# Chimera Payload Manager artifact policy contract

The controlled Phase-0.7 Payload Manager is maintained in the separate private
`chimera-ps5-payload-manager` repository. This repository supplies the
hash-bound artifact and runtime profile that the manager must enforce.

## Same-file-descriptor launch boundary

The controlled manager:

1. opens the selected artifact once with read-only, no-follow, close-on-exec
   flags;
2. requires a regular file and exact compiled byte size;
3. hashes that same file descriptor;
4. rejects the permanent denylist and every metadata mismatch;
5. rewinds and streams that same descriptor;
6. checks descriptor identity and path identity after streaming;
7. sends an exact versioned header over loopback only;
8. uses a compiled exact artifact ID, SHA-256, size, firmware 9.60, 2000 ms
   timeout, and `retry=false`.

There is no path reopen between hash and stream. A symlink, truncation,
replacement, digest mismatch, denylist match, wrong route, wrong firmware,
non-loopback destination, or post-stream identity change fails closed.

## Controlled upload boundary

The upload route accepts only the controlled directory, creates an exclusive
no-follow temporary file, writes and synchronizes it, verifies exact content,
then atomically renames it. Upload never autoloads or executes the artifact.
The removable application write is explicit in the Phase-0.7 budget; it is not
a firmware write.

## Receiver enforcement

The hardened elfldr independently hashes the received bytes, validates the
exact artifact ID/size/firmware/digest/timeout/no-retry header, and enforces the
permanent denylist. Sender metadata alone is therefore insufficient.

The legacy route is classified `UNVERIFIED_LEGACY` and is not a controlled
Chimera launch path.

## Repository static gate

Before preparing a later action, the exact lifecycle bytes must also pass:

```text
python3 tools/check_artifact_execution_policy.py \
  --manifest <artifact-manifest.json> \
  --denylist manifests/artifact-denylist.json \
  --artifact <exact-local-artifact> \
  --runtime-profile manifests/runtime/controlled-ps5-runtime-profile.json \
  --firmware 9.60
```

Only `PASS_STATIC_DEPLOYMENT_ELIGIBILITY_GATE` is accepted. The result always
contains `execution_authorized=false`; it is preparation evidence, not
permission.

## Permanent denial

SHA-256 `4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63`
must always return `ARTIFACT_PERMANENTLY_DENYLISTED`, regardless of metadata,
runtime profile, or later generic approval. The entry is also copied into both
hardened consumers.

## Current action state

No hardened binary is installed. No lifecycle artifact has been transferred
or executed. A separate exact-hash installation approval is required first;
after successful installation verification, lifecycle transfer and one-time
execution require another artifact-specific approval.