Development #11 — B1 closure trio + T-012 Done promotion + post-merge cleanup

[cemililik]

Summary

• B1 milestone implementation-complete. T-012 promoted In Review → Done 2026-04-28; T-013 already Done 2026-04-27 via PR Development #9 — T-011 + T-008 + T-013 (B0 hygiene close + B1 EL drop) #9. Milestone-level "Done" still gated on maintainer-side QEMU smoke + Miri pass — those are pre-closure work-items tracked in the audit-log Pending QEMU smoke verification status notes on UNSAFE-2026-0019 / 0020 / 0021.
• B1 closure review trio landed. Business retrospective + consolidated security pass + performance baseline re-run, all dated 2026-04-28. Verdict trio: Approve (security, with two forward-flagged non-blocking items only relevant when a future caller exists), Baseline recorded (performance, no proposal made; three concerns flagged for future hypothesis-driven cycles), B2-prep pivot (business retro's Pathfinder unblocks ADR-0027 drafting in parallel with maintainer-side smoke run).
• Post-merge cleanup landed. Independent approval-review on the trio returned Approve with 1 Medium + 7 Low + 2 Nit findings — all applied as prose / numerical-accuracy / framing fixes; substantive verdicts unchanged. Adjacent fix: docs/architecture/exceptions.md §"Idle's wfi activation" prose drift corrected (the section still claimed idle stays in spin_loop until T-012 lands; T-012 has shipped and idle_entry uses cpu.wait_for_interrupt()). Final cleanup: repo-wide umbrix-to-phase-a.md → tyrne-to-phase-a.md rename closes the pre-existing N2 finding from the project's 2026-04-22 Umbrix → Tyrne rename.

This is a documentation-only PR — no kernel code, BSP code, or HAL code changed since PR #10. All trio + cleanup work happens in docs/.

What landed (commit-by-commit)

Commit	Theme	Notes
ffefb76	docs(roadmap)	T-012 Done sweep — Status flipped to Done; tasks/phase-b README + phase-b.md B1 sub-item 5 + acceptance criteria + new "Status: B1 implementation complete 2026-04-28" line; current.md active-phase / active-milestone / last-completed-tasks / active-decisions all pivoted; architecture/README.md + exceptions.md status banners flipped to Done; top-level README phase-status sentence freshened.
9678d6c	docs(roadmap,analysis)	B1 closure review trio + roadmap pivot to B2 prep. Three new artefacts (security-reviews/2026-04-28-B1-closure.md, performance-optimization-reviews/2026-04-28-B1-closure.md, business-reviews/2026-04-28-B1-closure.md); three review-type README index updates; current.md pivot from "B1 closure trio is the next work-item" to "B2 prep — ADR-0027 drafting unblocked".
a5d4f9b	docs(analysis,architecture)	Approval-review findings on the trio — 1 Medium (canonisation-threshold three-way reconciliation in business retro), 7 Low (cancel_deadline race forward-flag in security; kernel zero-unsafe grep description correction; GIC ITARGETSR offset bound 0xC00 → 0xBFC; irq_entry+panic_entry ~400 → ~244 bytes objdump-verified; T-013/T-012 .text contribution two-thirds → 58 %; trampoline mov sp, x0 typo → mov x0, sp with restore 16 → 15; cost-of-arc commit-count 2+1+1+1+1+2+1=9 categorisation), 2 Nit (zero/two diagram framing; stale-link drift framing). Plus an adjacent finding: docs/architecture/exceptions.md §"Idle's wfi activation" prose drift fix (T-012 has shipped; section was still framing WFI as a future change).
10e3351	docs(refs)	Repo-wide stale-link rename. git mv × 2 (docs/analysis/reviews/{code,security}-reviews/2026-04-21-umbrix-to-phase-a.md → …tyrne-to-phase-a.md) + 3 stale link-form references fixed (B0 closure security review × 2 + B1 closure security review × 1). The empirical reality differed from the original framing — ~20 references already used the new tyrne- name (broken until rename), only 3 still used the old umbrix- name (working until rename); the rename cleans both directions. Closes the B1 retro's Repo-wide umbrix → tyrne link sweep Adjustments item.

Reviews included in this PR

Three artefacts under docs/analysis/reviews/:

• B1 closure consolidated security review — eight-axis adversarial pass. Verdict Approve (no Yüksek findings). Two forward-flagged non-blocking items (arm_deadline CVAL+CTL race + cancel_deadline CTL+GIC race), both only relevant when a future caller exists. Three threat-model shifts identified (IRQ delivery as structural property; expanded unsafe surface with proportionally expanded discipline; IRQ-handler aliasing as unified second-axis rule). Three positive review-surface observations (architecture-doc-as-security-multiplier confirmed second time; review-fix-round cadence catching 19+2 findings pre-merge; explicit Pending QEMU smoke verification audit-log status notes as forward-discipline pattern).
• B1 closure performance baseline — re-baseline against A6 baseline. Verdict Baseline recorded (no proposal made; per master-plan §Pre-flight). New Metric 6: IRQ delivery cost (~51 instructions per timer-IRQ ack-and-ignore round trip — 30 trampoline + 1 bl + 20 handler body + ~25 cycles microcode; not exercised in v1 because the IPC demo arms no deadline). Section deltas vs A6: .text 13.6 → 21.4 KiB (+57 %; T-013 + T-012 contribute ~58 % of the delta), .bss 17.5 → 21.7 KiB (+24 %; ~94 % from T-007's 4 KiB idle stack — T-012's .bss cost is ~32 bytes). Three concerns flagged for future hypothesis-driven cycles: IPC round-trip wall-clock measurement (now infrastructure-unblocked via T-009's now_ns()), stack high-water-mark probes, TrapFrame slimming for ack-and-ignore handlers.
• B1 closure retrospective — five-section retro. Cost-of-arc: B1 ~7 commits/day, between Phase A's 15/day and B0's 8/day. Two design patterns empirically validated: design-first arc (exceptions.md landed before code; only two diagram/prose mismatches caught in PR Development #10 — T-012 (B1 IRQ infrastructure) + B0 closure retros #10's two rounds — no structural design-vs-implementation disagreement) and explicit Pending QEMU smoke verification audit-log status notes (cross-arc reproducibility threshold for canonisation as unsafe-policy.md §3 sub-rule). ADR-0025 §Rule 2 calibration ongoing: planned-vs-unplanned Amendment distinction proposed for the 2026-05-04 ADR-0024 first-week measurement.

