{ "schema_version": 1, "schema_contract": { "id": "chimera-gfx-phase-0.9a-anti-brick-design-v1", "validator": "tests/test_phase09_transaction.py", "host_simulator": "tools/simulate_phase09_transaction.py" }, "status": "DESIGN_ONLY", "phase": "PHASE_0_9A_OFFLINE_ANTI_BRICK", "historical_status": "READ_ONLY_PREFLIGHT_BLOCKED", "hardware_observed": false, "ps5_connected": false, "device_write_performed": false, "files_transferred": false, "target_execution_performed": false, "target_artifact_created": false, "installation_authorized": false, "lifecycle_authorized": false, "execution_authorized": false, "transfer_authorized": false, "automatic_retry": false, "firmware_runtime_behavior": "UNPROVEN", "stock_identification": "reference_only", "payload_manager_backup": "HARD_BLOCKER", "lifecycle_probe_in_scope": false, "graphics_in_scope": false, "retroarch_in_scope": false, "host_simulation_is_hardware_evidence": false, "immutable_phase08_evidence": [ { "path": "docs/runtime/phase-0.8-read-only-preflight.md", "sha256": "3fbe086175a6048176075f447ec1482074928e3b5282db97ea2169395fe1d508" }, { "path": "manifests/runtime/phase-0.8-read-only-preflight.json", "sha256": "47d7f452f8799979fe99b3e6d56859f03544112725bf7e5b349eba5ed81b3322" }, { "path": "tests/test_phase08_preflight.py", "sha256": "8a4ad7c70de28ffe3148fd3fd1f68c36a872c53c691c9068e1ff163970863c48" } ], "permanent_denylist_binding": { "sha256": "4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63", "status": "BLOCKED", "permanent": true, "execution_eligible": false }, "source_evidence": { "repository_head": "2c944d6d65a08f7e1c02f518721cde061b999329", "hardened_elfldr_commit": "197623058f509eddde18868dafcb92fdcac66464", "controlled_payload_manager_commit": "e23d94ff91233aa770e2342800c1467875bdef44", "lifecycle_probe_source_commit": "fe08300339a13f899fb78ea404ada381a5cba87c", "payload_manager_public_base_commit": "cfbc70f30f419b09bf2b52283f7409e2d3117ee1", "elfldr_public_base_commit": "699e8bcff03e91e8d6ca6eba281af25c5a58d8c2" }, "threat_control_profiles": [ { "id": "A_WRONG_TARGET", "possible_damage": "The wrong object is replaced, potentially removing the only working launcher or manager.", "detection_before_mutation": "Require one stable no-follow object handle plus literal path token, mount ID, object ID, type, size and SHA-256; repeat identity immediately before mutation.", "preventive_invariants": ["AB-001", "AB-003", "AB-004", "AB-007"], "recovery": "Only a separately verified backup and an independent recovery executor could recover; neither is proven on PS5.", "residual_risk": "Namespace races and platform object-identity semantics remain UNPROVEN.", "phase_decision": "BLOCKED" }, { "id": "B_WRONG_PREIMAGE", "possible_damage": "A modified or firmware-incompatible live object is treated as stock and overwritten.", "detection_before_mutation": "Bind firmware, build manifest, path, mount, object ID, size and digest to one current stable observation.", "preventive_invariants": ["AB-001", "AB-002", "AB-003", "AB-004"], "recovery": "Do not mutate on any mismatch; post-mutation recovery is not an acceptable substitute.", "residual_risk": "Current on-device identities and firmware behavior remain UNPROVEN.", "phase_decision": "BLOCKED" }, { "id": "C_BACKUP_FAILURE", "possible_damage": "Rollback bytes are absent, ambiguous, partial, corrupt or dependent on the failed component.", "detection_before_mutation": "Create before staging, close, reopen, re-identify and rehash a separate object; verify capacity, mapping and an independent recovery executor.", "preventive_invariants": ["AB-005", "AB-006", "AB-016", "AB-017"], "recovery": "No live mutation is permitted until the backup and recovery path are proven.", "residual_risk": "The byte-exact on-device Payload Manager backup is a HARD_BLOCKER.", "phase_decision": "BLOCKED" }, { "id": "D_WRITE_POWER_LOSS", "possible_damage": "Power loss can expose a missing or partial live path, lose directory metadata or leave an ambiguous active identity.", "detection_before_mutation": "Prove staging isolation, file and directory durability, and a single atomic switch primitive under