From 45924d60c7a3581526e7c5f6d103bec00cc3fa39 Mon Sep 17 00:00:00 2001
From: Thefool <thefoolyuzhe@gmail.com>
Date: Wed, 11 Nov 2026 15:15:39 +0800
Subject: [PATCH 1/4] ci(smp): attach the restricted user network to the SMP
 harnesses

STRICT-Q S2 (D2(a), #64): smp_test.sh, smp_test_4core.sh and
extended_smp_test.sh boot with the same virtio-net device and
restricted user netdev as kernel_test.sh, so the seven network
runtime cases run instead of deferring on a missing eth0. Extending
boot_check.sh remains a separate, undecided proposal.
---
 scripts/gates/boot/extended_smp_test.sh |  2 ++
 scripts/gates/boot/smp_test.sh          |  2 ++
 scripts/gates/boot/smp_test_4core.sh    |  2 ++
 scripts/tests/gate_log_test.py          | 10 ++++++++++
 4 files changed, 16 insertions(+)

diff --git a/scripts/gates/boot/extended_smp_test.sh b/scripts/gates/boot/extended_smp_test.sh
index 775998c..2faebf1 100644
--- a/scripts/gates/boot/extended_smp_test.sh
+++ b/scripts/gates/boot/extended_smp_test.sh
@@ -116,6 +116,8 @@ run_smp_test() {
 
     run_gate_qemu "$timeout_val" "runtime" "$QEMU" -bios "$OVMF" \
         -drive format=raw,file=fat:"$ser.inputs/esp",snapshot=on \
+        -netdev user,id=net0,restrict=on,ipv6=off \
+        -device virtio-net-pci,netdev=net0,romfile= \
         -smp "$cpu_count" \
         -m 512M -vga std -no-reboot -no-shutdown \
         -cpu qemu64,+smep,+smap,+umip,+rdrand \
diff --git a/scripts/gates/boot/smp_test.sh b/scripts/gates/boot/smp_test.sh
index 609a4a5..c3f0210 100644
--- a/scripts/gates/boot/smp_test.sh
+++ b/scripts/gates/boot/smp_test.sh
@@ -92,6 +92,8 @@ python3 "$ROOT/scripts/ci/gate_inputs.py" prepare --source "$ESP" --output "$ser
 
 run_gate_qemu "$TO" "runtime" "$QEMU" -bios "$OVMF" \
     -drive format=raw,file=fat:"$ser.inputs/esp",snapshot=on \
+    -netdev user,id=net0,restrict=on,ipv6=off \
+    -device virtio-net-pci,netdev=net0,romfile= \
     -smp 2 \
     -m 512M -vga std -no-reboot -no-shutdown \
     -cpu qemu64,+smep,+smap,+umip,+rdrand \
diff --git a/scripts/gates/boot/smp_test_4core.sh b/scripts/gates/boot/smp_test_4core.sh
index fc22458..20e5435 100644
--- a/scripts/gates/boot/smp_test_4core.sh
+++ b/scripts/gates/boot/smp_test_4core.sh
@@ -93,6 +93,8 @@ python3 "$ROOT/scripts/ci/gate_inputs.py" prepare --source "$ESP" --output "$ser
 
 run_gate_qemu "$TO" "runtime" "$QEMU" -bios "$OVMF" \
     -drive format=raw,file=fat:"$ser.inputs/esp",snapshot=on \
+    -netdev user,id=net0,restrict=on,ipv6=off \
+    -device virtio-net-pci,netdev=net0,romfile= \
     -smp 4 \
     -m 512M -vga std -no-reboot -no-shutdown \
     -cpu qemu64,+smep,+smap,+umip,+rdrand \
diff --git a/scripts/tests/gate_log_test.py b/scripts/tests/gate_log_test.py
index a82ad62..b84a027 100644
--- a/scripts/tests/gate_log_test.py
+++ b/scripts/tests/gate_log_test.py
@@ -439,6 +439,16 @@ def test_q35_requires_active_iommu_and_retains_all_evidence(self):
         self.assertIn("-machine\nq35\n", arguments)
         self.assertIn("-device\nintel-iommu,intremap=on\n", arguments)
 
