ns`, `arm_deadline`, `cancel_deadline`, `resolution_ns`) lines up with ADR-0010 §Decision-outcome and with the BSP impl at [bsp-qemu-virt/src/cpu.rs:484](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/cpu.rs#L484) (`arm_deadline` → `ns_to_ticks` → `MSR CNTV_CVAL_EL0` + `MSR CNTV_CTL_EL0` + GIC `enable(TIMER_IRQ)`). The BSP correctly uses the host-testable `ns_to_ticks` from the HAL. -- [hal/src/timer.rs:198-213](../../../../../hal/src/timer.rs#L198) `ns_to_ticks` is **ceiling-rounded** (`intermediate.div_ceil(nanos)`), matching ADR-0010's contract that the IRQ "fires at-or-after the requested time." The PR #10 review-round-2 sub-tick test the brief asks about lives at [hal/src/timer.rs:422-436](../../../../../hal/src/timer.rs#L422) (`ns_to_ticks_rounds_up_on_subtick`) — confirmed present and exercises the discriminating `freq=3 Hz, ns=333_333_334` case where floor would give 1 tick but ceiling correctly gives 2. Saturating cast at `u128 → u64` is also tested ([hal/src/timer.rs:461-477](../../../../../hal/src/timer.rs#L461)). Solid coverage; no regression risk. +- [hal/src/timer.rs:198-213](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/hal/src/timer.rs#L198) `ns_to_ticks` is **ceiling-rounded** (`intermediate.div_ceil(nanos)`), matching ADR-0010's contract that the IRQ "fires at-or-after the requested time." The PR #10 review-round-2 sub-tick test the brief asks about lives at [hal/src/timer.rs:422-436](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/hal/src/timer.rs#L422) (`ns_to_ticks_rounds_up_on_subtick`) — confirmed present and exercises the discriminating `freq=3 Hz, ns=333_333_334` case where floor would give 1 tick but ceiling correctly gives 2. Saturating cast at `u128 → u64` is also tested ([hal/src/timer.rs:461-477](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/hal/src/timer.rs#L461)). Solid coverage; no regression risk. -- [hal/src/irq_controller.rs:37-59](../../../../../hal/src/irq_controller.rs#L37) `IrqController` four-method surface (`enable`/`disable`/`acknowledge`/`end_of_interrupt`), `Option` for spurious/race semantics on `acknowledge`, `IrqNumber(pub u32)` newtype. Matches ADR-0011. The `FakeIrqController` ([test-hal/src/irq_controller.rs:93](../../../../../test-hal/src/irq_controller.rs#L93)) captures every observable (enabled set, FIFO pending queue, EOI history) — fidelity is genuine, not degenerate. +- [hal/src/irq_controller.rs:37-59](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/hal/src/irq_controller.rs#L37) `IrqController` four-method surface (`enable`/`disable`/`acknowledge`/`end_of_interrupt`), `Option` for spurious/race semantics on `acknowledge`, `IrqNumber(pub u32)` newtype. Matches ADR-0011. The `FakeIrqController` ([test-hal/src/irq_controller.rs:93](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/test-hal/src/irq_controller.rs#L93)) captures every observable (enabled set, FIFO pending queue, EOI history) — fidelity is genuine, not degenerate. -- [test-hal/Cargo.toml:13-14](../../../../../test-hal/Cargo.toml#L13) `tyrne-test-hal` declares `tyrne-hal` as a regular dep (no dev-dep gating needed because the crate's *entire purpose* is host-test fakes), and the kernel pulls it in only as `[dev-dependencies]` ([kernel/Cargo.toml:16-17](../../../../../kernel/Cargo.toml#L16)). The kernel's library code at `lib.rs` only depends on `tyrne-hal`. Production builds (the BSP) depend on `tyrne-kernel` and `tyrne-hal` but never on `tyrne-test-hal` — confirmed by `grep -r "tyrne_test_hal\|tyrne-test-hal" bsp-qemu-virt`: no matches. The `[dev-dependencies]`-only linkage holds. +- [test-hal/Cargo.toml:13-14](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/test-hal/Cargo.toml#L13) `tyrne-test-hal` declares `tyrne-hal` as a regular dep (no dev-dep gating needed because the crate's *entire purpose* is host-test fakes), and the kernel pulls it in only as `[dev-dependencies]` ([kernel/Cargo.toml:16-17](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/Cargo.toml#L16)). The kernel's library code at `lib.rs` only depends on `tyrne-hal`. Production builds (the BSP) depend on `tyrne-kernel` and `tyrne-hal` but never on `tyrne-test-hal` — confirmed by `grep -r "tyrne_test_hal\|tyrne-test-hal" bsp-qemu-virt`: no matches. The `[dev-dependencies]`-only linkage holds. -- [test-hal/src/cpu.rs:99-108](../../../../../test-hal/src/cpu.rs#L99) `FakeCpu::disable_irqs` returns `IrqState(usize::from(state.irqs_enabled))` (so `1` if previously enabled, `0` if previously disabled). `restore_irq_state` flips to `state.0 != 0`. This is faithful to the Phase A "save and restore" semantics — the nested-guard test at [test-hal/src/cpu.rs:158-172](../../../../../test-hal/src/cpu.rs#L158) verifies inner-guard drop leaves the outer-section mask in place. Fidelity is good for the EL1/host-mock contract. (The fake is degenerate w.r.t. *what specific bits* go into the IrqState — which is correct, because the real BSP's DAIF bit pattern is meaningless on the host, and the fake's job is the save/restore *protocol*, not the bits.) +- [test-hal/src/cpu.rs:99-108](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/test-hal/src/cpu.rs#L99) `FakeCpu::disable_irqs` returns `IrqState(usize::from(state.irqs_enabled))` (so `1` if previously enabled, `0` if previously disabled). `restore_irq_state` flips to `state.0 != 0`. This is faithful to the Phase A "save and restore" semantics — the nested-guard test at [test-hal/src/cpu.rs:158-172](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/test-hal/src/cpu.rs#L158) verifies inner-guard drop leaves the outer-section mask in place. Fidelity is good for the EL1/host-mock contract. (The fake is degenerate w.r.t. *what specific bits* go into the IrqState — which is correct, because the real BSP's DAIF bit pattern is meaningless on the host, and the fake's job is the save/restore *protocol*, not the bits.) -- [test-hal/src/timer.rs:90-107](../../../../../test-hal/src/timer.rs#L90) `FakeTimer` deliberately does **not** simulate deadline expiry — the doc-comment at [test-hal/src/timer.rs:9-13](../../../../../test-hal/src/timer.rs#L9) calls this out. Tests assert on `armed_deadline()` and `cancel_count()` directly. Fidelity matches the real impl's *observable* surface (the manual clock + arm/cancel/replace semantics) without taking on the impossible job of simulating a hardware IRQ. Reasonable. +- [test-hal/src/timer.rs:90-107](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/test-hal/src/timer.rs#L90) `FakeTimer` deliberately does **not** simulate deadline expiry — the doc-comment at [test-hal/src/timer.rs:9-13](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/test-hal/src/timer.rs#L9) calls this out. Tests assert on `armed_deadline()` and `cancel_count()` directly. Fidelity matches the real impl's *observable* surface (the manual clock + arm/cancel/replace semantics) without taking on the impossible job of simulating a hardware IRQ. Reasonable. -- [test-hal/src/mmu.rs:128-174](../../../../../test-hal/src/mmu.rs#L128) `FakeMmu` stores mappings as a `HashMap` keyed by VirtAddr, returns `AlreadyMapped` on duplicate insert, `NotMapped` on missing unmap, and exposes `tlb_address_invalidations` / `tlb_all_count` for assertions. Tests at [test-hal/src/mmu.rs:177-318](../../../../../test-hal/src/mmu.rs#L177) cover map/unmap round-trip, alignment rejection in `PhysFrame::from_aligned`, double-map rejection, and TLB-invalidation ordering. Fidelity is appropriate for a fake that does not pretend to model `VMSAv8`. One thing the fake does *not* exercise — but no real consumer exists to need it — is `OutOfFrames`, since the fake never calls into `frames` (no intermediate-table walk). Acceptable for v1. +- [test-hal/src/mmu.rs:128-174](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/test-hal/src/mmu.rs#L128) `FakeMmu` stores mappings as a `HashMap` keyed by VirtAddr, returns `AlreadyMapped` on duplicate insert, `NotMapped` on missing unmap, and exposes `tlb_address_invalidations` / `tlb_all_count` for assertions. Tests at [test-hal/src/mmu.rs:177-318](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/test-hal/src/mmu.rs#L177) cover map/unmap round-trip, alignment rejection in `PhysFrame::from_aligned`, double-map rejection, and TLB-invalidation ordering. Fidelity is appropriate for a fake that does not pretend to model `VMSAv8`. One thing the fake does *not* exercise — but no real consumer exists to need it — is `OutOfFrames`, since the fake never calls into `frames` (no intermediate-table walk). Acceptable for v1. -- [hal/src/lib.rs:33-49](../../../../../hal/src/lib.rs#L33) Crate posture: `#![no_std]`, modules cleanly partitioned, public re-exports flat (`Console`, `FmtWriter`, `ContextSwitch`, `CoreId`, `Cpu`, `IrqGuard`, `IrqState`, `IrqController`, `IrqNumber`, `MappingFlags`, `Mmu`, `MmuError`, `PhysAddr`, `PhysFrame`, `VirtAddr`, `PAGE_SIZE`, `FrameProvider`, `Timer`). The `cpu` and `timer` modules are `pub mod` (so `tyrne_hal::timer::ns_to_ticks` and `tyrne_hal::cpu::current_el` resolve); the others are `mod` with selective re-exports. Sensible. +- [hal/src/lib.rs:33-49](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/hal/src/lib.rs#L33) Crate posture: `#![no_std]`, modules cleanly partitioned, public re-exports flat (`Console`, `FmtWriter`, `ContextSwitch`, `CoreId`, `Cpu`, `IrqGuard`, `IrqState`, `IrqController`, `IrqNumber`, `MappingFlags`, `Mmu`, `MmuError`, `PhysAddr`, `PhysFrame`, `VirtAddr`, `PAGE_SIZE`, `FrameProvider`, `Timer`). The `cpu` and `timer` modules are `pub mod` (so `tyrne_hal::timer::ns_to_ticks` and `tyrne_hal::cpu::current_el` resolve); the others are `mod` with selective re-exports. Sensible. -- [hal/src/cpu.rs:164](../../../../../hal/src/cpu.rs#L164) `current_el()` is gated `#[cfg(all(target_arch = "aarch64", target_os = "none"))]` so it is *absent* from host builds — host tests cannot accidentally trap with SIGILL. The doc-comment, the `# Safety` block, and the `SAFETY:` comment are all in good order; this matches UNSAFE-2026-0018 in the audit log. +- [hal/src/cpu.rs:164](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/hal/src/cpu.rs#L164) `current_el()` is gated `#[cfg(all(target_arch = "aarch64", target_os = "none"))]` so it is *absent* from host builds — host tests cannot accidentally trap with SIGILL. The doc-comment, the `# Safety` block, and the `SAFETY:` comment are all in good order; this matches UNSAFE-2026-0018 in the audit log. - [hal/Cargo.toml](../../../../../hal/Cargo.toml) Workspace-derived metadata, no dependencies. The crate is genuinely traits-only (no logic), per the `lib.rs` doc-comment's promise. Clean. @@ -70,3 +70,7 @@ **Comment** Three-line summary: the HAL trait surface is consistent with its ADRs, the test-HAL is `[dev-dependencies]`-isolated and the four exercised fakes are appropriately faithful, but `FakeCpu` is missing the `ContextSwitch` impl ADR-0020 sketches and has been silently shadowed by a local re-implementation inside `kernel/src/sched/mod.rs`. Closing that gap (lifting `FakeTaskContext` into `tyrne-test-hal`) is the highest-value follow-up; tightening `ContextSwitch` with `: Send + Sync` is a small consistency win matching the rest of HAL. No blockers, no security-shaped findings; trait↔BSP wiring is clean. + +## Source-line navigation reconciliation — 2026-10-13 + +The 33 original local line citations now open immutable historical source `214052d1bbcb0943ecdb236e7929f4698bac351a`. Explicit 214052d review/plan/preflight header; original review evidence, not later current state. Original fragments and labels remain historical evidence; source bounds and navigation relevance do not independently re-prove each original claim or run. diff --git a/docs/analysis/reviews/code-reviews/2026-05-06-full-tree/track-c-security.md b/docs/analysis/reviews/code-reviews/2026-05-06-full-tree/track-c-security.md index eb1c8e01..6fd2c4b5 100644 --- a/docs/analysis/reviews/code-reviews/2026-05-06-full-tree/track-c-security.md +++ b/docs/analysis/reviews/code-reviews/2026-05-06-full-tree/track-c-security.md @@ -12,22 +12,22 @@ Adversarial frame: *can a caller invoke `cap_copy` / `cap_derive` / `cap_revoke` / `cap_drop` / `cap_take` / `ipc_send` / `ipc_recv` / `ipc_notify` / `ipc_send_and_yield` / `ipc_recv_and_yield` without holding the authority `security-model.md` requires?* -- **Phase A + B0 + B1 invariants intact.** **OK** — every "OK" finding in the three prior consolidated reviews re-verified against the post-`214052d` source. No regressions in `cap_copy` ([`cap/table.rs:185-187`](../../../../../kernel/src/cap/table.rs#L185-L187)), `cap_derive` ([`cap/table.rs:260-262`](../../../../../kernel/src/cap/table.rs#L260-L262)), `cap_revoke` ([`cap/table.rs:322-324`](../../../../../kernel/src/cap/table.rs#L322-L324)), `cap_drop`, `cap_take`, `ipc_send` rights enforcement ([`ipc/mod.rs:266`](../../../../../kernel/src/ipc/mod.rs#L266)), or `ipc_recv` rights enforcement ([`ipc/mod.rs:343`](../../../../../kernel/src/ipc/mod.rs#L343)). -- **Capability is move-only at the type level.