interruption.", "preventive_invariants": ["AB-007", "AB-008", "AB-009", "AB-011", "AB-012", "AB-013"], "recovery": "Only a proven atomic old-or-new result plus an intact independent backup is acceptable.", "residual_risk": "PS5 filesystem atomicity, exchange and durability are UNPROVEN.", "phase_decision": "BLOCKED" }, { "id": "E_PROCESS_LIFECYCLE", "possible_damage": "An active mapping, supervisor, autoload or retry starts unverified bytes or creates a crash loop.", "detection_before_mutation": "Prove process/service/listener ownership, quiescence, supervisor behavior and authoritative autoload/retry state.", "preventive_invariants": ["AB-010", "AB-013", "AB-014", "AB-020"], "recovery": "Stop before switch on any active or unknown state; never rely on automatic restart.", "residual_risk": "Current process, listener and service topology is unobserved.", "phase_decision": "BLOCKED" }, { "id": "F_ROLLBACK_FAILURE", "possible_damage": "Rollback restores wrong bytes, targets the wrong object, starts a service, or cannot run after the replaced component fails.", "detection_before_mutation": "Bind rollback to the verified backup, target mapping, independent executor and post-rollback identity checks.", "preventive_invariants": ["AB-006", "AB-015", "AB-016", "AB-017"], "recovery": "A failed rollback verification is CATASTROPHIC/BLOCKED and never retried automatically.", "residual_risk": "No independent on-device recovery path is proven.", "phase_decision": "BLOCKED" }, { "id": "G_OPERATOR_ERROR", "possible_damage": "Artifacts, firmware, approvals or phases are confused and a general status bypasses a specific hard gate.", "detection_before_mutation": "Use component-specific manifests and approvals bound to one device, firmware, hash, size, action and expiry.", "preventive_invariants": ["AB-018", "AB-019", "AB-020"], "recovery": "Fail closed before mutation; one component window must be accepted or rolled back before another begins.", "residual_risk": "Component order is not inferred without proven dependency evidence.", "phase_decision": "BLOCKED" } ], "threat_model_items": [ {"id": "TM-A-01", "profile": "A_WRONG_TARGET", "scenario": "wrong_path", "severity": "CATASTROPHIC", "reason": "May replace an unrelated critical object."}, {"id": "TM-A-02", "profile": "A_WRONG_TARGET", "scenario": "wrong_mountpoint", "severity": "CATASTROPHIC", "reason": "Path text can name a different storage object."}, {"id": "TM-A-03", "profile": "A_WRONG_TARGET", "scenario": "symlink_junction_or_redirect", "severity": "CATASTROPHIC", "reason": "A redirect defeats the reviewed target mapping."}, {"id": "TM-A-04", "profile": "A_WRONG_TARGET", "scenario": "path_resolves_to_different_object_after_preflight", "severity": "CATASTROPHIC", "reason": "TOCTOU can switch the write target."}, {"id": "TM-A-05", "profile": "A_WRONG_TARGET", "scenario": "case_or_path_normalization_changes_identity", "severity": "HIGH", "reason": "Canonicalization may collapse distinct names."}, {"id": "TM-A-06", "profile": "A_WRONG_TARGET", "scenario": "target_replaced_between_check_and_write", "severity": "CATASTROPHIC", "reason": "The stable pre-image binding is lost."}, {"id": "TM-B-01", "profile": "B_WRONG_PREIMAGE", "scenario": "live_hash_differs_from_stock_reference", "severity": "HIGH", "reason": "Existing modifications could be destroyed."}, {"id": "TM-B-02", "profile": "B_WRONG_PREIMAGE", "scenario": "live_size_differs", "severity": "HIGH", "reason": "The observed object is not the approved pre-image."}, {"id": "TM-B-03", "profile": "B_WRONG_PREIMAGE", "scenario": "object_id_changes", "severity": "CATASTROPHIC", "reason": "The write would target an unverified object."}, {"id": "TM-B-04", "profile": "B_WRONG_PREIMAGE", "scenario": "firmware_differs", "severity": "HIGH", "reason": "Compatibility and recovery assumptions do not transfer."}, {"id": "TM-B-05", "profile": "B_WRONG_PREIMAGE", "scenario": "manifest_belongs_to_another_build", "severity": "HIGH", "reason": "Candidate and recovery evidence become invalid."}, {"id": "TM-B-06", "profile": "B_WRONG_PREIMAGE", "scenario": "modified_installation_treated_as_stock", "severity": "CATASTROPHIC", "reason": "Unknown required bytes could be irreversibly lost."