Documentation surface changes

• docs/architecture/exceptions.md — Status banner flipped to Done; §"Idle's wfi activation" prose drift fix (the WFI form is now framed as the default wake strategy; the historical spin_loop → WFI flip recorded as past tense via T-012 commit b4ed68c; ADR-0022 first rider's Sub-rider gate marked closed).
• docs/architecture/README.md — exceptions.md row status: T-012 In Review → T-012 Done 2026-04-28 via PR #10 merge.
• docs/roadmap/current.md — Active-phase headline pivots; Active-task pivots to B2 prep; Last-reviews list adds the three B1 closure artefacts; Active-decisions block updated for ADR-0010 (deferred halves now live), ADR-0021 (2026-04-28 Amendment), ADR-0022 (Sub-rider closed); Next-task / Next-review-trigger pivot to B2 closure.
• docs/roadmap/phases/phase-b.md — B1 sub-item 5 + acceptance criteria T-012 line both flipped to Done; new "Status: B1 implementation complete 2026-04-28 with PR Development #10 — T-012 (B1 IRQ infrastructure) + B0 closure retros #10's merge" line below the criteria (mirrors B0 closure's existing convention).
• docs/analysis/tasks/phase-b/T-012-exception-and-irq-infrastructure.md — Status In Review → Done; two new review-history rows (PR Development #10 — T-012 (B1 IRQ infrastructure) + B0 closure retros #10 review-fix sweeps summary + Done promotion row).
• docs/analysis/tasks/phase-b/README.md — T-012 row Done.
• README.md (top-level) — phase-status sentence freshened.

What this PR does NOT do

• No new ADRs. ADR-0021's 2026-04-28 Amendment was landed by PR Development #10 — T-012 (B1 IRQ infrastructure) + B0 closure retros #10; this PR doesn't touch ADR bodies. ADR-0027 (kernel virtual memory layout) is the natural next ADR but was deliberately not drafted here — its drafting is the B2-prep work scheduled to run in parallel with the maintainer-side QEMU smoke + Miri runs.
• No new audit-log entries. UNSAFE-2026-0019 / 0020 / 0021 + UNSAFE-2026-0014 commit-28c5ce9 Amendment all landed in PR Development #10 — T-012 (B1 IRQ infrastructure) + B0 closure retros #10. The Pending QEMU smoke verification status notes on the three new entries are explicitly not lifted in this PR — they remain until the maintainer runs the smoke trace and appends an Amendment recording the verification result. The introducing-commit-boundary discipline (UNSAFE-2026-0017's "Discipline note for future readers" paragraph) means audit-log bodies are append-only after their introducing commit.
• No new unsafe surface. The four commits in this PR are 100 % documentation; zero bsp-qemu-virt/, kernel/, hal/, test-hal/, Cargo.{toml,lock} changes.
• No B2 implementation work. B2 (MMU activation, kernel-half mapping) opens with ADR-0027 drafting; this PR pivots current.md to flag the unblock and the design-first hard-requirement, but the ADR itself is the next session's call.

DoD status

Documentation-only PR; the kernel/build gates apply trivially because no code changed:

Gate	Status
cargo fmt --all -- --check	✅ clean
cargo host-clippy	✅ clean (-D warnings)
cargo kernel-clippy	✅ clean
cargo kernel-build	✅ clean
cargo host-test	✅ 149 / 149 (25 hal + 90 kernel + 34 test-hal) — same as PR #10 post-5c9cf06
cargo +nightly miri test (host)	⏳ deferred to CI / R6 GitHub Actions skeleton — same disclaimer T-013 + T-012 used; pre-B1-closure work-item
QEMU smoke (default + -machine virtualization=on)	⏳ deferred to maintainer-side verification — pre-B1-closure work-item; lifts UNSAFE-2026-0019 / 0020 / 0021 status notes via append-only Amendment

Test plan

• CI: fmt, host-clippy, kernel-clippy, kernel-build, host-test, Miri pass on the R6 workflow (no code changed; this should be a no-op delta from PR Development #10 — T-012 (B1 IRQ infrastructure) + B0 closure retros #10's CI run).
• Cross-reference graph: post-merge, grep -rE "tyrne-to-phase-a\.md|umbrix-to-phase-a" --include="*.md" should show 32 link-form references all resolving to existing files; the only umbrix-to-phase-a mentions are the two prose descriptions in the B1 closure retro.
• Independent approval-review of this PR's four commits, focusing on (a) the B1 closure trio's substantive findings, (b) the rename's repo-wide consistency, (c) the exceptions.md idle prose's alignment with shipped code.
• Maintainer-side QEMU smoke (pre-B1-closure work-item, separate from this PR's merge): default config (EL1 entry) + -machine virtualization=on (EL2 entry); reproduce the A6 + T-009 instrumentation trace post-T-012; lifts the three audit-log Pending QEMU smoke verification status notes via append-only Amendment after the smoke completes.
• Maintainer-side Miri (pre-B1-closure work-item): cargo +nightly miri test --workspace --exclude tyrne-bsp-qemu-virt.

What this PR enables

Once merged + the maintainer-side smoke + Miri runs land, B1 milestone closes formally and B2 (MMU activation) can begin. The B2 design-first hard-requirement adopted by the B1 retro means the next implementation arc opens with an ADR (ADR-0027) + an architecture doc (docs/architecture/memory-management.md), then code — same shape as T-012's design-first arc.

🤖 Generated with Claude Code

Summary by Sourcery

Update roadmap and architecture documentation to mark T-012 and B1 implementation as Done, record the B1 closure review trio, and clean up stale references and audit-log status notes.

New Features:

• Add B1 closure business, security, and performance review artifacts, including a new IRQ delivery performance baseline metric.
• Document B1 implementation completion in the roadmap and top-level README, and outline B2 (MMU) preparation and design-first expectations.

