BONE/SEA S4: execute the actual SHINESEA no_std verified mount

[Deadbytes101]

BONE/SEA S4 ACTUAL SHINESEA VERIFIED-MOUNT CANDIDATE

STACKED BASE

• base branch: ecosystem/shinesea-s3-block-adapter
• exact parent head: f054e32818c68940eeebad740674f1b5bfb03913
• exact S4 head: 7f5aa091094da5e0030901dee0ef6bdfe3c5b917
• exact N6 authority: 93ea5ffb59ff31e87ab7fd5ecb5570c89b29ffee
• N6 nano SHA256: 581d1a6c59580fedca7fca97035449521231f9450ca4a3c2cf35d6ed07640855
• exact SHINESEA v1.0.0 source: 3bc6343ecaeae27f0d01c6301cab01a0e77bfb96

PURPOSE

S4 compiles the actual frozen SHINESEA src/lib.rs as a no_std + alloc rlib and executes its exported read_verified_image implementation against the exact deterministic S1 image.

This is actual-core host evidence only. It does not execute inside BONEBOX, compose the S3 sector adapter with the core, issue ATA operations, enter ring3, publish a namespace, read a payload, or claim runtime success.

EXACT CORE ORDER

1. read_blocks(1, 2) for redundant-superblock probing;
2. selected geometry validation against device capacity;
3. exact complete-image allocation;
4. read_blocks(0, 16) for the declared S1 volume;
5. normal check_image verification;
6. selected-superblock stability comparison;
7. VerifiedDeviceImage publication only after every check passes.

S1 AUTHORITY

• image bytes: 65536
• logical blocks: 16
• block bytes: 4096
• probe allocation: 8192
• image SHA256: 7c2f52f99de60097d16d89dab2f583450aba9727a3a456ad028dadd561c5dab1

NATIVE BUILD AND LICENSE BOUNDARY

• tools/bone-sea/src/bin/bone-sea-s4.rs: Apache-2.0 native orchestrator
• tools/bone-sea/s4/driver.rs: GPL-2.0-or-later temporary actual-core driver
• no Cargo dependency from the Apache orchestrator to SHINESEA
• exact SHINESEA core compiled directly with rustc, no_std + alloc, panic=abort, and -Dwarnings
• combined driver binary retained: no
• committed binary: no
• CI artifact: no
• public combined release: not authorized

OBSERVED WINDOWS VALIDATION

Exact head:

7f5aa091094da5e0030901dee0ef6bdfe3c5b917

Observed with RUSTFLAGS=-Dwarnings:

• native library target: 0 / 0 PASS
• S1 contracts: 13 / 13 PASS
• S2 domain contracts: 14 / 14 PASS
• S2 control contracts: 6 / 6 PASS
• S3 adapter contracts: 15 / 15 PASS
• S4 orchestrator contracts: 7 / 7 PASS
• total defined tests: 55 / 55 PASS
• compiler warnings: 0
• exact S1 deterministic proof: PASS
• actual SHINESEA v1.0.0 no_std + alloc core compilation: PASS
• BONE/SEA S4 HOST VOLUME VERIFIED
• probe generation: 2
• full generation: 3
• device too small: REJECTED
• probe read failure: REJECTED
• both superblocks corrupt: REJECTED
• selected superblock changed: DeviceChanged REJECTED
• write authority: DISABLED
• temporary GPL driver removed on exit
• runtime PASS emitted: no

ROOT-CAUSE CLOSURE

The earlier alternate image changed namespace bytes but retained the same selected-superblock generation, so the actual core correctly accepted it. The repaired driver changes both alternate superblock copies by exactly one generation, recomputes CRC32C with the actual SHINESEA implementation, independently mounts the changed image, proves all non-generation authority fields are unchanged, then observes DeviceChanged through the switching device.

