diff --git a/.omo/boulder.json b/.omo/boulder.json new file mode 100644 index 0000000000..4b26dcadda --- /dev/null +++ b/.omo/boulder.json @@ -0,0 +1,15 @@ +{ + "schema_version": 2, + "active_work_id": "ryzen-7000-x670e-compat", + "works": { + "ryzen-7000-x670e-compat": { + "work_id": "ryzen-7000-x670e-compat", + "active_plan": ".omo/plans/ryzen-7000-x670e-compat.md", + "plan_name": "ryzen-7000-x670e-compat", + "session_ids": [], + "status": "active", + "worktree_path": null, + "notes": "session_ids intentionally empty: prior 26 todos executed under run-continuation tracking only; OpenCode harness auto-tracks ses_* state. Constraint from operator 2026-08-05: redbear-full.toml and local/cache/pkgar/* are owned by another session — never stage them. QEMU via scripts/run_mini1.sh." + } + } +} diff --git a/.omo/evidence/task-5-ryzen-7000-x670e-compat.txt b/.omo/evidence/task-5-ryzen-7000-x670e-compat.txt index 826fc61016..321ae5dc11 100644 --- a/.omo/evidence/task-5-ryzen-7000-x670e-compat.txt +++ b/.omo/evidence/task-5-ryzen-7000-x670e-compat.txt @@ -141,3 +141,18 @@ RUST DISCIPLINE: - Kernel code uses log macros (debug!, warn!, error!) with structured messages NOTE (2026-08-05, orchestrator): the standalone test crate is now DURABLE at local/sources/kernel/host-tests/madt-normalize/ (15/15 GREEN re-verified). Run: cargo test --manifest-path local/sources/kernel/host-tests/madt-normalize/Cargo.toml + +REGRESSION + REMEDY RECORD (2026-08-05, QEMU verification) +========================================================== +The todo-5 acceptance "kernel boots in QEMU with all CPUs" caught a +scheme-contract regression the host-mirror tests could not see: +(1) the cpu- path parse rewrite (split_once consuming the separator) broke + /scheme/irq/cpu-XX/ creation — ENOENT on every vector create, + panicking xhcid and virtio-netd with "no interrupt vectors left"; +(2) the listing format was changed from upstream cpu-{:02x} to cpu-{:x} + (upstream scheme-contract divergence). +Remedy: kernel 88ca99c1 (parse fix) + 46ea4fac (listing reverted to +upstream {:02x}; parse accepts any width). Boot-verified 2026-08-05: +xhcid IRQ reactor + device enumerator running, virtio-netd on MSI-X, +zero panics, 24 CPUs (-smp 24). Policy: upstream scheme compatibility +is now ABSOLUTE (root AGENTS.md § SCHEME COMPATIBILITY POLICY). diff --git a/.omo/plans/ryzen-7000-x670e-compat.md b/.omo/plans/ryzen-7000-x670e-compat.md new file mode 100644 index 0000000000..92e2f8e3be --- /dev/null +++ b/.omo/plans/ryzen-7000-x670e-compat.md @@ -0,0 +1,482 @@ +# ryzen-7000-x670e-compat - Work Plan + +## TL;DR (For humans) + + + +**What you'll get:** Red Bear OS booting to a usable desktop-class system on your Ryzen 9 7900X / MSI X670E machine — storage, USB, wired 2.5GbE, MediaTek Wi-Fi and Bluetooth, the AMD integrated GPU driving a monitor, audio, and CPU power management — plus a documented compatibility plan and a set of platform improvements (PCI resource allocation, ACPI hardening, CPU enumeration, timers) that make every future bare-metal machine easier to support. + +**Why this approach:** Almost everything the machine needs already exists in some form — the plan maps each device to the closest working code and ports only the gaps from the Linux 7.1 reference (which we have on disk), in the same architecture the Intel Wi-Fi port already proved. Two load-bearing calls: the PCI resource allocator lives in the existing userspace PCI daemon (the firmware on this board leaves address conflicts that must be repaired, not ignored), and the display work goes probe-first — the current AMD display glue has the wrong memory model for the integrated GPU, so we verify the real hardware layout before porting the small DCN315 display slice instead of shipping a known-broken path. + +**What it will NOT do:** No NVIDIA GPU support. No suspend/sleep (desktop — shutdown and reboot only). No 3D acceleration, Mesa, or KWin work (stays in the 3D plan). No TPM, watchdog, RGB/AIO, or vendor-gadget drivers (documented as no-consumer deferrals). Nothing is deleted or disabled to make things pass. + +**Effort:** XL +**Risk:** High - three genuinely hard ports (PCI allocator, MT7922 Wi-Fi, DCN315 display) each carry real-hardware unknowns; gates catch failure early. +**Decisions to sanity-check:** the mt76 C-transport exemption amendment (mirrors the approved Intel Wi-Fi one); probe-gating the DCN315 port rather than shipping the existing AMD glue; PS/2 becoming fully optional (no-op on boards without a controller, kept everywhere else). + +Your next move: the plan runs the dual high-accuracy review (Momus + independent Oracle) before handoff, per your request. Full execution detail follows below. + +--- + +> TL;DR (machine): XL effort, high risk, 41 todos + 4 final verifiers; deliverables = durable compat doc, Gate A (minimally usable) + Gate B (full) bare-metal passes on MS-7D70, universal PCI/ACPI/IRQ/threading groundwork, r8125d + mt7922 + btmtk + DCN315 + platform drivers. + +## Scope +### Must have +1. Durable compatibility doc `local/docs/RYZEN-7000-X670E-COMPATIBILITY-PLAN.md` mirroring the LG GRAM plan structure (host profile, device-by-device matrix, boot-path analysis, phased plan, dependency graph, out-of-scope), plus a `quirks.d/50-system.toml` MS-7D70 DMI profile and MS-7D70 `[AVAILABLE]` annotations on the relevant HARDWARE-VALIDATION-MATRIX component rows. +2. Boot substrate on the X670E host: normalized MADT (types 0/4/5/9/A) in the kernel fork, bare-metal TSC calibration, bounded S5 + FADT reset-reg reboot, ps2d fully optional (no-i8042 boards are the norm), threading substrate validation (park/unpark, RwLock::write, thread::scope — the currently-unvalidated primitives). +3. **ACPI/acpid hardening — continuing the ACPICA-to-Rust port program** (LG plan §2.3 verdict: port ACPICA's algorithms/data structures into the acpi-rs vendored fork + acpid, never the C library): RSDP producer contract, GPE dispatch model with storm handling (evgpe.c reference), power-resource engine (_PR0/_PR3/_STA/_ON/_OFF) for GPP7-class trees, namespace-wide wake enumeration, _OSC platform negotiation + _REG opregion-connect wiring, AMD-Vi IRTE/MSI integration. +4. PCI resource safety: fail-closed resource auditor in pcid + transactional cold-plug BAR/bridge-window allocator (firmware conflicts like AMDIF031@0xfb300000 must be repaired, not stomped) + segment-aware MCFG handling. +5. Storage: NVMe HMB (FID 0x0D) for the ADATA drive, UAS (protocol 0x62) dispatch wiring in usbscsid, xHCI quirk parity for the board's five controllers. +6. Wired network: new `redbear-r8125d` Rust driver for RTL8125 2.5GbE (rtl8168d explicitly cannot bind it) with rtl_nic firmware via firmware-loader. +7. Wi-Fi: new `redbear-mt7922` — bounded mt76 C transport (WFDMA/Connac/MCU mailbox/reset) via the formalized linux-kpi mt76 exemption (todo 24) + Rust SoftMAC/supplicant control layer + redbear-wifictl backend; firmware `mediatek/WIFI_RAM_CODE_MT7922_1.bin` + `mediatek/WIFI_MT7922_patch_mcu_1_1_hdr.bin`. +8. Bluetooth: `redbear-btusb` btmtk module (WMT protocol, `BT_RAM_CODE_MT7922_1_1_hdr.bin`, 0x0E8D probing) + Wi-Fi/BT coexistence validation. +9. Display: GOP/vesad interim console (unchanged), read-only Raphael probe (BAR roles, IP discovery, ATOM, firmware inventory), Raphael firmware staging, minimal DCN315 display slice lighting up one HDMI/DP monitor on the iGPU. +10. Platform: AMD CPPC cpufreq path (correct MSR set 0xC00102B0–0xC00102B5, CPUID 0x80000008:EBX[27]), k10temp for 1022:14e3, `redbear-smbusd` for 1022:790b, gpio-amdpt for AMDIF031 (ACPI-launched), ihdad widened to AMD HDA 1022:15e3. +11. Every new `redbear-*` recipe wired into a config (first-class-citizen policy); all work durable (fork commits or local/recipes, never recipe-source-only). + +### Must NOT have (guardrails, anti-slop, scope boundaries) +- NO NVIDIA GPU work (10de:2704) — explicitly excluded by the operator. +- NO removal/ignore/comment-out of any existing package, patch, BINS entry, or service to make anything pass (ABSOLUTE RULE). +- NO stubs, fake headers, `#ifdef` no-ops, sed/awk hacks, "temporary" shortcuts — missing functionality is implemented in the correct component (zero-tolerance policy). +- NO new Gitea repos, NO new git branches, NO new submodules (single-repo + branch policy; all work on `0.3.2` release branch and existing `submodule/` branches). +- NO new C in this program's baseline diffs outside the operator-approved exemptions formalized in todo 24 (linux-kpi mt76 transport; amdgpu/DCN315 display slice bounded to the closure-recorded surface) — the pre-existing iwlwifi exemption and inherited C stay as-is; all other new logic in Rust. +- NO import of Linux mac80211/cfg80211 as the control plane (the MLME is implemented in Rust, shaped on mac80211 ops — see the SoftMAC bullet above). +- NO shipping of the current bounded AMD direct-register glue on Raphael (BAR roles are architecturally wrong for the APU); display work follows probe→firmware→DCN315-slice. +- NO FullMAC assumption for MT7922: it is a mac80211 SoftMAC device — the control plane is a bounded **Rust** SoftMAC/MLME (scan/auth/assoc/key/regulatory/aggregation policy); the C exemption covers ONLY DMA rings, firmware transfer, MCU mailbox, and reset. +- NO suspend/sleep deliverable (desktop target: S5 shutdown + reboot only; S3/s2idle stays in ACPI-IMPROVEMENT-PLAN). +- NO TPM/sp5100-watchdog/PSP/EDAC/MSI-vendor-HID drivers (documented no-consumer deferral). +- NO atomic-KMS/Mesa/radeonsi runtime work (belongs to 3D-DESKTOP-COMPREHENSIVE-PLAN; this plan ends at legacy modeset + framebuffer). +- NO copied Linux/ACPICA implementation code anywhere in the tree — Linux (GPL-2.0) and ACPICA are **reference only** per the project's LINUX REFERENCE SOURCE POLICY: all ported logic is an original reimplementation in the target component, using the Linux source to understand behavior/registers/protocols. The ONLY exception is the documented firmware-ABI header surface inside the two todo-24 C exemptions (register/struct layouts that must match the firmware ABI byte-for-byte). F2/F4 audit provenance on every ported file. +- NO `repo cook`/`make live`/`cargo check --target` as build substitutes — canonical `./local/scripts/build-redbear.sh` only. + +## Verification strategy +> Automated checks are agent-executed with zero human intervention; bare-metal boots and interactive hardware actions (booting the ISO, HPD plug cycles) are explicitly operator-assisted, with the agent providing the exact command and the packaged checker. +- Test decision: **tests-first for new pure-logic protocol/parsing code** (MADT normalization, HMB descriptor builder, r8125 PHY/MAC tables + firmware-action parser, mt76 ROM-patch/WMT parsers, SoftMAC/EAPOL vectors, PCI allocator planner, CPPC/k10temp/SMBus register logic) via host `cargo test` (the sanctioned host-unit-test path); **tests-after acceptable for MMIO/driver-bound code** where host tests cannot run; **canonical build is the compile gate** for every todo. +- Compile gate (every code todo): `./local/scripts/build-redbear.sh --check-sweep redbear-mini` for fork changes, or the canonical build for the affected config; recipe changes verified through the canonical build of `redbear-mini` (substrate) and `redbear-full` (display/audio/firmware wiring). +- Runtime gates: QEMU bounded proofs where a QEMU analogue exists (`local/scripts/test-lowlevel-controllers-qemu.sh`, `test-usb-maturity-qemu.sh`, `test-vm-network-qemu.sh`, QEMU `usb-uas` device for UAS); bare-metal gates on the MS-7D70 host via packaged in-guest checkers (pattern: `redbear-phase5-wifi-check`; the Gate A checker from todo 23 and Gate B checker from todo 40 are named binaries built from those patterns) with logs archived to `local/docs/evidence/ryzen-x670e/`. +- **Project validation gates**: after every image build used for a gate, run and archive `make validate CONFIG_NAME=redbear-mini` (Gate A path) and `make validate CONFIG_NAME=redbear-full` (Gate B path) — the project's own lint-config + init-service + file-ownership validation; a failed `make validate` blocks the gate exactly like a failed build; outputs archived beside the gate evidence. +- Evidence: `.omo/evidence/task--ryzen-7000-x670e-compat.` per todo (test output, build log tail, QEMU transcript, bare-metal log path). + +## Execution strategy +### Parallel execution waves +> Wave 0 is fully parallel EXCEPT the ten-SHA baseline snapshot (todo 3's `baselines.toml`), which is a serial pre-Wave-0 coordinator action taken before any other todo commits. Waves 1-2 are kernel/pcid-internal (parallel with each other). Wave 6's runtime gates onward serialize behind bare-metal Gate A; earlier code work proceeds per the dependency matrix. + +| Wave | Todos | Theme | +|---|---|---| +| 0 | 1-4 | Durable doc, quirk profile, evidence capture, validation matrix row | +| 1 | 5-8,41 | Boot substrate: MADT, TSC, S5/reboot, ps2d fully optional, threading validation | +| 2 | 9-14 | ACPI/acpid + ACPICA port: RSDP contract, GPE dispatch, power-resource engine, wake enum, _OSC/_REG, AMD-Vi IRTE | +| 3 | 15-17 | PCI auditor, cold-plug allocator, MCFG segment handling | +| 4 | 18-20 | Storage + USB: NVMe HMB, UAS wiring, xHCI quirk parity | +| 5 | 21-24 | Wired: r8125d core, PHY/firmware, policy commits, integration + Gate A | +| 6 | 25-28 | Wi-Fi: mt76 C transport, Rust SoftMAC, firmware, wifictl + bounded ladder | +| 7 | 29-34 | BT btmtk + Raphael probe + firmware + coexistence + DCN315 slice + modeset gate | +| 8 | 35-39 | Platform: HDA, CPPC, k10temp, SMBus, GPIO, deferred-docs | +| 9 | 40 | Gate B + matrix finalization | + +### Dependency matrix +| Todo | Depends on | Blocks | Can parallelize with | +| --- | --- | --- | --- | +| 1 compat doc | — | (informs all) | 2,3,4 | +| 2 DMI quirk profile | — | 20 | 1,3,4 | +| 3 evidence capture | — | 15,30 | 1,2,4 | +| 4 matrix row | — | — | 1,2,3 | +| 5 MADT normalization | — | 23 (Gate A) | 6-14,41 | +| 6 TSC calibration | — | 23 | 5,7-14,41 | +| 7 S5/reboot bounded | — | 23 | 5,6,8-14,41 | +| 8 ps2d fully optional | — | 23 | 5-7,9-14,41 | +| 41 threading substrate validation | — | — | 5-8 | +| 9 RSDP producer contract | — | 40 | 5-8,10-14 | +| 10 GPE dispatch hardening (evgpe port) | — | 11,12,13,40 | 5-9,14 | +| 11 power-resource engine (_PR0/_PR3) | 10 | 40 | 5-9,12-14 | +| 12 wake/_PRW namespace enum | 10 | 40 | 5-9,11,13,14 | +| 13 _OSC + _REG opregion wiring | 10 | 40 | 5-9,11,12,14 | +| 14 AMD-Vi IRTE structural correction | — | 23 | 5-13 | +| 15 PCI auditor | 3,10 | 16 | 9-14,17 | +| 16 cold-plug allocator | 15,17 | 23 | — | +| 17 MCFG segment handling | — | 16 | 15 | +| 18 NVMe HMB | — | 23 | 19,20 | +| 19 UAS wiring | — | 23 | 18,20 | +| 20 xHCI quirk parity | 2 | 23 | 18,19 | +| 21 r8125d core | — | 22 | 18-20 | +| 22 r8125d PHY+firmware+integration | 21,24 | 23 | — | +| 23 net integration + Gate A | 5,6,7,8,14,16,18,19,20,22 | 28 | — | +| 24 policy commits (mt76 + DCN315 + firmware) | — | 22,25,27,31,33 | any (policy-only) | +| 25 mt76 C transport | 24 | 26 | 30,31 | +| 26 mt7922 Rust SoftMAC control | 25 | 27 | 30,31 | +| 27 mt7922 firmware + wifictl | 24,26 | 28,29 | 30,31 | +| 28 Wi-Fi bounded ladder BM | 23,27 | 32 | 30,31 | +| 29 btusb btmtk module | 23,27 | 32 | 30,31 | +| 30 Raphael probe (read-only) | 3 | 33 | 25-29,31 | +| 31 Raphael firmware staging | 24 | 33 | 25-30 | +| 32 Wi-Fi+BT coexistence BM | 28,29 | 40 | 30,31,33 | +| 33 DCN315 display slice | 24,30,31 | 34 | 32 | +| 34 iGPU modeset gate BM | 23,33 | 40 | — | +| 35 ihdad AMD widening | — | 40 | 36-39 | +| 36 AMD CPPC cpufreq | — | 