Enhancements:

• Clarify the exceptions architecture doc to reflect shipped idle WFI behaviour, completed T-012 work, and remaining maintainer-side verification items.
• Refine roadmap phase-B details, including task statuses, active decisions, next tasks/review triggers, and expanded unsafe-audit status context.
• Index the new B1 closure reviews in the business, security, and performance review READMEs for easier navigation.

Documentation:

• Rename Phase A review artefact filenames and fix all remaining Umbrix→Tyrne links to restore a consistent, non-broken cross-reference graph across the docs.

Summary by CodeRabbit

• Documentation
  • Marked Phase B1 milestones (exception/IRQ/timer/idle work) as Done and updated task status entries.
  • Added B1 closure artifacts: business retrospective, consolidated security review, and performance baseline.
  • Updated architecture and roadmap indices to reflect B1 completion and advance preparation for Phase B2.
  • Noted pending maintainer verification items (QEMU smoke and Miri) as follow-up actions.

[qodo-code-review]

ⓘ You've reached your Qodo monthly free-tier limit. Reviews pause until next month — upgrade your plan to continue now, or link your paid account if you already have one.

[sourcery-ai]

Reviewer's Guide

Documentation-only PR that (1) promotes T-012 and the B1 milestone to implementation-complete across roadmap, task, and architecture docs; (2) adds the B1 closure review trio (security, performance baseline, business retrospective) and wires them into indexes; and (3) performs targeted cleanup including correcting exceptions/idle WFI prose and fixing the Umbrix→Tyrne review filename/link drift.

Sequence diagram for T_012 lifecycle and B1 closure documentation

sequenceDiagram
  actor Maintainer
  actor DevAgent
  participant Repo
  participant UnsafeLog
  participant RoadmapDocs
  participant ReviewDocs

  DevAgent->>Repo: create Task_T_012 (Draft)
  DevAgent->>Repo: add ArchDoc_Exceptions_md (design_first)
  DevAgent->>Repo: implement T_012 commits
  DevAgent->>Repo: add Unsafe_2026_0019_0021 entries
  DevAgent->>UnsafeLog: record new unsafe entries

  DevAgent->>Repo: open PR_10 (code + docs)
  Maintainer->>Repo: perform review_round_1
  Maintainer-->>DevAgent: review findings (safety, docs, tests)
  DevAgent->>Repo: commit review_round_1_fixes

  Maintainer->>Repo: perform review_round_2
  Maintainer-->>DevAgent: additional findings
  DevAgent->>Repo: commit review_round_2_fixes

  Maintainer->>Repo: merge PR_10 to main
  DevAgent->>RoadmapDocs: flip T_012 status In_Review -> Done
  DevAgent->>RoadmapDocs: mark B1 implementation complete
  DevAgent->>ReviewDocs: add B1_business_retro
  DevAgent->>ReviewDocs: add B1_security_review
  DevAgent->>ReviewDocs: add B1_performance_baseline

  DevAgent->>UnsafeLog: add Pending_QEMU_smoke_verification
  DevAgent->>RoadmapDocs: note maintainer_side QEMU + Miri pending

  Maintainer->>Repo: later run QEMU_smoke + Miri (outside this PR)
  Maintainer->>UnsafeLog: append Amendments lifting pending_status
  Maintainer->>RoadmapDocs: mark B1 milestone formally closed

Loading

Class diagram for B1/T_012 documentation relationships

classDiagram

class Milestone_B1 {
  status: implementation_complete
  opened: 2026_04_21
  implementation_complete: 2026_04_28
}

class Task_T_012 {
  phase: B
  milestone: B1
  status: Done
  created: 2026_04_27
}

class Task_T_013 {
  phase: B
  milestone: B1
  status: Done
  promoted: 2026_04_27
}

class ADR_0010_TimerTrait {
  status: Accepted
}

class ADR_0021_IPC_Bridge {
  status: Accepted
  amendment_2026_04_28: irq_handler_aliasing_discipline
}

class ADR_0022_Idle_Deadlock {
  status: Accepted
  first_rider_sub_rider: closed
}

class ADR_0024_EL_Drop {
  status: Accepted
}

class Review_B1_Security_2026_04_28 {
  type: security
  verdict: Approve
}

class Review_B1_Perf_2026_04_28 {
  type: performance_baseline
  verdict: Baseline_recorded
}

class Review_B1_Business_2026_04_28 {
  type: business_retro
}

class Unsafe_2026_0019 {
  scope: GIC_v2_MMIO
  status: Active
  pending_qemu_smoke: true
}

class Unsafe_2026_0020 {
  scope: EL1_vector_table_trampolines
  status: Active
  pending_qemu_smoke: true
}

class Unsafe_2026_0021 {
  scope: Generic_timer_CVAL_CTL
  status: Active
  pending_qemu_smoke: true
}

class Unsafe_2026_0014 {
  scope: Scheduler_momentary_mut_pattern
  amendment_28c5ce9: irq_entry_future_site
}

class ArchDoc_Exceptions_md {
  status: Accepted
  describes: exception_and_irq_infrastructure
}

class Roadmap_Current_md {
  active_phase: B
  active_milestone: B1
}

class Roadmap_PhaseB_md {
  B1_status: implementation_complete
}

class Reviews_Index_Security {
}

class Reviews_Index_Perf {
}

class Reviews_Index_Business {
}

Milestone_B1 "1" -- "2" Task_T_012 : includes
Milestone_B1 "1" -- "1" Task_T_013 : includes

Task_T_012 --> ADR_0010_TimerTrait : closes_deferred_halves
Task_T_012 --> ADR_0021_IPC_Bridge : adds_amendment
Task_T_012 --> ADR_0022_Idle_Deadlock : closes_first_rider
Task_T_013 --> ADR_0024_EL_Drop : implements

Task_T_012 --> Unsafe_2026_0019 : introduces
Task_T_012 --> Unsafe_2026_0020 : introduces
Task_T_012 --> Unsafe_2026_0021 : introduces
Task_T_012 --> Unsafe_2026_0014 : adds_amendment

