rajamesandClaude Opus 5.5
5e26fad30d
Any identity could have arbitrary FORTH run as Zuse: KH-ELEVATE-SEND and KH-BLK-ATTACH-SEND sent any text to Hera, from any VM (shown live). And the drain popped a message after running it, so a payload calling a colon word ran twice. Both fixed test first (FABRIC-3 SXXXVII): - KH-BLK-ATTACH-SEND is ( dev-addr ok? -- sent? ), Artemis only; the kernel writes the reply text. BLK-ATTACH-ACK is Hera's only. - The drain pops before it runs. - Elevation, ruled not needed: KH-ELEVATE-SEND, message type 8, zuse-eligibility.4th, ZUSE-ELIGIBLE?/ZUSE-ELIGIBILITY-ADD/ ELEVATE-PUBKEY-UNPACK and the eligibility list removed; its disk area stays reserved, unused. FABRIC-3.7 closed. Three ISAs: POST 1052 passed; new parity baseline word_count=523 hash=0xb73b58052d591638 (deliberate). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
39 lines
1.6 KiB
Forth
39 lines
1.6 KiB
Forth
Block 4016
|
|
( zuse.4th - Bootstrap superuser for StarForth ACL )
|
|
( Named for Konrad Zuse, pioneer of programmable computers. )
|
|
( Sole superuser; mints credentials; owns emergency REPL. )
|
|
( Loaded by ACL.4th; must not load before ACL.4th. )
|
|
( Thumbdrive-resident Ed25519 PKI (2026-08-28) -- her seed )
|
|
( lives only on her own minted drive, never system-resident. )
|
|
( HUMAN-REVIEW: capsule hash = root of superuser trust. )
|
|
( Cert (seed+pubkey) lives in C-only VM fields, installed by )
|
|
( capsule_zuse_boot.c on genesis-mint or thumbdrive attach. )
|
|
( NOT a CONSTANT: ACL-PIN blocks redefinition, not a )
|
|
( >BODY-then-store, so a pinned CONSTANT isn't tamper-proof. )
|
|
( Read with ZUSE-PUBKEY@ / ZUSE-CERT-INSTALLED? -- both C )
|
|
( primitives, read-only; the seed has no FORTH access at all. )
|
|
|
|
Block 4017
|
|
( ACL-ZUSE-BOOT ( -- ) re-invokable: capsule_zuse_boot.c )
|
|
( calls it again once a thumbdrive attach installs a cert. )
|
|
( Only authenticates if a real cert is installed -- refuses )
|
|
( god-mode to a Zuse with no real identity behind her. )
|
|
( ZUSE-AUTHENTICATE is C-only; no FORTH word grants god-mode )
|
|
( except through this sequence. )
|
|
: ACL-ZUSE-BOOT ( -- )
|
|
ZUSE-CERT-INSTALLED? IF
|
|
ZUSE-AUTHENTICATE
|
|
LOG-INFO" zuse: activated"
|
|
ELSE
|
|
LOG-INFO" zuse: NOT activated -- no cert installed"
|
|
THEN ;
|
|
|
|
Block 4018
|
|
( Pin against redefinition -- once, after definition closes; )
|
|
( ['] from inside its own body can't find itself mid-compile, )
|
|
( found live 2026-08-28 activating ACL.4th for the first time. )
|
|
( Pinning doesn't block re-EXECUTION, only redefinition -- the )
|
|
( re-invoke above still works after this runs. Self-activates. )
|
|
['] ACL-ZUSE-BOOT ACL-PIN
|
|
ACL-ZUSE-BOOT
|