** **OK** — `Capability` derives `Debug` only; not `Copy`, not `Clone` ([`cap/mod.rs:100-104`](../../../../../kernel/src/cap/mod.rs#L100-L104)). Duplication is structurally impossible without going through `cap_copy`, which requires `DUPLICATE`. -- **Reserved-bit masking at the ABI boundary.** **OK** — `CapRights::from_raw` silently masks bits outside `KNOWN_BITS` ([`cap/rights.rs:67-70`](../../../../../kernel/src/cap/rights.rs#L67-L70)). A hostile untrusted caller cannot smuggle reserved flags past `contains` checks. Test pinned at [`cap/rights.rs:179-188`](../../../../../kernel/src/cap/rights.rs#L179-L188). -- **Generation-tagged handles defeat slot-reuse confusion.** **OK** — `free_slot` bumps `generation` via `wrapping_add(1)` ([`cap/table.rs:548`](../../../../../kernel/src/cap/table.rs#L548)); stale handle fails `resolve_handle` ([`cap/table.rs:506-518`](../../../../../kernel/src/cap/table.rs#L506-L518)). **Inherited flag (latent):** `u32` generation wraps after 2³² reuse cycles per slot — Phase-A note carried forward unchanged; not exploitable in v1 (reuse counts are single digits). Tracked as a B-late ADR follow-up. -- **Cross-table revocation gap.** **flagged — inherited, unchanged.** `install_cap_if_some` calls `insert_root` on the receiver's table ([`ipc/mod.rs:370`](../../../../../kernel/src/ipc/mod.rs#L370)), so an IPC-transferred capability lands as a fresh root in the receiver's tree — sender's `cap_revoke` does not reach it. Tracked as ADR-0023 (deferred per B0 closure plan); `security-model.md`'s *Invariants* now carries the v1 scope qualification (see §8 below). No new code in B0/B1 makes the gap worse or better. -- **Bridge resolves cap rights *before* materialising any momentary `&mut`.** **OK** — `resolve_ep_cap` runs against the caller's `&CapabilityTable` ([`sched/mod.rs:273-284`](../../../../../kernel/src/sched/mod.rs#L273-L284)) before the inner block in `ipc_send_and_yield` / `ipc_recv_and_yield` allocates any `&mut`. Failure path returns `SchedError::Ipc(InvalidCapability)` with the scheduler untouched. -- **Capability transfer atomicity through the bridge.** **OK** — `ipc_send_and_yield`'s Phase 1 block reuses the bare `ipc_send` path ([`sched/mod.rs:651`](../../../../../kernel/src/sched/mod.rs#L651)); the cap moves out of the sender's table inside the same momentary-`&mut` block as the endpoint-state transition. The bridge adds yield/unblock around the existing flow but does not introduce a new cap-handling code path. -- **`ReceiverTableFull` pre-flight retains the in-flight cap.** **OK** — pre-flight check at [`ipc/mod.rs:356-363`](../../../../../kernel/src/ipc/mod.rs#L356-L363) tests `pending_has_cap && caller_table.is_full()` *before* `core::mem::replace` moves state to `Idle`. A failed install would otherwise drop the cap silently. Regression test `recv_with_full_table_preserves_pending_cap` exists in the IPC test module. -- **Slot-reuse generation guard with `Some(cap)` leak detection.** **OK** — `IpcQueues::reset_if_stale_generation` at [`ipc/mod.rs:211-228`](../../../../../kernel/src/ipc/mod.rs#L211-L228) fires a `debug_assert!` if a stale-generation reset would silently drop an in-flight `Capability`. The destruction-path drain-before-reset invariant is the future-proof bound the assertion enforces; release-mode behaviour acceptably leaks (debug_assert is a no-op) but the bug would surface as a generation-bump test failure in production. -- **`SchedError::Deadlock` rollback scope.** **OK** — `ipc_recv_and_yield` restores `s.current` and `s.task_states[current_idx]` at [`sched/mod.rs:773-778`](../../../../../kernel/src/sched/mod.rs#L773-L778) before returning Err. Endpoint state stays at `RecvWaiting` (documented in `SchedError::Deadlock`'s doc-comment, [`sched/mod.rs:160-180`](../../../../../kernel/src/sched/mod.rs#L160-L180)); a hostile retry sees `QueueFull`, not `Pending`. No capability leak; no escalation. -- **`PendingAfterResume` typed return.** **OK** — `ipc_recv_and_yield`'s Phase 3 decodes a resume-time `Pending` into `Err(SchedError::Ipc(IpcError::PendingAfterResume))` at [`sched/mod.rs:828`](../../../../../kernel/src/sched/mod.rs#L828) instead of returning `Ok(Pending)` (which a downstream `let RecvOutcome::Received { .. } else { panic!() }` would convert into a panic). +- **Phase A + B0 + B1 invariants intact.