Task_T_012 --> ArchDoc_Exceptions_md : implements_design
ArchDoc_Exceptions_md --> ADR_0010_TimerTrait : references
ArchDoc_Exceptions_md --> ADR_0021_IPC_Bridge : references
ArchDoc_Exceptions_md --> ADR_0022_Idle_Deadlock : references
ArchDoc_Exceptions_md --> ADR_0024_EL_Drop : references

Milestone_B1 --> Review_B1_Security_2026_04_28 : closure_review
Milestone_B1 --> Review_B1_Perf_2026_04_28 : closure_review
Milestone_B1 --> Review_B1_Business_2026_04_28 : closure_review

Review_B1_Security_2026_04_28 --> Unsafe_2026_0019 : audits
Review_B1_Security_2026_04_28 --> Unsafe_2026_0020 : audits
Review_B1_Security_2026_04_28 --> Unsafe_2026_0021 : audits
Review_B1_Security_2026_04_28 --> Unsafe_2026_0014 : audits

Review_B1_Perf_2026_04_28 --> Task_T_012 : measures_cost
Review_B1_Perf_2026_04_28 --> Task_T_013 : measures_cost
Review_B1_Business_2026_04_28 --> Milestone_B1 : analyzes_arc

Roadmap_Current_md --> Milestone_B1 : summarizes_status
Roadmap_PhaseB_md --> Milestone_B1 : defines_acceptance

Reviews_Index_Security --> Review_B1_Security_2026_04_28 : lists
Reviews_Index_Perf --> Review_B1_Perf_2026_04_28 : lists
Reviews_Index_Business --> Review_B1_Business_2026_04_28 : lists

Loading

Flow diagram for B1 implementation completion and closure gating

flowchart TD

  A_B1_Started["Phase B Milestone B1 opened<br/>T-013 EL_drop, T-012 exception_infrastructure planned"]
  B_T013_Done["T-013 Done 2026-04-27<br/>EL drop to EL1 implemented"]
  C_T012_DesignFirst["T-012 design-first<br/>exceptions_md drafted"]
  D_T012_Impl_Commits["T-012 implementation commits<br/>GIC + vectors + timer + idle WFI"]
  E_T012_Review_Fixes["PR #10 review rounds<br/>design + safety fixes<br/>host tests 149/149"]
  F_T012_Done["T-012 status: Done 2026-04-28<br/>roadmap and task docs updated"]
  G_B1_Closure_Trio["B1 closure review trio added<br/>security + performance + business"]
  H_B1_Impl_Complete["Milestone B1 implementation complete<br/>(but not fully closed)"]
  I_Pending_QEMU_Miri["Maintainer-side work pending<br/>QEMU smoke for IRQ path<br/>Miri run on workspace"]
  J_Unsafe_Status_Notes["UNSAFE-2026-0019/0020/0021<br/>carry Pending_QEMU_smoke_verification<br/>status notes"]
  K_B1_Formal_Closure["B1 milestone formally closed<br/>(after maintainer verifies and amends log)"]
  L_B2_Prep_ADR_0027["B2 prep: ADR-0027 drafting<br/>(memory layout) can start in parallel"]

  A_B1_Started --> B_T013_Done
  B_T013_Done --> C_T012_DesignFirst
  C_T012_DesignFirst --> D_T012_Impl_Commits
  D_T012_Impl_Commits --> E_T012_Review_Fixes
  E_T012_Review_Fixes --> F_T012_Done
  F_T012_Done --> G_B1_Closure_Trio
  G_B1_Closure_Trio --> H_B1_Impl_Complete
  H_B1_Impl_Complete --> J_Unsafe_Status_Notes
  H_B1_Impl_Complete --> I_Pending_QEMU_Miri
  I_Pending_QEMU_Miri --> K_B1_Formal_Closure
  J_Unsafe_Status_Notes --> K_B1_Formal_Closure
  H_B1_Impl_Complete --> L_B2_Prep_ADR_0027

Loading

File-Level Changes

Change	Details	Files
Promote T-012 from In Review to Done and mark B1 implementation as complete across roadmap and task docs, including updated status narratives and next-work pointers.	Update docs/roadmap/current.md to reflect B1 implementation complete, no active task, B2-prep as next work, refreshed active decisions, last completed tasks, next review trigger, and unsafe-audit status Flip T-012 status and dates from In Review to Done in the phase-b milestone breakdown and acceptance criteria, adding an explicit "B1 implementation complete" status line Mark T-012 as Done in the phase-b tasks index and extend its task file review-history with review-fix sweeps and Done promotion rows	docs/roadmap/current.md docs/roadmap/phases/phase-b.md docs/analysis/tasks/phase-b/README.md docs/analysis/tasks/phase-b/T-012-exception-and-irq-infrastructure.md
Update architecture documentation for the exceptions/IRQ path to match shipped behaviour and final T-012 status, especially idle's WFI activation and implementation mapping.	Flip exceptions.md status banner from T-012 In Review to T-012 Done via PR Development #10 — T-012 (B1 IRQ infrastructure) + B0 closure retros #10 with explicit mention of review-fix sweeps and pending maintainer-side smoke/Miri Rewrite the Idle's wfi activation section to describe WFI as the shipped default, capture the historical spin_loop→WFI flip, and note remaining pre-closure work-items Clarify that T-012 has landed as Done in the implementation-map section while still calling out pending smoke/Miri work	docs/architecture/exceptions.md docs/architecture/README.md
Add the B1 closure review trio (security, performance, business) and index entries, capturing the milestone-level verdicts and forward-looking concerns.	Introduce a B1 closure performance baseline document with detailed metric breakdowns, concerns, and references Introduce a B1 closure business retrospective covering cost-of-arc, ADR governance, audit-log patterns, and B2-prep recommendations Introduce a B1 closure consolidated security review for T-012 and new unsafe entries, with verdict and forward flags Wire the three new reviews into their respective README indexes and into roadmap/current.md last-reviews list	docs/analysis/reviews/performance-optimization-reviews/2026-04-28-B1-closure.md docs/analysis/reviews/business-reviews/2026-04-28-B1-closure.md docs/analysis/reviews/security-reviews/2026-04-28-B1-closure.md docs/analysis/reviews/performance-optimization-reviews/README.md docs/analysis/reviews/business-reviews/README.md docs/analysis/reviews/security-reviews/README.md docs/roadmap/current.md
Perform post-merge documentation cleanup around naming, links, and prose drift, including the Umbrix→Tyrne review rename and idle/WFI text corrections.	Rename the Phase-A-exit code/security review artifacts from umbrix-to-phase-a.md to tyrne-to-phase-a.md and update the few remaining stale links to match the majority usage Adjust B0 closure security review text to reference the new tyrne-to-phase-a filenames Fix idle WFI activation prose drift in exceptions.md so it no longer describes WFI as future work and clarifies its v1 observability Refresh the top-level README status paragraph to describe Phase B B0 closure and B1 implementation completion, pointing toward B2	docs/analysis/reviews/code-reviews/2026-04-21-tyrne-to-phase-a.md docs/analysis/reviews/security-reviews/2026-04-21-tyrne-to-phase-a.md docs/analysis/reviews/security-reviews/2026-04-27-B0-closure.md docs/architecture/exceptions.md README.md