+    def test_runtime_harnesses_attach_the_restricted_user_network(self):
+        # STRICT-Q D2(a): kernel_test.sh and the three SMP harnesses give the guest a
+        # virtio-net eth0; extending boot_check.sh is a separate, undecided proposal.
+        netdev = "-netdev\nuser,id=net0,restrict=on,ipv6=off\n-device\nvirtio-net-pci,netdev=net0,romfile=\n"
+        for name, attached in (("kernel_test.sh", True), ("smp_test.sh", True), ("smp_test_4core.sh", True),
+                               ("extended_smp_test.sh", True), ("boot_check.sh", False)):
+            with self.subTest(script=name):
+                self.assert_gate(self.run_gate(name), 0)
+                self.assertEqual(netdev in (self.work / "qemu.arguments").read_text(), attached)
+
     def test_extended_aggregate_does_not_turn_qualified_into_pass(self):
         self.assert_gate(self.run_gate("extended_smp_test.sh", second_serial=QUALIFIED), 3)
         self.assert_gate(self.run_gate("extended_smp_test.sh", FAILED, second_serial=""), 1)

From 791644253d5778ad5506678968fdb8bd803fd360 Mon Sep 17 00:00:00 2001
From: Thefool <thefoolyuzhe@gmail.com>
Date: Wed, 11 Nov 2026 17:51:19 +0800
Subject: [PATCH 2/4] docs(validation): index the STRICT-Q S2 receipts

---
 .validation/strict-q-s2/README.md | 34 +++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)
 create mode 100644 .validation/strict-q-s2/README.md

diff --git a/.validation/strict-q-s2/README.md b/.validation/strict-q-s2/README.md
new file mode 100644
index 0000000..6f2a9d1
--- /dev/null
+++ b/.validation/strict-q-s2/README.md
@@ -0,0 +1,34 @@
+# STRICT-Q S2 validation
+
+Source: `45924d60c7a3581526e7c5f6d103bec00cc3fa39` on `2e09191` (main after #99). It attaches the restricted user network to the three SMP harnesses (decision D2(a)).
+
+Detailed commands, environment identities and artifact hashes are archived in the private documentation repository:
+
+[Immutable receipt archive](https://github.com/Zero-kernel/Nilix-docs-private/tree/d58fdb1c04d3da567680a5d908c79cedd49ad1ab/validation/strict-q-s2) · [Archive PR](https://github.com/Zero-kernel/Nilix-docs-private/pull/14)
+
+## Recorded results and limits
+
+- **Local.**
+  - Shell syntax, `make lint` and `git diff --check` pass.
+  - The `gate_log` harness tests pass, 34 including the new netdev test. Restoring `smp_test.sh` from the parent fails that test in its `smp_test.sh` case.
+  - All Python harness tests pass except one `iommu_device_probe_test` import error under plain unittest, which is unrelated; CI runs pytest.
+- **Dev host, QEMU 8.2, parent and S2 side by side.**
+  - Strict SMP-4 goes from passed=38 deferred=36 to passed=45 deferred=29. Exactly the seven network cases change, each from deferred to pass.
+  - Strict boot, runtime and runtime-4 are unchanged.
+  - SMP-2 is QUALIFIED with the same change (38/36 to 45/29).
+  - The runtime group is GATE-QUALIFIED on both sides.
+  - Times to verdict are unchanged within a second (parent vs S2): SMP-4 30.6 s vs 30.1 s, SMP-2 27.9 s vs 27.3 s.
+  - The 8/16-vCPU harness is BLOCKED on this host before QEMU starts, because `zstd` is not installed. CI covers it.
+- **Extended CI, run 42978556364 on this source.**
+  - Aggregate success, with every lane green. smp-8-16 and smp-32 are GATE-QUALIFIED on Ubuntu 22.04 and 24.04.
+  - The strict diagnostic lanes FAIL as on main, with strict SMP-4 at 45/29 on both images.
+  - The retained `counts.json` show the seven network cases passing at 8, 16 and 32 vCPUs on both images, with passed=45 deferred=29 at each size. On main they are deferred, at 38/36.
+- **Budget.** Compared with main's Extended run 42950345865 on `297d7d5`:
+  - smp-32 gate time: 4030.6 s → 4025.9 s (22.04) and 4251.6 s → 4223.9 s (24.04).
+  - smp-8-16 gate time: 1945.9 s → 1963.2 s and 1926.4 s → 1961.9 s.
+  - These are window-mode gates, and QUALIFIED means the suite completed inside each window: 900 s at 8 and 16 vCPUs, 3600 s at 32. The completion offset inside a window is not recorded, so the 32-vCPU margin itself is not measured.
+  - The 22.04 smp-8-16 job grew from 40 to 46 minutes. The growth is in its `final-owner-16` gate (243.6 s → 539.5 s), whose harness this change does not touch.
+
+None of these results is a strict pass. Ordinary builds and public CI do not require the private archive.
+
+The local-checks and gates receipts have aggregate status 1, from the unrelated unittest import error and from the remaining strict deferrals plus the blocked dev-host extended runs respectively. Individual statuses and log hashes are preserved.

