feat(kernel): Implement RFC-00C8 concurrent fault isolation test

.github/workflows/qemu-boot.yml

@@ -715,6 +715,12 @@ jobs:
           # dereferences address 0x0, generating a Data Abort EC=0x24.
           # The scheduler's fault handler must contain it and return to EL1.
           check "[axion] el0: fault contained (tid=8, ec=0x24)"
+
+          # Phase 19 (RFC-00C8): EL0 concurrent fault isolation — Process F (tid=7)
+          # faults immediately on start. Process E (tid=6) continues running
+          # normally, proving the fault handler context-switches correctly.
+          check "[axion] el0: concurrent fault OK (tid=7 faulted, tid=6 exited)"
+
           check "[axion] t81sh: ready (principal=axion, tier=1)"
           echo "$pass passed, $fail failed"
           [ "$fail" -eq 0 ]

README.md

@@ -177,6 +177,7 @@ t81 code run inference.t81 --policy secure_model.apl --weights-model model.t81w
 - Running on real ternary hardware (none exists)
 
 T81 prioritizes **verifiability, determinism, and governance** over broad compatibility.
+All determinism guarantees are strictly bounded by the [Determinism Surface Registry](docs/governance/DETERMINISM_SURFACE_REGISTRY.md).
 
 ## License
 

docs/governance/PUBLIC_API_LOCK.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.9.0",
-  "surface_digest_sha256": "fa406791328c8ce64c03f25aa794b20b069d0b68a1755213585f90aee2d02c93",
+  "version": "1.9.1",
+  "surface_digest_sha256": "0273b35f183e65abd74a14ed51110e86b5272471753076a0839c8d8fbea56581",
   "scope": "include/t81/**/*.hpp"
 }

ternaryos/docs/PROGRESS.md

@@ -27,6 +27,15 @@ RFC-00B9 boundary note:
 
 ---
 
+## RFC-00C8 — Concurrent Fault Isolation (2026-03-23)
+
+Phase 19: Validates the fault handler context-switch path and per-thread L3 isolation.
+
+- **Two threads:** Thread E (tid=6, device wait) and Thread F (tid=7, immediate fault).
+- **Execution flow:** Process F faults immediately upon start. The fault handler marks it as Faulted, installs E's L3 table, and context-switches to E. E runs successfully, blocks on a device wait, wakes up, and exits.
+- **Verification:** Ensures the governance ring contains both `kGovThreadFault(7)` and `kGovTimerDeviceWake(6)`.
+- **CI gate:** `[axion] el0: concurrent fault OK (tid=7 faulted, tid=6 exited)`
+
 ## RFC-00C7 — EL0 Fault Containment (2026-03-23)
 
 Phase 18: hardware fault containment for the cooperative EL0 scheduler.

ternaryos/hal/aarch64_trap_entry.cpp

@@ -35,15 +35,22 @@ void axion_kernel_handle_svc_trap_aarch64(
     axion_kernel_handle_svc_trap(*g_trap_dispatch_state, svc_frame);
 }
 
+}  // namespace t81::ternaryos::hal
+
+#if defined(__aarch64__) && !defined(__APPLE__) && !defined(__MACH__)
+// axion_exception_vector_base is the symbol defined by the .balign 2048 /
+// .global directive in aarch64_exception_vectors.S.  Writing its address
+// into VBAR_EL1 installs the Axion exception vector table.
+extern "C" char axion_exception_vector_base[];
+#endif
+
+namespace t81::ternaryos::hal {
+
 void axion_kernel_install_exception_vectors() noexcept {
     // Only execute on bare-metal AArch64 targets (QEMU / real hardware).
     // Excluded on macOS/Apple Silicon: the host OS runs at EL0 and VBAR_EL1
     // is privileged; attempting to write it would fault immediately.
 #if defined(__aarch64__) && !defined(__APPLE__) && !defined(__MACH__)
-    // axion_exception_vector_base is the symbol defined by the .balign 2048 /
-    // .global directive in aarch64_exception_vectors.S.  Writing its address
-    // into VBAR_EL1 installs the Axion exception vector table.
-    extern char axion_exception_vector_base[];
     asm volatile(
         "msr vbar_el1, %0"
         :