Robert Allan JamesandClaude Sonnet 5
26c1117ccd
Two research passes confirmed the identity record itself (seed/pubkey/ cert) is already unreachable from any FORTH primitive -- only C-level read_devblock/write_devblock touch it. But a device's ordinary user block content CAN be copied between two attached devices today, using only stock, unpinned words: <src> BLOCK <dst> BUFFER 1024 MOVE UPDATE SAVE-BUFFERS, or the dedicated RELOCATE-BLOCK word (whose own doc comment already admits "performs no policy validation of its own"). Checked whether the existing per-block owner_fp/BLK-ACL-ALLOW@ metadata already solves this -- it doesn't: owner_fp encodes who (a VM identity pubkey), never where (physical device), and blk_get_buffer()/blk_update() never consult acl_allow/acl_ttl at all -- those fields are completely inert. Small, targeted fix, no rearchitecture: - blk_subsys_relocate_block() (block_subsystem.c): same-device check. Its own documented purpose is wear-leveling (relocate on the SAME device) -- never stated as cross-device, and nothing enforced that until now. - New public blk_lbn_device_handle() (block_subsystem.c/.h): the missing LBN-to-device direction (blk_get_device_range() already goes the other way). Opaque, stable, == comparable. - MOVE (memory_words.c) and CMOVE/CMOVE> (string_words.c): refuse when both addresses are block-window addresses backed by two different devices -- the exact shape of the composed attack. A copy where either end is ordinary VM memory (the overwhelming common case: staging text from PAD, editing a block in place) is untouched. - blk_vm_check_epoch()/blk_vm_slot_for_addr() exposed (block_words.h) so the two new call sites share the same window-slot invalidation contract rather than a second, divergent copy of it. Verified live on all three architectures, not just boot-clean: same- device MOVE/RELOCATE-BLOCK still succeed exactly as before; cross-device MOVE/CMOVE/RELOCATE-BLOCK all refused. Zero UNKNOWN WORD, identical dict_hash across all three (this change adds no FORTH-visible word, only internal refusal conditions, as predicted). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
src/word_source/
FORTH-79 word implementations, one file per category, registered into the
dictionary via include/word_registry.h. Each .c file here has a
matching header in src/word_source/include/ and (for most categories) a
matching test module in src/test_runner/modules/.
FORTH-79 core
arithmetic_words.c,mixed_arithmetic_words.c—+ - * / MOD ABS MIN MAXand mixed-precision arithmetic.stack_words.c—DUP DROP SWAP ROT OVER NIP TUCK.control_words.c—IF ELSE THEN DO LOOP BEGIN UNTIL WHILE.defining_words.c—: ; CREATE DOES> VARIABLE CONSTANT.memory_words.c—@ ! C@ C! MOVE FILL.return_stack_words.c—>R R> R@ RDROP 2>R 2R@ 2R>.double_words.c—2DUP 2DROP 2SWAP 2@ 2! D+ D-.logical_words.c—AND OR XOR NOT INVERT LSHIFT RSHIFT.io_words.c—EMIT KEY TYPE CR TAB SPACE ACCEPT.string_words.c—S" SLITERALand other string operations.block_words.c—BLOCK BUFFER LOAD THRU FLUSH.format_words.c—.( .R .S HEX DECIMAL BASE.system_words.c—BYE ABORT INCLUDE STATE.dictionary_words.c—FIND SEARCH-WORDLIST WORDS.dictionary_manipulation_words.c— dictionary entry manipulation words.vocabulary_words.c—VOCABULARY DEFINITIONS FORTH-WORDLIST.editor_words.c— block editor words.defer_words.c—DEFER/ISdeferred-word mechanism, used by the Tripod message-dispatch shim (seetools/hermes_tripod_smoke.sh).
StarForth-specific extensions
q48_16_words.c,q48_words.c— Q48.16 fixed-point word bindings.starforth_words.c— StarForth-specific extensions.acl_words.c— word-level ACL system's FORTH-callable primitives (seedocs/03-architecture/word-acl/).lifecycle_words_hosted.c— hosted-build VM lifecycle words (birth/run primitives on the hosted side; kernel-only primitives live insrc/starkernel/capsule/mama_forth_words.c).log_words.c— FORTH-callable logging primitives.inference_words.c— FORTH-callable bindings for the statistical inference engine (Loops #5/#6).physics_benchmark_words.c— benchmark harness for the 7 physics feedback loops.physics_diagnostic_words.c— physics diagnostics (WORD-ENTROPY).physics_freeze_words.c—PHYSICS-FREEZE/PHYSICS-THAW.physics_pipelining_diagnostic_words.c— Loop #4 pipelining diagnostics.dictionary_heat_diagnostic_words.c— Loop #1 heat diagnostics.
See src/word_source/include/ for the matching headers (also includes
mama_forth_words.h, whose .c implementation lives under
src/starkernel/capsule/ since it's kernel-only).