40 | 35,37-39 | +| 37 k10temp driver | — | 40 | 35,36,38,39 | +| 38 redbear-smbusd + gpio-amdpt | 10,15 | 40 | 35-37,39 | +| 39 deferred-docs table | — | 40 | 35-38 | +| 40 Gate B + matrix final | 9,10,11,12,13,23,28,32,34,35,36,37,38,39 | F1-F4 | — | + +## Todos +> Implementation + Test = ONE todo. Never separate. + +- [x] 1. Author `local/docs/RYZEN-7000-X670E-COMPATIBILITY-PLAN.md` (durable compatibility plan doc) + What to do / Must NOT do: Write the canonical host compatibility plan for the MSI MPG X670E CARBON WIFI (MS-7D70) + Ryzen 9 7900X, mirroring `local/docs/LG-GRAM-16Z90TP-COMPATIBILITY-PLAN.md` structure: §1 host profile (from the Linux 7.1.4 dmesg: AMI BIOS 1.74, 12C/24T Zen4, X670E dual-Promontory, 64GB, Raphael iGPU target, NVIDIA excluded), §2 device-by-device support matrix using THIS plan's assessed verdicts (✅/🟡/❌ per device with evidence paths), §3 boot-path analysis (UEFI→bootloader→kernel→pcid→driver-manager→login, including the no-i8042 and PCI-conflict callouts), §4 multiphase plan (phases = waves 1-8 of this work plan), §5 dependency graph, §6 execution order, §7 out-of-scope. Mark the DCN 3.1.5 correction, the RTL8125-not-r8168 fact, and the mt7921-family (not iwlwifi) fact prominently. Must NOT: copy the LG plan's Intel-specific content; claim runtime validation that has not happened (evidence language: compile-visible ≠ QEMU-bounded ≠ hardware-validated). + Parallelization: Wave 0 | Blocked by: — | Blocks: informs all later work + References (executor has NO interview context - be exhaustive): `local/docs/LG-GRAM-16Z90TP-COMPATIBILITY-PLAN.md` (template, 574 lines); `.omo/drafts/ryzen-7000-x670e-compat.md` (all findings, citations, Oracle verdicts); `local/docs/HARDWARE-VALIDATION-MATRIX.md`; machine dmesg (in conversation; key IDs: 1022:14d8/14d9, 1022:43f4/43f5/43f6/43f7, 1022:15b6/15b7/15b8, 1022:15e3, 1022:1649, 1022:790b/790e, 10ec:8125, 14c3:0616, 1cc1:5766, 144d:a80c, 1002:164e) + Acceptance criteria (agent-executable): `test -s local/docs/RYZEN-7000-X670E-COMPATIBILITY-PLAN.md && grep -c '^### PHASE' local/docs/RYZEN-7000-X670E-COMPATIBILITY-PLAN.md` ≥ 7; `grep -q 'DCN 3.1.5' file && grep -q 'redbear-r8125d' file && grep -q 'redbear-mt7922' file`; no Intel-only leftovers (`! grep -q 'BE201\|8086:7740' file`). + QA scenarios (name the exact tool + invocation): happy: `grep -E '10ec:8125|14c3:0616|1002:164e|1022:15e3|1022:790b' local/docs/RYZEN-7000-X670E-COMPATIBILITY-PLAN.md | wc -l` ≥ 5. failure: doc missing a device row for any dmesg PCI ID → add before commit. Evidence `.omo/evidence/task-1-ryzen-7000-x670e-compat.md` + Commit: Y | docs(plan): add Ryzen 7000 / X670E host compatibility plan + +- [x] 2. Add MS-7D70 DMI quirk profile to redbear-quirks + What to do / Must NOT do: Add a `[[dmi_system_quirk]]` entry for this board to `local/recipes/system/redbear-quirks/source/quirks.d/50-system.toml` (category **system** — the `redbear-quirks` crate owns the TOML set and installs to `/etc/quirks.d/`; `redox-driver-sys` is the consumer), using the existing schema: exact-match semantics with `match.sys_vendor = "Micro-Star International Co., Ltd."` + `match.board_name = "MS-7D70"` (per DMI line "Micro-Star International Co., Ltd. MS-7D70/MPG X670E CARBON WIFI (MS-7D70)"), appended below the existing entries. Carry only evidence-justified flags (start conservative: none — the profile is the anchor for future per-board flags discovered during bare-metal gates). Add a host unit test in `local/recipes/drivers/redox-driver-sys/source/src/quirks/` proving the entry parses, matches a synthetic MS-7D70 DMI blob, and does NOT match an LG 16Z90TP blob. Must NOT: invent flags without evidence (quirks are data, not speculation); store the DMI TOML profile anywhere under `local/recipes/drivers/` (wrong category — Metis B2; the consumer TEST in `redox-driver-sys` lives there by design and is explicitly permitted); touch other board entries. + Parallelization: Wave 0 | Blocked by: — | Blocks: 20 + References: `local/recipes/system/redbear-quirks/source/quirks.d/50-system.toml` (existing entries incl. LG 16Z90TP); `local/recipes/drivers/redox-driver-sys/source/src/quirks/dmi.rs:28-94` (exact-match semantics); `local/docs/QUIRKS-SYSTEM.md:334-390` (board-profile procedure); dmesg DMI line + Acceptance criteria: `cargo test --manifest-path local/recipes/drivers/redox-driver-sys/source/Cargo.toml quirks` passes with the new test; `./local/scripts/build-redbear.sh --check-sweep redbear-mini` clean. + QA scenarios: happy: new unit test GREEN. failure: TOML parse error or non-exact match → test RED until fixed. Evidence `.omo/evidence/task-2-ryzen-7000-x670e-compat.txt` + Commit: Y | feat(quirks): add MS-7D70 (X670E CARBON WIFI) DMI profile + +- [x] 3. Host evidence capture kit for the X670E machine + What to do / Must NOT do: Create the host evidence capture kit — implemented as a small **Rust** host-side utility (`local/scripts/capture-host-evidence/` cargo bin — the project's Rust-only rule applies to operational tooling; shell is permitted only for build glue, and this is not build glue) that runs on the Linux host read-only and collects into `local/docs/evidence/ryzen-x670e/`: `lspci -nnvvv -xxx`, `cat /proc/iomem`, `sudo acpidump -b` (all tables: MADT, MCFG, IVRS, FADT, DSDT, SSDT, HPET, WDRT, TPM2, CRAT, CDIT), `dmidecode`, `lsusb -t`, `/sys/kernel/debug/usb/devices`, **`nvme id-ctrl` for BOTH NVMe drives (raw HMPRE/HMMIN/HMMINDS/HMMAXD fields — Gate A's HMB assertion depends on whether the ADATA controller even offers HMB)**, MADT type-0-vs-type-9 record inventory (the Rust tool parses the acpidump binary itself), bridge-window/BAR topology dump, loaded firmware list (`ls /lib/firmware/amdgpu /lib/firmware/mediatek /lib/firmware/rtl_nic`), Raphael IP-discovery-relevant lines (`sudo dmesg | grep -iE 'amdgpu|drm'`), `/proc/cpuinfo` invariant-TSC flag. **Also:** operator enables the iGPU in BIOS (it is disabled when the dGPU is primary — the provided dmesg has no 1002:164e), then captures GOP/display mode info (`sudo dmesg | grep -iE 'amdgpu|drm|fb|efifb'`, `cat /sys/class/graphics/fb0/virtual_size 2>/dev/null`, `lspci -nnvvv -s ` with full BAR dump + `setpci` extended config) — this is the hard prerequisite for every display todo (vesad needs a GOP framebuffer; the DCN315 port needs the true BAR topology). **Also record the review/QA baselines: `git rev-parse HEAD` for the parent repo and each of the 9 `submodule/` branches → committed as `baselines.toml` (F2's immutable diff baseline).** **Ordering: the ten-SHA baseline snapshot is the program's FIRST action — a serial pre-Wave-0 coordinator step taken before ANY implementation todo commits, so no landed work escapes the F2 diff baseline.** **Evidence hygiene (mandatory):** raw `acpidump -b` binaries and any unredacted dumps are stored OUTSIDE the workspace in an operator-controlled path (`~/redbear-evidence-raw/`, never inside the repo — F2 requires a clean `git status --short` in every repo); the repo receives only decompiled (iasl) + allowlist-redacted excerpts, SHA-256 hashes of the raw tables, and a `RAW-MANIFEST.md` mapping hash → raw path; strip serial numbers, UUIDs, MAC addresses, and host identifiers from `dmidecode`/`lspci`/`dmesg` output; run an automated secret/identifier scan (UUID/serial/MAC patterns) over the evidence dir BEFORE committing — machine identity must not enter git. The committed artifacts feed todos 15, 16, 30, 33. Must NOT: modify the host; require Red Bear to run it (it runs on Linux Manjaro already on the machine); store raw binary ACPI tables or unredacted dumps anywhere inside the workspace. + Parallelization: Wave 0 | Blocked by: — | Blocks: 15, 30 + References: `local/scripts/test-baremetal.sh` (style); `local/docs/HARDWARE-NETWORKING-INVENTORY.md`; Linux 7.1 `drivers/pci/setup-bus.c` (what topology data the allocator needs); Oracle finding: AMDIF031 conflict at 0xfb300000 must be visible in /proc/iomem + lspci + Acceptance criteria: the Rust tool runs on the host producing all artifacts non-empty (`cargo run --manifest-path local/scripts/capture-host-evidence/Cargo.toml`); its MADT analysis reports the actual record types present on THIS firmware (types 0/1/2 expected, 4/9/A reported); `local/docs/evidence/ryzen-x670e/iomem.txt` shows the 0xfb300000 AMDIF031 region; `baselines.toml` records 10 SHAs; the secret scan reports zero identifier hits on committed files. + QA scenarios: happy: artifacts committed, `wc -l` each > 0, MADT analysis names record types. failure: acpidump unavailable → document `iasl`/`acpidump` install step in script header; partial artifacts marked MISSING in README inside evidence dir. Evidence `.omo/evidence/task-3-ryzen-7000-x670e-compat.md` + Commit: Y | feat(scripts): Rust X670E host evidence capture kit + initial artifacts + +- [x] 4. HARDWARE-VALIDATION-MATRIX entry for MS-7D70 + What to do / Must NOT do: The matrix (`local/docs/HARDWARE-VALIDATION-MATRIX.md`) has no per-host row schema — it is a component table using `[AVAILABLE] (host: ...)` parentheticals (the LG Gram convention). Follow that existing convention: annotate the relevant component rows with `[AVAILABLE] (MS-7D70: ...)` markers listing what is testable on this host, and state the update rule (refresh at every gate: 23, 28, 32, 34, 40). Must NOT: invent a new schema without need; mark anything QEMU- or BM-validated that has not run. + Parallelization: Wave 0 | Blocked by: — | Blocks: — + References: `local/docs/HARDWARE-VALIDATION-MATRIX.md` (existing `[AVAILABLE]` convention); Metis finding M1 (no host-row schema exists); evidence-language rule from root AGENTS.md (compile-visible ≠ QEMU-bounded ≠ hardware-validated) + Acceptance criteria: `grep -q 'MS-7D70' local/docs/HARDWARE-VALIDATION-MATRIX.md`; markers contain explicit `compile` / `—` levels only. + QA scenarios: happy: markers present with honest levels. failure: any cell claims runtime proof → downgrade. Evidence `.omo/evidence/task-4-ryzen-7000-x670e-compat.md` + Commit: Y | docs(matrix): annotate MS-7D70 availability (compile-only baseline) + +- [x] 5. Kernel MADT normalization (types 0/4/5/9/A, dedup, NMI, IrqScheme fix) + What to do / Must NOT do: In `local/sources/kernel/` (submodule/kernel branch): (a) extend `src/acpi/madt/mod.rs` to parse type 0x4 (LAPIC NMI), 0x5 (LAPIC Address Override), 0x9 (x2APIC), 0xA (x2APIC NMI) instead of falling to `Unknown`; (b) build ONE normalized processor table {32-bit APIC ID, ACPI UID, enabled/online-capable flags, logical CPU id} consumed by both SMP startup (`madt/arch/x86.rs`) and `IrqScheme::init()` (`src/scheme/irq.rs:109`, currently type-0-only u8 collection); (c) deduplicate compatible type-0+type-9 records **by matching ACPI UID only** — full 32-bit APIC-ID uniqueness is always retained (records with equal low-8 APIC-ID bytes but different UIDs, e.g. `0x000` vs `0x100`, are DISTINCT CPUs and must both start); type-9 (x2APIC) wins when the same UID appears in both record types; conflicting UID→APIC-ID mappings are logged loudly; never double-start; (d) pre-scan type-5 override before LAPIC mapping/AP startup; (e) apply type-4/0xA LINT NMI config per-CPU during LAPIC init (BSP and each AP), honoring `acpi_irq1_skip_override` consumer wired in LG work; (f) the parser MUST reject records shorter than 2 bytes and guarantee iterator progress on malformed input (no zero-length stall). First step: establish the fork's current MADT state (`git -C local/sources/kernel log --oneline -- src/acpi/madt/ src/scheme/irq.rs`) and whether `P1-ioapic-hpet-nmi.patch` content is already present — reconcile, don't re-add. Must NOT: absorb `P1-ioapic-hpet-nmi.patch` wholesale (it double-starts duplicated CPUs and applies override mid-iteration — port the logic into the normalized path instead); panic on malformed records (log + skip). + Parallelization: Wave 1 | Blocked by: — | Blocks: 23 (Gate A) + References: `local/sources/kernel/src/acpi/madt/mod.rs:149-228` (current parser); `local/sources/kernel/src/acpi/madt/arch/x86.rs:64-138` (SMP startup, x2 SIPI); `local/sources/kernel/src/scheme/irq.rs:109` (type-0-only); `local/sources/kernel/src/arch/x86_shared/device/local_apic.rs:52-79` (x2 enable); `local/patches/kernel/` (P1 patch to mine for intent, not to apply); task-3 MADT dump (which record types THIS board emits); Linux 7.1 `arch/x86/kernel/acpi/boot.c` (reference behavior) + Acceptance criteria: host-side table-driven tests (new `#[cfg(test)]` in kernel crate or a host-runnable parsing module) covering: type-0-only, type-9-only, mixed-duplicate (same UID in both types → single CPU, type-9 wins), **same-low-byte-different-UID (`0x000` vs `0x100`) → two distinct CPUs (non-dedup test)**, >255-APIC-ID synthetic tables, NMI record application, malformed sub-2-byte records (assert progress + skip) — all GREEN; `./local/scripts/build-redbear.sh --check-sweep redbear-mini` clean; canonical `./local/scripts/build-redbear.sh redbear-mini` builds the kernel. + QA scenarios: happy: synthetic mixed/duplicate MADT test passes; kernel boots in QEMU with all CPUs (`make qemu` boot log shows 24 CPUs under `-smp 24`). failure: duplicate CPU start or missing NMI → test RED, fix normalization. Evidence `.omo/evidence/task-5-ryzen-7000-x670e-compat.txt` + Commit: Y | feat(kernel): normalize MADT topology (x2APIC/NMI/override, dedup) + +- [x] 6. Bare-metal TSC calibration (CPUID invariant-TSC + HPET/PM-timer fallback) + What to do / Must NOT do: In `local/sources/kernel/`: implement bare-metal TSC frequency calibration **entirely inside the kernel** (early boot has no acpid userspace endpoint — the PM-timer fallback must read the FADT-derived I/O port via the kernel's own ACPI parse, and the HPET fallback uses the kernel-mapped HPET main counter): preference order — CPUID 0x15 (crystal-clock ratio, VALIDATED against a short HPET measurement window) → HPET-measured calibration → FADT PM-timer-measured calibration; CPUID 0x16 (nominal frequency) is a checked hint only, never the source of truth; **invariant-TSC detection via CPUID 0x80000007:EDX bit 8** gates whether TSC becomes the clocksource at all; keep HPET/PIT as clocksource when TSC is unstable; fix the HPET rollover TODO at `time.rs:19`. **Verification must exercise the new path, not the retained KVM pvclock path**: add forced test modes (kernel cmdline/build flag) selecting each calibration source with pvclock explicitly disabled — one boot per source (CPUID.15, HPET, PM-timer). Gate A asserts the calibration source actually used on bare metal and the measured drift. Must NOT: remove the KVM pvclock path; depend on userspace for calibration; use spin-count approximations as a permanent solution. + Parallelization: Wave 1 | Blocked by: — | Blocks: 23 (Gate A asserts calibration source + drift) + References: `local/sources/kernel/src/arch/x86_shared/device/tsc.rs:58-159` (KVM-only today); `local/sources/kernel/src/arch/x86_shared/time.rs:4-49` (monotonic source, rollover TODO); `local/sources/kernel/src/arch/x86_shared/device/hpet.rs:25-72`; `local/sources/base/drivers/acpid/src/gpe.rs:15-23` (PM timer reader); Linux 7.1 `arch/x86/kernel/tsc.c` `native_calibrate_tsc()` (reference); CPUID leaves 0x15/0x16 semantics (Intel SDM / AMD PPR) + Acceptance criteria: kernel boot log in QEMU prints a calibrated TSC frequency within 1% of expected **in each forced-source mode (CPUID.15, HPET, PM-timer, pvclock disabled)** — forced modes use QEMU CPU/machine parameters that actually expose the forced source (`-cpu host`/explicit flags for CPUID.15, `-machine hpet=on` for the HPET path, ACPI PM timer for the third), and a