This commit is contained in:
@@ -0,0 +1,20 @@
|
||||
# ADR-0003: Fail-closed capability probe
|
||||
|
||||
- Status: accepted
|
||||
- Date: 2026-07-16
|
||||
|
||||
## Decision
|
||||
|
||||
The PS5 probe is disabled in ordinary builds. A probe build embeds exactly one
|
||||
approved firmware identifier, defaulting to `NONE`. Runtime requires an exact
|
||||
firmware match and the literal `--acknowledge-read-only-probe` argument before
|
||||
module loading. The checked-in firmware matrix is empty.
|
||||
|
||||
The platform shim may call only `dlopen`, `dlsym`, and `dlclose`. Logs contain
|
||||
symbol names and booleans, never addresses. There is no deploy target.
|
||||
|
||||
## Consequences
|
||||
|
||||
Default artifacts cannot discover symbols on hardware. A deliberately gated
|
||||
artifact still requires separate human authorization before transfer or
|
||||
execution. Loader-internal side effects remain an explicitly recorded unknown.
|
||||
Reference in New Issue
Block a user