BONE/SEA S7: measure the actual-core allocation envelope under the S2 arena

.github/workflows/bone-sea-s7-allocation.yml

@@ -0,0 +1,62 @@
+name: BONE SEA S7 ALLOCATION
+
+on:
+  push:
+    branches:
+      - ecosystem/shinesea-s7-allocation-envelope
+  pull_request:
+    paths:
+      - config/bone_sea_s7.json
+      - docs/BONE_SEA_S7.md
+      - tools/bone-sea/**
+      - .github/workflows/bone-sea-s7-allocation.yml
+
+permissions:
+  contents: read
+
+env:
+  RUSTFLAGS: -Dwarnings
+
+jobs:
+  actual-core-allocation-envelope:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout exact BONEBOX branch
+        uses: actions/checkout@v4
+
+      - name: Checkout exact SHINESEA v1.0.0 source
+        uses: actions/checkout@v4
+        with:
+          repository: Deadbytes101/SHINESEA
+          ref: 3bc6343ecaeae27f0d01c6301cab01a0e77bfb96
+          path: shinesea
+
+      - name: Record Rust identity
+        run: |
+          rustc --version --verbose
+          cargo --version
+
+      - name: Test every native target with warning denial
+        run: |
+          cargo test --locked --all-targets \
+            --manifest-path tools/bone-sea/Cargo.toml
+
+      - name: Build exact deterministic S1 image
+        run: |
+          cargo run --locked --release \
+            --manifest-path tools/bone-sea/Cargo.toml \
+            --bin bone-sea -- \
+            proof --shinesea "$GITHUB_WORKSPACE/shinesea"
+
+      - name: Reverify shared S3 adapter
+        run: |
+          cargo run --locked --release \
+            --manifest-path tools/bone-sea/Cargo.toml \
+            --bin bone-sea-s3 -- verify
+
+      - name: Execute S7 requested-live allocation envelope
+        run: |
+          cargo run --locked --release \
+            --manifest-path tools/bone-sea/Cargo.toml \
+            --bin bone-sea-s7 -- \
+            verify --shinesea "$GITHUB_WORKSPACE/shinesea"

config/bone_sea_s7.json

@@ -0,0 +1,70 @@
+{
+  "phase": "S7-ACTUAL-CORE-ALLOCATION-ENVELOPE",
+  "parent_head": "7cb0adf092b027a19d1bffb8a8a5e6c7dbeec4c7",
+  "n6_base": "93ea5ffb59ff31e87ab7fd5ecb5570c89b29ffee",
+  "n6_nano_sha256": "581d1a6c59580fedca7fca97035449521231f9450ca4a3c2cf35d6ed07640855",
+  "shinesea": {
+    "commit": "3bc6343ecaeae27f0d01c6301cab01a0e77bfb96",
+    "version": "1.0.0",
+    "core_mode": "no_std+alloc",
+    "api": "read_verified_image"
+  },
+  "adapter": {
+    "module": "bone_sea::s3_adapter",
+    "logical_block_bytes": 4096,
+    "sector_bytes": 512,
+    "sectors_per_block": 8,
+    "start_lba": 40,
+    "last_lba": 167,
+    "total_sector_transfers": 144,
+    "atomic_publication": true,
+    "write_method_exposed": false
+  },
+  "arena": {
+    "authority_bytes": 262144,
+    "source_region_start": "0x40000",
+    "source_region_end": "0x80000",
+    "measurement": "requested_live_bytes",
+    "backing_allocator": "std::alloc::System",
+    "hard_quota_enabled": true,
+    "allocator_metadata_measured": false,
+    "alignment_padding_measured": false,
+    "preexisting_driver_buffers_measured": false,
+    "final_live_bytes": 0
+  },
+  "success_gate": {
+    "verified_image_bytes": 65536,
+    "core_block_reads": [
+      {"start_block": 1, "block_count": 2},
+      {"start_block": 0, "block_count": 16}
+    ],
+    "peak_must_not_exceed_arena": true,
+    "quota_denials": 0,
+    "sector_transfers": 144
+  },
+  "low_budget_gate": {
+    "budget_bytes": 65535,
+    "expected_allocation_failure_bytes": 65536,
+    "expected_sector_transfers": 16,
+    "full_volume_read_allowed": false,
+    "final_live_bytes": 0,
+    "quota_denials": 1
+  },
+  "license_boundary": {
+    "driver_license": "GPL-2.0-or-later",
+    "retained": false,
+    "committed_binary": false,
+    "ci_artifact": false,
+    "public_release_authorized": false
+  },
+  "claims": {
+    "host_requested_live_high_water": true,
+    "actual_runtime_allocator": false,
+    "allocator_metadata": false,
+    "real_ata": false,
+    "n6_io_gate": false,
+    "ring3": false,
+    "runtime_pass": false,
+    "write_authority": false
+  }
+}

