BONE/SEA S14: prove controlled CPL3 entry through the SEA LDT by Deadbytes101 · Pull Request #47 · Deadbytes101/BONEBOX-01

Deadbytes101 · 2026-08-05T00:29:24Z

BONE/SEA S14 CONTROLLED RING3 PROBE

STACKED BASE

base branch: ecosystem/shinesea-s13-local-offset-image
exact parent head: 0213d2368da7c49555e62555b17496a91cea6f2b
exact S14 head: c9a0329af316defe9f8e7b7d3194a2ca7d19f8f2
exact N6 authority: 93ea5ffb59ff31e87ab7fd5ecb5570c89b29ffee
exact SHINESEA source: 3bc6343ecaeae27f0d01c6301cab01a0e77bfb96
exact S13 ELF SHA256: 22560ca0ca12aaf81e1324fe77c93d9ba01af1d7e775cb66e9b2df0ada77d4b9
exact S13 flat SHA256: 668f272d4035c18600dfaec211756307bd5ab18734bd093bc5a0fe41a6028cd3

PURPOSE

S14 proves one bounded transition through SEA LDT selector 0x38 into CPL3 at local EIP zero and one processor-exception return to NANOSUP.

It uses temporary probe bytes and deliberately does not execute exact SHINESEA _start.

success bytes            0F 0B / UD2
success event            #UD vector 6, error 0, EIP 0
vector adversary         F4 90 / HLT; NOP
vector rejection         #GP vector 13, error 0, EIP 0
context adversary limit  0x0006fffe
context rejection        ERR_BAD_DISPATCH / 4

CONTEXT TRANSACTION

The five-service N6 pipeline leaves an active event sourced from CTX_A. S14 preserves that source record and dispatches the SEA probe through CTX_B.

active event source      CTX_A / 0x00011c40
SEA dispatch target      CTX_B / 0x00011c80
SEA LDT selector         0x0038
SEA entry offset         0x00000000
SEA stack offset         0x00013ffc
SEA code/data limit      0x0006ffff

Rewriting CTX_A before consuming its active event would destroy the source-descriptor transaction; S14 therefore uses CTX_B explicitly.

DETERMINISTIC AUTHORITY

S14 does not commit copied forks of N5 nano, N6 NANOSUP, or S12 root.

The machine proof:

rebuilds and verifies the exact S13 local-offset ELF and flat image;
applies single-anchor generated transforms to exact N5/N6 authorities;
validates USER and SEA contexts separately;
selects SEA LDT only for a SEA-base context;
preserves the 20-byte nano mutable authority and emits BNR7;
keeps the exact S12 BIOS publication, CRC32, LDT installation, and LSL read-back path;
executes success, vector-adversary, and context-adversary QEMU images;
removes all temporary outputs on exit.

HOST-COMPATIBILITY REPAIRS

Three observed host-side failures were repaired before machine acceptance:

dynamic dataclass authority modules were registered in sys.modules before exec_module();
the exact legacy five-argument S13 compile_image() call was boundedly adapted to the current four-argument signature;
frozen UD2, HLT/NOP, exact-SHINESEA, and write-authority proof literals were retained for the native Rust gate.

The compatibility launcher verifies the exact original implementation object:

implementation commit  0ab8f218f17d0586c94dc88bca981eec4cc2faa1
implementation path    tools/bone-sea/s14/prove.py
implementation blob    ab9be2eb5e8fe06477e6415e7e33973d744cc06c

N5/N6 transforms, S12 root, S13 image authority, CRC law, machine images, QEMU ordering, adversaries, and non-claims remain unchanged.

OBSERVED EXACT-HEAD VALIDATION

Working tree:

tracked/index state clean;
local untracked artifacts only: .tools/, __pycache__/, sc.local.png, and phase-local __pycache__/ directories.

Native validation:

total defined tests: 134 / 134 PASS;
compiler warnings: 0.