** **OK** — every "OK" finding in the three prior consolidated reviews re-verified against the post-`214052d` source. No regressions in `cap_copy` ([`cap/table.rs:185-187`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/cap/table.rs#L185-L187)), `cap_derive` ([`cap/table.rs:260-262`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/cap/table.rs#L260-L262)), `cap_revoke` ([`cap/table.rs:322-324`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/cap/table.rs#L322-L324)), `cap_drop`, `cap_take`, `ipc_send` rights enforcement ([`ipc/mod.rs:266`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/ipc/mod.rs#L266)), or `ipc_recv` rights enforcement ([`ipc/mod.rs:343`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/ipc/mod.rs#L343)). +- **Capability is move-only at the type level.** **OK** — `Capability` derives `Debug` only; not `Copy`, not `Clone` ([`cap/mod.rs:100-104`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/cap/mod.rs#L100-L104)). Duplication is structurally impossible without going through `cap_copy`, which requires `DUPLICATE`. +- **Reserved-bit masking at the ABI boundary.** **OK** — `CapRights::from_raw` silently masks bits outside `KNOWN_BITS` ([`cap/rights.rs:67-70`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/cap/rights.rs#L67-L70)). A hostile untrusted caller cannot smuggle reserved flags past `contains` checks. Test pinned at [`cap/rights.rs:179-188`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/cap/rights.rs#L179-L188). +- **Generation-tagged handles defeat slot-reuse confusion.** **OK** — `free_slot` bumps `generation` via `wrapping_add(1)` ([`cap/table.rs:548`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/cap/table.rs#L548)); stale handle fails `resolve_handle` ([`cap/table.rs:506-518`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/cap/table.rs#L506-L518)). **Inherited flag (latent):** `u32` generation wraps after 2³² reuse cycles per slot — Phase-A note carried forward unchanged; not exploitable in v1 (reuse counts are single digits). Tracked as a B-late ADR follow-up. +- **Cross-table revocation gap.** **flagged — inherited, unchanged.** `install_cap_if_some` calls `insert_root` on the receiver's table ([`ipc/mod.rs:370`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/ipc/mod.rs#L370)), so an IPC-transferred capability lands as a fresh root in the receiver's tree — sender's `cap_revoke` does not reach it. Tracked as ADR-0023 (deferred per B0 closure plan); `security-model.md`'s *Invariants* now carries the v1 scope qualification (see §8 below). No new code in B0/B1 makes the gap worse or better. +- **Bridge resolves cap rights *before* materialising any momentary `&mut`.** **OK** — `resolve_ep_cap` runs against the caller's `&CapabilityTable` ([`sched/mod.rs:273-284`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/sched/mod.rs#L273-L284)) before the inner block in `ipc_send_and_yield` / `ipc_recv_and_yield` allocates any `&mut`. Failure path returns `SchedError::Ipc(InvalidCapability)` with the scheduler untouched. +- **Capability transfer atomicity through the bridge.** **OK** — `ipc_send_and_yield`'s Phase 1 block reuses the bare `ipc_send` path ([`sched/mod.rs:651`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/sched/mod.rs#L651)); the cap moves out of the sender's table inside the same momentary-`&mut` block as the endpoint-state transition. The bridge adds yield/unblock around the existing flow but does not introduce a new cap-handling code path. +- **`ReceiverTableFull` pre-flight retains the in-flight cap.** **OK** — pre-flight check at [`ipc/mod.rs:356-363`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/ipc/mod.rs#L356-L363) tests `pending_has_cap && caller_table.is_full()` *before* `core::mem::replace` moves state to `Idle`. A failed install would otherwise drop the cap silently. Regression test `recv_with_full_table_preserves_pending_cap` exists in the IPC test module. +- **Slot-reuse generation guard with `Some(cap)` leak detection.** **OK** — `IpcQueues::reset_if_stale_generation` at [`ipc/mod.rs:211-228`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/ipc/mod.rs#L211-L228) fires a `debug_assert!` if a stale-generation reset would silently drop an in-flight `Capability`. The destruction-path drain-before-reset invariant is the future-proof bound the assertion enforces; release-mode behaviour acceptably leaks (debug_assert is a no-op) but the bug would surface as a generation-bump test failure in production. +- **`SchedError::Deadlock` rollback scope.