1.5 KiB
Phase 1.0DM: bounded snapshot observer
Status: OFFLINE_ARTIFACT_BUILT_AUDITED_INACTIVE
DM replaces the rejected daemon route with one single-purpose raw-elfldr
process. It opens only /system_data/priv/mms/appinfo.db using O_RDONLY,
O_CLOEXEC and O_NOFOLLOW, rejects non-regular, empty or larger-than-64-MiB
objects, and transmits only over inherited stdout. It creates no socket,
listener, connection or filesystem output on the target.
The stream is CHS10DM1 begin frame, exact declared file bytes and a terminal
frame. Metadata is checked before and after. A process-wide 20-second alarm
interrupts reads or sends; short progress is continued, while errors terminate
without reconnect or a second file open. The host parser requires exact length,
matching terminal metadata and an SQLite 3 header, then computes SHA-256.
The stock SDK linker script marks text RWE. The build tool accepts only the
pinned v0.41 script hash and mechanically derives a build-local variant whose
text segment is RE. The resulting 109,896-byte ELF has load flags RE/RW/RW and
SHA-256 147b5bede0f0b5b7d2be903bc72ff0d0541a2cdc28eae7d86b6bf95e1978ebdf;
two consecutive builds produced identical ELF bytes. Linker maps differ in
non-runtime build metadata and are not identity evidence.
Normal SDK CRT effects still apply, and runtime/cleanup are unproven. The ELF is therefore inactive and transfer-/execution-ineligible. The one-shot host runner and consumed-receipt gate exist but its tracked activation is inert; a separate exact approval remains mandatory before any socket is opened.