RUNTIME BOUNDARY

No boot, root, supervisor, service, nanokernel, ATA, ring3, or SHINESEA runtime source changed. S3 adapter composition, 144 sector transfers, namespace publication, payload readback, allocator high-water, and runtime PASS remain unclaimed.

MERGE LAW

S4 is ready for review against exact S3 head. Merge is not performed automatically. Keep it stacked until prior PR disposition is deliberate; any retarget or integration into another tree requires fresh exact-head verification.

REPORTS ARE CLAIMS, NOT EVIDENCE.
NO COSTUME RIGOR.

[Deadbytes101]

S4 WINDOWS EVIDENCE — ADVERSARIAL DESIGN FAILURE FOUND

Observed on exact head b75e6f23d1393439f83984c40c38c38b2fb23451 with RUSTFLAGS=-Dwarnings:

• all native targets compiled with zero warnings;
• S1/S2/S3/S4 static contracts: 55 / 55 PASS (0 + 13 + 14 + 6 + 15 + 7);
• exact S1 deterministic image proof: PASS;
• exact S1 image SHA256: 7c2f52f99de60097d16d89dab2f583450aba9727a3a456ad028dadd561c5dab1;
• actual SHINESEA no_std core and temporary GPL driver compiled and executed;
• S4 final verdict: FAIL at the DeviceChanged adversary.

ROOT CAUSE

The probe S1 image and the independently built alternate image both used the same operation count: mkfs + put. SHINESEA put_file increments the selected superblock generation once, so both valid images retained an equal selected-superblock identity even though their catalogs and payloads differed. read_verified_image correctly accepted the full-read alternate because DeviceChanged compares the selected Superblock, not arbitrary image bytes.

SURGICAL REPAIR

Current head: 7f5aa091094da5e0030901dee0ef6bdfe3c5b917

• mutate both alternate superblock copies by exactly one generation;
• zero and recompute each superblock CRC with actual shinesea::crc::crc32c;
• mount the changed alternate independently through actual read_verified_image before the switching test;
• require generation delta exactly +1;
• require every non-generation superblock authority field to remain unchanged;
• reject before the switching test if the alternate is not independently valid;
• replace the previous full-image debug dump with bounded generation/error reporting.

The PR remains draft. The previous 55 / 55 result is valid evidence for the old source head but does not authorize the repaired head. Exact-head Windows compile and actual-core proof must be rerun.

REPORTS ARE CLAIMS, NOT EVIDENCE.
NO COSTUME RIGOR.

[Deadbytes101]

S4 EXACT-HEAD WINDOWS PROOF CLOSURE

Exact head:

7f5aa091094da5e0030901dee0ef6bdfe3c5b917

Observed with RUSTFLAGS=-Dwarnings:

• native library target: 0 / 0 PASS
• S1 contracts: 13 / 13 PASS
• S2 domain contracts: 14 / 14 PASS
• S2 control contracts: 6 / 6 PASS
• S3 adapter contracts: 15 / 15 PASS
• S4 orchestrator contracts: 7 / 7 PASS
• total defined tests: 55 / 55 PASS
• compiler warnings: 0
• exact S1 deterministic image proof: PASS
• exact S1 image SHA256: 7c2f52f99de60097d16d89dab2f583450aba9727a3a456ad028dadd561c5dab1
• actual SHINESEA v1.0.0 no_std + alloc core compiled and executed
• probe read: block 1 count 2
• full read: block 0 count 16
• probe generation: 2
• full generation: 3
• device too small: REJECTED
• probe read failure: REJECTED
• both superblocks corrupt: REJECTED
• changed selected superblock: DeviceChanged REJECTED
• write authority: DISABLED
• combined GPL research driver: temporary and removed on exit
• runtime PASS claim: none

The repaired adversary now changes selected-superblock identity for a real reason and the actual core rejects it. S4 host evidence is complete. This does not claim BONEBOX runtime execution, ATA, ring3, namespace publication, or payload readback.

REPORTS ARE CLAIMS, NOT EVIDENCE.
NO COSTUME RIGOR.