** **OK** — `ipc_recv_and_yield` restores `s.current` and `s.task_states[current_idx]` at [`sched/mod.rs:773-778`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/sched/mod.rs#L773-L778) before returning Err. Endpoint state stays at `RecvWaiting` (documented in `SchedError::Deadlock`'s doc-comment, [`sched/mod.rs:160-180`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/sched/mod.rs#L160-L180)); a hostile retry sees `QueueFull`, not `Pending`. No capability leak; no escalation. +- **`PendingAfterResume` typed return.** **OK** — `ipc_recv_and_yield`'s Phase 3 decodes a resume-time `Pending` into `Err(SchedError::Ipc(IpcError::PendingAfterResume))` at [`sched/mod.rs:828`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/kernel/src/sched/mod.rs#L828) instead of returning `Ok(Pending)` (which a downstream `let RecvOutcome::Received { .. } else { panic!() }` would convert into a panic). - **GIC `enable` / `disable` / `acknowledge` / `end_of_interrupt` are not capability-gated in v1.** **N/A — deliberate.** These are kernel-internal hardware operations; they correspond to MMU page-table ops in spirit, not to capability-table ops. The `IrqController` trait sits below the capability layer (mirroring `Console::write_bytes`'s lack of `ConsoleCap` check). Future userspace IRQ delivery is gated by the `IrqCap` pattern in [`exceptions.md`](../../../../architecture/exceptions.md)'s "No userspace IRQ delivery in v1" §; that lands with Phase C work. **Adversarial probe — can a hostile caller reach `IrqController::enable`?** No; the only callers are `arm_deadline` / `cancel_deadline` (kernel-internal) and `irq_entry` itself, none of which is reachable from userspace in v1. - **`Timer::arm_deadline` / `cancel_deadline` are not capability-gated in v1.** **N/A — deliberate.** Same reasoning. There is *no caller* in v1 — the cooperative IPC demo arms no deadline; idle uses `wait_for_interrupt` which goes via `Cpu::wait_for_interrupt`, not `Timer`. The first userspace-reachable arm path will be Phase B5+ `time_sleep_until` syscall, gated by `TimerCap`. -- **GIC range assertions on `enable` / `disable`.** **OK** — `assert!(irq.0 < GIC_MAX_IRQ)` at [`gic.rs:317-322`](../../../../../bsp-qemu-virt/src/gic.rs#L317-L322) and [`:343-348`](../../../../../bsp-qemu-virt/src/gic.rs#L343-L348) gates offset arithmetic against ARM IHI 0048B's 1020-INTID architectural cap. The assertion is *before* any MMIO; defence-in-depth against future regressions (only caller passes `IrqNumber(27)` today). -- **`acknowledge` folds spurious INTID 1023 to `None`.** **OK** — [`gic.rs:369-376`](../../../../../bsp-qemu-virt/src/gic.rs#L369-L376) masks the bottom 10 bits of `GICC_IAR` and folds `1023` to `None` per the trait contract. The spurious value cannot leak as a real `IrqNumber` to a downstream caller. -- **`end_of_interrupt` writes the raw IRQ ID.** **OK** — [`gic.rs:378-384`](../../../../../bsp-qemu-virt/src/gic.rs#L378-L384) writes `irq.0` to `GICC_EOIR` without further validation; GICv2 EOIR ignores writes that don't match a currently-active priority level. No state corruption from a mis-paired call. +- **GIC range assertions on `enable` / `disable`.** **OK** — `assert!(irq.0 < GIC_MAX_IRQ)` at [`gic.rs:317-322`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/gic.rs#L317-L322) and [`:343-348`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/gic.rs#L343-L348) gates offset arithmetic against ARM IHI 0048B's 1020-INTID architectural cap. The assertion is *before* any MMIO; defence-in-depth against future regressions (only caller passes `IrqNumber(27)` today). +- **`acknowledge` folds spurious INTID 1023 to `None`.** **OK** — [`gic.rs:369-376`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/gic.rs#L369-L376) masks the bottom 10 bits of `GICC_IAR` and folds `1023` to `None` per the trait contract. The spurious value cannot leak as a real `IrqNumber` to a downstream caller. +- **`end_of_interrupt` writes the raw IRQ ID.** **OK** — [`gic.rs:378-384`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/gic.rs#L378-L384) writes `irq.0` to `GICC_EOIR` without further validation; GICv2 EOIR ignores writes that don't match a currently-active priority level. No state corruption from a mis-paired call. --- @@ -36,20 +36,20 @@ Adversarial frame: *can a caller invoke `cap_copy` / `cap_derive` / `cap_revoke` Adversarial frame: *what new boundaries did B0/B1 add, and what untrusted bytes (or values) cross them?