Intrepid/prometeu-runtime
Intrepid/prometeu-runtime
4
0
Fork 0
Code Pull Requests Activity
prometeu-runtime/discussion/workflow/plans/PLN-0049-system-profile-abi-gates.md

3.9 KiB
Raw Blame History

id ticket title status created completed ref_decisions tags
PLN-0049 runtime-mode-separation-game-system System Profile ABI Gates open 2026-05-14
DEC-0023
runtime
firmware
hub
system-apps
abi
stdlib

Briefing

This plan enforces the negative side of DEC-0023: System must not inherit the game ABI or game stdlib surfaces. It does not design the final public System ABI.

Decisions de Origem

  • DEC-0023 - System Pipeline Separation.

Alvo

Make profile gates explicit enough that System apps cannot call game-only public surfaces by accident while the dedicated system ABI remains deferred.

Escopo

  • Audit current runtime syscall/profile gates for game-only domains.
  • Preserve or add guards that reject System access to game-only surfaces.
  • Ensure logs may share runtime implementation internally but remain resolved through profile-specific author-facing APIs later.
  • Add tests for representative game-only surfaces under AppMode::System.

Fora de Escopo

  • No final System stdlib/framework.
  • No public PBS System ABI.
  • No filesystem contract beyond preserving the negative rule that System does not use game memory cards as its public storage model.

Plano de Execucao

Step 1 - Audit existing domain gates

What: Map syscall domains and runtime dispatch branches that are game-only or shared. How: Inspect dispatch.rs, syscalls/domains/*, caps, and tests for checks against current_cartridge_app_mode. File(s): crates/console/prometeu-system/src/virtual_machine_runtime/dispatch.rs, crates/console/prometeu-hal/src/syscalls/domains/, crates/console/prometeu-hal/src/syscalls/caps.rs.

Step 2 - Define a local profile-gate helper if duplication appears

What: Centralize repeated AppMode::Game checks only if it reduces real duplication. How: Add a small helper in runtime dispatch or profile policy code that returns the existing fault/error style for game-only domains. File(s): crates/console/prometeu-system/src/virtual_machine_runtime/dispatch.rs or a nearby runtime module.

Step 3 - Preserve shared internal services without exposing shared author APIs

What: Keep internal log implementation sharing valid while avoiding a shared stdlib conclusion. How: Do not rename or split internal log services in this plan. Add comments/tests only where needed to clarify that profile-specific stdlib resolution is future tooling/API work. File(s): crates/console/prometeu-hal/src/log/, crates/console/prometeu-system/src/virtual_machine_runtime/dispatch.rs.

Step 4 - Add system-denial tests for game surfaces

What: Prove System cannot use representative game-only surfaces. How: Add tests that set current_cartridge_app_mode = AppMode::System and verify game-only calls fail for representative GFX/composer/bank/input/memcard-style surfaces according to the existing error contract. File(s): crates/console/prometeu-system/src/virtual_machine_runtime/tests.rs, crates/console/prometeu-system/src/virtual_machine_runtime/tests_fs_memcard.rs, related dispatch tests.

Criterios de Aceite

  • Game-only public surfaces reject AppMode::System.
  • Representative tests cover system denial for game rendering/composition/bank or persistence surfaces.
  • Shared internal log implementation is not mistaken for shared public stdlib.
  • No final System ABI is introduced.

Tests / Validacao

  • cargo test -p prometeu-system
  • cargo test -p prometeu-hal
  • rg -n "current_cartridge_app_mode != AppMode::Game|AppMode::System" crates/console/prometeu-system/src/virtual_machine_runtime to review gate coverage.

Riscos

  • Over-centralizing gates may cause churn in dispatch code; use a helper only when it makes tests and policy clearer.
  • Some game-only surfaces may currently fail through capabilities rather than explicit profile checks; tests should assert the behavioral contract, not force one implementation style.