}, {"id": "TM-C-01", "profile": "C_BACKUP_FAILURE", "scenario": "backup_missing", "severity": "CATASTROPHIC", "reason": "No rollback bytes exist."}, {"id": "TM-C-02", "profile": "C_BACKUP_FAILURE", "scenario": "backup_is_same_object_as_live", "severity": "CATASTROPHIC", "reason": "A switch or failure can destroy both identities."}, {"id": "TM-C-03", "profile": "C_BACKUP_FAILURE", "scenario": "backup_on_same_vulnerable_path", "severity": "CATASTROPHIC", "reason": "One namespace failure can remove both copies."}, {"id": "TM-C-04", "profile": "C_BACKUP_FAILURE", "scenario": "backup_partial", "severity": "CATASTROPHIC", "reason": "Partial bytes cannot restore the pre-image."}, {"id": "TM-C-05", "profile": "C_BACKUP_FAILURE", "scenario": "backup_hash_mismatch", "severity": "CATASTROPHIC", "reason": "Rollback bytes are not the verified pre-image."}, {"id": "TM-C-06", "profile": "C_BACKUP_FAILURE", "scenario": "backup_cannot_be_reopened", "severity": "HIGH", "reason": "Durability and later readability are unproven."}, {"id": "TM-C-07", "profile": "C_BACKUP_FAILURE", "scenario": "backup_mapping_ambiguous", "severity": "CATASTROPHIC", "reason": "Rollback may restore the wrong target."}, {"id": "TM-C-08", "profile": "C_BACKUP_FAILURE", "scenario": "recovery_tool_depends_on_replaced_component", "severity": "CATASTROPHIC", "reason": "The recovery executor may disappear with the failure."}, {"id": "TM-C-09", "profile": "C_BACKUP_FAILURE", "scenario": "insufficient_storage", "severity": "HIGH", "reason": "Writes or metadata allocation can fail partway."}, {"id": "TM-C-10", "profile": "C_BACKUP_FAILURE", "scenario": "backup_created_after_live_mutation", "severity": "CATASTROPHIC", "reason": "The only known-good pre-image may already be lost."}, {"id": "TM-D-01", "profile": "D_WRITE_POWER_LOSS", "scenario": "power_loss_before_staging", "severity": "LOW", "reason": "No live mutation should have occurred, but platform evidence is still required."}, {"id": "TM-D-02", "profile": "D_WRITE_POWER_LOSS", "scenario": "power_loss_during_staging", "severity": "HIGH", "reason": "A partial candidate must never become live."}, {"id": "TM-D-03", "profile": "D_WRITE_POWER_LOSS", "scenario": "power_loss_after_staging_before_verification", "severity": "HIGH", "reason": "Unverified staged bytes may persist."}, {"id": "TM-D-04", "profile": "D_WRITE_POWER_LOSS", "scenario": "power_loss_during_live_switch", "severity": "CATASTROPHIC", "reason": "The live identity can become missing or ambiguous."}, {"id": "TM-D-05", "profile": "D_WRITE_POWER_LOSS", "scenario": "power_loss_immediately_after_live_switch", "severity": "CATASTROPHIC", "reason": "Directory metadata may not be durable."}, {"id": "TM-D-06", "profile": "D_WRITE_POWER_LOSS", "scenario": "power_loss_before_directory_metadata_durable", "severity": "CATASTROPHIC", "reason": "The namespace may revert or lose the live entry."}, {"id": "TM-D-07", "profile": "D_WRITE_POWER_LOSS", "scenario": "partial_write", "severity": "CATASTROPHIC", "reason": "A partial live executable is unusable."}, {"id": "TM-D-08", "profile": "D_WRITE_POWER_LOSS", "scenario": "short_write", "severity": "HIGH", "reason": "Completion cannot be assumed from one write."}, {"id": "TM-D-09", "profile": "D_WRITE_POWER_LOSS", "scenario": "write_error", "severity": "HIGH", "reason": "The candidate or backup may be incomplete."}, {"id": "TM-D-10", "profile": "D_WRITE_POWER_LOSS", "scenario": "flush_or_fsync_error", "severity": "CATASTROPHIC", "reason": "Bytes may not survive interruption."}, {"id": "TM-D-11", "profile": "D_WRITE_POWER_LOSS", "scenario": "file_correct_directory_not_durable", "severity": "CATASTROPHIC", "reason": "The live path may still disappear."}, {"id": "TM-D-12", "profile": "D_WRITE_POWER_LOSS", "scenario": "new_file_wrong_metadata", "severity": "HIGH", "reason": "Ownership or mode may prevent startup or recovery."}, {"id": "TM-E-01", "profile": "E_PROCESS_LIFECYCLE", "scenario": "target_file_active", "severity": "HIGH", "reason": "Old mappings and replacement behavior are unproven."