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[coderabbitai]

📝 Walkthrough

Walkthrough

Documentation updates marking Phase B1 (T-012 exception/IRQ infrastructure and T-013) as complete: status changes across README/architecture/roadmap, new B1 closure retrospectives for business, security, and performance, index updates, and preparatory notes toward B2 (MMU activation and downstream work).

Changes

Cohort / File(s)	Summary
Top-level Status & Roadmap README.md, docs/roadmap/current.md, docs/roadmap/phases/phase-b.md	Promotes B1/T-012 to Done (PR #10 referenced), updates milestone/status text, moves next-review trigger to B2 (MMU arc), and records pending maintainer-side QEMU smoke / miri gates.
Architecture Index & Doc docs/architecture/README.md, docs/architecture/exceptions.md	Marks exceptions.md as Done, adds PR #10 merge context, updates idle wfi narrative (ADR-0022 closed) and notes deferred QEMU/Miri verification.
Task List docs/analysis/tasks/phase-b/README.md, docs/analysis/tasks/phase-b/T-012-exception-and-irq-infrastructure.md	Updates T-012 status from In Review → Done, adjusts acceptance checklist and review-history entries to record PR #10 merge and remaining maintainer verification items.
Business Review docs/analysis/reviews/business-reviews/2026-04-28-B1-closure.md, docs/analysis/reviews/business-reviews/README.md	Adds B1 closure retrospective detailing completed tasks (T-013, T-012), ADR amendments, audit-log entries, test deltas, delivered architecture docs, and index entry for 2026-04-28.
Security Review docs/analysis/reviews/security-reviews/2026-04-28-B1-closure.md, docs/analysis/reviews/security-reviews/README.md, docs/analysis/reviews/security-reviews/2026-04-27-B0-closure.md	Adds B1 consolidated security closure with trust-boundary analysis (GICv2 MMIO, EL1 vector table, IRQ trampoline, timer wiring), documents UNSAFE audit items and race windows, marks verdict Approve, updates index and corrects B0 closure link target.
Performance Baseline docs/analysis/reviews/performance-optimization-reviews/2026-04-28-B1-closure.md, docs/analysis/reviews/performance-optimization-reviews/README.md	Introduces B1 baseline artifact: ELF/section sizing, contributors to .text/.bss growth, IRQ delivery cost metric, boot-time estimates, hotspot analysis, and index update with new metric.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐇 I thumped my foot — B1's done at last,

EL1 and IRQs hopped past,
Papers filed and baselines laid,
QEMU snooze and Miri stayed,
Onward we bound toward B2's vast.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: B1 closure documentation, T-012 promotion to Done, and repository cleanup—all of which are the primary focus across the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch development

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Review rate limit: 0/1 reviews remaining, refill in 60 minutes.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sourcery-ai]

Hey - I've left some high level feedback:

• The repeated explanations of the Pending QEMU smoke verification pattern across current.md, phase-b.md, the reviews, and the T-012 task file could be factored into a single canonical explanation (e.g., in unsafe-policy.md or a short standard) and referenced from those sites to reduce duplication and drift risk.
• The narrative sections around B1 status and scope (e.g., current.md, phase-b.md, B1 closure retro, security/perf reviews) repeat similar timeline and cost-of-arc details; consider tightening or cross-linking instead of restating full context in each file to keep future milestone updates simpler and less error-prone.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The repeated explanations of the `Pending QEMU smoke verification` pattern across `current.md`, `phase-b.md`, the reviews, and the T-012 task file could be factored into a single canonical explanation (e.g., in `unsafe-policy.md` or a short standard) and referenced from those sites to reduce duplication and drift risk.
- The narrative sections around B1 status and scope (e.g., `current.md`, `phase-b.md`, B1 closure retro, security/perf reviews) repeat similar timeline and cost-of-arc details; consider tightening or cross-linking instead of restating full context in each file to keep future milestone updates simpler and less error-prone.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[gemini-code-assist]

Code Review

This pull request completes the implementation of Phase B1, which includes exception infrastructure and interrupt delivery for the microkernel. Key changes involve the installation of an EL1 exception vector table, a GIC v2 driver, and generic-timer IRQ wiring. The documentation has been updated to reflect the 'Done' status of milestone B1, and several performance and security review artifacts have been added. I have provided feedback on improving the conciseness of the README, correcting a calculation error in the B1 closure retrospective, clarifying the status of the file rename, and improving the evergreen nature of the task documentation.

[gemini-code-assist]

The status description is very detailed and lengthy for the main README.md. A more concise summary that directs readers to docs/roadmap/current.md for details would improve readability for newcomers to the project.