docs/BONE_SEA_S7.md

@@ -0,0 +1,129 @@
+BONE/SEA S7 — ACTUAL-CORE ALLOCATION ENVELOPE
+
+STATUS
+
+S7 is host evidence for requested-live allocation pressure while the exact SHINESEA v1.0.0 no_std + alloc core mounts the exact S1 image through the shared S3 sector adapter.
+
+It is not a runtime allocator proof.
+
+STACKED AUTHORITY
+
+Parent S6 head:
+7cb0adf092b027a19d1bffb8a8a5e6c7dbeec4c7
+
+Exact SHINESEA source:
+3bc6343ecaeae27f0d01c6301cab01a0e77bfb96
+
+S2 allocator arena:
+0x40000..0x80000
+262144 bytes
+
+S1 image:
+65536 bytes
+SHA256 7c2f52f99de60097d16d89dab2f583450aba9727a3a456ad028dadd561c5dab1
+
+WHAT IS MEASURED
+
+A temporary GPL-2.0-or-later driver installs a process global quota allocator backed by std::alloc::System.
+
+The quota window opens immediately before actual read_verified_image and remains open until the returned VerifiedDeviceImage is dropped.
+
+The allocator records:
+
+- requested live bytes;
+- peak requested live bytes;
+- requested live bytes at publication;
+- allocation, deallocation, and reallocation calls;
+- denied requests;
+- final requested live bytes after drop.
+
+The successful window is hard capped at 262144 requested live bytes. Any request that would raise current requested-live bytes above that limit returns a null allocation to the caller.
+
+The exact SHINESEA allocate_zeroed path uses Vec::try_reserve_exact, so quota denial is surfaced as DeviceImageError::AllocationFailed rather than an uncontrolled process allocation.
+
+WHAT IS EXCLUDED
+
+The following are deliberately outside the measurement:
+
+- allocator metadata;
+- heap headers;
+- alignment padding added by System;
+- fragmentation;
+- the S1 source bytes held by the host sector device;
+- fixed sector and block trace arrays prepared before the window;
+- process startup and command-line allocations;
+- actual N6 allocator behavior.
+
+For this reason S7 reports REQUESTED LIVE BYTES ONLY and does not claim runtime allocator PASS.
+
+SUCCESS GATE
+
+The exact core must complete:
+
+1. read_blocks(1, 2);
+2. sector transfers LBA 48..63;
+3. read_blocks(0, 16);
+4. sector transfers LBA 40..167;
+5. exact total 144 sector transfers;
+6. exact S1 byte publication;
+7. peak requested-live bytes not greater than 262144;
+8. zero quota denials;
+9. zero requested-live bytes after VerifiedDeviceImage drop.
+
+LOW-BUDGET ADVERSARY
+
+The same actual core and shared adapter run under a 65535-byte quota.
+
+Expected behavior:
+
+- the 8192-byte superblock probe allocation succeeds;
+- the probe adapter staging allocation succeeds;
+- exactly 16 sector transfers occur for LBA 48..63;
+- the declared 65536-byte image allocation is denied;
+- read_verified_image returns AllocationFailed { bytes: 65536 };
+- the full-volume read never begins;
+- requested-live bytes return to zero;
+- exactly one quota denial is observed.
+
+LICENSE BOUNDARY
+
+The exact SHINESEA core and exact BONE/SEA library are compiled as separate rlibs with rustc, -Dwarnings, optimization, and panic=abort.
+
+Only tools/bone-sea/s7/driver.rs links them. The resulting binary is temporary GPL-2.0-or-later research output and is removed on exit.
+
+NON-CLAIMS
+
+S7 does not claim:
+
+- allocator metadata high-water;
+- exact arena offset consumption;
+- a bounded bump allocator;
+- N6 allocator integration;
+- real ATA;
+- N6 I/O gate execution;
+- CPU RIGHT_IO enforcement;
+- ring3 execution;
+- runtime PASS;
+- write authority.
+
+VALIDATION
+
+Set RUSTFLAGS=-Dwarnings and run all native targets, rebuild the exact S1 image, then run bone-sea-s7 verify against the exact SHINESEA checkout.
+
+Required fixed terminals include:
+
+BONE/SEA S7 ALLOCATION ENVELOPE VERIFIED
+ARENA AUTHORITY BYTES    262144
+FINAL LIVE BYTES         0
+SECTOR TRANSFERS         144
+LOW BUDGET BYTES         65535
+FULL IMAGE ALLOCATION    REJECTED AT 65536
+LOW-BUDGET TRANSFERS     16
+ACCOUNTING               REQUESTED LIVE BYTES ONLY
+ALLOCATOR METADATA       NOT MEASURED
+WRITE AUTHORITY          DISABLED
+BONE/SEA S7 ACTUAL ALLOCATION VERIFY PASS
+TEMPORARY DRIVER         REMOVED ON EXIT
+
+REPORTS ARE CLAIMS, NOT EVIDENCE.
+NO COSTUME RIGOR.

tools/bone-sea/s7/LICENSE-NOTICE.txt

@@ -0,0 +1,9 @@
+BONE/SEA S7 TEMPORARY DRIVER LICENSE NOTICE
+
+The file tools/bone-sea/s7/driver.rs is GPL-2.0-or-later.
+
+It links the exact SHINESEA v1.0.0 core and the BONE/SEA shared S3 adapter only inside a temporary local research binary. The orchestrator removes the complete temporary directory when the proof process exits.
+
+The combined driver binary is not retained, committed, uploaded as a CI artifact, or authorized for public distribution.
+
+The surrounding BONEBOX proof orchestrator and configuration remain under their repository licenses. This notice does not claim that the temporary combined binary is Apache-2.0-only.