}, {"id": "TM-E-02", "profile": "E_PROCESS_LIFECYCLE", "scenario": "multiple_instances", "severity": "HIGH", "reason": "Quiescence and ownership become ambiguous."}, {"id": "TM-E-03", "profile": "E_PROCESS_LIFECYCLE", "scenario": "service_self_restarts", "severity": "CATASTROPHIC", "reason": "Unverified bytes could start automatically."}, {"id": "TM-E-04", "profile": "E_PROCESS_LIFECYCLE", "scenario": "listener_conflict", "severity": "MEDIUM", "reason": "Control and recovery channels may be unavailable."}, {"id": "TM-E-05", "profile": "E_PROCESS_LIFECYCLE", "scenario": "process_holds_old_file_or_mapping", "severity": "HIGH", "reason": "Observed path identity may differ from running code."}, {"id": "TM-E-06", "profile": "E_PROCESS_LIFECYCLE", "scenario": "watchdog_or_supervisor_auto_restart", "severity": "CATASTROPHIC", "reason": "It bypasses the execution approval gate."}, {"id": "TM-E-07", "profile": "E_PROCESS_LIFECYCLE", "scenario": "autoload_starts_candidate_before_verification", "severity": "CATASTROPHIC", "reason": "Unverified code can run automatically."}, {"id": "TM-E-08", "profile": "E_PROCESS_LIFECYCLE", "scenario": "automatic_retry_crash_loop", "severity": "CATASTROPHIC", "reason": "Repeated failure may prevent stable recovery."}, {"id": "TM-F-01", "profile": "F_ROLLBACK_FAILURE", "scenario": "rollback_uses_wrong_backup", "severity": "CATASTROPHIC", "reason": "The restored object is not the pre-image."}, {"id": "TM-F-02", "profile": "F_ROLLBACK_FAILURE", "scenario": "rollback_uses_wrong_target_path", "severity": "CATASTROPHIC", "reason": "Recovery can corrupt another object."}, {"id": "TM-F-03", "profile": "F_ROLLBACK_FAILURE", "scenario": "rollback_interrupted", "severity": "CATASTROPHIC", "reason": "Neither old nor new live identity may remain usable."}, {"id": "TM-F-04", "profile": "F_ROLLBACK_FAILURE", "scenario": "rollback_hash_wrong_after_restore", "severity": "CATASTROPHIC", "reason": "Recovery did not restore verified bytes."}, {"id": "TM-F-05", "profile": "F_ROLLBACK_FAILURE", "scenario": "rollback_auto_starts_service", "severity": "CATASTROPHIC", "reason": "Execution occurs before restored identity review."}, {"id": "TM-F-06", "profile": "F_ROLLBACK_FAILURE", "scenario": "rollback_requires_payload_manager", "severity": "CATASTROPHIC", "reason": "Payload Manager replacement can remove its own recovery path."}, {"id": "TM-F-07", "profile": "F_ROLLBACK_FAILURE", "scenario": "rollback_requires_elfldr", "severity": "CATASTROPHIC", "reason": "elfldr replacement can remove its own recovery path."}, {"id": "TM-G-01", "profile": "G_OPERATOR_ERROR", "scenario": "elfldr_and_manager_swapped", "severity": "CATASTROPHIC", "reason": "The wrong executable is installed into a critical role."}, {"id": "TM-G-02", "profile": "G_OPERATOR_ERROR", "scenario": "lifecycle_probe_treated_as_install_candidate", "severity": "CATASTROPHIC", "reason": "The probe is not a runtime replacement component."}, {"id": "TM-G-03", "profile": "G_OPERATOR_ERROR", "scenario": "wrong_firmware_or_build_selected", "severity": "HIGH", "reason": "Evidence and compatibility binding are invalid."}, {"id": "TM-G-04", "profile": "G_OPERATOR_ERROR", "scenario": "two_installation_phases_combined", "severity": "CATASTROPHIC", "reason": "A single failure can remove both recovery dependencies."}, {"id": "TM-G-05", "profile": "G_OPERATOR_ERROR", "scenario": "approval_reused_for_other_component", "severity": "HIGH", "reason": "Authority is not component or hash bound."}, {"id": "TM-G-06", "profile": "G_OPERATOR_ERROR", "scenario": "stale_manifest_used", "severity": "HIGH", "reason": "The approved identities may no longer match."}, {"id": "TM-G-07", "profile": "G_OPERATOR_ERROR", "scenario": "general_ready_overrides_specific_blocker", "severity": "CATASTROPHIC", "reason": "A hard stop can be silently bypassed."} ], "anti_brick_invariants": [ {"id": "AB-001", "text": "No write without exact stable path, mount ID, object ID, type, size and pre-image SHA-256."}, {"id": "AB-002", "text": "A stock digest remains reference_only until observed on one stable on-device object."}, {"id": "AB-003", "text": "A digest match without object identity is insufficient."