80 lines
3.9 KiB
Markdown
80 lines
3.9 KiB
Markdown
---
|
|
id: PLN-0049
|
|
ticket: runtime-mode-separation-game-system
|
|
title: System Profile ABI Gates
|
|
status: open
|
|
created: 2026-05-14
|
|
completed:
|
|
ref_decisions: [DEC-0023]
|
|
tags: [runtime, firmware, hub, system-apps, abi, stdlib]
|
|
---
|
|
|
|
## Briefing
|
|
|
|
This plan enforces the negative side of `DEC-0023`: `System` must not inherit the game ABI or game stdlib surfaces. It does not design the final public `System` ABI.
|
|
|
|
## Decisions de Origem
|
|
|
|
- `DEC-0023` - System Pipeline Separation.
|
|
|
|
## Alvo
|
|
|
|
Make profile gates explicit enough that `System` apps cannot call game-only public surfaces by accident while the dedicated system ABI remains deferred.
|
|
|
|
## Escopo
|
|
|
|
- Audit current runtime syscall/profile gates for game-only domains.
|
|
- Preserve or add guards that reject `System` access to game-only surfaces.
|
|
- Ensure logs may share runtime implementation internally but remain resolved through profile-specific author-facing APIs later.
|
|
- Add tests for representative game-only surfaces under `AppMode::System`.
|
|
|
|
## Fora de Escopo
|
|
|
|
- No final `System` stdlib/framework.
|
|
- No public PBS `System` ABI.
|
|
- No filesystem contract beyond preserving the negative rule that `System` does not use game memory cards as its public storage model.
|
|
|
|
## Plano de Execucao
|
|
|
|
### Step 1 - Audit existing domain gates
|
|
|
|
**What:** Map syscall domains and runtime dispatch branches that are game-only or shared.
|
|
**How:** Inspect `dispatch.rs`, `syscalls/domains/*`, caps, and tests for checks against `current_cartridge_app_mode`.
|
|
**File(s):** `crates/console/prometeu-system/src/virtual_machine_runtime/dispatch.rs`, `crates/console/prometeu-hal/src/syscalls/domains/`, `crates/console/prometeu-hal/src/syscalls/caps.rs`.
|
|
|
|
### Step 2 - Define a local profile-gate helper if duplication appears
|
|
|
|
**What:** Centralize repeated `AppMode::Game` checks only if it reduces real duplication.
|
|
**How:** Add a small helper in runtime dispatch or profile policy code that returns the existing fault/error style for game-only domains.
|
|
**File(s):** `crates/console/prometeu-system/src/virtual_machine_runtime/dispatch.rs` or a nearby runtime module.
|
|
|
|
### Step 3 - Preserve shared internal services without exposing shared author APIs
|
|
|
|
**What:** Keep internal log implementation sharing valid while avoiding a shared stdlib conclusion.
|
|
**How:** Do not rename or split internal log services in this plan. Add comments/tests only where needed to clarify that profile-specific stdlib resolution is future tooling/API work.
|
|
**File(s):** `crates/console/prometeu-hal/src/log/`, `crates/console/prometeu-system/src/virtual_machine_runtime/dispatch.rs`.
|
|
|
|
### Step 4 - Add system-denial tests for game surfaces
|
|
|
|
**What:** Prove `System` cannot use representative game-only surfaces.
|
|
**How:** Add tests that set `current_cartridge_app_mode = AppMode::System` and verify game-only calls fail for representative GFX/composer/bank/input/memcard-style surfaces according to the existing error contract.
|
|
**File(s):** `crates/console/prometeu-system/src/virtual_machine_runtime/tests.rs`, `crates/console/prometeu-system/src/virtual_machine_runtime/tests_fs_memcard.rs`, related dispatch tests.
|
|
|
|
## Criterios de Aceite
|
|
|
|
- [ ] Game-only public surfaces reject `AppMode::System`.
|
|
- [ ] Representative tests cover system denial for game rendering/composition/bank or persistence surfaces.
|
|
- [ ] Shared internal log implementation is not mistaken for shared public stdlib.
|
|
- [ ] No final `System` ABI is introduced.
|
|
|
|
## Tests / Validacao
|
|
|
|
- `cargo test -p prometeu-system`
|
|
- `cargo test -p prometeu-hal`
|
|
- `rg -n "current_cartridge_app_mode != AppMode::Game|AppMode::System" crates/console/prometeu-system/src/virtual_machine_runtime` to review gate coverage.
|
|
|
|
## Riscos
|
|
|
|
- Over-centralizing gates may cause churn in dispatch code; use a helper only when it makes tests and policy clearer.
|
|
- Some game-only surfaces may currently fail through capabilities rather than explicit profile checks; tests should assert the behavioral contract, not force one implementation style.
|