forced mode whose source is unavailable FAILS LOUDLY (it never silently falls back — a fallback would mask a broken calibration path); `/scheme/time/CLOCK_MONOTONIC` drift check (two reads 10s apart vs QEMU host wall clock) within 50ms/10s in each mode; canonical build of kernel succeeds. + QA scenarios: happy: calibration log line + drift < 50ms/10s per forced mode in QEMU. failure: no CPUID leaves → HPET calibration path exercised and logged. Evidence `.omo/evidence/task-6-ryzen-7000-x670e-compat.txt` + Commit: Y | feat(kernel): bare-metal TSC calibration with HPET fallback + +- [x] 7. acpid: bounded S5 + FADT reset-register reboot + 8042 fallback + What to do / Must NOT do: In `local/sources/base/drivers/acpid/`: (a) make `set_global_s_state(5)` bounded — after the PM1 write, wait a BOUNDED delay (5 s); if the machine has not transitioned, log loudly and execute the NAMED terminal fallback: FADT `reset_reg`/`reset_value` reboot (so the machine never sits dead in a spin), and if the reset register is absent/fails, the 8042 keyboard-controller pulse (0x64/0xFE); only if every mechanism fails, halt with a distinct error state and serial log — never an unbounded silent spin (`acpi.rs:1226-1230`); (b) implement reboot via FADT `reset_reg`/`reset_value` (already parsed at `acpi.rs:1890-1892`) with the 8042 pulse as fallback; (c) keep the kstop/shutdown eventing intact. Must NOT: change the \_S5 AML evaluation path; weaken the existing GPE/EC work; leave any path that spins forever without a named outcome. + Parallelization: Wave 1 | Blocked by: — | Blocks: 23 + References: `local/sources/base/drivers/acpid/src/acpi.rs:1060-1231` (S5 path, spin), `:1890-1892` (reset_reg parse); `local/docs/ACPI-IMPROVEMENT-PLAN.md:380-429` (required fixes); Linux 7.1 `drivers/acpi/reboot.c` (reference) + Acceptance criteria: canonical build; QEMU: `redbear-mini` guest `poweroff` exits QEMU (no hang) and `reboot` re-enters firmware boot; a forced-failure QA (point SLP_TYP at invalid value in a test build — do NOT ship) demonstrates the bounded delay → reset-register fallback fires with the named log line, and the machine resets instead of spinning. + QA scenarios: happy: QEMU poweroff/reboot both terminate/reset cleanly. failure: PM1 write rejected (QA build) → bounded timeout + fallback log captured. Evidence `.omo/evidence/task-7-ryzen-7000-x670e-compat.txt` + Commit: Y | fix(acpid): bounded S5 failure + reset-reg/8042 reboot path + +- [ ] 8. ps2d: make PS/2 support fully optional (zombie-daemon + kernel IRQ wiring fix) + What to do / Must NOT do: Two coordinated fixes with ONE kernel-owned presence verdict (probing twice independently invites false positives on floating legacy I/O ports). (a) **kernel fork** (`local/sources/kernel/`): derive the i8042 presence verdict ONCE from sources the early kernel can actually consult — the kernel has SDT/FADT parsing but NO AML namespace interpreter, so an ACPI PNP inventory (PNP0303/PNP0F13) is NOT available at early IRQ-wiring time: verdict = FADT `IA_PC_BOOT_ARCH` 8042 flag (primary) + a bounded active controller probe (self-test command with timeout, fallback when the flag is ambiguous); wire IRQ1/IRQ12 → serio ONLY when the verdict is present; expose the verdict on the kernel serio scheme (e.g. `/scheme/serio/present`). acpid may refine later once AML is up (mask/unmask), but the early wiring decision is kernel-local. (b) **ps2d** (`local/sources/base/drivers/input/ps2d/src/main.rs`): replace the `.expect()` startup with a read of the kernel verdict — if absent, log ONE info line ("no PS/2 controller present; USB HID is the input path") and exit 0 (no respawn, init treats it as success). Boards WITH an i8042 keep the full current behavior. Host-runnable tests for the verdict matrix. Must NOT: remove ps2d from any config or BINS (ABSOLUTE RULE); probe the controller twice (kernel and ps2d must share the verdict); add retries/warning noise on absence; gate usbhidd behind ps2d. + Parallelization: Wave 1 | Blocked by: — | Blocks: 23 + References: `local/sources/base/drivers/input/ps2d/src/main.rs:53,68` (the expects); `local/sources/kernel/src/scheme/{mod.rs,serio.rs}` + IRQ wiring (`irq.rs` IRQ1/IRQ12 handlers); `local/sources/kernel/src/acpi/fadt.rs` (FADT parse — add IA_PC_BOOT_ARCH); `local/sources/base/init.initfs.d/` + `init.d/` ps2d services; machine dmesg ("i8042: PNP: No PS/2 controller found"); user directive 2026-08-04; Oracle review (presence-verdict design) + Acceptance criteria: canonical build; QEMU regression (i8042 present): PS/2 keyboard works; absence QA (QA-only FADT-flag-cleared + PNP-less fixture — not shipped): kernel does not wire IRQ1/12, ps2d exits 0 with one info line, init reaches login on USB HID; verdict matrix host tests GREEN. + QA scenarios: happy: no-i8042 boot reaches login on USB HID, one info line, zero spurious serio input. failure: false-positive presence (floating ports fixture) → verdict must still say absent (ACPI/flag precedence wins). Evidence `.omo/evidence/task-8-ryzen-7000-x670e-compat.txt` + Commit: Y | fix(ps2d): fully optional PS/2 — kernel-owned presence verdict + conditional IRQ wiring + +- [ ] 41. Threading substrate validation: park/unpark, RwLock::write, thread::scope on bare metal + What to do / Must NOT do: Build a stress validation suite for the threading primitives currently marked UNVALIDATED on the Redox target (`local/docs/PACKAGE-BUILD-QUIRKS.md` § `std::thread::scope`), shipped as a new `redbear-threadtest` recipe wired into `config/redbear-mini.toml [packages]` (first-class citizen — the in-guest binary must exist in the image). **Layer-isolated root-cause strategy** (the hang path traverses Rust std → relibc pthread cond/mutex → futex syscall → kernel — any layer can be the culprit): (a) per-layer isolation tests — L1 kernel futex syscall (via raw syscall wrappers), L2 relibc pthread cond/mutex, L3 std PAL Parker/queue-RwLock, L4 `thread::scope` structured join — host runs validate the suite's own logic, but hang ATTRIBUTION happens on-target in the QEMU reproduction step (the hang is Redox-target-specific; host cannot reproduce it); (b) fixes land in the FIRST proven-failing durable component AMONG {relibc fork, kernel fork} — if attribution lands on Rust std PAL itself (not one of the 9 submodules), that is escalated to the operator as a toolchain decision, never silently patched; (c) a host-side external WATCHDOG supervises the in-guest suite to classify and capture hangs (dump state on timeout) — the watchdog is evidence tooling, never a functional workaround (a suite that passes only under the watchdog's timeout is a FAIL, not a pass); (d) reproduction ladder: reproduce the known `thread::scope` hang in QEMU FIRST (attribution here), fix, re-verify in QEMU, THEN bare metal. Suite coverage: futex park/unpark under contention; `RwLock::write` writer progress under read contention (no starvation at 24 threads, 60 s soak); `thread::scope` 10k structured-join iterations. **Milestones: (1) pre-Gate-A: suite builds + host-runnable layers green + QEMU hang reproduced; (2) Gate-A-runtime: in-guest soak on the MS-7D70 (rides the Gate A boot, not a Gate-A assertion).** When green, flip the guidance in `local/docs/PACKAGE-BUILD-QUIRKS.md` with a validated/unvalidated matrix + evidence links. Must NOT: weaken the current guidance before the suite passes; use `thread::scope` or unvalidated `RwLock::write` anywhere in this program until the suite proves them (all plan code stays on the proven subset: spawn, join, Mutex, mpsc, Condvar, RwLock::read); treat a watchdog timeout as acceptable behavior. + Parallelization: Wave 1 | Blocked by: — | Blocks: — (parallel with 5-8; in-guest milestone rides the Gate A boot) + References: `local/docs/PACKAGE-BUILD-QUIRKS.md` § "Platform Quirk: std::thread::scope hangs on the Redox target" (proven vs unvalidated list); `local/recipes/drivers/redox-driver-core/source/src/concurrent.rs` (proven spawn+join worker pool); `local/docs/DRIVER-MANAGER.md` (thread::scope platform finding); `local/sources/relibc/` (futex + pthread cond/mutex — fork commits on submodule/relibc); `local/sources/kernel/` (futex syscall path); Rust std Redox PAL (parker/queue-based RwLock on the pthread path) + Acceptance criteria: milestone 1: suite builds into redbear-mini image; suite logic validated on host; QEMU reproduces the known `thread::scope` hang and the layer-isolation tests attribute it to exactly one layer (L1/L2/L3/L4); post-fix QEMU passes. milestone 2: in-guest soak on the MS-7D70 green — scope 10k iterations, park/unpark contention, `RwLock::write` 60 s zero-starvation — with the watchdog capturing any hang state (watchdog pass = clean completion, not timeout); `PACKAGE-BUILD-QUIRKS.md` updated with the evidence-linked matrix; canonical build. + QA scenarios: happy: all primitives green in-guest with logged iteration counts. failure: hang at layer X → root-cause fix in that layer's durable component (relibc/kernel fork commit; std-PAL attribution → operator escalation), suite RED until fixed. Evidence `.omo/evidence/task-41-ryzen-7000-x670e-compat.txt` + Commit: Y | test(threading): substrate validation suite (+ in-tree fixes only where attribution lands) + +- [x] 9. acpid RSDP producer contract + BIOS-search fallback wiring + What to do / Must NOT do: Reconcile the RSDP bootstrap: `acpid/src/acpi.rs:281-283` currently hard-requires `RSDP_ADDR`; wire the acpi-rs bounded BIOS-search fallback (`acpi-rs/src/rsdp.rs:41-55,177-190`) as the documented secondary path, define the explicit producer contract (bootloader → kernel `/scheme/kernel.acpi` → hwd/init env → acpid) per ACPI-IMPROVEMENT-PLAN W1.5, and emit a startup diagnostic naming which producer supplied the RSDP. Reference ACPICA's table-discovery ordering (`drivers/acpi/acpica/tbxfroot.c` in linux-7.1) for the fallback precedence. Must NOT: make BIOS low-memory scanning the primary path on UEFI (it is fallback-only); change the service env-var inheritance. + Parallelization: Wave 2 | Blocked by: — | Blocks: 40 + References: `local/sources/base/drivers/acpid/src/acpi.rs:270-294`; `local/sources/base/drivers/acpi-rs/src/rsdp.rs:41-55,177-190,208-211`; `local/sources/base/init.initfs.d/{40_hwd,41_acpid}.service:6-7`; `local/sources/base/drivers/hwd/src/backend/acpi.rs:12-39`; `local/docs/ACPI-IMPROVEMENT-PLAN.md:325-362` (W1.5 contract); `local/reference/linux-7.1/drivers/acpi/acpica/tbxfroot.c` + Acceptance criteria: acpid unit tests for producer-selection precedence (env > kernel scheme > BIOS search) GREEN; canonical build; QEMU boot log shows the producer diagnostic line; forced-absence QA (unset RSDP_ADDR in a QA initfs — not shipped) shows BIOS-search fallback engaging on legacy boot or a clear bounded failure on UEFI. + QA scenarios: happy: producer diagnostic names the source; boot proceeds. failure: no producer → bounded error, never a silent hang. Evidence `.omo/evidence/task-9-ryzen-7000-x670e-compat.txt` + Commit: Y | feat(acpid): explicit RSDP producer contract + BIOS-search fallback + +- [x] 10. acpid GPE dispatch hardening (ACPICA evgpe port: default-on, bounded, storm-safe) + What to do / Must NOT do: Port ACPICA's GPE model into acpid, replacing the opt-in synchronous dispatcher (`power_events.rs:252-276`, `REDBEAR_ACPI_GPE_DISPATCH=1`): (a) dispatch becomes DEFAULT-ON; (b) **one serialized AML execution worker** — acpi-rs namespace/opregion state is NOT reentrant, so ALL AML method evaluations in acpid (GPE `_Lxx/_Exx`, EC `_Qxx`, and the power/wake/_OSC/_REG work in todos 11-13) run on a single AML worker thread fed by a bounded queue; the scheme-serving thread and IRQ dispatch never evaluate AML themselves; enforcement is an **interpreter opcode-count budget + wall-clock budget inside the AML executor** (a wedged method is aborted by the budget — `join()` on a wedged worker blocks forever, which is why budget-in-interpreter is the mechanism; `thread::scope` remains FORBIDDEN on Redox per PACKAGE-BUILD-QUIRKS); per-GPE handler registration maps each GPE to a queued work item, so a slow method delays but never wedges scheme reads; **queue-saturation semantics are explicit: each GPE carries pending/coalescing state (a level-triggered GPE is never silently dropped — a second edge while one is queued coalesces, not vanishes), a saturated GPE stays MASKED until its work item is queued (never left enabled-and-unhandled), and queue-full triggers recovery (disable the GPE, log, bounded re-enable probe) with dedicated queue-full tests**; **todos 11, 12, 13 depend on this executor and route every evaluation through it**; (c) port evgpe.c storm detection (interrupt-count threshold → disable GPE + log + bounded re-enable probe); (d) disable/re-enable state machine per GPE preserving firmware bits for unowned GPEs; (e) host-runnable tests with a synthetic GPE register file. Reference: `local/reference/linux-7.1/drivers/acpi/acpica/evgpe.c` (ev_gpe_detect, storm logic), `evgpeblk.c`, `evxface.c` (acpi_install_gpe_handler model). Must NOT: run AML on the scheme thread; enable every GPE at boot (ownership stays: EC + fixed events + explicitly handled methods). + Parallelization: Wave 2 | Blocked by: — | Blocks: 11,12,13,40 + References: `local/sources/base/drivers/acpid/src/power_events.rs:207-276`; `local/sources/base/drivers/acpid/src/gpe.rs:59-162`; `local/docs/ACPI-IMPROVEMENT-PLAN.md`; `local/reference/linux-7.1/drivers/acpi/acpica/evgpe.c` + `evgpeblk.c`; PACKAGE-BUILD-QUIRKS (thread::scope prohibition) + Acceptance criteria: host tests GREEN (storm suppression triggers after synthetic burst; **a deliberately-slow fake method does not block scheme reads** — the scheme thread answers while the method sits in the AML queue; budget aborts a wedged method and the queue drains; **queue-full test: coalescing preserves level-triggered semantics, saturated GPE stays masked until queued, recovery re-enables**); canonical build; QEMU: EC GPE + fixed events still dispatch (power button → shutdown flow). + QA scenarios: happy: synthetic storm disabled + recovered; QEMU power button works. failure: blocking fake method → scheme stays responsive (test asserts). Evidence `.omo/evidence/task-10-ryzen-7000-x670e-compat.txt` + Commit: Y | feat(acpid): storm-safe bounded GPE dispatch (ACPICA evgpe port) + +- [ ] 11. acpid power-resource engine (_PR0/_PR3/_STA/_ON/_OFF, GPP7-class trees) + What to do / Must NOT do: Implement the device power-resource policy layer in acpid (reference: Linux `drivers/acpi/power.c` + ACPICA namespace walk): parse `_PR0`/`_PR3` package membership, resolve shared/nested power-resource dependencies, evaluate resource `_STA`, sequence `_ON`/`_OFF` with reference counting, walk the PCI namespace (not hardcoded laptop paths — this board's tree is `\_SB.PCI0.GPP7.