}, {"id": "AB-004", "text": "Object identity without a digest match is insufficient."}, {"id": "AB-005", "text": "The separate backup exists before staging and passes close, reopen, identity, size and digest verification."}, {"id": "AB-006", "text": "Backup and recovery do not depend on the candidate or replaced component."}, {"id": "AB-007", "text": "Never overwrite a live executable in place."}, {"id": "AB-008", "text": "Stage under a separate inactive identity."}, {"id": "AB-009", "text": "Reopen and hash the staged candidate before activation; bytes equal the offline-approved artifact."}, {"id": "AB-010", "text": "No autoload, retry, service restart or boot starts the candidate."}, {"id": "AB-011", "text": "Switch only with a separately proven transactional or atomic primitive."}, {"id": "AB-012", "text": "Unproven atomicity or durability blocks installation."}, {"id": "AB-013", "text": "Verify live identity after switch; execution is a later separate approval."}, {"id": "AB-014", "text": "At most one manual execution and zero automatic retries."}, {"id": "AB-015", "text": "Failed post-switch verification enters ROLLBACK_REQUIRED, never execution."}, {"id": "AB-016", "text": "Rollback uses only the preverified backup and exact target mapping."}, {"id": "AB-017", "text": "After rollback, re-establish size, SHA-256, object identity and relevant metadata."}, {"id": "AB-018", "text": "Hardened elfldr and controlled Payload Manager are never replaced in one uninterrupted transaction."}, {"id": "AB-019", "text": "The lifecycle probe is never an installation candidate."}, {"id": "AB-020", "text": "No later phase begins without separate human permission."} ], "transaction_states": [ "OFFLINE_ONLY", "OBSERVATION_NOT_AUTHORIZED", "OBSERVATION_AUTHORIZED", "DEVICE_IDENTITY_OBSERVED", "LIVE_OBJECTS_VERIFIED", "BACKUP_NOT_PRESENT", "BACKUP_CREATION_NOT_AUTHORIZED", "BACKUP_CREATION_AUTHORIZED", "BACKUP_CREATED", "BACKUP_REOPENED_AND_VERIFIED", "RECOVERY_PATH_VERIFIED", "CANDIDATE_NOT_AUTHORIZED", "CANDIDATE_APPROVED_OFFLINE", "STAGING_NOT_AUTHORIZED", "STAGING_AUTHORIZED", "CANDIDATE_STAGED", "CANDIDATE_REOPENED_AND_VERIFIED", "TARGET_NOT_QUIESCENT", "TARGET_QUIESCENT", "SWITCH_NOT_AUTHORIZED", "SWITCH_AUTHORIZED", "SWITCH_IN_PROGRESS", "POST_SWITCH_VERIFY", "MANUAL_EXECUTION_NOT_AUTHORIZED", "MANUAL_EXECUTION_AUTHORIZED", "ONE_SHOT_EXECUTION", "ACCEPTED", "ROLLBACK_REQUIRED", "ROLLBACK_AUTHORIZED", "ROLLBACK_IN_PROGRESS", "ROLLBACK_VERIFIED", "BLOCKED" ], "allowed_transitions": [ "OFFLINE_ONLY->OBSERVATION_NOT_AUTHORIZED", "OBSERVATION_NOT_AUTHORIZED->OBSERVATION_AUTHORIZED", "OBSERVATION_AUTHORIZED->DEVICE_IDENTITY_OBSERVED", "DEVICE_IDENTITY_OBSERVED->LIVE_OBJECTS_VERIFIED", "LIVE_OBJECTS_VERIFIED->BACKUP_NOT_PRESENT", "BACKUP_NOT_PRESENT->BACKUP_CREATION_NOT_AUTHORIZED", "BACKUP_CREATION_NOT_AUTHORIZED->BACKUP_CREATION_AUTHORIZED", "BACKUP_CREATION_AUTHORIZED->BACKUP_CREATED", "BACKUP_CREATED->BACKUP_REOPENED_AND_VERIFIED", "BACKUP_REOPENED_AND_VERIFIED->RECOVERY_PATH_VERIFIED", "RECOVERY_PATH_VERIFIED->CANDIDATE_NOT_AUTHORIZED", "CANDIDATE_NOT_AUTHORIZED->CANDIDATE_APPROVED_OFFLINE", "CANDIDATE_APPROVED_OFFLINE->STAGING_NOT_AUTHORIZED", "STAGING_NOT_AUTHORIZED->STAGING_AUTHORIZED", "STAGING_AUTHORIZED->CANDIDATE_STAGED", "CANDIDATE_STAGED->CANDIDATE_REOPENED_AND_VERIFIED", "CANDIDATE_REOPENED_AND_VERIFIED->TARGET_NOT_QUIESCENT", "TARGET_NOT_QUIESCENT->TARGET_QUIESCENT", "TARGET_QUIESCENT->SWITCH_NOT_AUTHORIZED", "SWITCH_NOT_AUTHORIZED->SWITCH_AUTHORIZED", "SWITCH_AUTHORIZED->SWITCH_IN_PROGRESS", "SWITCH_IN_PROGRESS->POST_SWITCH_VERIFY", "POST_SWITCH_VERIFY->MANUAL_EXECUTION_NOT_AUTHORIZED", "MANUAL_EXECUTION_NOT_AUTHORIZED->MANUAL_EXECUTION_AUTHORIZED", "MANUAL_EXECUTION_AUTHORIZED->ONE_SHOT_EXECUTION", "ONE_SHOT_EXECUTION->ACCEPTED", "POST_SWITCH_VERIFY->ROLLBACK_REQUIRED", "ROLLBACK_REQUIRED->ROLLBACK_AUTHORIZED", "ROLLBACK_AUTHORIZED->ROLLBACK_IN_PROGRESS", "ROLLBACK_IN_PROGRESS->ROLLBACK_VERIFIED", "ANY_ERROR_MISMATCH_TIMEOUT_OR_UNKNOWN->BLOCKED" ], "forbidden_transitions": [ "automatic_transition_across_any_authorization_state", "automatic_retry", "autoload", "in_place_overwrite", "two_step_rename_with_missing_live_gap", "post_switch_direct_to_execution", "combined_component_installation", "second_component_before_first_accepted_or_rolled_back", "lifecycle_probe_to_installation_candidate", "lifecycle_transition", "graphics_transition", "retroarch_transition", "general_ready_overrides_specific_blocker" ], "approval_gates": [ {"id": "observation", "authorized": false, "separate_human_approval_required": true}, {"id": "backup_creation", "authorized": false, "separate_human_approval_required": true}, {"id": "staging", "authorized": false, "separate_human_approval_required": true}, {"id": "switch", "authorized": false, "separate_human_approval_required": true}, {"id": "one_shot_execution", "authorized": false, "separate_human_approval_required": true}, {"id": "rollback", "authorized": false, "separate_human_approval_required": true} ], "power_loss_boundaries": [ {"id": "before_backup_write", "before": "verified old live; no backup write", "possible_objects": "old live only", "visible_live": "old live", "backup": "absent", "automatic_start": false, "independent_recovery": "not needed before mutation", "recoverable": "UNPROVEN", "result": "UNPROVEN"}, {"id": "during_backup_write", "before": "old live intact; backup creation authorized", "possible_objects": "old live plus partial backup", "visible_live": "old live", "backup": "partial and invalid", "automatic_start": false, "independent_recovery": "old live must remain independent", "recoverable": "UNPROVEN", "result": "UNPROVEN"}, {"id": "after_backup_write_before_flush", "before": "backup bytes written but not durable", "possible_objects": "old live plus volatile backup", "visible_live": "old live", "backup": "not durable", "automatic_start": false, "independent_recovery": "unproven", "recoverable": "UNPROVEN", "result": "UNPROVEN"}, {"id": "after_flush_before_reopen_hash", "before": "backup flush requested", "possible_objects": "old live plus unverified backup", "visible_live": "old live", "backup": "not reopened or rehashed", "automatic_start": false, "independent_recovery": "unproven", "recoverable": "UNPROVEN", "result": "UNPROVEN"}, {"id": "during_candidate_staging", "before": "verified backup; separate candidate write", "possible_objects": "old live, verified backup, partial candidate", "visible_live": "old live", "backup": "must remain intact", "automatic_start": false, "independent_recovery": "must not use candidate", "recoverable": "UNPROVEN", "result": "UNPROVEN"}, {"id": "after_candidate_staging_before_verification", "before": "candidate present but unverified", "possible_objects": "old live, verified backup, unverified candidate", "visible_live": "old live", "backup": "must remain intact", "automatic_start": false, "independent_recovery": "old live remains primary", "recoverable": "UNPROVEN", "result": "UNPROVEN"}, {"id": "immediately_before_live_switch", "before": "candidate and backup verified; target quiescent", "possible_objects": "old live, verified backup, verified candidate", "visible_live": "old live", "backup": "verified", "automatic_start": false, "independent_recovery": "required", "recoverable": "UNPROVEN", "result": "UNPROVEN"}, {"id": "during_live_switch", "before": "atomic switch requested", "possible_objects": "must be exactly complete old or complete new; platform behavior unknown", "visible_live": "UNPROVEN", "backup": "must remain verified", "automatic_start": false, "independent_recovery": "required", "recoverable": "UNPROVEN", "result": "UNPROVEN"}, {"id": "immediately_after_live_switch", "before": "namespace switch returned", "possible_objects": "new live plus backup if atomic; directory durability unknown", "visible_live": "UNPROVEN", "backup": "must remain verified", "automatic_start": false, "independent_recovery": "required", "recoverable": "UNPROVEN", "result": "UNPROVEN"}, {"id": "after_switch_before_live_hash", "before": "candidate nominally live but not verified", "possible_objects": "new live or ambiguous namespace plus backup", "visible_live": "unverified", "backup": "must remain