* - **No userspace/kernel privilege boundary in code yet.** **N/A — by design.** Phase B5+ work. `kernel_entry` and task entry functions are still called from within the same privilege level (EL1) and the same Rust module tree. No `svc`/`smc`/`hvc`/`ecall` instruction appears anywhere in the tree (verified by grep across `bsp-qemu-virt/src`). No syscall dispatch table, no enter-user routine, no EL0-bound code. -- **No premature userspace surface introduced by B0/B1.** **OK** — vectors.s explicitly defends against IRQs taken from `SP_EL0` mode or any lower EL ([`vectors.s:174-186`](../../../../../bsp-qemu-virt/src/vectors.s#L174-L186)) by routing them to `panic_entry` with class id 1. The architectural surface is reserved for Phase C; no B0/B1 code reaches it. -- **EL2 → EL1 boot transition (T-013, UNSAFE-2026-0017).** **OK** — `boot.s`'s EL drop sequence configures `HCR_EL2 = 0x80000000` (RW=1; everything else literally zero — explicitly non-VHE), `SPSR_EL2 = 0x3c5` (mode=EL1h + DAIF masked), `ELR_EL2 ← post_eret`. The post-`eret` PSTATE inherits the masked DAIF from `SPSR_EL2`. Adversarial probe: a firmware that delivered at EL2 with `HCR_EL2.IMO = 1` (route IRQs to EL2) — the literal write at [`boot.s:76-77`](../../../../../bsp-qemu-virt/src/boot.s#L76-L77) clears `IMO` so the kernel runs with EL1-bound IRQ delivery. Verified safe. -- **EL3 entry path.** **OK** — `boot.s` halts in a named-label `wfe`-loop on EL3 entry ([`boot.s:60-62`](../../../../../bsp-qemu-virt/src/boot.s#L60-L62)). No Rust runtime is up; no panic frame attempted. Future BSPs needing the EL3→EL2→EL1 chain are tracked in ADR-0024 §Open questions. -- **`CurrentEL` boot-time post-condition assertion.** **OK** — `QemuVirtCpu::new` calls `tyrne_hal::cpu::current_el()` and asserts `== 1` at [`bsp-qemu-virt/src/cpu.rs:135-139`](../../../../../bsp-qemu-virt/src/cpu.rs#L135-L139) *before* any timer-related MRS. A regression in `boot.s`'s EL drop becomes a loud, named boot panic with the observed EL value — useful for triage, not an information leak. The assertion is now load-bearing (post-T-013 Amendment to UNSAFE-2026-0016). -- **`tyrne_hal::cpu::current_el()` cfg-gating.** **OK** — function is `cfg(all(target_arch = "aarch64", target_os = "none"))`-gated at [`hal/src/cpu.rs:164`](../../../../../hal/src/cpu.rs#L164). On hosted targets (including `aarch64-apple-darwin` test runs) the function is structurally absent — there is no fallback EL0 read; the `MRS` would `SIGILL`. The Amendment to UNSAFE-2026-0018 corrects the original "or yield `EL0`" prose; current source aligns with the corrected reasoning. +- **No premature userspace surface introduced by B0/B1.** **OK** — vectors.s explicitly defends against IRQs taken from `SP_EL0` mode or any lower EL ([`vectors.s:174-186`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/vectors.s#L174-L186)) by routing them to `panic_entry` with class id 1. The architectural surface is reserved for Phase C; no B0/B1 code reaches it. +- **EL2 → EL1 boot transition (T-013, UNSAFE-2026-0017).** **OK** — `boot.s`'s EL drop sequence configures `HCR_EL2 = 0x80000000` (RW=1; everything else literally zero — explicitly non-VHE), `SPSR_EL2 = 0x3c5` (mode=EL1h + DAIF masked), `ELR_EL2 ← post_eret`. The post-`eret` PSTATE inherits the masked DAIF from `SPSR_EL2`. Adversarial probe: a firmware that delivered at EL2 with `HCR_EL2.IMO = 1` (route IRQs to EL2) — the literal write at [`boot.s:76-77`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/boot.s#L76-L77) clears `IMO` so the kernel runs with EL1-bound IRQ delivery. Verified safe. +- **EL3 entry path.** **OK** — `boot.s` halts in a named-label `wfe`-loop on EL3 entry ([`boot.s:60-62`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/boot.s#L60-L62)). No Rust runtime is up; no panic frame attempted. Future BSPs needing the EL3→EL2→EL1 chain are tracked in ADR-0024 §Open questions. +- **`CurrentEL` boot-time post-condition assertion.** **OK** — `QemuVirtCpu::new` calls `tyrne_hal::cpu::current_el()` and asserts `== 1` at [`bsp-qemu-virt/src/cpu.rs:135-139`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/cpu.rs#L135-L139) *before* any timer-related MRS. A regression in `boot.s`'s EL drop becomes a loud, named boot panic with the observed EL value — useful for triage, not an information leak. The assertion is now load-bearing (post-T-013 Amendment to UNSAFE-2026-0016). +- **`tyrne_hal::cpu::current_el()` cfg-gating.