*` with 40+ PWRS resources per dmesg), detect cycles, roll back on failure. Expose device power state on the acpid scheme. Host-runnable tests over a synthetic AML namespace fixture (including a GPP7-shaped tree extracted from the task-3 acpidump). Must NOT: power-gate devices Red Bear drivers are using (default policy: enumerate + expose, only act on explicit consumer request); hardcode board paths. + Parallelization: Wave 2 | Blocked by: 10 | Blocks: 40 + References: `local/sources/base/drivers/acpid/src/acpi.rs:951-964` (current object enumeration only); `local/sources/base/drivers/acpi-rs/src/aml/mod.rs:1558-1601` (PowerResource object model); `local/reference/linux-7.1/drivers/acpi/power.c`; machine dmesg (GPP7 PWRS tree); task-3 acpidump + Acceptance criteria: host tests: synthetic GPP7 tree → correct _ON ordering with ref-counts; cycle injection → detected + error; canonical build; QEMU: scheme exposes `/scheme/acpi/power/` states without changing device power. + QA scenarios: happy: enumeration of the synthetic tree matches expected order. failure: cycle/missing method → typed error, no panic, no half-applied _ON sequence. Evidence `.omo/evidence/task-11-ryzen-7000-x670e-compat.txt` + Commit: Y | feat(acpid): power-resource dependency engine (_PR0/_PR3/_STA/_ON/_OFF) + +- [ ] 12. acpid namespace-wide wake/_PRW enumeration (AMD desktop paths) + What to do / Must NOT do: Replace the fixed laptop-oriented wake-device candidate list (`wake.rs:178-189`: PC00/CNVW/THC/lid) with a namespace walk that discovers every device exposing `_PRW`, including AMD desktop GPP paths (`\_SB.PCI0.GPP*`), and feeds the existing `_DSW/_PSW` arm/disarm logic (`wake.rs:208-280`). Host test with a synthetic namespace containing both Intel-laptop and AMD-desktop shapes. Must NOT: change the arm/disarm semantics; break the LG Gram paths (regression fixture for both shapes). + Parallelization: Wave 2 | Blocked by: 10 | Blocks: 40 + References: `local/sources/base/drivers/acpid/src/wake.rs:176-280`; LG plan §2.3 (already-ported wake table); `local/reference/linux-7.1/drivers/acpi/acpica/` (nswalk patterns); task-3 acpidump (real _PRW surface of this board) + Acceptance criteria: host tests for both namespace shapes GREEN (all _PRW devices discovered, no duplicates); canonical build; QEMU: arm/disarm still functions for the EC/button wake sources. + QA scenarios: happy: synthetic AMD tree → GPP wake devices enumerated. failure: malformed _PRW package → skipped with log, enumeration continues. Evidence `.omo/evidence/task-12-ryzen-7000-x670e-compat.txt` + Commit: Y | feat(acpid): namespace-wide _PRW wake-device enumeration + +- [ ] 13. acpid/acpi-rs _OSC negotiation + _REG opregion-connect wiring + What to do / Must NOT do: (a) Implement PCI host-bridge `_OSC` negotiation in acpid at init, using the correct TWO-PASS protocol: first a QUERY pass (`OSC_QUERY_ENABLE` set) per root bridge (PNP0A03/PNP0A08 discovered by namespace walk, PCI host-bridge UUID — not a hardcoded `\_SB._OSC`) to learn what the firmware supports, then a CONTROL pass requesting only supported bits — with returned-mask and error handling (a firmware reject or masked-down result is logged and treated as authoritative, never fatal). Populate the **support** DWORD and the **control-request** DWORD correctly and separately: advertise MSI/MSI-X in the SUPPORT mask; request **NO native control** (no native AER, no native hotplug, no PME control) in the control mask until complete consumers + recovery paths exist. Log requested-vs-granted per root and expose the typed granted-capability set on the acpid scheme for pcid/driver-manager consumers; (b) wire `initialize_namespace()` in acpi-rs so `_REG` opregion-connect callbacks run (currently dead code per LG Phase 1 note — firmware gates EC access behind `_REG(EmbeddedControl,1)`), with a bounded handler for EmbeddedControl + PCI_Config + SystemMemory opregions, ALL routed through todo 10's serialized AML executor. Host tests for both. Must NOT: conflate support bits with control-request bits (they are different DWORDs); skip the query pass (requesting unsupported control bits is a protocol violation); claim control of capabilities Red Bear does not implement; let _REG handlers run unbounded AML. + Parallelization: Wave 2 | Blocked by: 10 | Blocks: 40 + References: LG plan Phase 1 integration note (`initialize_namespace` dead code); `local/sources/base/drivers/acpid/src/ec.rs`; `local/sources/base/drivers/acpi-rs/src/` (namespace init); `local/reference/linux-7.1/drivers/acpi/acpica/{nsxfobj.c,evregion.c,utosi.c}`; machine dmesg (_OSC lines) + Acceptance criteria: host tests: _OSC result parsing (granted-mask extraction) + _REG connect sequence for a synthetic EC opregion; canonical build; QEMU: boot log prints _OSC granted capabilities; EC access unchanged (regression). + QA scenarios: happy: _OSC line logged with correct mask; EC still functional. failure: firmware rejects _OSC → log + continue with defaults (never fatal). Evidence `.omo/evidence/task-13-ryzen-7000-x670e-compat.txt` + Commit: Y | feat(acpi): _OSC negotiation + _REG opregion-connect wiring + +- [ ] 14. AMD-Vi interrupt remapping: structural correction (parser, IRT ownership, kernel gate removal) + What to do / Must NOT do: The current AMD-Vi path is structurally wrong in four places — fix at the root, then integrate. (a) **IVRS parser** (`local/recipes/system/iommu/source/src/acpi.rs`): parse IVHD types 0x10/0x11/**0x40** and IVMD types 0x20/0x21/**0x22** — note the IVMD type is a SCOPE selector (0x20 = all devices, 0x21 = single device, 0x22 = device-ID range), NOT an exclusion flag; the exclusion semantics come from the IVMD flags field (`IVMD_FLAG_EXCL_RANGE`, plus UNITY/read/write permission bits) applied independently of the scope, with segment and alias ownership preserved (reference: Linux 7.1 `drivers/iommu/amd/init.c` IVMD handling); correct the IVHD device-entry type/layout decode, and apply IVMD exclusions to DMA translation. (b) **Interrupt-remap table ownership**: remove the global 16-byte-IRTE assumption; implement AMD's per-device/alias IRT allocation selected from the IVHD EFR field (32-bit vs 128-bit-GA table format), with correct DTE programming, table invalidation, and remapped-message encoding. (c) **BDF-aware MSI/MSI-X programming**: `irq_trigger()`/MSI message composition currently has no device context — pcid/pcid-interface must own MSI/MSI-X programming (it has the BDF), composing either a direct APIC message or an IOMMU-remappable message per device and requesting the matching IRTE from the iommu daemon via scheme:iommu. (d) **Remove the delivery-time kernel gate**: delete the unconditional-true `iommu_validate_msi_irq()` (`kernel/src/scheme/irq.rs:221-227`) — validation belongs at message-composition/IRTE-allocation time, not at IRQ delivery. Extend the QEMU self-test: IRTE programmed on first device use + interrupt actually delivered through the remapped entry. Must NOT: enable translation for devices before their driver claims them; keep a global shared IRTE; leave the kernel gate as a shim. + Parallelization: Wave 2 | Blocked by: — | Blocks: 23 + References: `local/sources/kernel/src/scheme/irq.rs:59-63,221-227`; `local/recipes/system/iommu/source/src/{main.rs:294-402,acpi.rs:204-399,amd_vi.rs:76-165}`; `local/sources/base/drivers/pcid/src/driver_interface/msi.rs` (message composition site); `local/docs/IRQ-AND-LOWLEVEL-CONTROLLERS-ENHANCEMENT-PLAN.md:380-408`; Linux 7.1 `drivers/iommu/amd/{iommu.c,init.c}` (IVRS/EFR/IRTE reference); AMD IOMMU spec (IVMD 0x22 semantics) + Acceptance criteria: canonical build; QEMU self-test passes with IRTE-programmed + delivered-through-remap assertion; IVMD 0x22 regions excluded from DMA translation; host tests for the IVRS parser (all six types incl. 0x40/0x22) and IRT format selection (EFR-driven) GREEN. + QA scenarios: happy: QEMU self-test log shows per-device IRTE + delivered interrupt. failure: device without IRTE → MSI falls back to legacy with a log (never silent drop). Evidence `.omo/evidence/task-14-ryzen-7000-x670e-compat.txt` + Commit: Y | feat(iommu): AMD-Vi interrupt remapping structural correction + IVMD honor + +- [ ] 15. pcid fail-closed resource auditor (namespace-wide _CRS + reservations) + What to do / Must NOT do: In pcid (`local/sources/base/drivers/pcid/` — **base fork; commits on `submodule/base` + parent gitlink bump, NOT local/patches** — review-verified location): (a) FIRST validate/extend acpid's `_CRS` parsing — root-bridge windows alone are NOT enough (AMDIF031 is a namespace platform device, not part of the root `_CRS`; the auditor needs namespace-wide resource reservations) — acpid must expose (i) normalized host-bridge apertures, (ii) namespace-wide fixed reservations (ACPI devices like AMDIF031, PNP0C01/02), (iii) the UEFI/e820 exclusion list (via kernel/boot handoff) — **all `_CRS`/namespace AML evaluations routed through todo 10's serialized AML executor**; if acpid cannot deliver these, the auditor falls back to "preserve firmware assignments + fail-closed on detected overlaps" (never block boot on unparseable AML); (b) the audit pass: before any driver `enable`/BAR-map is honored, check every device BAR against other BARs, **programmable bridge windows** (Type-1 headers — distinguished from root apertures, which are containment-valid, not conflicts), namespace reservations, and e820/UEFI exclusions; on a true conflict (overlapping decode by two owners), log the full topology and mark the affected subtree "needs-repair" — its drivers are NOT enabled until todo 16 repairs it. Must NOT: treat ancestor-window containment as a conflict; break boot when _CRS is missing (fallback above); silently map overlapping BARs (today's bug). + Parallelization: Wave 3 | Blocked by: 3,10 | Blocks: 16 + References: `local/sources/base/drivers/pcid/src/{cfg_access/mod.rs:423-447,main.rs:33-71,driver_interface/mod.rs:533-536}`; `local/sources/base/drivers/acpid/src/` (_CRS capability — must be extended to namespace-wide reservations); task-3 evidence (`/proc/iomem`, lspci, AMDIF031 region); Linux 7.1 `drivers/pci/setup-bus.c`/`setup-res.c` + Acceptance criteria: host-runnable auditor tests over synthetic topologies: (i) clean → all pass; (ii) BAR/ACPI-reservation overlap (AMDIF031-shaped) → subtree flagged, enable refused with typed error; (iii) ancestor-window containment → PASS (not a conflict); (iv) missing _CRS → firmware-preserve fallback, boot proceeds; canonical build of base fork. + QA scenarios: happy: true overlap → refusal log + no mapping. failure: unparseable _CRS → fallback path, devices still enabled from firmware assignments. Evidence `.omo/evidence/task-15-ryzen-7000-x670e-compat.txt` + Commit: Y | feat(pcid): fail-closed PCI resource auditor (namespace-wide reservations) + +- [ ] 16. pcid transactional cold-plug allocator (evidence-selected strategy) + What to do / Must NOT do: In pcid (base fork, `submodule/base`): implement the cold-plug allocator for "needs-repair" subtrees: compute a complete allocation plan first — preserve all valid firmware assignments; the PLANNER selects per-subtree between (i) tightening an oversized programmable bridge window around existing child BARs and (ii) relocating the subtree into a free aperture, chosen from the evidence (window size vs child BAR span vs available apertures), not a hardcoded tighten-first rule; honor BAR/window alignment, 32/64-bit + prefetchable classes, above-4GiB placement, namespace/UEFI reservations; then program transactionally: snapshot config → disable bus-mastering + decode on the subtree → size BARs with decode disabled → program child BARs + bridge windows → verify readback → restore decoding with bus-mastering last; on any failure leave the subtree DISABLED (never restore a known-conflicting configuration). `NO_RESOURCE_RELOC` quirk semantics become "preserve and fail closed". NO hot-plug (newly discovered hot-plug devices stay disabled until the allocator reruns). Must NOT: relocate resources of working devices; program without readback verification; leave decode enabled during sizing. + Parallelization: Wave 3 | Blocked by: 15,17 | Blocks: 23 + References: `local/sources/base/drivers/pcid/src/{main.rs:33-102,driver_interface/bar.rs:1-79}`; task-3 evidence (real conflict: AMDIF031 mem 0xfb300000 vs bridge window 0xfb200000-0xfb9fffff); Linux 7.1 `drivers/pci/setup-bus.c` (`pci_assign_unassigned_bridge_resources`), `drivers/pci/setup-res.c`; Oracle verdict A (transactional sequence) + Acceptance criteria: host-runnable planner tests: AMDIF031-class conflict → correct strategy selected + conflict resolved; unresolvable case → subtree relocation into free aperture; readback-failure injection → subtree left disabled with typed error; canonical build. + QA scenarios: happy: conflict resolved, devices mapped, overlap gone. failure: forced program failure → subtree disabled, nothing stomped, error logged. Evidence `.omo/evidence/task-16-ryzen-7000-x670e-compat.txt` + Commit: Y | feat(pcid): transactional cold-plug BAR/bridge-window allocator + +- [ ] 17. pcid MCFG: correct single-segment handling + segment-aware fail-closed + What to do / Must NOT do: In pcid (base fork): from the task-3 acpidump, confirm this board's MCFG segment count (single-socket consumer → almost certainly segment 0 only). If segment 0 only: keep the working single-segment path and make any non-zero-segment entry a LOUD fail-closed (explicit log naming the skipped segment, never silent device loss); record multi-segment (`Segment:BDF` identity across pcid/driver-manager/pcid-interface/IOMMU — an end-to-end identity change) as deferred-with-docs in todo 39. If the board IS multi-segment: implement the full `Segment:BDF` identity end-to-end with two-segment tests (claim, MSI/IOMMU, driver matching per segment). Must NOT: silently skip segments (current behavior loses devices); claim multi-segment support without the identity change (a bare per-segment ECAM map breaks BDF addressing everywhere downstream). + Parallelization: Wave 3 | Blocked by: — | Blocks: 16 + References: `local/sources/base/drivers/pcid/src/cfg_access/mod.rs:152-199,262-315`; task-3 MCFG dump; Linux 7.1 `drivers/acpi/pci_mcfg.c`; Oracle review (segment-identity analysis) + Acceptance criteria: host test: non-zero-segment MCFG input → loud fail-closed log + segment-0 devices unaffected; canonical build; QEMU (single-segment) boot unchanged. (If multi-segment taken: synthetic 2-segment enumeration test GREEN.) + QA scenarios: happy: segment-0 unaffected, anomaly logged loudly. failure: malformed MCFG → typed error + CF8/CFB fallback per existing path. Evidence `.omo/evidence/task-17-ryzen-7000-x670e-compat.txt` + Commit: Y | feat(pcid): MCFG segment handling (fail-closed beyond segment 0) + +- [x] 18. nvmed: NVMe Host Memory Buffer (FID 0x0D) support + What to do / Must NOT do: In `local/sources/base/drivers/storage/nvmed/` (base fork): implement HMB — NOTE: `cmbloc`/`cmbsz` (declared dead at `nvme/mod.rs:54-57`) are the **Controller Memory Buffer** registers and are UNRELATED to HMB — do not use them. Instead, parse Identify Controller fields with their CORRECT semantics (NVMe 1.4 §8.9; reference Linux 7.1 `drivers/nvme/host/pci.c` `nvme_alloc_host_mem`): HMPRE/HMMIN are total preferred/minimum sizes **in 4-KiB units**; HMMINDS is the **per-descriptor minimum** size; HMMAXD caps the **descriptor COUNT** (0 = unrestricted), not the total size; allocation = min(HMPRE, OS cap 64 MiB) split into descriptors ≥ HMMINDS, count ≤ HMMAXD — **and the resulting total MUST satisfy the HMMIN floor: if min(HMPRE, cap) < HMMIN, HMB is disabled cleanly (spec-invalid undersized allocation), with below/equal/above-HMMIN tests pinning all three cases**. Extend `identify.rs` (currently parses only VID/serial/model), build the descriptor list, and issue `Set Features / Host Memory Buffer (FID 0x0D)` with the EXACT command layout (NVMe 1.4 §8.9, cross-checked against Linux `drivers/nvme/host/pci.c`): CDW10 = FID 0x0D; CDW11 = EHM (bit 0, enable) + MR (bit 1, memory-return) ONLY; CDW12 = HSIZE (total size in 4-KiB units); CDW13/CDW14 = host-memory descriptor-list DMA address (64-bit); CDW15 = descriptor count — issued before I/O queues are created; handle the full lifetime: on controller reset/shutdown paths the HMB is released correctly (MR/RETURN when the controller may retain, zero flags before freeing the host allocation), and