Exact S13 authority recovery:

ELF bytes       79972
ELF SHA256      22560ca0ca12aaf81e1324fe77c93d9ba01af1d7e775cb66e9b2df0ada77d4b9
code bytes      35040
flat SHA256     668f272d4035c18600dfaec211756307bd5ab18734bd093bc5a0fe41a6028cd3

Generated machine authority:

nano bytes                  1788
nano SHA256                 988790627cf0dc1c5104bb24402f8b3cc172c38c2a1cb70ba42297aa9c3893f3
nano mutable offset         1736
nano mutable bytes          20
NANOSUP bytes               2604
NANOSUP SHA256              4bb38e3bccc35577f96be9c089bfdc7aa516afd191f139aae3e979b33301e827
success root bytes          14411
success root SHA256         f3b4cd5e67f6949db525c3f7c0534818041d155ee755eec863712af7fcfa0a45
vector root SHA256          084ab4464024028084295912daaf674e8098fea868985e16e5212748c8226f7e
context root SHA256         a9cf5793991f5f4c74822f7429a9f78f6904d61cc9a28b9e5da406ebab7d1b0e

SEA image evidence:

success CRC32               097a474a
vector CRC32                8a78b0a7
success image SHA256        e643f79a4400ccfa804d7fe881469896463815d7ac02dc284e9efedae1ae252f
vector image SHA256         866f459d65046c6d54a529bbce9c631ee98e0cb2e05535f1d73b9d8ff1b6f73e
context image SHA256        0fb23c7365a4be605f61679c82cccfbff69e980169e23992dc79b63c1b26faf6

Observed machine verdicts:

success exception: #UD vector 6, error 0, EIP 0;
vector adversary: #GP vector 13 rejected;
context-limit adversary: rejected before entry;
inherited N6 pipeline continuation: PASS;
temporary outputs: removed on exit;
terminal verdict: BONE/SEA S14 CONTROLLED RING3 PROBE VERIFY PASS.

SUCCESS ORDER

BONE/SEA S12 IMAGE LOADED
BONE/SEA S12 CRC PASS
BONE/SEA S12 LDT PASS
N6 USER SERVICES PASS
N6 PIPELINE COMMIT PASS
BONE/SEA S14 RING3 ENTRY PASS

PROOF SURFACE

.github/workflows/bone-sea-s14-ring3-probe.yml
config/bone_sea_s14.json
docs/BONE_SEA_S14.md
tools/bone-sea/s14/LICENSE-NOTICE.txt
tools/bone-sea/s14/patches.py
tools/bone-sea/s14/prove.py
tools/bone-sea/src/bin/bone-sea-s14.rs

NON-CLAIMS

exact SHINESEA _start execution: no;
SEA sector gate ready: no;
SEA-issued ATA reads: no;
read_verified_image success: no;
SHINESEA runtime mount: no;
allocator runtime PASS: no;
write authority: no.

MERGE LAW

S14 is ready for review only against exact parent 0213d2368da7c49555e62555b17496a91cea6f2b and exact head c9a0329af316defe9f8e7b7d3194a2ca7d19f8f2.

Any head movement, rebase, retarget, or integration requires fresh evidence.

GitHub Actions exposed no pull-request workflow run for the exact head at evidence closure time; the local exact-head transcript is the observed authority.

No merge is performed automatically.

REPORTS ARE CLAIMS, NOT EVIDENCE.
NO COSTUME RIGOR.

Deadbytes101 · 2026-08-05T00:42:46Z

S14 EXACT-HEAD FAILURE AND SURGICAL REPAIR

OBSERVED FAILED HEAD

head: 0ab8f218f17d0586c94dc88bca981eec4cc2faa1
tracked/index state: clean; local untracked .tools/, __pycache__/, sc.local.png
NASM archive SHA256 gate: PASS
NASM identity: 3.01
QEMU identity: 10.2.50
Rust target i686-unknown-linux-gnu: installed
native tests: 134 / 134 PASS
compiler warnings: 0
S1 exact image proof: PASS, SHA256 7c2f52f99de60097d16d89dab2f583450aba9727a3a456ad028dadd561c5dab1
S13 exact ELF/flat proof: PASS
S14 stopped before NASM assembly and before every QEMU image.

