bprof: split the M28 organ arm off the substrate-core M29 khash KAT (stage-B PR-3)#87
Merged
Conversation
…stage-B PR-3)
The one gate site where the PR-2 pattern (cfg the whole if/else) would be
WRONG: gating the M28 block whole would strip the M29 khash KAT from the
substrate image, contradicting boot-profiles.md §3.3 ("khash is
substrate-core"). Split asymmetrically instead:
- ONLY the M28 operator-cmd organ (opcmd selftest, its witness lines, the
`M28: operator-cmd OK` marker AND its substrate-skip form) is gated behind
`#[cfg(feature = "agent-organs")]`. With --no-default-features it vanishes
absent-by-omission.
- The M29 khash KAT (a keyed BLAKE2s-256 integrity primitive) is hoisted OUT
of the else arm into a standalone, ungated block. On the agent profile it
still rides the opcmd path (byte-identical, skipped standalone); on the
substrate profile (default build) and on EVERY --no-default-features boot it
emits the same khash: + `M29: khash-mac OK` lines at the same stream
position. Exactly one khash+M29 emission per boot on either profile / build.
Serial order preserved on the DEFAULT build (both profiles) byte-for-byte:
agent = khash/opcmd/M28/M29; substrate = M28-skip/khash/M29. On
--no-default-features: khash + M29 present, all M28 forms absent.
run-compileout-x86_64.sh: move M28 from the PIPELINE cluster into the ORGANS
table (`M28: operator-cmd OK | opcmd: challenge= | M28:`), organs-not-built
14->15; the khash/M29 core-PRESENT assertions already cover the substrate-core
half. ci.yml comments + step name updated to match. run-substrate,
witness-census, tb-hal, tb-encode, docs untouched.
bahadirarda
added a commit
that referenced
this pull request
Jul 12, 2026
…ut of every main.rs organ block) (#89) The status banner gains the 2026-07-10..12 paragraph: #85 M20 untangle, #86 the 14 self-contained organs, #87 the M28/M29 asymmetric split (dual-cfg let, khash substrate-core unconditional on feature-OFF), #88 the pipeline cluster via the contiguous span audit. Frontmatter description updated in lockstep. PR-5 (the image-split product decision, symbol/size verification, wire-witness flip) stays the named §12 operator gate, with the kernel-only-gate design recommendation recorded.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Stage-B PR-3: the ONE gate site where PR-2's pattern (cfg the whole if/else) would be actively WRONG — naively gating M28/M29 together would delete the khash KAT from the compile-out image, contradicting boot-profiles §3.3's "khash is substrate-core" ruling. The split is asymmetric:
#[cfg(feature = "agent-organs")], PR-2 style): the whole M28 operator-inbound organ — opcmd selftest + fail gate +opcmd:witness +M28: operator-cmd OKmarker + its skip form.khash: … kat=RFC7693-PASSwitness +M29: khash-mac OK, running iff the agent arm didn't already emit it — via a dual-cfglet(khash_emitted_by_agent_arm): feature ON → the runtime profile decides (today's behavior); feature OFF → the binding is const-false, so the substrate-core khash can never fall through a runtime check into absence, even if a compile-out image were booted withyuva.profile=agent.Byte-identity (the CI-gated invariant)
git diffcontains ZERO removed/editedserial_write_stremission lines — the khash/M29 emits moved verbatim (git matched them as unchanged context). Serial order per scenario: default/agentkhash, opcmd, M28, M29(unchanged) · default/substrateM28-skip, khash, M29(unchanged) · no-default/substratekhash, M29with all M28 forms absent.The lane
M28 moves from the pipeline cluster into the ORGANS table (
"M28: operator-cmd OK|opcmd: challenge=|M28:"— the witness prefix confirmed unique to the gated arm);organs-not-builtauto-recomputes 14→15; the khash/M29 core-PRESENT assertions were already in CORE_REQUIRE. Pipeline cluster is now M25/M30/M31/M38 — PR-4's scope.Untouched
tb-hal, tb-encode, docs, the three default run scripts, kani, witness-census (unaffected by construction: the census generator greps source text, and both M28 literals remain in source — just cfg-gated).
Merge gate: 2× green + SP#4 byte-identity from boot logs.