This commit is contained in:
Chimera GFX release export
@@ -0,0 +1,137 @@
|
||||
# Phase 0.8 read-only on-device preflight
|
||||
|
||||
Audit date: 2026-07-18. Decision:
|
||||
**READ_ONLY_PREFLIGHT_BLOCKED**.
|
||||
|
||||
This is an offline admissibility audit. No on-device preflight session was
|
||||
started, no connection to the PS5 was made, and no collector was run against
|
||||
the PS5. No file, configuration, service, process, artifact, autoload setting,
|
||||
or retry state on the console was touched. Local documentation and manifest
|
||||
changes are outside that console-action statement.
|
||||
|
||||
The attached preflight form requires both an exact permission record and a
|
||||
collector whose reads demonstrably cannot change atime, audit logs, caches,
|
||||
metadata, process state, or on-device logs. Neither condition can currently be
|
||||
filled truthfully. The form's own fail-closed rule therefore requires
|
||||
`STOP-RO`.
|
||||
|
||||
## Authorization record
|
||||
|
||||
| Field | Recorded value |
|
||||
|---|---|
|
||||
| explicit read-only preflight permission | absent; no exact text/reference was supplied |
|
||||
| connection authorized | `false` |
|
||||
| installation authorized | `false` |
|
||||
| lifecycle authorized | `false` |
|
||||
| execution authorized | `false` |
|
||||
| automatic retry | `false` |
|
||||
|
||||
The request to read and act on a blank checklist is not recorded as an exact,
|
||||
artifact-independent authorization sentence. This finding alone prevents an
|
||||
on-device session. It does not prevent this offline source audit.
|
||||
|
||||
## Collector review
|
||||
|
||||
### Stock Payload Manager HTTP
|
||||
|
||||
The exact public v0.3.1 source is commit
|
||||
`cfbc70f30f419b09bf2b52283f7409e2d3117ee1`.
|
||||
|
||||
This candidate is **UNSAFE for the Phase-0.8 read-only contract**:
|
||||
|
||||
- `src/http_server.c:131-152` calls `log_server_set_active()` for every
|
||||
non-`OPTIONS` request before route dispatch;
|
||||
- `src/log_server.c:20-23` implements that call by writing
|
||||
`server_active_flag = 1`;
|
||||
- `src/http_server.c:847-871` dispatches `/autoload_status` to
|
||||
`pldmgr_autoload_get_status()` and opens
|
||||
`/data/pldmgr/autoload.txt`;
|
||||
- `src/autoload.c:44-48` writes `autoload_triggered = 1`; the worker at
|
||||
`src/autoload.c:78-93` uses that flag to leave its frontend-wait state and
|
||||
start the countdown;
|
||||
- `src/http_server.c:911-930` also opens the autoload file for `/get_config`;
|
||||
- non-noisy routes call `pldmgr_log()` at `src/http_server.c:479-481`;
|
||||
`src/log_server.c:25-55` prints to stdout and mutates the in-process ring,
|
||||
log version, mutex/condition state, and waiting clients.
|
||||
|
||||
Even `/version`, which is filtered from the explicit request log, first calls
|
||||
`log_server_set_active()`. Therefore an apparently informational endpoint is
|
||||
not sufficient evidence of a no-side-effect collector. `/autoload_status`
|
||||
must not be used at all under this contract.
|
||||
|
||||
Pinned source-file SHA-256 values:
|
||||
|
||||
| File | SHA-256 |
|
||||
|---|---|
|
||||
| `src/http_server.c` | `35cf5d8f0dd44cf64ceab5e4b0ecc09413c82d7e9946ba9de2ca4b1898631fdd` |
|
||||
| `src/autoload.c` | `7051cab3ee1a3e0b9f6498000565eb9e160b9c63efa1771f250e98ec3aa4ae67` |
|
||||
| `src/log_server.c` | `659095f43df1bbe8eb24acb165f027edc277af1e60aabb26ba9e3920b233d6f1` |
|
||||
|
||||
### Direct filesystem or process collector
|
||||
|
||||
No exact collector, version, source, transport, or operation set was supplied.