re-established after reset. Keep the no-HMB path fully working (HMPRE=0 controllers, or allocation failure → log + continue without HMB, never fail the drive). Host-runnable tests for descriptor-list construction (HMMINDS/HMMAXD edge cases) + feature-command dword encoding. Gate A asserts HMB actually enabled **only if the controller advertises HMPRE>0** (todo 3 captures `nvme id-ctrl`; an HMPRE=0 ADATA is an explicit no-go/replan, not a failed gate). Must NOT: treat HMMAXD as a size cap; conflate CMB with HMB; regress the existing 8-queue/PRP data path. + Parallelization: Wave 4 | Blocked by: — | Blocks: 23 + References: `local/sources/base/drivers/storage/nvmed/src/nvme/{mod.rs:54-57,417-465,cmd.rs,identify.rs:8-21}`; Linux 7.1 `drivers/nvme/host/pci.c:2543-2603` (HMB reference); NVMe 1.4 spec §8.9 (HMB) + Identify Controller HMPRE/HMMIN/HMMINDS/HMMAXD field layout + Acceptance criteria: host tests: descriptor list + FID 0x0D dword encoding against NVMe spec vectors GREEN; canonical build; QEMU (nvme device, no HMB) exercises the fallback path cleanly. + QA scenarios: happy: HMB-capable path constructs + issues FID 0x0D (asserted at Gate A on the ADATA). failure: allocation failure → log + continue without HMB. Evidence `.omo/evidence/task-18-ryzen-7000-x670e-compat.txt` + Commit: Y | feat(nvmed): Host Memory Buffer support (FID 0x0D) + +- [x] 19. usbscsid: wire UAS (protocol 0x62) dispatch with alternate-setting BOT fallback + What to do / Must NOT do: In `local/sources/base/drivers/storage/usbscsid/` (base fork): the 1006-line `uas.rs` exists but `main.rs:57-62` matches only interface protocol 0x50 (BOT), AND the UAS setup path itself is fragile (`protocol/mod.rs:84` unwraps UAS init; stream detection at `uas.rs:389` uses a vacuous `.all()`). Wire UAS properly: (a) on a mass-storage interface, enumerate ALTERNATE SETTINGS — a device may offer UAS (0x62) on one alt-setting and BOT (0x50) on another; (b) replace the unwrap with typed setup errors, and validate before use: all four UAS pipes (command/status/data-in/data-out) present, stream/controller capability descriptors readable with NON-vacuous checks, **with SPEED-AWARE stream requirements (Linux `uas.c` model: pre-SuperSpeed UAS operates WITHOUT streams — a no-stream USB2 device IS UAS-capable; SuperSpeed requires successful stream allocation, else fall back to BOT when a BOT alternate exists)**, and no quirk entry demands BOT-only (Linux `uas-detect.h` quirk model — apply the existing unusual-devs TOML quirks); (c) UAS failure fallback is possible ONLY by tearing down/resetting the endpoints and selecting the BOT alternate setting via SET_INTERFACE — never "wrap" a failed UAS session in BOT on the same setting; if no BOT alternate exists, fail honestly. Host-runnable tests for the alt-setting decision matrix + stream-validation edge cases. Runtime proof: QEMU `usb-uas` device (in addition to the existing BOT regression). Must NOT: regress the proven BOT path; leave UAS devices unspawned (today's silent failure at main.rs:69); pretend a failed UAS interface can be used as BOT without reconfiguration. + Parallelization: Wave 4 | Blocked by: — | Blocks: 23 + References: `local/sources/base/drivers/storage/usbscsid/src/{main.rs:57-69,protocol/mod.rs:84-92,protocol/uas.rs:389-396,protocol/bot.rs}`; Linux 7.1 `drivers/usb/storage/uas-detect.h` + `drivers/usb/storage/uas.c` (pipe validation); QEMU `-device usb-uas` (runtime proof); task-3 `lsusb` evidence (SC750 interface protocols/alt-settings) + Acceptance criteria: host tests: 0x50→BOT, 0x62(+valid pipes, SS, streams)→UAS, 0x62(+USB2, no streams)→UAS without streams, 0x62(+SS, stream alloc fails, BOT alternate present)→teardown+SET_INTERFACE→BOT, 0x62(+SS, stream alloc fails, no BOT alternate)→honest failure — matrix GREEN; canonical build; QEMU BOT regression passes AND QEMU `usb-uas` runtime proof (attach, read sectors) passes. + QA scenarios: happy: dispatch matrix tests pass; QEMU BOT proof still green. failure: UAS-without-BOT-alternate → typed failure log, never silent unspawn. Evidence `.omo/evidence/task-19-ryzen-7000-x670e-compat.txt` + Commit: Y | feat(usbscsid): UAS dispatch with alternate-setting BOT fallback + +- [x] 20. xHCI quirk-table parity for X670E controllers (1022:43f7, 1022:15b6/15b7/15b8) + What to do / Must NOT do: In `local/recipes/drivers/redox-driver-sys/source/src/quirks/xhci_table.rs` (+ TOML layer if board-specific): add/verify entries for the five controllers — `1022:43f7` (ASMedia-sourced, AMD-vendored) gets **exactly** `XHCI_DEFAULT_PM_RUNTIME_ALLOW` per Linux `xhci-pci.c:331` (do NOT add SPURIOUS_SUCCESS — the dmesg mask 0x200000010 is the COMBINED controller word; per-PCI-ID assignment is DEFAULT_PM_RUNTIME_ALLOW only — Metis m2); `1022:15b6/15b7/15b8` (AMD Raphael USB4-adjacent xHCI, hci 0x120): verify the universal `hci_version > 0x96 → SPURIOUS_SUCCESS` and `>= 0x120 → DEFAULT_PM_RUNTIME_ALLOW` rules cover them (they do — add a parity test pinning the expected flag set per controller); check ASMedia `XHCI_ASMEDIA_MODIFY_FLOWCONTROL` applicability from task-3 evidence. Host tests: flag-parity per controller vs Linux 7.1 `xhci-pci.c` expectations. Must NOT: copy the combined dmesg mask as per-device flags; remove existing entries. + Parallelization: Wave 4 | Blocked by: 2 | Blocks: 23 + References: `local/recipes/drivers/redox-driver-sys/source/src/quirks/xhci_table.rs` (51-flag table, 38 tests); Linux 7.1 `drivers/usb/host/xhci-pci.c:285-343,331`; LG plan item 0.3 (same procedure precedent); machine dmesg xHCI lines (hcc params, hci versions, quirk mask) + Acceptance criteria: `cargo test --manifest-path local/recipes/drivers/redox-driver-sys/source/Cargo.toml quirks` GREEN with new parity tests; `--check-sweep` clean. + QA scenarios: happy: each controller ID resolves to exactly the Linux-expected flag set. failure: flag mismatch → RED until table corrected. Evidence `.omo/evidence/task-20-ryzen-7000-x670e-compat.txt` + Commit: Y | feat(quirks): xHCI parity for X670E ASMedia/AMD controllers + +- [x] 21. redbear-r8125d: driver core (MAC init, rings, descriptors) + What to do / Must NOT do: New Rust driver `local/recipes/drivers/redbear-r8125d/` (with symlink `recipes/drivers/redbear-r8125d`), porting Linux 7.1 `drivers/net/ethernet/realtek/r8169_main.c` RTL8125-specific sections: MAC version table (RTL_GIGA_MAC_VER_61-66 covering 8125A/B/D/K/BP/CP), the 8125-specific MAC registers and init sequences (INT_CFG0_8125, INT_CFG1_8125, 0xa00-0xb00 register clearing, `rtl_hw_start_8125*`), the OCP/ERI register-access sequences, PHY page programming, link-state handling, interrupt mitigation (8125 IntrMitigate), and reset/recovery — the descriptor ring STRUCTURES are shared with the r8169 family (correcting the earlier "different descriptor format" claim: the incompatibility with rtl8168d is the MAC register layout + init/firmware sequences, not the descriptor structs), plus MSI/MSI-X via redox-driver-sys/pcid-interface, netstack handoff via the smolnetd scheme contract (same as rtl8168d/e1000d). Host-runnable tests for descriptor encode/decode + MAC-version detection table. Must NOT: extend rtl8168d to "also handle 8125" (the config documents the exclusion explicitly); reference rtase (different automotive chips entirely — Metis m1); use C. + Parallelization: Wave 5 | Blocked by: — | Blocks: 22 + References: Linux 7.1 `drivers/net/ethernet/realtek/{r8169_main.c:57-129,431,2730,5558,r8169.h,r8169_phy_config.c}`; `local/sources/base/drivers/net/rtl8168d/src/{main.rs,device.rs}` (pattern + why it doesn't fit); `config/redbear-device-services.toml:295-304` (documented exclusion); `local/docs/HARDWARE-NETWORKING-INVENTORY.md` + Acceptance criteria: `cargo test --manifest-path local/recipes/drivers/redbear-r8125d/source/Cargo.toml` GREEN (descriptor encode/decode + MAC-version detection table tests); the crate type-checks for `x86_64-unknown-redox` via `./local/scripts/build-redbear.sh --check-sweep redbear-mini`. (Config wiring + image inclusion are todo 22's deliverables; firmware-action-parser tests live in todo 22, which owns the firmware work — not here.) + QA scenarios: happy: unit tests pass; driver compiles for x86_64-unknown-redox via canonical build. failure: MAC version misdetect → test RED. Evidence `.omo/evidence/task-21-ryzen-7000-x670e-compat.txt` + Commit: Y | feat(drivers): redbear-r8125d core (RTL8125 MAC/rings/descriptors) + +- [x] 22. redbear-r8125d: PHY, firmware, integration + fix redbear-info claim + What to do / Must NOT do: (a) PHY layer: port 8125 PHY page access/config from Linux `r8169_phy_config.c` (page 0x1F access pattern per MAC version) + the OCP/ERI/MDIO sequences; (b) firmware: load `rtl_nic/rtl8125{a,b,d,k,bp,cp}-*.fw` via firmware-loader — the Realtek firmware is NOT a raw blob: implement the firmware ACTION parser/executor (rtl8169 firmware opcodes: PHY-register write/read, delay, MAC-register write sequences — Linux `r8169_firmware.c` `rtl_fw_write_firmware`/`rtl_apply_firmware`), with host-runnable tests over a captured firmware file (from task-3 staging); **single-ownership packaging: a new `redbear-firmware-realtek` subset recipe is the SOLE owner of all `rtl_nic/**` paths in EVERY config (the monolithic `redbear-firmware` gets a matching exclusion so no two packages own the same files — Gate A needs the firmware in mini, and a 1.9 GB monolith in mini is not acceptable; assert blob presence AND zero ownership collisions in both mini and full)** + `firmware-fallbacks.d/30-rtl-nic.toml` chain mirroring `10-iwlwifi.toml`; (c) integration: `[[driver]]`+`[[driver.match]]` entry (`vendor = 0x10EC, device = [0x8125], class = 2, subclass = 0`) in `local/config/drivers.d/10-network.toml` + embedded copy in `config/redbear-device-services.toml`; include the recipe in `config/redbear-mini.toml [packages]` (text-only networking → mini per first-class-citizen policy; full inherits); (d) fix the false claim in `local/recipes/system/redbear-info/source/src/common.rs:1077-1079` ("RTL8125 via rtl8168d" — wrong per the TOML exclusion) to name redbear-r8125d. Must NOT: hand-fetch blobs at runtime (durable recipe staging only); load firmware without the action executor (a raw write of the blob is not how r8169 firmware works); leave the redbear-info false claim. + Parallelization: Wave 5 | Blocked by: 21,24 | Blocks: 23 + References: Linux 7.1 `drivers/net/ethernet/realtek/{r8169_phy_config.c,r8169_firmware.c,r8169_main.c:57-63}`; `local/recipes/system/redbear-firmware*/recipe.toml` (subset mechanism — Metis M2); `local/config/firmware-fallbacks.d/10-iwlwifi.toml` (chain pattern); `local/config/drivers.d/10-network.toml`; `local/recipes/system/redbear-info/source/src/common.rs:1077-1079` + Acceptance criteria: canonical `./local/scripts/build-redbear.sh redbear-mini` builds with redbear-r8125d staged + firmware present in image (`ls` the staged sysroot for `rtl_nic/rtl8125*`); **firmware-action-parser host tests over the real staged blob GREEN (opcode decode + executed-sequence equivalence against Linux `r8169_firmware.c` behavior)**; driver-manager TOML validates (driver-manager config parse test); `! grep -q 'rtl8168d.*8125\|8125.*rtl8168d' local/recipes/system/redbear-info/source/src/common.rs`. + QA scenarios: happy: image contains driver + firmware; config parses. failure: missing firmware blob at probe → driver logs typed NotFound and stays resident for retry (never panic). Evidence `.omo/evidence/task-22-ryzen-7000-x670e-compat.txt` + Commit: Y | feat(drivers): r8125d PHY/firmware/integration + redbear-info fix + +- [ ] 23. Gate A (minimally usable): wired network integration + staged bare-metal validation + What to do / Must NOT do: Package the **host-orchestrated staged checker** as two named components: the guest agent `redbear-gate-a-check` (new recipe `local/recipes/system/redbear-gate-a-check/`, wired into `config/redbear-mini.toml [packages]`) writing checkpoints to a persistent location, and the Rust host orchestrator `local/scripts/gate-orchestrator/` (cargo bin) driving boot transitions and validating checkpoints across them — a single in-guest run cannot perform a real reboot/poweroff and then exit 0: the guest agent asserts each sub-check and records a checkpoint after each phase; the host orchestrator (QEMU serial or bare-metal serial/IPMI-style log capture) validates phases across boot transitions. Assertions on the MS-7D70 host: all MADT-enabled CPUs online (24), dual-IO-APIC GSI routing verified (both IO-APIC IDs live, devices on both GSI ranges delivering interrupts), **bare-metal TSC calibration source identified (one of CPUID.15/HPET/PM-timer per todo 6) + drift within tolerance**, stable monotonic time, zero unresolved PCI resource conflicts (auditor log clean or allocator repairs logged), **both NVMe BDFs bound with verified I/O** (ADATA 1cc1:5766 + Samsung 144d:a80c), **HMB reported enabled on the ADATA drive IF AND ONLY IF its `nvme id-ctrl` (captured in todo 3) shows HMPRE>0 — an HMPRE=0 controller is an explicit no-go/replan note, not a gate failure**, **UAS transport + sector readback on the ADATA SC750**, **ASM1064 AHCI bound + I/O where media present**, **all five xHCI controllers live** (2× 1022:43f7 + 1022:15b6/15b7/15b8), USB HID keyboard, **staged terminal actions: reboot checkpoint (machine returns to login after a real reboot) then poweroff checkpoint (machine actually powers off; the orchestrator confirms from the host side — the guest cannot assert its own death)**, r8125d bound + DHCP lease via redbear-netctl. Operator boots the canonical `redbear-mini` ISO; logs archived to `local/docs/evidence/ryzen-x670e/gate-a/`. Update matrix markers (todo 4 convention). Must NOT: mark Gate A passed on QEMU evidence alone; proceed to Wi-Fi/display BM work before Gate A passes; require the guest checker to assert its own reboot/poweroff (host-orchestrated instead). + Parallelization: Wave 5 | Blocked by: 5,6,7,8,14,16,18,19,20,22 | Blocks: 28 (Wi-Fi BM ladder) + References: `local/scripts/test-phase5-network-qemu.sh` (harness pattern); `local/docs/evidence/` layout; gate definition from Oracle verdict E + Acceptance criteria: every checkpoint logged including the host-confirmed reboot + poweroff; `command -v redbear-gate-a-check` succeeds in the redbear-mini image; evidence archived; matrix updated. + QA scenarios: happy: full staged gate pass on bare metal. failure: any sub-check fails → root-cause fix per ABSOLUTE RULE (never skip the check), re-run gate. Evidence `.omo/evidence/task-23-ryzen-7000-x670e-compat.txt` + Commit: Y | test(gates): Gate A minimally-usable staged validation on MS-7D70 + +- [x] 24. C-exemption formalization: mt76 transport + DCN315 display slice (root AGENTS.md amendments, own commits) + What to do / Must NOT do: Draft and land THREE **root** `AGENTS.md` amendment blocks (the existing operator-approved exemption lives in root AGENTS.md, NOT `local/AGENTS.md`), each mirroring the iwlwifi block's structure (C-surface/boundary/rationale), each its own commit: + (a) `### linux-kpi + redbear-mt76 exemption (operator-approved 2026-08-04)` — C headers = firmware ABI contract (mt76/Connac register + descriptor layouts, matching Linux `mt792x_regs.h`/fw headers byte-for-byte); C transport = WFDMA rings, ROM-patch/WM firmware transfer, MCU mailbox, subsystem reset (bounded, no control logic); Rust = ALL driver logic (SoftMAC/MLME, scan/join/key policy, lifecycle, bridge). Cite the operator's 2026-08-04 approval from this planning session. + (b) `### amdgpu + redbear DCN315 display-slice exemption (operator-approved 2026-08-04)` — regularizes the PRE-EXISTING amdgpu C surface (it predates the formal policy — record it, do not expand it) AND authorizes the DCN315 slice C boundary BY CATEGORY (register access, DMUB interface, firmware load — no modeset policy, no connector state, no scheme logic in C). **Sequencing (removes the circular dependency): this policy commit lands NOW in todo 24 with the category-level boundary; todo 33's closure record then assigns every closure unit to exactly one of {authorized C ABI surface, reference-only Rust reimplementation} BEFORE any C is written, and the closure record is appended to this AGENTS.md block as its concrete surface list.