verified", "automatic_start": false, "independent_recovery": "required", "recoverable": "UNPROVEN", "result": "UNPROVEN"}, {"id": "after_live_hash_before_execution", "before": "post-switch hash recorded; execution still unauthorized", "possible_objects": "verified new live plus backup if platform durable", "visible_live": "new live", "backup": "must remain verified", "automatic_start": false, "independent_recovery": "required", "recoverable": "UNPROVEN", "result": "UNPROVEN"}, {"id": "during_first_manual_execution", "before": "separate one-shot execution gate", "possible_objects": "new live plus backup", "visible_live": "new live", "backup": "must remain verified", "automatic_start": false, "independent_recovery": "must work without executed component", "recoverable": "UNPROVEN", "result": "UNPROVEN"}, {"id": "during_rollback", "before": "rollback separately authorized", "possible_objects": "must be complete new or complete old plus intact backup", "visible_live": "UNPROVEN", "backup": "must remain verified", "automatic_start": false, "independent_recovery": "required", "recoverable": "UNPROVEN", "result": "UNPROVEN"}, {"id": "after_rollback_before_recovery_verification", "before": "rollback switch returned", "possible_objects": "restored old live if atomic and durable", "visible_live": "unverified restored object", "backup": "must remain verified", "automatic_start": false, "independent_recovery": "required", "recoverable": "UNPROVEN", "result": "UNPROVEN"} ], "backup_conditions": [ "created_before_any_live_mutation", "exact_source_object_and_restore_target_recorded", "source_stable_during_read", "all_bytes_read", "exact_size", "exact_sha256", "separate_object", "closed_reopened_reidentified_and_rehashed", "storage_medium_and_mount_recorded", "capacity_and_metadata_reserve_proven", "not_removed_by_autoload_cleanup_or_packaging", "not_replaced_by_candidate", "mapping_not_derived_from_glob_or_basename", "rollback_requires_no_target_path_guess", "strongly_recommended_second_off_device_copy_requires_separate_future_transfer_approval" ], "recovery_conditions": [ "recovery_start_mechanism_exactly_identified", "recovery_executor_exactly_identified", "recovery_executor_is_not_the_replaced_component", "works_if_elfldr_does_not_start", "works_if_payload_manager_does_not_start", "works_without_autoload", "works_without_replaced_component_network_listener", "second_independent_recovery_path_is_proven", "post_rollback_size_hash_object_identity_and_metadata_verified" ], "filesystem_evidence_requirements": [ "filesystem_type", "mount_identity", "read_write_status", "atomic_rename_or_exchange_support", "replace_existing_file_semantics", "file_flush_durability", "directory_flush_durability", "power_loss_behavior", "symlink_no_follow_semantics", "stable_open_object_identity", "ownership_and_mode_preservation", "available_space_and_metadata_capacity", "maximum_file_size", "behavior_while_target_process_has_file_open" ], "unproven_platform_properties": [ "exact_current_firmware_from_two_device_sources", "current_live_paths_mounts_objects_sizes_and_hashes", "filesystem_type_and_mount_semantics", "atomic_exchange_or_transactional_switch", "file_and_directory_flush_durability", "power_loss_namespace_behavior", "no_follow_and_stable_object_identity", "ownership_mode_and_metadata_preservation", "capacity_and_maximum_file_size", "open_executable_replacement_behavior", "process_service_listener_and_supervisor_topology", "autoload_and_retry_state", "independent_recovery_executor", "second_independent_recovery_path", "byte_exact_reopenable_on_device_payload_manager_backup" ], "component_models": [ { "component": "hardened_elfldr", "live_preimage": { "classification": "reference_only", "path": null, "mount_id": null, "object_id": null, "size": 397000, "sha256": "092d16ee0ede0c494947efd38d1a17bbd7cc4b022d3858ea898833c188c703e8", "current_device_match": "UNPROVEN" }, "backup": {"status": "STOP_GATE", "on_device_present": "UNPROVEN", "reopened_and_verified": false}, "candidate": { "classification": "exact_offline_reviewed_reference", "size": 