Suggested change

**Status:** Pre-alpha. Phase A complete (2026-04-21) — the kernel boots on QEMU `virt` aarch64 and runs a two-task IPC demo end-to-end with capability-gated message transfer. Phase B B0 (Phase-A exit hygiene — scheduler hardening, idle task, monotonic time source via the ARM Generic Timer) closed 2026-04-27. Phase B B1 (drop to EL1 + exception infrastructure) implementation complete 2026-04-28: kernel runs at EL1 unconditionally with a 16-entry vector table at `VBAR_EL1`, a GIC v2 driver, generic-timer IRQ wiring, and idle's `wfi` activation. Path forward: B2 MMU activation, then per-task address spaces, task loader, syscall boundary, first userspace "hello". See [`docs/roadmap/current.md`](docs/roadmap/current.md) for the active task.

**Status:** Pre-alpha. Phase A (IPC demo) and Phase B milestones B0 (hygiene) and B1 (exception infrastructure) are implementation-complete. The kernel now runs at EL1 with a functional IRQ path. Next up is B2 (MMU activation). See [`docs/roadmap/current.md`](docs/roadmap/current.md) for details.

[gemini-code-assist]

There appears to be a calculation error in the total number of findings. The text states 19 + 2 + 2 = 23 total findings, but other documents in this PR and the breakdown on line 90 of this file (11/12 findings + 8 findings + 2 nitpicks) suggest a total of 21 findings (19 findings + 2 nitpicks). Please correct the total for consistency and accuracy.

Suggested change

**Result: only two diagram/prose mismatches caught during PR #10's two rounds — no structural "doc disagrees with code" findings.** The Mermaid diagram in the doc was updated in PR #10 round-1 to reflect the shipped ack-and-ignore behaviour (the original draft showed `sched::on_timer_irq` which was deliberately deferred); round-2 caught a remaining prose mismatch at lines 160-167 that round-1 missed. Two diagram/prose corrections out of 19 + 2 + 2 = 23 total findings — both narrow scope, both about post-design behaviour drift rather than design-vs-implementation disagreement. **Lesson: design-first reduces but does not eliminate doc-vs-code drift; the doc still needs a post-implementation reconciliation pass.** Recommendation: continue design-first for B2's MMU activation, but bake "post-implementation doc-vs-code reconciliation" into the AC rather than relying on the review-fix-rounds to catch it.

**Result: only two diagram/prose mismatches caught during PR #10's two rounds — no structural "doc disagrees with code" findings.** The Mermaid diagram in the doc was updated in PR #10 round-1 to reflect the shipped ack-and-ignore behaviour (the original draft showed `sched::on_timer_irq` which was deliberately deferred); round-2 caught a remaining prose mismatch at lines 160-167 that round-1 missed. Two diagram/prose corrections out of 21 total findings (19 findings + 2 nitpicks) — both narrow scope, both about post-design behaviour drift rather than design-vs-implementation disagreement. **Lesson: design-first reduces but does not eliminate doc-vs-code drift; the doc still needs a post-implementation reconciliation pass.** Recommendation: continue design-first for B2's MMU activation, but bake "post-implementation doc-vs-code reconciliation" into the AC rather than relying on the review-fix-rounds to catch it.

[gemini-code-assist]

This paragraph states that the umbrix-to-phase-a.md rename will be handled in a future commit. However, this pull request already includes the rename commit (10e3351). The documentation should be updated to reflect that this change is part of the current PR to avoid confusion. The Adjustments section on line 152 correctly marks this as done, but this paragraph contradicts it.

Suggested change

The T-009 mini-retro flagged file-rename / cross-reference drift as a pattern. The B0 retro confirmed it as a pattern (T-008's review needed a second round to catch four broken cross-references). T-012 produced **zero broken cross-references in its own changes** during PR #10's two rounds. Why? The post-fix sweep DoD rule (codified during B0) plus design-first (the `exceptions.md` doc was authoritative from commit-1, so subsequent commits couldn't drift). **Pattern confirmed: design-first + post-fix sweep DoD + review-fix-round cadence = stale-link drift suppressed for new T-012 changes.** Pre-existing repo-wide drift — the 2026-04-22 Umbrix → Tyrne rename had moved most filename references to the new shape but left two artefact files (`docs/analysis/reviews/{code,security}-reviews/2026-04-21-umbrix-to-phase-a.md`) at the old name, surfaced by the B1-closure approval-review's N2 finding — was a separate concern outside PR #10's scope; a follow-up `docs(refs):` commit (the immediate next commit on the `development` branch after this retro lands) renames both files to the new shape and fixes the three remaining link-form references that still point at the old name (the other ~20 references already use the new name and resolve correctly post-rename). The R6 CI follow-up (automated link check) is still desirable, both as a regression gate for new changes and as a backstop against future rename drift.

The T-009 mini-retro flagged file-rename / cross-reference drift as a pattern. The B0 retro confirmed it as a pattern (T-008's review needed a second round to catch four broken cross-references). T-012 produced **zero broken cross-references in its own changes** during PR #10's two rounds. Why? The post-fix sweep DoD rule (codified during B0) plus design-first (the `exceptions.md` doc was authoritative from commit-1, so subsequent commits couldn't drift). **Pattern confirmed: design-first + post-fix sweep DoD + review-fix-round cadence = stale-link drift suppressed for new T-012 changes.** Pre-existing repo-wide drift from the 2026-04-22 Umbrix → Tyrne rename was also fixed in this PR. Two artefact files (`docs/analysis/reviews/{code,security}-reviews/2026-04-21-umbrix-to-phase-a.md`) were renamed and three remaining stale link-form references were fixed. The R6 CI follow-up (automated link check) is still desirable, both as a regression gate for new changes and as a backstop against future rename drift.

[gemini-code-assist]

The note about the merge commit SHA being back-filled later is a process detail that can be confusing and makes the document feel dated immediately after merge. This pattern appears in other documents in this PR as well. Consider rephrasing to be more evergreen, for example by stating that the promotion to "Done" happens with the merge of the PR that includes these changes.