** Todo 33 must not add C beyond the units the closure record classifies as C ABI. Cite the same operator approval. + (c) `### Firmware redistribution note (operator-approved 2026-08-04)` — documents that binary device firmware (linux-firmware: amdgpu/mediatek/rtl_nic/iwlwifi) is an operator-approved, narrow exception to the source-availability preference: these blobs are redistributable DEVICE firmware executed on the device's own processor (not host code), shipped under their upstream WHENCE licenses, pinned to the literal linux-firmware tag `20260622` (matching the reference set in `local/reference/cachyos/iso/cachyos-desktop-linux-260628.pkgs.txt`; re-pinned deliberately at future bumps), with a committed per-blob SHA-256 + WHENCE/license manifest at `local/recipes/system/redbear-firmware/firmware-manifest.toml` (the monolith recipe owns the manifest; every subset recipe validates against it), provisioned offline from the pinned local cache — formalizing the established iwlwifi/amdgpu practice for the new mediatek/rtl_nic additions. + Must NOT: expand either exemption beyond its listed C surface; amend `local/AGENTS.md` instead of root; bundle with implementation commits; let todo 33 add C beyond the closure-recorded surface. + Parallelization: Wave 5 | Blocked by: — | Blocks: 22,25,27,31,33 + References: root `AGENTS.md` (linux-kpi + redbear-iwlwifi exemption block — the structure to mirror); `local/recipes/drivers/redbear-iwlwifi/source/src/linux_port.c` (precedent C transport); `local/recipes/gpu/amdgpu/source/` (pre-existing C surface being regularized); Metis B1; Oracle reviews (root-vs-local; DCN315 unauthorized-C finding) + Acceptance criteria: root `AGENTS.md` contains all three dated policy blocks; **three** clean policy commits naming the operator approval (mt76 exemption, DCN315 exemption, firmware note); no implementation code in any of them. + QA scenarios: happy: blocks present, commits clean. failure: wrong file amended → fix before any C work. Evidence `.omo/evidence/task-24-ryzen-7000-x670e-compat.txt` + Commit: Y | docs(policy): linux-kpi mt76 + amdgpu/DCN315 C exemptions (operator-approved 2026-08-04) + +- [x] 25. mt76 C transport for MT7922 (linux-kpi boundary) + What to do / Must NOT do: New `linux_mt_port.c` in the redbear-mt7922 recipe, modeled on the iwlwifi `linux_port.c` skeleton (`local/recipes/drivers/redbear-iwlwifi/source/src/linux_port.c` — 2769 lines, category **drivers**) but implementing mt76 semantics within the todo-24 exemption boundary: WFDMA ring init, Connac TX/RX descriptor encode/decode, ROM-patch (`WIFI_MT7922_patch_mcu_1_1_hdr.bin`) section parsing + download, WM firmware (`WIFI_RAM_CODE_MT7922_1.bin`) transfer, MCU mailbox commands, subsystem reset. Host-runnable tests for the ROM-patch parser + descriptor encoding (pure-logic). Must NOT: write any control logic in C (scan/join/key/MLME is Rust — todo 26); import Linux mac80211/cfg80211; exceed the exemption's C surface. + Parallelization: Wave 6 | Blocked by: 24 | Blocks: 26 + References: `local/recipes/drivers/redbear-iwlwifi/source/src/linux_port.c` (skeleton); Linux 7.1 `drivers/net/wireless/mediatek/mt76/{mt7921/{pci.c,mcu.c,init.c},mt792x_dma.c,mt76_connac_mcu.c,dma.c}`; todo 24 exemption block; Oracle verdict B + Acceptance criteria: `cargo test` for the parser/encoder modules GREEN (incl. the real ROM-patch blob obtained from the local linux-firmware cache via `./local/scripts/fetch-firmware.sh` or the task-3 staged copy — the test does NOT depend on todo 27's image staging): correct section bounds; recipe compiles via canonical build. + QA scenarios: happy: ROM-patch parser handles the real blob with correct section bounds. failure: truncated/corrupt blob → typed error before any DMA submission. Evidence `.omo/evidence/task-25-ryzen-7000-x670e-compat.txt` + Commit: Y | feat(drivers): mt76 C transport (WFDMA/Connac/MCU/reset) + +- [x] 26. redbear-mt7922 Rust control layer — bounded SoftMAC/MLME + station/supplicant core + What to do / Must NOT do: Rust daemon `local/recipes/drivers/redbear-mt7922/source/src/`. MT7922 is a mac80211 **SoftMAC** device (review-verified against Linux `mt7921/mac.c`/`main.c`): the firmware does NOT do MLME. Structure the work as TWO Rust layers: (a) a **reusable station SoftMAC/supplicant core** — a NEW library-only crate at `local/recipes/drivers/redbear-softmac/source/` (library-only per the project's library-crate policy: no init service, no config package entry, consumed via Cargo path deps; redbear-mt7922 depends on it now, redbear-iwlwifi converges onto it in later work): management-frame RX/TX (auth/assoc/(re)assoc/deauth/disassoc), retransmission timers, RSN IE negotiation, WPA2-PSK EAPOL 4-way handshake, replay/MIC validation, PTK/GTK installation, fragmentation/reorder/defrag, scan result processing; REUSE the existing iwlwifi Rust station/key modules (`local/recipes/drivers/redbear-iwlwifi/source/src/mld/{key.rs,sta.rs}` shapes and the bridge's data conversion) where they are already vendor-agnostic, migrating them into the new crate with attribution; (b) the **MT7922 adapter** (`local/recipes/drivers/redbear-mt7922/source/src/`, path-dep on redbear-softmac): daemon lifecycle + driver-manager onboarding (`PCID_CLIENT_CHANNEL` contract), typed state machine driving the core, MCU command wrappers over the todo-25 C transport FFI, netstack handoff via the bridge shape (802.11 ↔ Ethernet frame conversion → `network.wlan0` scheme), recovery decisions, **fail-closed regulatory enforcement (only firmware/regdb-advertised channels and power levels are usable; unknown regulatory domain = 2.4 GHz channels 1-11 at lowest power, never optimistic enablement) and the aggregation lifecycle (ADDBA request/response, BA session state machine, DELBA teardown, reorder-buffer flush)** — regulatory and aggregation unit tests included in the core's test set, and the **wifictl control protocol** (the exact scheme messages wifictl sends: scan request/results, join, disconnect, status — define them, the existing bridge only handles data conversion). Host-runnable tests: packet-vector tests for the EAPOL handshake + RSN IE negotiation (captured vectors), state-machine transitions, defrag/reorder. Integration tests: open-network association AND WPA2-PSK association against a fixture AP before todo 28's hardware ladder. Must NOT: assume firmware-offloaded MLME; reuse iwlwifi MVM/MLD command IDs; import `mld/*.rs` wholesale (802.11ax single-link — the MLD multi-link parts are irrelevant, but station/key/scan shapes may be reused); write MLME in C; skip the EAPOL handshake (WPA2 is a ladder rung — the gate requires it). + Parallelization: Wave 6 | Blocked by: 25 | Blocks: 27 + References: `local/recipes/drivers/redbear-iwlwifi/source/src/{daemon.rs,actions.rs,bridge/,mld/key.rs,mld/sta.rs}` (reusable shapes); `local/recipes/drivers/linux-kpi/source/src/rust_impl/{pci.rs:999-1151,mac80211.rs,wireless.rs}`; Linux 7.1 `drivers/net/wireless/mediatek/mt76/mt7921/{main.c,mac.c,mcu.c}`; `net/mac80211/{mlme.c,auth.c,assoc.c,key.c,rx.c,tx.c}` (supplicant behavior reference); Oracle review (SoftMAC scope) + Acceptance criteria: `cargo test` GREEN (EAPOL 4-way handshake vector test, RSN IE negotiation, defrag/reorder, state machine scan→auth→assoc→key→connected, **regulatory reject-out-of-domain + safe-default tests, ADDBA/DELBA BA-session lifecycle + reorder-flush tests**); integration tests: open + WPA2-PSK association against fixture; canonical build; `--daemon` onboarding registers `network.wlan0` + the wifictl control messages defined and exercised in tests. + QA scenarios: happy: WPA2 fixture association completes with PTK/GTK installed. failure: bad MIC/replay → frame rejected, association aborted with typed error. Evidence `.omo/evidence/task-26-ryzen-7000-x670e-compat.txt` + Commit: Y | feat(drivers): redbear-mt7922 Rust SoftMAC + station/supplicant core + +- [x] 27. MT7922 firmware staging + redbear-wifictl backend + driver-manager wiring + What to do / Must NOT do: (a) firmware: **policy + reproducibility first** — MediaTek/Realtek/AMD blobs are operator-approved redistributable DEVICE firmware (executed on the device's own processor, not host code) per the todo-24(c) policy block; make it pinned and auditable: pin the linux-firmware cache to the literal tag `20260622`, commit the per-blob SHA-256 + WHENCE/license `firmware-manifest.toml` (owned by the monolith recipe, validated by subsets), and document the operator-approved firmware-redistribution note in the todo-24 policy commit. **Package-collision avoidance:** full already ships the monolithic `redbear-firmware` (whole-tree glob MINUS the `rtl_nic/**` exclusion carved out by todo 22 — mediatek/ IS covered by the monolith) — do NOT add `redbear-firmware-mediatek` to full (two packages owning the same files); the mediatek SUBSET recipe exists only for the standalone wifi-experimental wrapper (and future minimal profiles); full relies on the monolith for mediatek, with the acceptance check asserting the blob PATHS are staged in the full image (not subset-package membership). + `firmware-fallbacks.d/20-mediatek.toml` chain + driver-side `ucode_candidates` table. **Config-chain fix (verified gap + composition-safe design): `config/redbear-full.toml` currently includes ONLY `redbear-mini.toml` (line 10), and the experimental profiles are STANDALONE profiles carrying their own `filesystem_size = 2048` and profile-local files — including them wholesale would defeat full's automatic sizing and risk overriding full's files. The correct composition: split each experimental profile into (i) a composition-safe FRAGMENT carrying only `[packages]`/`[services]` additions (no `filesystem_size`, no standalone-profile `[general]` keys) and (ii) the existing standalone wrapper that includes the fragment + sets its own sizing for standalone builds. `redbear-full.toml` then includes ONLY the fragments (`redbear-wifi-fragment.toml`, `redbear-bluetooth-fragment.toml`), keeping its own sizing and file precedence.** (b) wifictl: extend the backend to drive the mt7922 daemon via the `network.wlan0` scheme (backend is already largely vendor-agnostic — add the mt7922 detection/selection path, no stub fallbacks). (c) driver-manager: `[[driver]]` entry (`vendor = 0x14C3, device = [0x0616], class = 2, subclass = 0x80`) in `local/config/drivers.d/70-wifi.toml` + embedded copy. (d) first-class-citizen wiring: `redbear-mt7922` into the wifi-fragment config `[packages]` (full inherits via the fragment; standalone experimental wrapper also gets it). Must NOT: mix iwlwifi and mt76 firmware candidate lists; vendor-lock wifictl; leave the full config without the fragment includes; create package-file collisions between the monolith and subsets; fetch from an unpinned linux-firmware HEAD. + Parallelization: Wave 6 | Blocked by: 24,26 | Blocks: 28, 29 + References: `local/recipes/system/redbear-firmware-*/recipe.toml` (subset mechanism); `local/config/firmware-fallbacks.d/10-iwlwifi.toml`; `local/recipes/system/redbear-wifictl/source/src/backend.rs`; `local/config/drivers.d/70-wifi.toml`; `config/redbear-wifi-experimental.toml`; `local/docs/WIFI-IMPLEMENTATION-PLAN.md` + Acceptance criteria: canonical `./local/scripts/build-redbear.sh redbear-full` stages the mediatek blobs in-image **via the monolithic redbear-firmware (paths verified: `mediatek/WIFI_RAM_CODE_MT7922_1.bin`, `mediatek/WIFI_MT7922_patch_mcu_1_1_hdr.bin`, `mediatek/BT_RAM_CODE_MT7922_1_1_hdr.bin` present in the staged sysroot — no subset/monolith file collision)**; `firmware-manifest.toml` committed with per-blob SHA-256 + WHENCE/license fields and the pinned linux-firmware tag; **resolved full config retains automatic filesystem sizing and the intended `/etc/netctl/active` (fragment-composition proof) and resolves redbear-mt7922**; driver-manager config parses; wifictl unit/integration tests GREEN; first-class-citizen check (recipe reachable from a config). + QA scenarios: happy: blobs in image, wifictl selects mt7922 backend on the right scheme. failure: missing blob → typed NotFound surfaced to wifictl (no silent fallback to scan-fake — that was eliminated in LG work and must not return). Evidence `.omo/evidence/task-27-ryzen-7000-x670e-compat.txt` + Commit: Y | feat(wifi): MT7922 firmware staging + wifictl backend + driver wiring + +- [ ] 28. Wi-Fi bounded runtime ladder on the host + What to do / Must NOT do: Run the bounded ladder on the MS-7D70 (post-Gate-A): probe → firmware alive (patch MCU + RAM code accepted) → scan (see real SSIDs) → association → WPA2 keying → DHCP via netstack → sustained TX/RX → recovery (bounded subsystem-reset path). NO suspend/resume rung — suspend is explicitly out of scope for this desktop program (removes the internally-impossible acceptance). Package as a `redbear-mt7922-check` in-guest binary (pattern: `redbear-phase5-wifi-check`) with capture/analyze artifacts to `local/docs/evidence/ryzen-x670e/wifi/`. Each rung is a separate logged checkpoint; a rung failure = root-cause fix before proceeding (ABSOLUTE RULE). Must NOT: claim connectivity from bounded simulation; skip the recovery rung (mt76 reset paths are where these drivers die). + Parallelization: Wave 6 | Blocked by: 23,27 | Blocks: 32 + References: `local/docs/WIFI-IMPLEMENTATION-PLAN.md` (ladder discipline); `local/scripts/test-wifi-baremetal-runtime.sh` + `redbear-phase5-wifi-*` harness (pattern); `local/docs/evidence/` layout + Acceptance criteria: checker exits 0 with every rung logged; real association + DHCP lease + traffic counters non-zero in the capture. + QA scenarios: happy: full ladder pass on host. failure: rung N fails → fix, re-run from rung N (never skip). Evidence `.omo/evidence/task-28-ryzen-7000-x670e-compat.txt` + Commit: Y | test(wifi): MT7922 bounded runtime ladder on MS-7D70 + +- [ ] 29. redbear-btusb: real USB HCI transport + btmtk WMT vendor module (MediaTek BT) + What to do / Must NOT do: Two prerequisites before any WMT work is meaningful. (a) **Real USB HCI transport**: the current daemon constructs `StubTransport` (`redbear-btusb/source/src/main.rs:798`), which is only an in-memory test double (`usb_transport.rs:43-137`) — replace it with a real USB transport: control transfers (HCI commands), interrupt endpoint (HCI events), bulk IN/OUT (ACL data), and isochronous surface reserved (SCO later), with USB error recovery (STALL clear, bounded retries, device reset on repeated failure). Host-runnable tests over a mock USB stack; the transport must pass the existing HCI core's test suite unchanged. (b) **btmtk WMT vendor module**: add `btmtk.rs` mirroring the `btintel.rs` pattern (vendor handler plugged into the existing vendor-agnostic HCI core — NOT a new probe path): WMT header structs (`btmtk_wmt_hdr`, hci_wmt_cmd/evt), subsystem reset sequence (MTK_BT_SUBSYS_RST write + EP_RST_OPT + msleep), chip-id query, firmware section-map download (`BTMTK_WMT_PATCH_DWNLD`, ≤250-byte blocks) of `BT_RAM_CODE_MT7922_1_1_hdr.bin`, FUNC_CTRL enable. VID:PID → vendor-module dispatch: `0e8d:0616` (and the btusb.c wildcard family) routes to btmtk; Intel VIDs stay on btintel. The MT7922 BT advertises class 0xE0/0x01/0x01, so binding already succeeds via the existing class path — add 0x0E8D to `KNOWN_BLUETOOTH_USB_VENDORS` as belt-and-braces (not the binding gate — Metis M4). Firmware staged via todo 27's selected provider (monolithic `redbear-firmware` in full; the mediatek subset only in the standalone experimental profile). Host-runnable tests for WMT packet encode/decode + section-map parsing. Must NOT: accept the StubTransport as a runtime path (Gate B requires the real transport); fork the HCI core per vendor; block USB transport on firmware download (bounded retries + typed error). + Parallelization: Wave 7 | Blocked by: 23,27 | Blocks: 32 + References: `local/recipes/drivers/redbear-btusb/source/src/{main.rs:23-84,798,hci.rs,btintel.rs,usb_transport.rs:43-137}`; Linux 7.1 `drivers/bluetooth/{btusb.c:2939-2960 (transport shape),btmtk.c:134-273,623-671,btmtk.h:69-81}`; `local/docs/BLUETOOTH-IMPLEMENTATION-PLAN.md` + Acceptance criteria: `cargo test` GREEN (WMT codec + section map + mock-USB transport contract incl. HCI core suite unchanged); canonical build; bounded HCI bring-up QA on host with the REAL transport: reset → read version → firmware download → operational mode logged. + QA scenarios: happy: BT device reaches operational mode on host over the real USB transport. failure: firmware download NACK → typed error + bounded retry, never a hung USB transfer; transport STALL → clear + retry, never silent drop. Evidence `.omo/evidence/task-29-ryzen-7000-x670e-compat.txt` + Commit: Y | feat(bt): real USB HCI transport + btmtk WMT vendor module (redbear-btusb) + +- [x] 30. Raphael read-only probe (BAR roles, IP discovery, ATOM, firmware inventory) + What to do / Must NOT do: **Evidence-only, zero register writes to the GPU.