docs: benchmark refresh + ip65 status, LSP artifact cleanup, drain-budget fixes

.gitignore

@@ -12,3 +12,5 @@ tools/https_e2e/certs/*
 tools/diag_4de0_*.py
 tools/diag_read_live.py
 .serena/
+.ca65-ls/
+.mcp.json

Makefile

@@ -6,7 +6,8 @@
 # make — default, produces build/c64-https.prg + build/labels.txt
 # make clean — remove build artifacts
 # make run — launch the PRG in VICE x64sc
-# make ip65-libs — rebuild ip65 object libraries from the submodule
+# make ip65-libs — build ip65 object libraries from the submodule
+# (required once per fresh clone, BACKEND=ip65 only)
 # make ip65-blob — rebuild ip65-build/ip65-c64.bin (requires ip65-libs first)
 #
 # Variables:
@@ -418,13 +419,16 @@ ifeq ($(USE_OVERLAY_P384_EMBED),1)
 build/crypto/ecdsa_verify_384.o: build/p384_overlay_equates.inc
 endif
 
-# Build ip65 object libraries from the submodule. Only needed if the ip65
-# submodule changes; the prebuilt blob is committed to ip65-build/.
+# Build ip65 object libraries from the submodule. Required once per fresh
+# clone — the submodule ships sources, and the ip65-blob link below needs
+# the .lib archives this target produces. Re-run when the submodule moves.
 ip65-libs:
 	cd $(IP65_DIR) && $(MAKE) -C ip65 && $(MAKE) -C drivers
 
-# Build the ip65 binary blob (ip65-build/ip65-c64.bin). The resulting file is
-# committed to the repo so a normal `make` does not need to rebuild it.
+# Build the ip65 binary blob (ip65-build/ip65-c64.bin). The file is a
+# gitignored build artifact (.gitignore: ip65-build/*.bin), NOT committed.
+# `all` depends on it under BACKEND=ip65, so a normal `make` builds it once
+# and then reuses it — `clean` only removes build/, so it survives.
 ip65-blob: $(IP65_BIN)
 
 $(IP65_BIN): $(IP65_BUILD)/ip65_stub.s $(IP65_BUILD)/ip65.cfg

src/crypto/ecdsa_verify_384.s

@@ -33,9 +33,9 @@
 ;
 ; Phase 5 Fix A: blob length is 130 bytes, not 146. RFC 8446
 ; §4.4.1 specifies the transcript-hash uses the negotiated cipher
-; suite's hash function — c64-https only negotiates
-; TLS_AES_128_GCM_SHA256, so the transcript is always 32 B SHA-256
-; regardless of the signature scheme. The 46+33+1+32 = 130 layout
+; suite's hash function — c64-https offers exactly one suite,
+; TLS_CHACHA20_POLY1305_SHA256 (0x1303), so the transcript is
+; always 32 B SHA-256 regardless of the signature scheme. The 46+33+1+32 = 130 layout
 ; is what the server signed; padding to 48 B for SHA-384's digest
 ; width would feed the verifier a different message than the one
 ; the server hashed. SHA-384(blob) still produces a 48 B digest
@@ -49,7 +49,9 @@
 ; 6. crypto_swap_to_p384_curve -> ecdsa_verify_384.
 ; C=0 valid / C=1 invalid -- propagated to caller.
 ;
-; Phase 5 note: c64-https only negotiates TLS_AES_128_GCM_SHA256, so
+; Phase 5 note: c64-https offers exactly one cipher suite,
+; TLS_CHACHA20_POLY1305_SHA256 (0x1303) — see src/tls_handshake.s:85
+; and the ServerHello echo check at :380 — and its hash is SHA-256, so
 ; the TLS 1.3 transcript-hash function is always SHA-256 (RFC 8446
 ; §4.4.1 ties transcript-hash to the cipher suite's hash, not to the
 ; signature_algorithm). The signed-content blob therefore embeds a
@@ -249,7 +251,7 @@ ecdsa_verify_384_tls:
  ; [98..129] transcript hash (32 B SHA-256). Phase 5 Fix A:
  ; copy the 32 B SHA-256 tls_transcript verbatim — no padding.
  ; The TLS 1.3 transcript-hash is bound to the cipher suite
- ; (SHA-256 via TLS_AES_128_GCM_SHA256), independent from the
+ ; (SHA-256 via TLS_CHACHA20_POLY1305_SHA256), independent of the
  ; signature_algorithm's hash (SHA-384 here). Padding to 48 B
  ; would feed the verifier a different message than the server
  ; signed.