Suggested change

| 2026-04-28 | @cemililik (+ independent review agent) | Promoted `In Review → Done` via PR #10 merge to `main` (merge commit SHA pending back-fill in a follow-up `docs(audits)`-style commit, per the precedent set by `6d2f725` for the T-012 step-3 SHA). At merge: 149 / 149 host tests, kernel-build / kernel-clippy / host-clippy / fmt all clean. Three implementation commits + one documentation sweep + two review-round commits land as one cohesive `In Review` arc. **Two DoD gates remain explicitly maintainer-side and untouched by this promotion** — `cargo +nightly miri test` and the QEMU smoke run that exercises the deliberate-deadline path; both are pinned for the maintainer's CI / hardware-side runs (R6 GitHub Actions skeleton). UNSAFE-2026-0019 / 0020 / 0021 audit-log entries keep their `Pending QEMU smoke verification at the maintainer's first opportunity` status notes intact; those notes will be lifted to past-tense via append-only Amendments only after the maintainer has actually run the smoke, not as part of the merge promotion. T-012 closes B1's exception-infrastructure half: ADR-0010 deferred halves are live (`arm_deadline` / `cancel_deadline` real on `QemuVirtCpu`), ADR-0022 first rider's *Sub-rider* is closed (idle's WFI activation), ADR-0021 carries the IRQ-handler aliasing discipline as the 2026-04-28 Amendment. Next review trigger is the **B1 closure** business + security + performance review trio (per `docs/roadmap/current.md`'s next-review-trigger entry). |

| 2026-04-28 | @cemililik (+ independent review agent) | Promoted `In Review → Done` with the merge of PR #10 to `main`. At merge: 149 / 149 host tests, kernel-build / kernel-clippy / host-clippy / fmt all clean. Three implementation commits + one documentation sweep + two review-round commits land as one cohesive `In Review` arc. **Two DoD gates remain explicitly maintainer-side and untouched by this promotion** — `cargo +nightly miri test` and the QEMU smoke run that exercises the deliberate-deadline path; both are pinned for the maintainer's CI / hardware-side runs (R6 GitHub Actions skeleton). UNSAFE-2026-0019 / 0020 / 0021 audit-log entries keep their `Pending QEMU smoke verification at the maintainer's first opportunity` status notes intact; those notes will be lifted to past-tense via append-only Amendments only after the maintainer has actually run the smoke, not as part of the merge promotion. T-012 closes B1's exception-infrastructure half: ADR-0010 deferred halves are live (`arm_deadline` / `cancel_deadline` real on `QemuVirtCpu`), ADR-0022 first rider's *Sub-rider* is closed (idle's WFI activation), ADR-0021 carries the IRQ-handler aliasing discipline as the 2026-04-28 Amendment. Next review trigger is the **B1 closure** business + security + performance review trio (per `docs/roadmap/current.md`'s next-review-trigger entry). |

[coderabbitai]

Actionable comments posted: 6

🧹 Nitpick comments (1)

README.md (1)

5-5: Consider splitting the status line for readability.

This is clear but very dense; a short bullet list (Phase A / B0 / B1 / next) would also eliminate the repeated sentence-start pattern flagged by LanguageTool.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@README.md` at line 5, Split the dense "Status:" single-line entry into a
short bullet list to improve readability: create separate bullets for "Phase A",
"Phase B B0", "Phase B B1", and "Next" (or "Path forward"), moving the detailed
notes about kernel boot, QEMU virt aarch64 IPC demo, the scheduler/idle/timer
work, and the EL1/vector/GIC/timer/idle details into their respective bullets
and add a final bullet linking to docs/roadmap/current.md; keep the "Status:"
label and dates but avoid repeating sentence starts so each bullet is a concise
summary of the phase and its outcome.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In
`@docs/analysis/reviews/performance-optimization-reviews/2026-04-28-B1-closure.md`:
- Line 177: Update the summary text to match the linked security review by
changing "one forward-flagged non-blocking item" to "two forward-flagged
non-blocking items" and include both item names exactly as recorded in "B1
closure security review (2026-04-28)"; ensure the existing "arm_deadline
CVAL+CTL race" entry remains and add the other forward-flagged item from that
security review so the count and list are fully synchronized.

In `@docs/analysis/reviews/security-reviews/2026-04-28-B1-closure.md`:
- Around line 68-71: The doc's claims that irq_entry is "straight-line" and
"loop-free" are incorrect — the actual implementation in irq_entry (see
bsp-qemu-virt's irq_entry handler) uses a loop to acknowledge pending IRQs via
repeated GICC_IAR reads; update the text to remove absolutes about being
straight-line/loop-free/constant-time and instead state that irq_entry may
iterate to drain pending IRQs, describe that the loop is bounded by the number
of pending IRQs returned by GICC_IAR, and soften any timing/real-time guarantees
(e.g., change "constant-time" to "bounded by pending-interrupt count" and remove
claims that rely on being strictly straight-line). Ensure you reference
irq_entry and the GICC_IAR-based acknowledge loop in the revised wording.
- Line 120: Replace the non-English verdict word "Yüksek" with "High" in the
verdict text to comply with the English-only guideline; locate the verdict
string "Yüksek" in the document's verdict section and update that token to
"High" without altering surrounding markdown or formatting so the rest of the
review text remains unchanged.

In `@docs/analysis/reviews/security-reviews/README.md`:
- Line 36: Update the verdict text string "Approve — no Yüksek findings;" to use
an English term (e.g., "Approve — no High findings;" or "Approve — no
high-severity findings;") so the README entry uses only English; locate and
replace that exact phrase in the README line containing the table entry (the
cell starting "Approve — no Yüksek findings;") and ensure the rest of the
punctuation/format remains unchanged.

In `@docs/analysis/tasks/phase-b/T-012-exception-and-irq-infrastructure.md`:
- Line 5: Update the checklist item that currently reads "Task status updated to
`In Review`" in the T-012 document so it matches the actual state `Done` (e.g.,
change the checklist text to "Task status updated to `Done`"); ensure the
document’s status lines for T-012 (the header/status and the checklist entry)
are consistent and reflect the new `Done` state.

In `@docs/roadmap/phases/phase-b.md`:
- Line 96: Update the B1 status sentence that currently reads "B1 closure review
trio is pending" to reflect that the closure trio has landed on 2026-04-28;
change the paragraph around "Status: B1 implementation complete 2026-04-28" /
"B1 closure review trio is pending" to state the trio is complete (landed via
PRs noted) and leave only "maintainer-side QEMU smoke + Miri pass" as pending.
Ensure you modify the exact phrase "B1 closure review trio" and the surrounding
sentence so the only remaining pending items are the maintainer QEMU smoke and
Miri passes.

