BONE/SEA S13: execute exact SEA entry through controlled ring 3

[Deadbytes101]

BONE/SEA S13 CONTROLLED RING-3 ENTRY CANDIDATE

STACKED BASE

• base branch: ecosystem/shinesea-s12-n6-loader
• exact parent head: 56f9697f094fd848b0cf659861f21407b3a9ea75
• current S13 head: fb5a4492ed2799d86a7362c383cb0f2a3564d862
• exact N6 authority: 93ea5ffb59ff31e87ab7fd5ecb5570c89b29ffee
• exact SHINESEA source: 3bc6343ecaeae27f0d01c6301cab01a0e77bfb96
• exact S10 flat SHA256: 835333bb0636540a7af2d3b59b14482bb5157b38c7d3c250148965e0d51991a8

PURPOSE

S12 proved actual BIOS publication, full-byte CRC, SEA LDT installation and N6 continuation. S13 performs a controlled ring-3 transfer to exact S10 _start, then uses one PIT timer event to return control to NANOSUP and carry SEA scratch evidence through the nanokernel event record.

S13 deliberately keeps the SEA sector gate not-ready. Exact _start must therefore write RESULT_ERR (0x53454145) before spinning. Observing that value after the transfer proves exact entry execution without claiming a SHINESEA mount.

ONE DECISION

Prove exact ring-3 entry, context authority and bounded return evidence before implementing the synchronized read-only sector gate.

EXACT EXECUTION CONTRACT

SEA physical base       0x00020000
SEA bytes               458752
SEA segment limit       0x0006ffff
SEA LDT selector        0x0038
SEA entry offset        0x00000000
SEA stack offset        0x00013ffc
SEA scratch physical    0x00035000
expected result         0x53454145 / RESULT_ERR
PIT divisor             65535

DETERMINISTIC AUTHORITY TRANSFORM

S13 does not commit copied forks of N5 nano, N6 NANOSUP or S12 root. The machine proof reads those exact frozen sources and applies single-anchor deterministic transforms. Any missing or duplicate anchor fails before assembly.

Generated N7/S13 nanokernel:

• preserves normal USER_PHYS / 0x0fff validation;
• adds explicit SEA_PHYS / 0x6ffff validation;
• restores SEA LDT only for a SEA-base context;
• initializes scratch fail-closed before dispatch;
• publishes result/gate evidence through timer-event AUX0/AUX1;
• expands capability bounds from three to five records;
• emits BNR7 while preserving the 20-byte mutable state.

Generated NANOSUP:

• preserves the exact five-service N6 pipeline;
• configures CTX_A for SEA entry and enables IF;
• programs PIT channel 0 as a one-shot;
• unmasks only IRQ0;
• dispatches via CALL_DISPATCH, not a raw far jump;
• masks IRQ0 after return;
• accepts only exact timer or #UD evidence.

Generated root:

• reuses exact S12 BIOS loader, CRC, GDT, SEA LDT and IDT;
• adds bounded PIC/PIT capabilities at 0x00011b90 and 0x00011ba0;
• expands capability count to five without moving context slots;
• adds a 64-byte BS13 assembled contract at root offset 0x2cc0.

SUCCESS ORDER

BONE/SEA S12 IMAGE LOADED
BONE/SEA S12 CRC PASS
BONE/SEA S12 LDT PASS
N6 USER SERVICES PASS
N6 PIPELINE COMMIT PASS
BONE/SEA S13 ENTRY EXECUTED
BONE/SEA S13 RESULT ERR OBSERVED
BONE/SEA S13 TIMER RETURN PASS

ADVERSARIAL JUDGE

Entry-byte adversary:

• replace SEA bytes 0..1 with UD2;
• recompute CRC so S12 gates still pass;
• require BONE/SEA S13 ENTRY REJECT from a #UD event at EIP 0;
• forbid every S13 success marker.

Context-limit adversary:

• keep exact S10 bytes;
• configure code/data limit 0x0006fffe;
• require nanokernel rejection before entry;
• require BONE/SEA S13 CONTEXT REJECT;
• forbid every S13 success marker.

DEADBYTE ECOSYSTEM REUSE

• CINDER-16 9eadc22d03b0782373d5ca23290bb76768df5e4f: exact identity, bounded transforms and fail-closed publication;
• LOOM 444937bd0aef2e5b17ed253deb7677a778225d7e: freestanding machine judge, ordered evidence and adversarial images;
• no CINDER VM code copied;
• no LOOM runtime code copied.