** **OK** — function is `cfg(all(target_arch = "aarch64", target_os = "none"))`-gated at [`hal/src/cpu.rs:164`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/hal/src/cpu.rs#L164). On hosted targets (including `aarch64-apple-darwin` test runs) the function is structurally absent — there is no fallback EL0 read; the `MRS` would `SIGILL`. The Amendment to UNSAFE-2026-0018 corrects the original "or yield `EL0`" prose; current source aligns with the corrected reasoning. - **GIC MMIO surface (UNSAFE-2026-0019).** **OK** — every read/write goes through `core::ptr::read_volatile` / `write_volatile` against typed offsets within the distributor (`0x0800_0000`) and CPU interface (`0x0801_0000`) windows. Adversarial offset analysis in the [B1 closure review §2](../../security-reviews/2026-04-28-B1-closure.md#2-trust-boundaries) re-verified at HEAD: `GICD_ITARGETSR + byte_idx` for `byte_idx < 1024` produces a maximum offset of `0xC00` — well within a 4 KiB distributor window; `ISENABLER` / `ICENABLER` indexed by `n / 32 < 32` produces offsets in `[0x100, 0x180)` and `[0x180, 0x200)` respectively. CPU interface offsets are fixed (0x000 / 0x004 / 0x00C / 0x010). No window escape possible. -- **`gic.init` runs with `DAIF.I` masked.** **OK** — `kernel_entry` sequences "MSR `VBAR_EL1` → GIC construct → GIC init" before "MSR `DAIFClr, #0x2`" at [`bsp-qemu-virt/src/main.rs:548-598`](../../../../../bsp-qemu-virt/src/main.rs#L548-L598). A fault during `init` (e.g. wrong base) would land at `tyrne_vectors+0x200` (sync, current EL with SP_ELx) which trampolines to `panic_entry(class=0, ESR_EL1)` — loud failure. -- **EL1 vector table install via `MSR VBAR_EL1` (UNSAFE-2026-0020).** **OK** — address read via `core::ptr::addr_of!(tyrne_vectors) as u64` at [`main.rs:555`](../../../../../bsp-qemu-virt/src/main.rs#L555) (no deref of the zero-byte symbol), written to `VBAR_EL1` with `ISB`. Two-layer 2-KiB alignment: `.balign 2048` in [`vectors.s:39`](../../../../../bsp-qemu-virt/src/vectors.s#L39) plus the linker's `. = ALIGN(2048)` directive. Either alone is sufficient; both is defence-in-depth. -- **IRQ trampoline frame layout invariant.** **OK** — `const _: () = assert!(core::mem::size_of::() == 192);` at [`exceptions.rs:77`](../../../../../bsp-qemu-virt/src/exceptions.rs#L77) is the strongest possible safety net for the asm ↔ `repr(C)` ABI invariant. A future field reorder or padding change fails the build before it ships. `repr(C)` for `[u64; 2]`-typed fields is layout-stable. +- **`gic.init` runs with `DAIF.I` masked.** **OK** — `kernel_entry` sequences "MSR `VBAR_EL1` → GIC construct → GIC init" before "MSR `DAIFClr, #0x2`" at [`bsp-qemu-virt/src/main.rs:548-598`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/main.rs#L548-L598). A fault during `init` (e.g. wrong base) would land at `tyrne_vectors+0x200` (sync, current EL with SP_ELx) which trampolines to `panic_entry(class=0, ESR_EL1)` — loud failure. +- **EL1 vector table install via `MSR VBAR_EL1` (UNSAFE-2026-0020).** **OK** — address read via `core::ptr::addr_of!(tyrne_vectors) as u64` at [`main.rs:555`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/main.rs#L555) (no deref of the zero-byte symbol), written to `VBAR_EL1` with `ISB`. Two-layer 2-KiB alignment: `.balign 2048` in [`vectors.s:39`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/vectors.s#L39) plus the linker's `. = ALIGN(2048)` directive. Either alone is sufficient; both is defence-in-depth. +- **IRQ trampoline frame layout invariant.** **OK** — `const _: () = assert!(core::mem::size_of::() == 192);` at [`exceptions.rs:77`](https://github.com/HodeTech/Tyrne/blob/214052d1bbcb0943ecdb236e7929f4698bac351a/bsp-qemu-virt/src/exceptions.rs#L77) is the strongest possible safety net for the asm ↔ `repr(C)` ABI invariant. A future field reorder or padding change fails the build before it ships. `repr(C)` for `[u64; 2]`-typed fields is layout-stable. - **`tyrne_vectors_end` exported but unused by linker.ld.** **N/A — defensive.** Recorded in vectors.s as a future-tools convenience for audit-region bound checks. No security impact. - **Vector entry padding fills with `0x00` = `udf` on aarch64.** **OK** — `.balign 0x80` after each `b