From 574a183e6feb6cfc01dd814c7e68aff37152b27b Mon Sep 17 00:00:00 2001
From: Thefool <thefoolyuzhe@gmail.com>
Date: Wed, 11 Nov 2026 17:51:29 +0800
Subject: [PATCH 3/4] docs(validation): name the main artifact the S2 counts
 were compared with

---
 .validation/strict-q-s2/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.validation/strict-q-s2/README.md b/.validation/strict-q-s2/README.md
index 6f2a9d1..4cd37c1 100644
--- a/.validation/strict-q-s2/README.md
+++ b/.validation/strict-q-s2/README.md
@@ -22,7 +22,7 @@ Detailed commands, environment identities and artifact hashes are archived in th
 - **Extended CI, run 42978556364 on this source.**
   - Aggregate success, with every lane green. smp-8-16 and smp-32 are GATE-QUALIFIED on Ubuntu 22.04 and 24.04.
   - The strict diagnostic lanes FAIL as on main, with strict SMP-4 at 45/29 on both images.
-  - The retained `counts.json` show the seven network cases passing at 8, 16 and 32 vCPUs on both images, with passed=45 deferred=29 at each size. On main they are deferred, at 38/36.
+  - The retained `counts.json` show the seven network cases passing at 8, 16 and 32 vCPUs on both images, with passed=45 deferred=29 at each size. In main's 24.04 smp-8-16 artifact they are deferred, at 38/36.
 - **Budget.** Compared with main's Extended run 42950345865 on `297d7d5`:
   - smp-32 gate time: 4030.6 s → 4025.9 s (22.04) and 4251.6 s → 4223.9 s (24.04).
   - smp-8-16 gate time: 1945.9 s → 1963.2 s and 1926.4 s → 1961.9 s.

From 6e70aa1f52b6d75114c2e8ba3cd2da6f72368162 Mon Sep 17 00:00:00 2001
From: Thefool <thefoolyuzhe@gmail.com>
Date: Wed, 11 Nov 2026 18:26:48 +0800
Subject: [PATCH 4/4] docs(validation): record the S2 completion-mode extended
 runs

---
 .validation/strict-q-s2/README.md | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/.validation/strict-q-s2/README.md b/.validation/strict-q-s2/README.md
index 4cd37c1..89bc962 100644
--- a/.validation/strict-q-s2/README.md
+++ b/.validation/strict-q-s2/README.md
@@ -4,7 +4,7 @@ Source: `45924d60c7a3581526e7c5f6d103bec00cc3fa39` on `2e09191` (main after #99)
 
