---
id: PLN-0049
ticket: runtime-mode-separation-game-system
title: System Profile ABI Gates
status: open
created: 2026-05-14
completed:
ref_decisions: [DEC-0023]
tags: [runtime, firmware, hub, system-apps, abi, stdlib]
---

## Briefing

This plan enforces the negative side of `DEC-0023`: `System` must not inherit the game ABI or game stdlib surfaces. It does not design the final public `System` ABI.

## Decisions de Origem

- `DEC-0023` - System Pipeline Separation.

## Alvo

Make profile gates explicit enough that `System` apps cannot call game-only public surfaces by accident while the dedicated system ABI remains deferred.

## Escopo

- Audit current runtime syscall/profile gates for game-only domains.
- Preserve or add guards that reject `System` access to game-only surfaces.
- Ensure logs may share runtime implementation internally but remain resolved through profile-specific author-facing APIs later.
- Add tests for representative game-only surfaces under `AppMode::System`.

## Fora de Escopo

- No final `System` stdlib/framework.
- No public PBS `System` ABI.
- No filesystem contract beyond preserving the negative rule that `System` does not use game memory cards as its public storage model.

## Plano de Execucao

### Step 1 - Audit existing domain gates

**What:** Map syscall domains and runtime dispatch branches that are game-only or shared.
**How:** Inspect `dispatch.rs`, `syscalls/domains/*`, caps, and tests for checks against `current_cartridge_app_mode`.
**File(s):** `crates/console/prometeu-system/src/virtual_machine_runtime/dispatch.rs`, `crates/console/prometeu-hal/src/syscalls/domains/`, `crates/console/prometeu-hal/src/syscalls/caps.rs`.

### Step 2 - Define a local profile-gate helper if duplication appears

**What:** Centralize repeated `AppMode::Game` checks only if it reduces real duplication.
**How:** Add a small helper in runtime dispatch or profile policy code that returns the existing fault/error style for game-only domains.
**File(s):** `crates/console/prometeu-system/src/virtual_machine_runtime/dispatch.rs` or a nearby runtime module.

### Step 3 - Preserve shared internal services without exposing shared author APIs

**What:** Keep internal log implementation sharing valid while avoiding a shared stdlib conclusion.
**How:** Do not rename or split internal log services in this plan. Add comments/tests only where needed to clarify that profile-specific stdlib resolution is future tooling/API work.
**File(s):** `crates/console/prometeu-hal/src/log/`, `crates/console/prometeu-system/src/virtual_machine_runtime/dispatch.rs`.

### Step 4 - Add system-denial tests for game surfaces

**What:** Prove `System` cannot use representative game-only surfaces.
**How:** Add tests that set `current_cartridge_app_mode = AppMode::System` and verify game-only calls fail for representative GFX/composer/bank/input/memcard-style surfaces according to the existing error contract.
**File(s):** `crates/console/prometeu-system/src/virtual_machine_runtime/tests.rs`, `crates/console/prometeu-system/src/virtual_machine_runtime/tests_fs_memcard.rs`, related dispatch tests.

## Criterios de Aceite

- [ ] Game-only public surfaces reject `AppMode::System`.
- [ ] Representative tests cover system denial for game rendering/composition/bank or persistence surfaces.
- [ ] Shared internal log implementation is not mistaken for shared public stdlib.
- [ ] No final `System` ABI is introduced.

## Tests / Validacao

- `cargo test -p prometeu-system`
- `cargo test -p prometeu-hal`
- `rg -n "current_cartridge_app_mode != AppMode::Game|AppMode::System" crates/console/prometeu-system/src/virtual_machine_runtime` to review gate coverage.

## Riscos

- Over-centralizing gates may cause churn in dispatch code; use a helper only when it makes tests and policy clearer.
- Some game-only surfaces may currently fail through capabilities rather than explicit profile checks; tests should assert the behavioral contract, not force one implementation style.