Observed exception:

AttributeError: 'NoneType' object has no attribute '__dict__'

The failure occurred while dynamically executing tools/bone-sea/s13/prove.py. Its @dataclass decorator resolves cls.__module__ through sys.modules, but the S14 load_module() helper called exec_module() without first registering the new module object.

No S14 ring3, vector-adversary, or context-adversary claim is accepted from this run.

CURRENT REPAIR

repaired head: 405b8b99258af7886b53a2cfa49c58bdeb473cb1
changed path: tools/bone-sea/s14/prove.py
machine implementation authority remains the exact failed-head blob ab9be2eb5e8fe06477e6415e7e33973d744cc06c
launcher resolves and verifies 0ab8f218f17d0586c94dc88bca981eec4cc2faa1:tools/bone-sea/s14/prove.py before execution
launcher registers only bone_sea_s12_authority, bone_sea_s13_authority, and bone_sea_s14_patches in sys.modules
prior module state and importlib.util.module_from_spec are restored in finally
N5/N6 transforms, S12 root, S13 image authority, CRC law, QEMU matrix, adversaries, and non-claims are unchanged

REVALIDATION REQUIRED

RUSTFLAGS=-Dwarnings
cargo test --locked --all-targets --manifest-path tools/bone-sea/Cargo.toml
cargo run --locked --release --manifest-path tools/bone-sea/Cargo.toml --bin bone-sea-s14 -- verify --shinesea D:\TECHNICAL\SHINESEA --timeout 20

Keep PR draft. No merge and no S15 authorization before observed repaired-head evidence.

REPORTS ARE CLAIMS, NOT EVIDENCE.
NO COSTUME RIGOR.

Deadbytes101 · 2026-08-05T00:47:30Z

BONE/SEA S14 SECOND EXACT-HEAD FAILURE AND SURGICAL REPAIR

FAILED HEAD

405b8b99258af7886b53a2cfa49c58bdeb473cb1

Observed on Windows:

exact head matched;
tracked/index state clean; local untracked caches only;
native suite reached S14 and failed 3 / 8 S14 tests because the compatibility launcher no longer contained three literal proof tokens expected by the frozen Rust gate;
S14 machine proof advanced past the dataclass importer repair, then stopped before NASM assembly and before every QEMU image with:

TypeError: compile_image() takes 4 positional arguments but 5 were given

The current S13 authority exposes:

compile_image(linker, bone_sea, shine, output)

The exact failed-head S14 implementation called the former helper signature:

compile_image(shinesea, linker, bone_sea, shine, output)

No S14 ring3, exception-return, vector-adversary or context-adversary claim is accepted from this run.

CURRENT REPAIRED HEAD

b636513c032274129798b2b0b0b3d9d4abaebfcb

One file changed from the previous repaired head:

tools/bone-sea/s14/prove.py  +24 / -3

The bounded compatibility launcher now:

continues to verify implementation commit 0ab8f218f17d0586c94dc88bca981eec4cc2faa1;
continues to verify implementation blob ab9be2eb5e8fe06477e6415e7e33973d744cc06c;
retains the exact native proof literals for UD2, HLT/NOP and the exact-SHINESEA non-claim;
requires exactly one legacy five-argument call and zero already-current calls;
replaces only that exact call with the frozen four-argument S13 helper signature;
leaves N5/N6 transforms, S12 root, S13 ELF/flat authority, CRC law, all three disk images, QEMU ordering and non-claims unchanged.

REVALIDATION REQUIRED

RUSTFLAGS=-Dwarnings
cargo test --locked --all-targets --manifest-path tools/bone-sea/Cargo.toml
cargo run --locked --release --manifest-path tools/bone-sea/Cargo.toml --bin bone-sea-s14 -- verify --shinesea D:\TECHNICAL\SHINESEA --timeout 20

Keep PR #47 draft. No merge and no S15 authorization before exact-head native and machine evidence.

REPORTS ARE CLAIMS, NOT EVIDENCE.
NO COSTUME RIGOR.

