Files
LithosAnanke/src/starkernel/capsule
Robert Allan JamesandClaude Sonnet 5 5c5896fbc1
Build / build-amd64-iso (push) Canceled after 0s
Build / build-aarch64-iso (push) Canceled after 0s
Build / build-riscv64-img (push) Canceled after 0s
Stage A: fix USE's silent stack-underflow/bad-address guards, and the Hera fault-scoping gap they exposed (FABRIC-3.md §XXXII.1)
mama_word_use()'s two silent vm->error=1 guards (dsp<1 stack underflow,
NULL from vm_ptr()) now print a diagnostic and return, matching the
function's other five guards.

Live verification of that fix alone surfaced a bigger problem: with the
guard no longer silent, the REPL proceeds to interpret the leftover
token as an unrecognized word, which independently sets vm->error, and
sk_repl_step()/sk_repl_run()'s Hera-branch still hard-halted on that.
Investigated kernel_main.c's boot/capsule-load paths directly: they
already catch and clear mama->error entirely separately, before
sk_repl_run() is ever entered -- so the "no fallthrough surface" halt
in these two REPL functions was never protecting a boot-time fault, only
an ordinary interactive REPL-turn one. Both functions now recover
unconditionally on any VM's error, Hera included, matching how a
redirected (WIREBIND/USE'd) identity's session already recovered.
Removed the now-fully-unused sk_fault_handler().

Verified live, amd64: USE rajames at Zuse's own console prints the new
diagnostic, then "VM fault -- session recovered, resuming", console
stays interactive afterward. Three-arch clean qemu acceptance passed
before and after the Hera-fault-scoping change.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BWpNjdwPtFLuVLaAq44L9K
2026-09-15 09:06:33 -04:00
..

src/starkernel/capsule/

Kernel-side capsule system: locating, validating, and executing the immutable, content-addressed .4th initialization payloads in capsules/ (embedded into the kernel image via tools/mkcapsule.c).

  • capsule_find.c — locates a capsule by name in the generated capsule directory.
  • capsule_validate.c — validates a capsule's content hash before use.
  • capsule_birth.c — the birth protocol: allocate VM ID → execute IDENTITY (capsule code) → execute PERSONALITY (block 1 from ramdrive) → log parity record.
  • capsule_run.c — capsule execution against a VM instance.
  • capsule_loader.c — loads capsule block content into kernel ramdrive block RAM, writing each Block N header to its literal numbered block address (not reordered).
  • capsule_vm_hooks.c — VM integration hooks for capsule execution.
  • capsule_vm_physics.c — physics-runtime bindings for capsule-birthed VMs.
  • mama_forth_words.c — Mama VM-specific FORTH word bindings.