** A probe tool (host-side analysis + in-guest read-only utility) that establishes from task-3 artifacts + live reads: (a) true BAR roles for 1002:164e (verify BAR0=framebuffer aperture, BAR2=doorbell, BAR5=MMIO — the current glue assumes the inverse); (b) IP-discovery TMR location/content summary (GC 10.3.6, DCN 3.1.5, SDMA 5.2.6, VCN 3.1.2, MP0/MP1 13.0.5 per `apu-asic-info-table.csv:9`); (c) ATOM BIOS table inventory (connector routing: which HDMI/DP ports the board wires); (d) firmware inventory vs the 11-file required set; (e) GOP state: confirm the bootloader can establish a GOP framebuffer on this iGPU (vesad interim depends on it — Metis M8). Output: `local/docs/evidence/ryzen-x670e/raphael-probe.md` with a go/no-go assessment for the DCN315 slice (todo 33 is BLOCKED on this). Must NOT: take over the display, write GPU registers, or load firmware — read-only. + Parallelization: Wave 7 | Blocked by: 3 | Blocks: 33 + References: task-3 evidence (lspci -vv of iGPU BDF, GOP info); Linux 7.1 `drivers/gpu/drm/amd/amdgpu/{amdgpu_discovery.c:265-350,514-543,655-725,amdgpu_device.c:3834,amdgpu_doorbell_mgr.c:204}`; `Documentation/gpu/amdgpu/apu-asic-info-table.csv:9`; Oracle verdict C (top-3 unknowns); Metis M8/M12 + Acceptance criteria: probe report committed answering (a)-(e) with citations; explicit go/no-go + confirmed BAR topology recorded; if go=NO, todo 33 replans before any port work (gate, not a failure). + QA scenarios: happy: report answers all five with real data. failure: any item undeterminable from available access → recorded as BLOCKED with the exact missing access (e.g. needs in-guest MMIO read), no guessing. Evidence `.omo/evidence/task-30-ryzen-7000-x670e-compat.md` + Commit: Y | test(gpu): Raphael read-only probe + BAR/IP/ATOM inventory + +- [x] 31. Raphael firmware staging (11-file set) + redox-drm manifest correction + What to do / Must NOT do: Stage Raphael's required 11-blob set: `gc_10_3_6_{ce,pfp,me,mec,mec2,rlc}.bin`, `psp_13_0_5_{toc,ta}.bin`, `sdma_5_2_6.bin`, `vcn_3_1_2.bin`, `dcn_3_1_5_dmcub.bin` — **NO `smu_13_0_5.bin`** (does not exist; APU SMU loads via PSP — Metis B3), no sdma_6/vcn_4/mes_2 (RDNA3, not Raphael). The per-ASIC manifest requests ONLY this set for 1002:164e; all existing firmware for other ASICs is retained untouched (the shared `redbear-firmware-amdgpu` recipe globs the full `amdgpu/` tree — that stays). Verify the recipe covers all 11; if upstream-gated, wire a `firmware-fallbacks.d/40-amdgpu-raphael.toml` chain. Correct the redox-drm AMD firmware manifest (`redox-drm/source/src/main.rs:334-355`): replace the gc_11_0_0-only expectation list with per-ASIC-version resolution (GC 10.3.6 → gc_10_3_6_*, DCN 3.1.5 → dcn_3_1_5_dmcub, SDMA 5.2.6 → sdma_5_2_6, VCN 3.1.2 → vcn_3_1_2), keeping RDNA2-desktop (NAVI) entries for other hardware. Host test for the manifest resolution. Must NOT: remove the NAVI entries (other boards use them); require firmware before the probe says go (staging is harmless; loading is gated). + Parallelization: Wave 7 | Blocked by: 24 | Blocks: 33 + References: `local/recipes/gpu/redox-drm/source/src/main.rs:274-278,334-355`; `local/scripts/fetch-firmware.sh:149` (pattern check); `local/recipes/system/redbear-firmware-amdgpu/recipe.toml`; Linux 7.1 `MODULE_FIRMWARE` declarations (`gfx_v10_0.c:265-270`, `psp_v13_0.c:40-41`, `sdma_v5_2.c:54`, `amdgpu_vcn.c:57`, `amdgpu_dm.c:130-131`); Metis B3 + Acceptance criteria: all 11 blobs present in the redbear-full image (`ls` staged sysroot); manifest resolution unit test GREEN for both 1002:164e and a NAVI ID; canonical build. + QA scenarios: happy: 11/11 blobs in image; manifest resolves per-ASIC. failure: any blob missing → recipe glob fixed, never a runtime chase. Evidence `.omo/evidence/task-31-ryzen-7000-x670e-compat.txt` + Commit: Y | feat(gpu): Raphael firmware staging + per-ASIC manifest resolution + +- [ ] 32. Wi-Fi + BT coexistence validation on the host + What to do / Must NOT do: Concurrent-operation proof on the MS-7D70 (post todos 28+29): simultaneous Wi-Fi scan/association + BT LE scan + a BT ACL/BLE connection while Wi-Fi passes traffic — record Wi-Fi throughput delta and BT packet success rate; the pass bar: association maintained, BT connection maintained, throughput delta < 30% vs solo baseline, zero firmware resets in a 10-minute soak. Artifacts to `local/docs/evidence/ryzen-x670e/coexistence/`. Must NOT: add a coordination daemon unless the soak proves independent reset paths cannot be serialized through existing lifecycle policy (Oracle verdict B). + Parallelization: Wave 7 | Blocked by: 28,29 | Blocks: 40 + References: Linux 7.1 mt76/btmtk coexistence handling (`mt76_connac` shared-firmware notes); `local/docs/WIFI-IMPLEMENTATION-PLAN.md` + `BLUETOOTH-IMPLEMENTATION-PLAN.md` + Acceptance criteria: soak log shows both radios operational for 10 minutes within the pass bar; evidence archived. + QA scenarios: happy: soak passes. failure: resets/dropouts → root-cause (antenna/share firmware coordination) and re-run; escalate to operator if hardware-level coordination is required. Evidence `.omo/evidence/task-32-ryzen-7000-x670e-compat.txt` + Commit: Y | test(net): MT7922 Wi-Fi/BT coexistence soak on MS-7D70 + +- [ ] 33. DCN315 minimal display slice (probe-gated; closure derived from dcn315_resource.c) + What to do / Must NOT do: **BLOCKED on todo 30's go-decision AND todo 24's exemption AND confirmed BAR topology.** FIRST deliverable — derive and record the exact compile/link closure from Linux 7.1 `dcn315_resource.c` BEFORE writing any port code (review-verified: it pulls the **dcn31** header family — `dcn31_init/resource/hubbub/hubp/optc/hpo_dp_stream_encoder/hpo_dp_link_encoder/apg` — NOT dcn314; the DML pieces Raphael needs live under `dc/dml/dcn31/`, and the DCN315-specific files are laid out per-subsystem as `dc/{resource,clk_mgr,gpio,irq}/dcn315/`, there is no single `dc/dcn315/` directory). The closure record must enumerate AND CLASSIFY every unit: DCN315 resource pool + clk_mgr + gpio + irq, the DCN31 DML/HWSS transitive set, DMUB interface + firmware load (`dcn_3_1_5_dmcub.bin`), PSP/SMU init prerequisites, ATOM table usage, NBIO/IH register needs, and the concrete scanout-memory path (UMA carve-out vs minimal GMC address translation, cache coherency, IOMMU interaction) — **each unit tagged as either {authorized C ABI surface} (register access, DMUB interface, firmware load — per the todo-24(b) category boundary) or {reference-only Rust reimplementation} (DML math, resource-pool construction, HWSS sequencing, modeset policy — ported into Rust using the Linux source as reference, NOT compiled as C)**; the classified record is appended to the todo-24(b) AGENTS.md block as its concrete surface list. THEN implement: C only for the C-classified units; Rust for everything else. Target: DC-init + one connector (HDMI or DP per ATOM routing) + legacy modeset producing a framebuffer. NO atomic KMS, NO rendering/3D, NO Mesa (3D-DESKTOP-COMPREHENSIVE-PLAN owns those) — but if the closure evidence shows APU scanout REQUIRES minimal GMC address translation to reach the framebuffer, that minimal GMC subset is in scope (the prohibition is on render/GART-for-3D, not on evidence-required scanout translation). Must NOT: reuse the current bounded AMD glue's inverted BAR assumptions; take over the GOP framebuffer before the DC path is proven (vesad stays the console until the modeset gate passes); start porting before the closure record exists. + Parallelization: Wave 7 | Blocked by: 24,30,31 | Blocks: 34 + References: Linux 7.1 `drivers/gpu/drm/amd/display/dc/resource/dcn315/dcn315_resource.c` (+ its dcn31 include family), `drivers/gpu/drm/amd/display/dc/{clk_mgr,gpio,irq}/dcn315/`, `dc/dml/dcn31/`, `dc/core/dc_resource.c:356-357`, `amdgpu_dm/amdgpu_dm.c:6105-6154` (DMCUB load); Raphael probe report (todo 30); `local/docs/3D-DESKTOP-COMPREHENSIVE-PLAN.md` + Acceptance criteria: closure record committed to `local/docs/evidence/ryzen-x670e/dcn315-closure.md` (file lists + sizes + init order + scanout path) BEFORE port code; canonical build of the slice; DC-init completes on host with DMCUB handshake logged; connector detected with EDID read. + QA scenarios: happy: closure record exists, DC-init + EDID on host. failure: DMCUB no-response → typed error + firmware-state dump, never register poking blind. Evidence `.omo/evidence/task-33-ryzen-7000-x670e-compat.txt` + Commit: Y | feat(gpu): DCN315 minimal display slice (probe-gated, closure-first) + +- [ ] 34. iGPU modeset gate: one monitor on HDMI/DP via redox-drm + What to do / Must NOT do: The display gate: redox-drm claims 1002:164e (driver-manager `[[driver.match]]` for `vendor = 0x1002, device = [0x164E]` with appropriate priority vs vesad), performs the DCN315 legacy modeset at the EDID native mode, and produces a stable framebuffer on a physical monitor for 30 minutes (no flicker, no IH-ring wedges, HPD unplug/replug recovery logged). vesad remains installed as fallback (never removed). Update matrix markers. Must NOT: claim 3D/acceleration (framebuffer only); regress the QEMU virtio-gpu path. + Parallelization: Wave 7 | Blocked by: 23,33 | Blocks: 40 + References: `local/recipes/gpu/redox-drm/source/src/` (scheme/KMS surface); `local/scripts/test-drm-display-runtime.sh` + `test-amd-gpu.sh` (harness); todo 33 slice + Acceptance criteria: 30-minute stability log + HPD recovery log on the host; QEMU virtio-gpu regression boot unaffected. + QA scenarios: happy: stable native-mode framebuffer + HPD recovery. failure: wedge/flicker → root-cause in the slice, re-run. Evidence `.omo/evidence/task-34-ryzen-7000-x670e-compat.txt` + Commit: Y | test(gpu): iGPU modeset gate on MS-7D70 (framebuffer) + +- [x] 35. ihdad: AMD HDA support (widen match + runtime verification on 1022:15e3) + What to do / Must NOT do: ihdad's code is vendor-agnostic (claims any class 0x0403; verbs/CORB/RIRB are HD Audio spec) but the driver-manager entry is Intel-only (`local/config/drivers.d/50-audio.toml:9-11`, vendor=0x8086): widen to include `vendor = 0x1022, device = [0x15E3]` (+ embedded copy in redbear-device-services.toml), then runtime-verify on the host: controller init, codec enumeration (Realtek ALC on this board), stream setup; if AMD-specific quirks surface (snoop/reset behavior), implement them properly (reference Linux `sound/pci/hda/`), NOT workarounds. Must NOT: regress Intel HDA (LG path); claim HDMI-audio-through-iGPU (separate function, out of scope here). + Parallelization: Wave 8 | Blocked by: — | Blocks: 40 + References: `local/sources/base/drivers/audio/ihdad/src/{main.rs,hda/}`; `local/config/drivers.d/50-audio.toml`; Linux 7.1 `sound/pci/hda/` (AMD quirk references); task-3 lspci (codec visibility) + Acceptance criteria: canonical build; on host: ihdad binds 1022:15e3, enumerates codecs, and produces an audio scheme node; Intel regression test (existing harness) still passes. + QA scenarios: happy: codec enumerated + scheme live on host. failure: probe finds no codecs → typed graceful failure (never a boot hang — LG plan requirement). Evidence `.omo/evidence/task-35-ryzen-7000-x670e-compat.txt` + Commit: Y | feat(audio): AMD HDA (1022:15e3) via ihdad + runtime verification + +- [x] 36. AMD CPPC cpufreq path (correct MSR set 0xC00102B0-B5, CPUID 0x80000008:EBX[27]) + What to do / Must NOT do: Extend `redbear-power` + `cpufreqd` with the AMD path alongside the Intel HWP path, with the CORRECT hardware interface (review-verified against Linux 7.1 `arch/x86/include/asm/msr-index.h:768-773` + `cpufeatures.h:348`): capability detection via **CPUID level 0x80000008, EBX bit 27**; read capabilities from MSR_AMD_CPPC_CAP1 (0xC00102B0, lowest/low-nonlinear/nominal/highest perf masks) and CAP2 (0xC00102B2); enable via MSR_AMD_CPPC_ENABLE (0xC00102B1); program via MSR_AMD_CPPC_REQ (0xC00102B3) min/max/desired/EPP fields — active/passive/guided modes map onto REQ semantics; **REQ2 (0xC00102B5) is NOT an autonomous-mode surface — it carries FloorPerf and is used only when the CPPC performance-priority feature is advertised (**CPUID 0x80000007:EDX bit 16**, CPPC_PERF_PRIO — with a negative test: REQ2 access absent when the bit is clear)** (reference: Linux `amd-pstate.c` REQ2 usage); programming verification = readback of REQ; **observed frequency derives from APERF/MPERF delta sampling, not from STATUS alone**; per-core energy readout via the existing AMD RAPL MSRs (0xC0010299-0xC001029B). Governor policy maps to EPP values (0=perf … 0xFF=efficiency). All MSR access per-core with safe read/modify/write. Host-runnable tests for MSR encode/decode + EPP mapping + APERF/MPERF delta math. Must NOT: touch the Intel HWP path semantics; use ACPI _CPC as the primary path (MSR is canonical for Zen4 — _CPC is the fallback); treat REQ2 as always-available (gate on the support bit). + Parallelization: Wave 8 | Blocked by: — | Blocks: 40 + References: `local/recipes/system/cpufreqd/source/src/main.rs:13-181` (Intel-centric today); `local/recipes/system/redbear-power/source/src/{msr.rs:76-79,acpi.rs,platform.rs}`; Linux 7.1 `arch/x86/include/asm/msr-index.h:768-773` + `arch/x86/include/asm/cpufeatures.h:348` + `drivers/cpufreq/amd-pstate.c:202-353` + Acceptance criteria: `cargo test` GREEN; canonical build; on host: redbear-power shows per-core Zen4 frequencies + governor switch changes EPP (verify via frequency shift under load). + QA scenarios: happy: governor switch measurably changes clocks on host. failure: MSR write rejected (virtualized env) → typed error, Intel path unaffected. Evidence `.omo/evidence/task-36-ryzen-7000-x670e-compat.txt` + Commit: Y | feat(power): AMD CPPC cpufreq