Deadbytes101 · 2026-08-05T00:50:07Z

S14 EXACT-HEAD FAILURE 3 AND TOKEN-ONLY REPAIR

OBSERVED HEAD

head: b636513c032274129798b2b0b0b3d9d4abaebfcb
tracked/index state: clean
untracked local artifacts only: .tools/, root and S12/S13/S14 __pycache__/, sc.local.png
native tests: 133 / 134 PASS
warnings: 0

OBSERVED NATIVE FAILURE

Only bone-sea-s14::runtime_and_write_claims_remain_forbidden failed:

assertion failed: PROOF_TEXT.contains("WRITE AUTHORITY          DISABLED")

The compatibility launcher retained the UD2, HLT/NOP and exact-SHINESEA non-claim literals but omitted the frozen write-authority non-claim literal. This is a static proof-token omission, not a machine-path failure.

MACHINE EVIDENCE STATUS

The supplied S14 transcript ends after:

Preparing worktree (detached HEAD b636513)
HEAD is now at b636513 repair S14 proof tokens and S13 helper compatibility

No terminal verdict, hash ledger, ordered QEMU success trace, vector rejection trace, context rejection trace, or cleanup verdict was supplied. Therefore no S14 machine claim is accepted from this run.

SURGICAL REPAIR

Current head: c9a0329af316defe9f8e7b7d3194a2ca7d19f8f2

One comment-contract line was added to tools/bone-sea/s14/prove.py:

# WRITE AUTHORITY          DISABLED

No executable Python logic changed. The exact implementation-object gate, module registration, four-argument S13 compatibility transform, N5/N6 transforms, S12 root, S13 image authority, CRC law, disk images, QEMU order and adversaries remain unchanged.

REVALIDATION REQUIRED

RUSTFLAGS=-Dwarnings
cargo test --locked --all-targets --manifest-path tools/bone-sea/Cargo.toml
cargo run --locked --release --manifest-path tools/bone-sea/Cargo.toml --bin bone-sea-s14 -- verify --shinesea D:\TECHNICAL\SHINESEA --timeout 20

Keep PR #47 draft. No merge and no S15 authorization before exact-head 134 / 134 PASS and complete S14 machine evidence.

REPORTS ARE CLAIMS, NOT EVIDENCE.
NO COSTUME RIGOR.

Deadbytes101 · 2026-08-05T01:08:00Z

S14 EXACT-HEAD EVIDENCE CLOSURE

Exact head

c9a0329af316defe9f8e7b7d3194a2ca7d19f8f2

Working tree

tracked/index state clean;
local untracked artifacts only: .tools/, __pycache__/, sc.local.png, and phase-local __pycache__/ directories.

Native validation

total defined tests: 134 / 134 PASS;
compiler warnings: 0.

Exact S13 authority recovery

ELF bytes       79972
ELF SHA256      22560ca0ca12aaf81e1324fe77c93d9ba01af1d7e775cb66e9b2df0ada77d4b9
code bytes      35040
flat SHA256     668f272d4035c18600dfaec211756307bd5ab18734bd093bc5a0fe41a6028cd3

Generated machine authority

nano bytes                  1788
nano SHA256                 988790627cf0dc1c5104bb24402f8b3cc172c38c2a1cb70ba42297aa9c3893f3
nano mutable offset         1736
nano mutable bytes          20
NANOSUP bytes               2604
NANOSUP SHA256              4bb38e3bccc35577f96be9c089bfdc7aa516afd191f139aae3e979b33301e827
success root bytes          14411
success root SHA256         f3b4cd5e67f6949db525c3f7c0534818041d155ee755eec863712af7fcfa0a45
vector root SHA256          084ab4464024028084295912daaf674e8098fea868985e16e5212748c8226f7e
context root SHA256         a9cf5793991f5f4c74822f7429a9f78f6904d61cc9a28b9e5da406ebab7d1b0e

SEA image evidence

success CRC32               097a474a
vector CRC32                8a78b0a7
success image SHA256        e643f79a4400ccfa804d7fe881469896463815d7ac02dc284e9efedae1ae252f
vector image SHA256         866f459d65046c6d54a529bbce9c631ee98e0cb2e05535f1d73b9d8ff1b6f73e
context image SHA256        0fb23c7365a4be605f61679c82cccfbff69e980169e23992dc79b63c1b26faf6

Observed machine verdicts

SEA LDT selector 0x0038;
local entry offset 0x00000000;
local stack offset 0x00013ffc;
success probe: #UD vector 6, error 0, EIP 0;
vector adversary: #GP vector 13 rejected;
context-limit adversary: rejected before entry;
inherited N6 pipeline continuation: PASS;
temporary outputs: removed on exit;
terminal verdict: BONE/SEA S14 CONTROLLED RING3 PROBE VERIFY PASS.