|
||||
No evidence proves `noatime` behavior, suppression of audit records, absence
|
||||
of caches, absence of network/service counters, or absence of on-device
|
||||
logging. Classifying these effects as “probably harmless” would contradict the
|
||||
required `Onbekend -> STOP-RO` rule.
|
||||
|
||||
Historical Phase-0.6 endpoint observations are not reused as current
|
||||
Phase-0.8 evidence. They lack current pre/post identity and were gathered
|
||||
under a different, less strict observation boundary.
|
||||
|
||||
## Gate state
|
||||
|
||||
| Preflight section | Review | Reason |
|
||||
|---|---|---|
|
||||
| permission | `STOP-RO` | exact permission text/reference absent |
|
||||
| collector | `STOP-RO` | side-effect freedom unproven |
|
||||
| stock HTTP collector | `STOP-RO` | proven process-state mutations |
|
||||
| two-source firmware 9.60 | `STOP-GATE` | one user attestation, no two current device sources |
|
||||
| live elfldr path/object/hash | `STOP-GATE` | no current admissible observation |
|
||||
| live Payload Manager path/object/hash | `STOP-GATE` | no current admissible observation |
|
||||
| processes/services/listeners | `STOP-GATE` | current topology and ownership absent |
|
||||
| autoload/startup/retry | `STOP-GATE` | authoritative sources not collected |
|
||||
| separate backup destination | `STOP-GATE` | device, space, and reserve unproven |
|
||||
| stock elfldr rollback backup | `STOP-GATE` | exact separate backup unproven |
|
||||
| stock Payload Manager rollback backup | `HARD STOP-GATE` | exact separate on-device backup unproven |
|
||||
|
||||
The expected stock identities remain reference values only:
|
||||
|
||||
- elfldr: 397000 bytes,
|
||||
`092d16ee0ede0c494947efd38d1a17bbd7cc4b022d3858ea898833c188c703e8`;
|
||||
- Payload Manager: 2050320 bytes,
|
||||
`518740adbacccb9094fadb07dd424c53ee290f38306449ccc9d6957fdf813c0b`.
|
||||
|
||||
They are not claims about the console's current state.
|
||||
|
||||
## Minimum evidence to reopen
|
||||
|
||||
1. Exact permission text and a stable task reference authorizing only this
|
||||
read-only preflight, while leaving installation, lifecycle execution,
|
||||
transfer, artifact execution, and automatic retry unauthorized.
|
||||
2. A pinned public collector and transport with a complete source and
|
||||
environment proof excluding file, atime, metadata, audit-log, cache,
|
||||
process-state, service-state, network-state, and on-device-log mutation.
|
||||
3. Two authoritative current firmware sources that agree exactly on `9.60`.
|
||||
4. A side-effect-free collection plan for current object identities, full
|
||||
metadata, hashes, process/service ownership, ports 8084/8085/9021, and all
|
||||
autoload/startup/retry sources, including stable pre/post observations.
|
||||
5. Proof that separate, already-present, byte-exact rollback objects exist.
|
||||
The stock Payload Manager backup is a hard gate.
|
||||
|
||||
The stock Payload Manager HTTP interface cannot satisfy item 2 without a
|
||||
different, separately reviewed implementation. No workaround is attempted.
|
||||
|
||||
## Final state
|
||||
|
||||
- dataset complete: `false`;
|
||||
- open STOP-RO: `true`;
|
||||
- open STOP-GATE: `true`;
|
||||
- Payload Manager backup exact/current: `UNPROVEN`;
|
||||
- installation approval: **NOT AUTHORIZED**;
|
||||
- lifecycle approval: **NOT AUTHORIZED**;
|
||||
- execution authorized: `false`;
|
||||
- automatic retry: `false`.
|
||||
|
||||
The complete machine-readable record is
|
||||
`manifests/runtime/phase-0.8-read-only-preflight.json`.
|
||||
Reference in New Issue
Block a user