fix: honest isolation docs, syscall cap checks, QEMU CI smoke

[undivisible]

Stop treating cloned identity maps as isolation, and land the reviewable hardening we can actually verify.

Isolation

• Docs now state that domains clone the 4 GiB identity map, run at CPL0, and are not a security boundary. Exclusive maps + CPL3/iret are still required; this PR does not pretend they exist.
• Kernel binds cr3_read/cr3_write into globals at domain-init and zeros 0x4058/0x4060. Guests remain ring 0, so this is a published-gadget removal, not a privilege boundary.
• linux-init / NVMe storage no longer fall back to domain 1 on domain-create failure.
• Architecture gate requires the identity-map honesty sentence and forbids invoke1(load64(0x4060), ...).

Capabilities

• Each domain stores a minted cap index. sys-write/sys-read require cap-serial; channel syscalls require cap-graph. sys-cap-check may only query the caller’s current cap. mint/revoke stay -1.
• Packed/file SCI loads mint that cap and cap image-size. sci-load-file uses SCI-GUEST-GRANTS, not realm-grants.
• Guest sys-write of addresses below the shared-page window is rejected. Hardening asserts the cap and CR3-unpublish behavior.

CI

• Space-owned kernel workflow: persist-credentials: false, compiler pinned to 2e3bf26 (matches vendor/inauguration), nasm + qemu-system-x86, scripts/check-qemu-smoke.sh on the built image.
• scripts/check-all.sh wraps the host gates + QEMU boot + audit hardening.

Follow-ups

• Exclusive page tables together with CPL3 trampoline (do not land maps-only).
• Channel handle table (syscalls still take pointers from domain 0).
• SparkFS superblock caps, PCI BAR type/size, ELF PT_LOAD, TCP per-socket state.

Verified locally: check-architecture-boundaries, check-spdp-protocol, check-qemu-smoke, check-audit-fixes, check-qemu-boot against the new kernel.

---

Note

Medium Risk
Changes kernel domain switching, published CR3 gadgets, and syscall capability enforcement—security-sensitive paths—though scope is bounded to verifiable gates rather than claiming full isolation.

Overview
This PR stops presenting memory domains as isolation and documents that guests still share a cloned 4 GiB identity map and run at CPL0. It adds the syscall and loader hardening that can be enforced and tested today, plus CI that builds the kernel and runs a QEMU smoke gate.

Domain / CR3: domain-init binds cr3_read/cr3_write into kernel globals and clears the published stubs at 0x4058/0x4060. Domain switches and preempt ticks go through cr3-write and refresh current-cap per domain. linux-init and NVMe storage startup no longer fall back to domain 1 when domain-create fails.

Capabilities: SCI loads mint a cap and bind it to the domain (sci-bind-domain-cap), validate image bounds, and use SCI-GUEST-GRANTS for file loads (not realm-grants). sys-write/sys-read require cap-serial; channel syscalls require cap-graph; guest buffers below the shared-page window are rejected. sys-cap-check may only query the caller’s current cap; mint/revoke stay -1. Shell hardening and check-architecture-boundaries assert these behaviors.

CI / scripts: Replaces the reusable inauguration workflow with an in-repo kernel job (pinned compiler 2e3bf26, nasm, qemu-system-x86, persist-credentials: false). Adds check-qemu-smoke.sh, check-all.sh, and optional KERNEL_BIN reuse in check-qemu-boot.sh. Website CI pins Bun / v86 / wrangler versions.

^{Reviewed by Cursor Bugbot for commit b43ad1c. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_69c8f5c6-953c-4910-9c81-91df6c641268)

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request