This commit is contained in:
@@ -0,0 +1,22 @@
|
||||
# Phase 1.0AM: offline bounded copy and restore model
|
||||
|
||||
Status: `HOST_EXACT_PROGRESS_AND_RESTORE_MODEL_COMPLETE_TARGET_CODE_BLOCKED`
|
||||
|
||||
Date: 2026-07-29
|
||||
|
||||
The capability-free model replaces the unsafe semantics identified in Phase
|
||||
1.0AL. It validates 64-bit source and destination ranges, bounds total size,
|
||||
chunk count and synthetic ticks, rejects zero or oversized progress, and
|
||||
accepts completion only at the exact requested byte count.
|
||||
|
||||
Auth ID and capabilities are both backed up before modification. Every field
|
||||
that changed is independently restored on every exit, with separate failure
|
||||
bits. A partial copy requires child termination and reap. Any credential
|
||||
restore failure additionally requires termination of the now-untrusted service;
|
||||
failure of either terminal cleanup operation is a hard error.
|
||||
|
||||
Successful exact copy keeps the child alive for subsequent loader stages. This
|
||||
is only host-model behavior. The model imports no credential, process, memory,
|
||||
clock, network or target interface and does not establish the undocumented
|
||||
remote status semantics or firmware-9.60 behavior. Target implementation stays
|
||||
blocked pending service-lifecycle ownership and source review.
|
||||
Reference in New Issue
Block a user