PROOF SURFACE

• .github/workflows/bone-sea-s13-ring3-entry.yml
• config/bone_sea_s13.json
• docs/BONE_SEA_S13.md
• tools/bone-sea/s13/LICENSE-NOTICE.txt
• tools/bone-sea/s13/patches.py
• tools/bone-sea/s13/prove.py
• tools/bone-sea/src/bin/bone-sea-s13.rs

VALIDATION REQUIRED

powershell -ExecutionPolicy Bypass -File tools/bootstrap-nasm.ps1
rustup target add i686-unknown-linux-gnu

RUSTFLAGS=-Dwarnings
cargo test --locked --all-targets --manifest-path tools/bone-sea/Cargo.toml

cargo run --locked --release --manifest-path tools/bone-sea/Cargo.toml --bin bone-sea -- proof --shinesea D:\TECHNICAL\SHINESEA
cargo run --locked --release --manifest-path tools/bone-sea/Cargo.toml --bin bone-sea-s12 -- verify --shinesea D:\TECHNICAL\SHINESEA --timeout 20
cargo run --locked --release --manifest-path tools/bone-sea/Cargo.toml --bin bone-sea-s13 -- verify --shinesea D:\TECHNICAL\SHINESEA --timeout 20

Expected native total after S13: 126 / 126 PASS, warnings 0.

OBSERVED VALUES REQUIRED

• generated N7 nano bytes, SHA256, mutable offset and mutable bytes;
• generated NANOSUP bytes and SHA256;
• generated root bytes and SHA256;
• exact SEA CRC32;
• success image SHA256;
• entry-adversary image SHA256;
• context-adversary image SHA256;
• exact ordered success and rejection traces;
• temporary-output cleanup.

NON-CLAIMS

• SEA sector gate ready: no;
• SEA-issued ATA reads: no;
• read_verified_image success: no;
• SHINESEA runtime mount: no;
• runtime allocator PASS: no;
• write authority: no.

MERGE LAW

Keep this PR draft until exact-head tests, S12 revalidation, generated-source anchor gates, N7/NANOSUP/root budgets, exact entry execution, timer return, both adversaries, hashes and cleanup all pass.

No merge and no S14 authorization before observed evidence.

REPORTS ARE CLAIMS, NOT EVIDENCE.
NO COSTUME RIGOR.

[Deadbytes101]

S13 EXACT-HEAD VALIDATION GATE

Current candidate head:

fb5a4492ed2799d86a7362c383cb0f2a3564d862

Static branch judge:

base        56f9697f094fd848b0cf659861f21407b3a9ea75
status      ahead
commits     7
files       7
behind      0

Frozen N5, N6, S12 and S10 authority files are not modified. S13 generates temporary N7/NANOSUP/root sources through exact single-anchor transforms during the proof run.

Required local evidence:

cd D:\TECHNICAL\BONEBOX-01
git fetch origin --prune
git switch ecosystem/shinesea-s13-ring3-entry
git reset --hard origin/ecosystem/shinesea-s13-ring3-entry
git rev-parse HEAD
git status --short

$env:RUSTFLAGS = '-Dwarnings'
cargo test --locked --all-targets --manifest-path .\tools\bone-sea\Cargo.toml

cargo run --locked --release --manifest-path .\tools\bone-sea\Cargo.toml --bin bone-sea -- proof --shinesea D:\TECHNICAL\SHINESEA
cargo run --locked --release --manifest-path .\tools\bone-sea\Cargo.toml --bin bone-sea-s12 -- verify --shinesea D:\TECHNICAL\SHINESEA --timeout 20
cargo run --locked --release --manifest-path .\tools\bone-sea\Cargo.toml --bin bone-sea-s13 -- verify --shinesea D:\TECHNICAL\SHINESEA --timeout 20

Expected native total: 126 / 126 PASS, warnings 0.

Machine acceptance requires:

• generated BNR7 nano within 2048 bytes;
• generated NANOSUP before the fixed 0x1ae0 mode marker;
• generated root within 16384 bytes;
• exact S10 flat SHA256 recovery;
• exact entry execution and RESULT_ERR observation through timer AUX evidence;
• UD2 entry adversary rejected;
• 0x0006fffe context-limit adversary rejected;
• temporary outputs removed.

Keep PR #45 draft. No merge and no S14 authorization before exact-head evidence.

REPORTS ARE CLAIMS, NOT EVIDENCE.
NO COSTUME RIGOR.

[Deadbytes101]

SUPERSEDED — DO NOT MERGE

This candidate was created directly from S12 before the segment-local address model was proven.

Its exact S10 image uses physical addresses as ELF VMAs while the SEA LDT already contributes physical base 0x00020000. A ring3 transfer through that descriptor would double-add the base for static addresses. PR #46 subsequently classified and repaired this boundary by proving local VMAs, physical LMAs, entry offset zero, exact translation, repeatability and adversarial rejection.

The replacement work is ecosystem/shinesea-s14-ring3-probe, based on exact S13-local head 0213d2368da7c49555e62555b17496a91cea6f2b. S14 intentionally proves only one bounded CPL3 entry and exception return using a temporary two-byte probe. It does not claim exact SHINESEA _start execution, timer return, ATA authority, mount success or write authority.

PR #45 is closed as architecturally superseded. Its branch is retained as historical evidence and is not merged.

REPORTS ARE CLAIMS, NOT EVIDENCE.
NO COSTUME RIGOR.