# ADR-0003: Fail-closed capability probe

- Status: accepted
- Date: 2026-07-16

## Decision

The PS5 probe is disabled in ordinary builds. A probe build embeds exactly one
approved firmware identifier, defaulting to `NONE`. Runtime requires an exact
firmware match and the literal `--acknowledge-read-only-probe` argument before
module loading. The checked-in firmware matrix is empty.

The platform shim may call only `dlopen`, `dlsym`, and `dlclose`. Logs contain
symbol names and booleans, never addresses. There is no deploy target.

## Consequences

Default artifacts cannot discover symbols on hardware. A deliberately gated
artifact still requires separate human authorization before transfer or
execution. Loader-internal side effects remain an explicitly recorded unknown.