 Detailed commands, environment identities and artifact hashes are archived in the private documentation repository:
 
-[Immutable receipt archive](https://github.com/Zero-kernel/Nilix-docs-private/tree/d58fdb1c04d3da567680a5d908c79cedd49ad1ab/validation/strict-q-s2) · [Archive PR](https://github.com/Zero-kernel/Nilix-docs-private/pull/14)
+[Immutable receipt archive](https://github.com/Zero-kernel/Nilix-docs-private/tree/8b1854057a907bd0c112aea50173d7d26ef14950/validation/strict-q-s2) · [Archive PR](https://github.com/Zero-kernel/Nilix-docs-private/pull/14)
 
 ## Recorded results and limits
 
@@ -18,7 +18,10 @@ Detailed commands, environment identities and artifact hashes are archived in th
   - SMP-2 is QUALIFIED with the same change (38/36 to 45/29).
   - The runtime group is GATE-QUALIFIED on both sides.
   - Times to verdict are unchanged within a second (parent vs S2): SMP-4 30.6 s vs 30.1 s, SMP-2 27.9 s vs 27.3 s.
-  - The 8/16-vCPU harness is BLOCKED on this host before QEMU starts, because `zstd` is not installed. CI covers it.
+  - The 8/16/32-vCPU extended harness was then run in completion mode, against the parent. The first batch's BLOCKED rows came from leaving the host's `zstd` off PATH.
+    - All runs are QUALIFIED, 38/36 on the parent and 45/29 on S2.
+    - Times to verdict (S2 vs parent): 37.7 s vs 36.1 s at 8 vCPUs, 286.6 s vs 297.0 s at 16, and 699.5 s vs 740.9 s at 32.
+    - The NIC adds no measurable time.
 - **Extended CI, run 42978556364 on this source.**
   - Aggregate success, with every lane green. smp-8-16 and smp-32 are GATE-QUALIFIED on Ubuntu 22.04 and 24.04.
   - The strict diagnostic lanes FAIL as on main, with strict SMP-4 at 45/29 on both images.
@@ -26,9 +29,11 @@ Detailed commands, environment identities and artifact hashes are archived in th
 - **Budget.** Compared with main's Extended run 42950345865 on `297d7d5`:
   - smp-32 gate time: 4030.6 s → 4025.9 s (22.04) and 4251.6 s → 4223.9 s (24.04).
   - smp-8-16 gate time: 1945.9 s → 1963.2 s and 1926.4 s → 1961.9 s.
-  - These are window-mode gates, and QUALIFIED means the suite completed inside each window: 900 s at 8 and 16 vCPUs, 3600 s at 32. The completion offset inside a window is not recorded, so the 32-vCPU margin itself is not measured.
+  - These are window-mode gates, and QUALIFIED means the suite completed inside each window: 900 s at 8 and 16 vCPUs, 3600 s at 32.
+  - CI does not record when the suite completed inside a window, so the CI margin at 32 vCPUs is not measured.
+  - The dev-host completion times above bound the NIC's relative cost: none is measurable. They do not give the CI margin, because CI runners are smaller.
   - The 22.04 smp-8-16 job grew from 40 to 46 minutes. The growth is in its `final-owner-16` gate (243.6 s → 539.5 s), whose harness this change does not touch.
 
 None of these results is a strict pass. Ordinary builds and public CI do not require the private archive.
 
-The local-checks and gates receipts have aggregate status 1, from the unrelated unittest import error and from the remaining strict deferrals plus the blocked dev-host extended runs respectively. Individual statuses and log hashes are preserved.
+The local-checks and gates receipts have aggregate status 1, from the unrelated unittest import error and from the remaining strict deferrals respectively. The extended receipt has status 3: all QUALIFIED. Individual statuses and log hashes are preserved.