path (Zen4 MSR, correct set) + +- [x] 37. k10temp driver for 1022:14e3 (Zen thermal sensor) + What to do / Must NOT do: New Rust daemon `local/recipes/drivers/redbear-k10tempd/` reading the Family 19h thermal device (PCI 1022:14e3, DF F3): Tctl register access per Linux `drivers/hwmon/k10temp.c`, temperature publication on a scheme consumed by redbear-power/thermald; driver-manager match entry + mini config inclusion (text-only monitor → mini per first-class policy). Host-runnable tests for register decode + Tctl offset math. Must NOT: assume Linux sysfs (that's the Linux fallback, not our stack); hardcode per-model quirks without a table (use the quirk system). + Parallelization: Wave 8 | Blocked by: — | Blocks: 40 + References: Linux 7.1 `drivers/hwmon/k10temp.c:543-575` (ID table incl. 0x14e3); `local/recipes/system/redbear-power/source/src/sensor.rs:385-396` (consumer); driver-manager TOML format (`local/config/drivers.d/`) + Acceptance criteria: `cargo test` GREEN; canonical build; on host: sane Tctl readout (30-95°C range) in redbear-power. + QA scenarios: happy: temperature tracks load on host. failure: implausible reading → typed error + no publication (never publish garbage to thermald). Evidence `.omo/evidence/task-37-ryzen-7000-x670e-compat.txt` + Commit: Y | feat(power): redbear-k10tempd (Family 19h thermal) + +- [ ] 38. redbear-smbusd (1022:790b) + gpio-amdpt port (AMDIF031 via acpid/hwd) + What to do / Must NOT do: (a) `local/recipes/drivers/redbear-smbusd/`: FCH SMBus driver on the piix4 model (Linux `drivers/i2c/busses/i2c-piix4.c`, rev ≥ 0x51 MMIO mode) — it is a PCI device (1022:790b), so it gets a driver-manager `[[driver.match]]` entry; it registers as an i2cd provider (substrate — no consumer claims until proven; do NOT present it as an I²C-HID transport without evidence of an actual I2C-HID device behind FCH SMBus on this board); (b) `local/recipes/drivers/redbear-gpio-amdptd/`: port of Linux `drivers/gpio/gpio-amdpt.c` (147 LoC — PT_DIRECTION/INPUT/OUTPUT/CLOCKRATE/SYNC registers, 24 pins for AMDIF031). AMDIF031 is an **ACPI platform device, NOT PCI**, and the needed ACPI→driver spawn path **does not exist yet** (hwd's ACPI backend enumerates/logs HIDs but never matches, claims, or spawns platform drivers with `_CRS` resources) — so this todo BUILDS that path first: a typed HID→driver registry in hwd/acpid (HID string → driver binary + spawn policy), an exclusive claim model (one driver per ACPI device), a capability-safe `_CRS` resource handoff (MMIO region passed as a scoped capability, not raw physmap), and lifecycle (driver exit → device released). gpio-amdptd is the first consumer of the registry (HID `AMDIF031`), exposing a GPIO scheme. All AML (`_CRS` etc.) routed through todo 10's serialized executor. Integration tests: synthetic AMDIF031 device → registry match → spawn → scheme live. Both daemons: host tests for register logic, mini config inclusion, documented as substrate in the compat doc. Must NOT: conflate AMDIF031 (gpio-amdpt) with AMDI0030/31 (pinctrl-amd — different IP, not on this board); force AMDIF031 through driver-manager's PCI match (it has no BDF); hand raw physical addresses to drivers (capability-scoped handoff only); claim consumers that don't exist. + Parallelization: Wave 8 | Blocked by: 10,15 | Blocks: 40 + References: Linux 7.1 `drivers/i2c/busses/i2c-piix4.c:892-1099` + `drivers/gpio/gpio-amdpt.c:69-147`; `local/sources/base/drivers/i2c/i2cd/` (provider contract); `local/sources/base/drivers/acpid/` (ACPI device spawn path); `local/docs/QUIRKS-SYSTEM.md` + Acceptance criteria: `cargo test` GREEN for both; canonical build; on host: smbus registers as i2c provider (visible in i2cd adapter list); GPIO scheme exposes 24 pins with direction/read/write via the acpid-spawned path. + QA scenarios: happy: providers live on host. failure: MMIO readback mismatch → typed error + no registration. Evidence `.omo/evidence/task-38-ryzen-7000-x670e-compat.txt` + Commit: Y | feat(drivers): redbear-smbusd + redbear-gpio-amdptd (ACPI-launched) + +- [x] 39. Deferred-with-docs table (TPM, sp5100 watchdog, PSP, MSI vendor HIDs, UAC2, multi-segment MCFG) + What to do / Must NOT do: Add the "permanent no-driver (for now)" table to `local/docs/RYZEN-7000-X670E-COMPATIBILITY-PLAN.md` (LG plan §9.6 pattern): TPM2 CRB (MSFT0101 — no consumer: no measured boot/attestation), sp5100_tco watchdog (no consumer today), AMD PSP 1022:1649 (no crypto consumer), MSI Mystic Light 1462:7d70 / MEG AIO 0db0:6a05 / Nuvoton 0db0:9ba6 (vendor-protocol USB HIDs — enumerate cleanly, no driver; RGB/AIO control is vendor-software domain), USB Audio UAC 2.0 for 0db0:d6e7 (redbear-usbaudiod is UAC 1.0 — documented gap with the exact UAC2 features missing), multi-segment `Segment:BDF` identity (deferred if todo-17 evidence shows single-segment — end-to-end identity change across pcid/driver-manager/IOMMU, not a patch), suspend/S3 (desktop: S5 only, tracked in ACPI-IMPROVEMENT-PLAN). Each entry: one-line justification + what would unblock it. Must NOT: silently drop any device from the matrix; leave any of these as TODO-without-reason. + Parallelization: Wave 8 | Blocked by: — | Blocks: 40 + References: LG plan §9.6 (table pattern); `local/docs/ACPI-IMPROVEMENT-PLAN.md` (sleep tracking); device evidence from task-3 + Acceptance criteria: table present in the compat doc with every deferred device listed + justification; `grep -c '|' table` matches the deferred inventory (≥ 8 rows). + QA scenarios: happy: table complete. failure: a deferred device without justification row → add it. Evidence `.omo/evidence/task-39-ryzen-7000-x670e-compat.md` + Commit: Y | docs(plan): deferred-with-docs table for X670E + +- [ ] 40. Gate B (full): Wi-Fi + BT + display + audio + platform validation, matrix final + What to do / Must NOT do: The full bare-metal gate on the MS-7D70, packaged as `redbear-gate-b-check` (new recipe `local/recipes/system/redbear-gate-b-check/`, wired into `config/redbear-full.toml [packages]`): re-run Gate A checks plus — ACPI hardening evidence (GPE dispatch active + storm-safe, _OSC granted-capabilities log line, namespace wake enumeration, power-resource enumeration on the GPP7 tree, RSDP producer diagnostic), MT7922 associated + passing traffic (todo 28 evidence), coexistence soak (32), BT LE peripheral visible/connectable via redbear-btctl, iGPU modeset stable (34), ihdad codec live (35), CPPC governor switch (36), k10temp tracking (37), smbus/GPIO providers live (38). Update all matrix markers to hardware-validated levels; finalize the compat doc's matrix §2 verdicts from 🟡 to ✅/❌ per evidence; archive all logs under `local/docs/evidence/ryzen-x670e/gate-b/`. Must NOT: upgrade any verdict without the corresponding archived log. + Parallelization: Wave 9 | Blocked by: 9,10,11,12,13,23,28,32,34,35,36,37,38,39 | Blocks: F1-F4 + References: all gate evidence paths above; `local/docs/HARDWARE-VALIDATION-MATRIX.md`; compat doc (todo 1) + Acceptance criteria: every sub-check logged with archived artifact; matrix + compat doc updated in the same commit as the evidence index. + QA scenarios: happy: full gate pass. failure: any sub-check fails → root-cause, re-run gate (never downgrade the gate). Evidence `.omo/evidence/task-40-ryzen-7000-x670e-compat.txt` + Commit: Y | test(gates): Gate B full validation on MS-7D70 + matrix finalization + +## Final verification wave +> Runs in parallel after ALL todos. ALL must APPROVE. Surface results and wait for the user's explicit okay before declaring complete. +- [ ] F1. Plan compliance audit + Invocation: `task(subagent_type="oracle", prompt="Read .omo/plans/ryzen-7000-x670e-compat.md and every .omo/evidence/task-* artifact; per todo answer (a) Must-do implemented? (b) every Must-NOT honored? (c) does the recorded acceptance output match the claim? Return per-todo PASS/FAIL with citations.")`. Inputs: plan file + `.omo/evidence/`. Pass: 41/41 todos have matching evidence artifacts AND zero Must-NOT violations. Fail: any missing artifact, any policy violation (stub, removal, non-canonical build), any unverifiable acceptance claim → the verifier exits with the failing todo list. Verdict record: `.omo/evidence/f1-compliance-audit.md`. +- [ ] F2. Code quality review + Invocation: per-repo literal commands against the recorded baselines (`local/docs/evidence/ryzen-x670e/baselines.toml`): `git -C local/sources/ diff ..HEAD` for each of the 9 forks + `git diff ..HEAD` for the parent, PLUS `git -C status --short` in each (catches dirty/untracked work that a diff of commits misses — including any raw-evidence residue; todo 3's raw artifacts live outside the workspace, so `status --short` MUST be empty). Feed the diffs to a reviewer subagent (oracle) auditing every changed line for: `unwrap()`/`expect()` in new driver/library code, stubs/`unimplemented!()` in exercised paths, stringly-typed errors, C outside the two documented todo-24 exemptions, AI attribution in any commit message (`git log --format=%B ..HEAD`), newly added non-Rust operational tooling outside build glue (shell/python utilities — the project's Rust-only rule covers tooling), and **provenance: any ported file that is a copy of Linux/ACPICA implementation code rather than an original reimplementation (license + policy violation — reference-only rule; the firmware-ABI header surface inside the exemptions is the only permitted shared layout)**. Inputs: baselines.toml + submodule checkouts. Pass: zero violations AND clean `status --short` in every repo. Fail: any violation with file:line, or any uncommitted residue. Verdict record: `.omo/evidence/f2-code-quality.md`. +- [ ] F3. Real manual QA (operator-assisted bare-metal, two configuration passes) + Invocation: **Pass 1 — `build/x86_64/redbear-mini.iso`** on the MS-7D70: the staged Gate-A flow from todo 23 (guest checkpoints + host orchestrator confirms the real reboot and poweroff transitions). **Pass 2 — `build/x86_64/redbear-full.iso`** (the full config carries Wi-Fi/BT/display/audio/firmware): execute `redbear-mt7922-check` (todo 28, recipe `local/recipes/drivers/redbear-mt7922/` packaged checker) and `redbear-gate-b-check` (todo 40's packaged checker, new recipe `local/recipes/system/redbear-gate-b-check/` wired into `config/redbear-full.toml [packages]`: ACPI hardening evidence, Wi-Fi traffic, coexistence, BT LE, iGPU modeset, HDA codec, CPPC, k10temp, smbus/GPIO), then interactive spot checks: USB keyboard input at login, `redbear-netctl renew` on RTL8125, `redbear-power` governor toggle with frequency readback, one HPD unplug/replug cycle on the iGPU monitor. Pass: all three checkers exit 0 (Pass 1: gate-a staged; Pass 2: mt7922 + gate-b) + all four spot checks behave; `command -v redbear-gate-a-check` (mini) and `command -v redbear-gate-b-check` (full) verified in their images; archived `make validate CONFIG_NAME=redbear-mini` and `make validate CONFIG_NAME=redbear-full` outputs are clean. Fail: any checker non-zero or interactive anomaly → recorded with the failing sub-check. Verdict record: `.omo/evidence/f3-manual-qa.md` + archived boot logs for both passes. +- [ ] F4. Scope fidelity + Invocation: `task(subagent_type="metis", prompt="Read .omo/plans/ryzen-7000-x670e-compat.md Scope section; verify each of the 11 Must-have items has landed evidence in .omo/evidence/ (11/11), and verify EVERY Must-NOT guardrail holds: (1) no NVIDIA work, (2) no removals/ignores/comments-out of packages/patches/BINS/services, (3) no stubs/fake-headers/ifdef no-ops/sed-awk hacks, (4) no new Gitea repos/branches/submodules, (5) no new C in baseline diffs outside the two todo-24 exemptions (pre-existing iwlwifi/inherited C exempt), (6) no mac80211/cfg80211 import as control plane, (7) no bounded-AMD-glue shipped on Raphael, (8) no FullMAC assumption (MLME is Rust), (9) no suspend/sleep work, (10) no TPM/sp5100/PSP/EDAC/MSI-vendor-HID drivers, (11) no atomic-KMS/Mesa/radeonsi runtime work, (12) no non-canonical builds (repo cook/make live/cargo check --target as build substitutes), (13) no copied Linux/ACPICA implementation code (reference-only reimplementation; F2 provenance audit confirms). Return itemized verdict for all 11+13 items.")`. Pass: 11/11 Must-have evidenced, 0 guardrail violations. Fail: any gap. Verdict record: `.omo/evidence/f4-scope-fidelity.md`. + +## Commit strategy +- One atomic commit SET per todo (per project commit discipline): when a todo spans repos (e.g. todo 8: `submodule/kernel` + `submodule/base`; todo 14: `submodule/kernel` + the iommu recipe + `submodule/base` for the pcid-side MSI programming), the set is: submodule commits first (`submodule/` branches), then ONE parent commit containing the gitlink bumps, parent-tree changes (config, docs, recipes), and the todo's evidence pointer. Single-repo todos are a single commit. **Two multi-commit exceptions: todo 24 (three ordered policy commits: mt76 exemption, DCN315 exemption, firmware-redistribution note) and todo 33 (two ordered parent commits: closure record + AGENTS.md surface-list amendment FIRST, implementation SECOND — policy evidence must land before any C is written).** +- Fork code (MADT, TSC, ps2d, kernel IRQ wiring, acpid, nvmed, usbscsid, **pcid** — pcid lives in the base fork at `local/sources/base/drivers/pcid/`) → commits on the existing `submodule/` branches in `local/sources/*`, then parent gitlink bumps. New drivers → new `local/recipes/drivers//` recipes + symlinks + config wiring in the same commit series. +- New crate versions: Cat 1 in-house crates use `0.3.2` (branch version); run `./local/scripts/sync-versions.sh --check` before pushing. +- No AI attribution in any commit message. No new branches, no new repos, no new submodules. Push to `gitea.redbearos.org/vasilito/RedBear-OS` on the `0.3.2` branch (and `submodule/*` branches for forks). +- The AGENTS.md exemption amendments (todo 24) are their own commits on the `0.3.2` branch citing the operator's 2026-08-04 approval; they amend the **root** `AGENTS.md` (where the iwlwifi exemption block lives), not `local/AGENTS.md`. + +## Success criteria +1. `local/docs/RYZEN-7000-X670E-COMPATIBILITY-PLAN.md` exists as the canonical host plan, with device matrix, boot-path analysis, and the deferred-with-docs table. +2. Gate A (minimally usable) passes on the MS-7D70 host: boot to login, all CPUs online, no PCI resource conflicts, both NVMe controllers bound with verified I/O, USB HID input, wired RTL8125 network with DHCP, staged host-confirmed reboot and poweroff. +3. Gate B (full) passes on the host: MT7922 Wi-Fi associated with traffic, Wi-Fi/BT coexistence soak, BT LE operational, Raphael iGPU driving one monitor at native mode (framebuffer), AMD HDA codec live, CPPC governor switching, k10temp tracking, SMBus/GPIO providers live. +4. Every new driver is a first-class citizen (wired into a config), durable (fork commits / local recipes / local patches), and covered by host unit tests where pure-logic. +5. Canonical builds green throughout: `./local/scripts/build-redbear.sh redbear-mini` and `redbear-full` produce ISOs at every gate; `--check-sweep` clean. +6. No existing package, patch, service, or test was removed, ignored, or commented out anywhere in the program. +7. Universal groundwork landed machine-independently: PCI auditor+allocator, MADT normalization, TSC calibration, ACPI/acpid hardening (GPE/power-resources/_OSC/_REG/wake), UAS, HMB, optional PS/2, threading substrate validation (park/unpark, RwLock::write, thread::scope with the PACKAGE-BUILD-QUIRKS guidance matrix updated from evidence) — each documented in the compat doc as host-generic.