---

Nitpick comments:
In `@README.md`:
- Line 5: Split the dense "Status:" single-line entry into a short bullet list
to improve readability: create separate bullets for "Phase A", "Phase B B0",
"Phase B B1", and "Next" (or "Path forward"), moving the detailed notes about
kernel boot, QEMU virt aarch64 IPC demo, the scheduler/idle/timer work, and the
EL1/vector/GIC/timer/idle details into their respective bullets and add a final
bullet linking to docs/roadmap/current.md; keep the "Status:" label and dates
but avoid repeating sentence starts so each bullet is a concise summary of the
phase and its outcome.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 5d6959f0-75a0-4a85-907d-e3e9adedbb70

📥 Commits

Reviewing files that changed from the base of the PR and between 7b42bbe and 10e3351.

📒 Files selected for processing (16)

• README.md
• docs/analysis/reviews/business-reviews/2026-04-28-B1-closure.md
• docs/analysis/reviews/business-reviews/README.md
• docs/analysis/reviews/code-reviews/2026-04-21-tyrne-to-phase-a.md
• docs/analysis/reviews/performance-optimization-reviews/2026-04-28-B1-closure.md
• docs/analysis/reviews/performance-optimization-reviews/README.md
• docs/analysis/reviews/security-reviews/2026-04-21-tyrne-to-phase-a.md
• docs/analysis/reviews/security-reviews/2026-04-27-B0-closure.md
• docs/analysis/reviews/security-reviews/2026-04-28-B1-closure.md
• docs/analysis/reviews/security-reviews/README.md
• docs/analysis/tasks/phase-b/README.md
• docs/analysis/tasks/phase-b/T-012-exception-and-irq-infrastructure.md
• docs/architecture/README.md
• docs/architecture/exceptions.md
• docs/roadmap/current.md
• docs/roadmap/phases/phase-b.md

[coderabbitai]

⚠️ Potential issue | 🟠 Major

Correct ISR characterization: irq_entry is not straight-line and not loop-free.

This section says dispatch is constant-time/straight-line and that there are no loops in ISR, but bsp-qemu-virt/src/exceptions.rs shows irq_entry iterates in a loop while acknowledging pending IRQs. Please revise these claims to avoid overstating timing bounds.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@docs/analysis/reviews/security-reviews/2026-04-28-B1-closure.md` around lines
68 - 71, The doc's claims that irq_entry is "straight-line" and "loop-free" are
incorrect — the actual implementation in irq_entry (see bsp-qemu-virt's
irq_entry handler) uses a loop to acknowledge pending IRQs via repeated GICC_IAR
reads; update the text to remove absolutes about being
straight-line/loop-free/constant-time and instead state that irq_entry may
iterate to drain pending IRQs, describe that the loop is bounded by the number
of pending IRQs returned by GICC_IAR, and soften any timing/real-time guarantees
(e.g., change "constant-time" to "bounded by pending-interrupt count" and remove
claims that rely on being strictly straight-line). Ensure you reference
irq_entry and the GICC_IAR-based acknowledge loop in the revised wording.

[cemililik]

@coderabbitai review

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

♻️ Duplicate comments (1)

docs/analysis/reviews/security-reviews/2026-04-28-B1-closure.md (1)

68-71: ⚠️ Potential issue | 🟠 Major

Unaddressed past review finding: IRQ dispatch characterization needs correction.

A previous review identified that lines 68-71 incorrectly characterize irq_entry as "straight-line" and "loop-free," but the actual implementation uses a loop to acknowledge pending IRQs via repeated GICC_IAR reads. This finding was not marked as addressed.

Please revise to accurately reflect the implementation: remove absolute claims about being straight-line/loop-free/constant-time and instead describe that irq_entry may iterate to drain pending IRQs, with the loop bounded by the number of pending interrupts returned by GICC_IAR.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@docs/analysis/reviews/security-reviews/2026-04-28-B1-closure.md` around lines
68 - 71, Update the review text about irq_entry to remove the incorrect
"straight-line", "loop-free", and "constant-time" assertions and instead state
that irq_entry may iterate reading GICC_IAR to drain pending interrupts;
describe that the dispatch loop is bounded by the number of pending IRQs
returned by GICC_IAR and thus remains predictable, heap-free, and non-allocating
(preserving ISR minimality), and adjust any references to the invariants/ISR
minimality claim to reflect this bounded-loop behavior of irq_entry.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@docs/analysis/reviews/security-reviews/2026-04-28-B1-closure.md`:
- Around line 68-71: Update the review text about irq_entry to remove the
incorrect "straight-line", "loop-free", and "constant-time" assertions and
instead state that irq_entry may iterate reading GICC_IAR to drain pending
interrupts; describe that the dispatch loop is bounded by the number of pending
IRQs returned by GICC_IAR and thus remains predictable, heap-free, and
non-allocating (preserving ISR minimality), and adjust any references to the
invariants/ISR minimality claim to reflect this bounded-loop behavior of
irq_entry.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 208f690f-ddb3-4a88-a081-5ed4c58a7967

📥 Commits

Reviewing files that changed from the base of the PR and between 10e3351 and 214052d.

📒 Files selected for processing (8)

• README.md
• docs/analysis/reviews/business-reviews/2026-04-28-B1-closure.md
• docs/analysis/reviews/performance-optimization-reviews/2026-04-28-B1-closure.md
• docs/analysis/reviews/security-reviews/2026-04-28-B1-closure.md
• docs/analysis/reviews/security-reviews/README.md
• docs/analysis/tasks/phase-b/T-012-exception-and-irq-infrastructure.md
• docs/roadmap/current.md
• docs/roadmap/phases/phase-b.md

✅ Files skipped from review due to trivial changes (1)

• docs/analysis/reviews/business-reviews/2026-04-28-B1-closure.md

🚧 Files skipped from review as they are similar to previous changes (2)

• docs/analysis/reviews/security-reviews/README.md
• docs/roadmap/phases/phase-b.md