397000, "sha256": "63e810982471eb40cae3a20aa9df9a0a02892f420e429874fae4e99aa400b561", "source_commit": "197623058f509eddde18868dafcb92fdcac66464" }, "target_mapping": {"live_path": null, "backup_path": null, "staging_path": null, "status": "UNPROVEN"}, "recovery_dependency": "UNPROVEN", "process_service_status": "UNPROVEN", "listener_status": "UNPROVEN", "autoload_status": "UNPROVEN", "approval": false, "staging": "NOT_AUTHORIZED", "switch": {"authorized": false, "primitive": "UNPROVEN", "atomicity": "UNPROVEN", "durability": "UNPROVEN"}, "post_switch_verification": "NOT_PERFORMED", "manual_execution": "NOT_AUTHORIZED", "accepted": false, "rollback": "NOT_AUTHORIZED" }, { "component": "controlled_payload_manager", "live_preimage": { "classification": "reference_only", "path": null, "mount_id": null, "object_id": null, "size": 2050320, "sha256": "518740adbacccb9094fadb07dd424c53ee290f38306449ccc9d6957fdf813c0b", "current_device_match": "UNPROVEN" }, "backup": {"status": "HARD_BLOCKER", "on_device_present": "UNPROVEN", "reopened_and_verified": false}, "candidate": { "classification": "exact_offline_reviewed_reference", "size": 99560, "sha256": "8fecf8241a46246eddbd21e8bb4d875f5d76f1f4f4c6a11384df1f131aa5e5b1", "source_commit": "e23d94ff91233aa770e2342800c1467875bdef44" }, "target_mapping": {"live_path": null, "backup_path": null, "staging_path": null, "status": "UNPROVEN"}, "recovery_dependency": "UNPROVEN", "process_service_status": "UNPROVEN", "listener_status": "UNPROVEN", "autoload_status": "UNPROVEN", "approval": false, "staging": "NOT_AUTHORIZED", "switch": {"authorized": false, "primitive": "UNPROVEN", "atomicity": "UNPROVEN", "durability": "UNPROVEN"}, "post_switch_verification": "NOT_PERFORMED", "manual_execution": "NOT_AUTHORIZED", "accepted": false, "rollback": "NOT_AUTHORIZED" } ], "component_order": { "selected": null, "reason": "No order is inferred without proven dependency and independent recovery evidence.", "combined_install_all": false, "second_component_requires_first_accepted_or_fully_rolled_back": true }, "switch_preference": [ "side_by_side_or_dual_slot_without_removing_stock", "proven_atomic_exchange", "proven_transactional_snapshot", "other_method_only_after_separate_proof" ], "blockers": [ {"id": "READ_ONLY_PREFLIGHT_BLOCKED", "severity": "HARD_STOP"}, {"id": "PAYLOAD_MANAGER_BACKUP_NOT_BYTE_EXACT_ON_DEVICE", "severity": "HARD_STOP"}, {"id": "NO_PROVEN_POWER_LOSS_SAFE_SWITCH", "severity": "HARD_STOP"}, {"id": "FILESYSTEM_ATOMICITY_UNPROVEN", "severity": "STOP"}, {"id": "FILE_DURABILITY_UNPROVEN", "severity": "STOP"}, {"id": "DIRECTORY_DURABILITY_UNPROVEN", "severity": "STOP"}, {"id": "RECOVERY_INDEPENDENCE_UNPROVEN", "severity": "HARD_STOP"}, {"id": "CURRENT_LIVE_IDENTITIES_UNPROVEN", "severity": "STOP"}, {"id": "CURRENT_PROCESS_AND_SERVICE_TOPOLOGY_UNPROVEN", "severity": "STOP"}, {"id": "FIRMWARE_RUNTIME_BEHAVIOR_UNPROVEN", "severity": "STOP"}, {"id": "COMPONENT_ORDER_UNPROVEN", "severity": "STOP"}, {"id": "ALL_DEVICE_ACTION_AUTHORIZATIONS_FALSE", "severity": "STOP"}, {"id": "ANY_UNSAFE_OR_UNPROVEN_POWER_LOSS_BOUNDARY", "severity": "HARD_STOP"} ], "proof_requirements_before_future_bounded_observation": [ "new exact observation-only human authorization", "exact collector identity and complete side-effect contract", "collector bounded runtime and fail-closed cleanup", "two current authoritative firmware observations", "no installation transfer execution lifecycle autoload retry graphics or RetroArch authority", "exact raw output and reviewer evidence contract", "immutable Phase-0.8 and Phase-0.8R blockers preserved" ], "prohibited_actions": [ "connect_to_ps5", "use_usb_or_device_transport", "transfer_file", "execute_target_code", "install_or_replace_component", "create_on_device_backup", "change_configuration", "activate_autoload_or_retry", "start_stop_or_signal_process_or_service", "build_target_elf_self_sprx_pkg_or_payload", "build_or_run_lifecycle_probe", "generate_device_install_commands", "modify_hardened_elfldr_production_code", "modify_payload_manager_production_code", "modify_lifecycle_probe_code", "modify_target_toolchain", "modify_graphics_sdl_or_retroarch_code", "contact_network_gitea_or_upstream", "install_packages", "commit_or_push" ] }