Non-claims remain enforced

exact SHINESEA _start not executed;
SEA sector gate not ready;
no SEA-issued ATA reads;
no read_verified_image success;
no SHINESEA runtime mount;
no allocator runtime PASS;
write authority disabled.

GitHub Actions exposes no pull-request workflow run for this exact head at evidence closure time. The local exact-head transcript is the observed authority.

S14 is ready for review against exact parent 0213d2368da7c49555e62555b17496a91cea6f2b and exact head c9a0329af316defe9f8e7b7d3194a2ca7d19f8f2 only. Any head movement, rebase, retarget, or integration requires fresh evidence.

No merge is performed automatically.

REPORTS ARE CLAIMS, NOT EVIDENCE.
NO COSTUME RIGOR.

Deadbytes101 · 2026-08-05T01:13:59Z

FINAL INTEGRATION COMPLETE

The complete S0-S14 stack is now retained directly on main through final closure commit a319d003650a93aa432a66b1a3514c74092917df.

Exact accepted S14 evidence head remains c9a0329af316defe9f8e7b7d3194a2ca7d19f8f2. The two commits above it change only .gitignore local-artifact exclusions and add FINAL_MILESTONE.txt; no runtime or proof code moved.

The pre-final main tip is preserved at archive/pre-final-main-2026-08-05. The final authority is also pinned at archive/bonebox-final-2026-08-05.

This PR is being closed without an additional merge commit because its exact content is already an ancestor of final main.

PROJECT STATE: CLOSED / FROZEN.
NO S15 AUTHORIZED.

REPORTS ARE CLAIMS, NOT EVIDENCE.
NO COSTUME RIGOR.

Deadbytes101 added 9 commits August 5, 2026 07:22

add deterministic S14 ring3 probe transforms

7901001

add S14 ring3 machine proof

82653a5

preserve the active-event source during S14 dispatch

1c858ef

freeze the S14 controlled ring3 probe contract

692edfb

add the S14 native contract gate

99bb5d9

add S14 license notice

f8c7c7b

document the S14 controlled ring3 probe

189fe8a

add the S14 ring3 probe workflow

0ab8f21

repair S14 dynamic authority loading

405b8b9

repair S14 proof tokens and S13 helper compatibility

b636513

restore the S14 write-authority proof token

c9a0329

Deadbytes101 marked this pull request as ready for review August 5, 2026 01:08

Deadbytes101 closed this Aug 5, 2026

Repository owner locked as resolved and limited conversation to collaborators Aug 5, 2026

Navigation Menu

BONE/SEA S14: prove controlled CPL3 entry through the SEA LDT - #47

BONE/SEA S14: prove controlled CPL3 entry through the SEA LDT#47
Deadbytes101 wants to merge 11 commits into
ecosystem/shinesea-s13-local-offset-imagefrom
ecosystem/shinesea-s14-ring3-probe

Deadbytes101 commented Aug 5, 2026 •

edited

Loading

Uh oh!

Deadbytes101 commented Aug 5, 2026

Uh oh!

Deadbytes101 commented Aug 5, 2026

Uh oh!

Deadbytes101 commented Aug 5, 2026

Uh oh!

Deadbytes101 commented Aug 5, 2026

Uh oh!

Deadbytes101 commented Aug 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

Deadbytes101 commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Deadbytes101 commented Aug 5, 2026

Uh oh!

Deadbytes101 commented Aug 5, 2026

Uh oh!

Deadbytes101 commented Aug 5, 2026

Uh oh!

Deadbytes101 commented Aug 5, 2026

Uh oh!

Deadbytes101 commented Aug 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Deadbytes101 commented Aug 5, 2026 •

edited

Loading