src/net/uci/net_tuning.inc

@@ -17,10 +17,10 @@
 ; uci_wait_not_busy, uci_begin_cmd, 4x uci_put_byte, uci_push_wait,
 ; uci_check_err, header read, uci_drain_resp + uci_drain_status +
 ; uci_ack — ~25 fenced register accesses plus FPGA turnaround).
-; Measured on a C64 Ultimate at 48 MHz: ~37 ms per poll, of which only
-; ~2.8 ms is fence time — the remainder is clock-invariant firmware
+; Measured on a C64 Ultimate at 48 MHz: ~40 ms per poll, of which only
+; ~3 ms is fence time — the remainder is clock-invariant firmware
 ; turnaround, so turbo does not help. ip65's 2000-poll budget therefore
-; cost ~70 s and regressed the shipped handshake from 51.0 s to 125.4 s
+; cost ~80 s and regressed the shipped handshake from 51.0 s to 125.4 s
 ; (issue #73).
 ;
 ; 16 polls (~0.6 s at 48 MHz) is a deliberate small hedge rather than 0:

src/tls13.s

@@ -471,9 +471,9 @@ tls_recv_server_hello:
  ; The budget is BACKEND-SENSITIVE and therefore lives in the
  ; per-backend net_tuning.inc (issue #73): an ip65 net_poll is a
  ; cheap NIC pump, but a UCI net_poll is a full firmware command
- ; round-trip (~37 ms measured at 48 MHz, mostly clock-invariant
+ ; round-trip (~40 ms measured at 48 MHz, mostly clock-invariant
  ; FPGA turnaround). Sizing this loop on ip65's poll cost alone
- ; cost UCI ~70 s of pure wall-clock — and UCI firmware ACKs
+ ; cost UCI ~80 s of pure wall-clock — and UCI firmware ACKs
  ; autonomously, so the drain has nothing to buy there anyway.
  ; See each backend's net_tuning.inc for the values + rationale.
  ldy #NET_SH_DRAIN_OUTER

tools/_vice_helpers.py

@@ -8,12 +8,37 @@
 
 See user memory ``vice_reu_required_for_p256`` and the project's
 "VICE harness gotcha" note in ``CLAUDE.md`` for the canonical motivation.
+
+Opt-in no-REU mode
+------------------
+Setting ``C64_VICE_NO_REU=1`` in the environment drops the REU flags, so
+the packaging claim "the onchip PRG passes the ECDSA KAT without an REU"
+has a runnable test instead of requiring a monkeypatched copy of the
+script. It is deliberately opt-in and noisy: a no-REU run of a
+*REU-profile* build does not error, it silently computes wrong answers
+(a valid signature verifies as C=1). Only use it on
+``USE_NISTCURVES_ONCHIP=1`` images.
 """
 
 from __future__ import annotations
 
+import os
+import sys
+
 from c64_test_harness import ViceConfig
 
+#: Environment variable that opts a run out of the mandatory REU flags.
+NO_REU_ENV = "C64_VICE_NO_REU"
+
+
+def no_reu_requested(env: dict | None = None) -> bool:
+ """Return True when the environment opts out of the REU flags.
+
+ :param env: mapping to inspect (defaults to ``os.environ``).
+ """
+ src = os.environ if env is None else env
+ return str(src.get(NO_REU_ENV, "")).strip().lower() in ("1", "true", "yes", "on")
+
 
 def default_vice_config(
  *,
@@ -35,6 +60,20 @@ def default_vice_config(
  options (e.g. ``-warp``, custom monitor flags) without losing the REU
  enablement.
 
+ Setting ``C64_VICE_NO_REU=1`` omits the REU flags (and announces it on
+ stderr). That mode exists to test the REU-less onchip profile — the
+ shipped ``c64-https-uci-onchip.prg`` claims "no REU required", and this
+ is how that claim is reproduced:
+
+ .. code-block:: sh
+
+ make clean && make BACKEND=uci USE_NISTCURVES_ONCHIP=1
+ C64_SKIP_BUILD=1 C64_VICE_NO_REU=1 \\
+ python3 tools/test_ecdsa_kat_oracle.py
+
+ On any other build the same invocation returns wrong answers without
+ complaining, which is exactly why REU stays the default.
+
  Remaining keyword arguments are forwarded verbatim to ``ViceConfig``;
  typical callers pass ``prg_path``, ``warp``, ``ntsc``, ``sound`` etc.
 
@@ -44,7 +83,17 @@ def default_vice_config(
  :param kwargs: forwarded to :class:`c64_test_harness.ViceConfig`.
  :returns: a configured ``ViceConfig`` instance.
  """
- base_args = ["-reu", "-reusize", "512"]
+ if no_reu_requested():
+ print(
+ f"[{NO_REU_ENV}] VICE launching WITHOUT -reu — valid only for "
+ "USE_NISTCURVES_ONCHIP builds; any REU-profile image will "
+ "silently compute wrong results.",
+ file=sys.stderr,
+ flush=True,
+ )
+ base_args: list[str] = []
+ else:
+ base_args = ["-reu", "-reusize", "512"]
  if extra_args:
  base_args = base_args + list(extra_args)
  return ViceConfig(extra_args=base_args, **kwargs)