28 lines
1.5 KiB
Markdown
28 lines
1.5 KiB
Markdown
# Phase 1.0DM: bounded snapshot observer
|
|
|
|
Status: `OFFLINE_ARTIFACT_BUILT_AUDITED_INACTIVE`
|
|
|
|
DM replaces the rejected daemon route with one single-purpose raw-elfldr
|
|
process. It opens only `/system_data/priv/mms/appinfo.db` using `O_RDONLY`,
|
|
`O_CLOEXEC` and `O_NOFOLLOW`, rejects non-regular, empty or larger-than-64-MiB
|
|
objects, and transmits only over inherited stdout. It creates no socket,
|
|
listener, connection or filesystem output on the target.
|
|
|
|
The stream is `CHS10DM1` begin frame, exact declared file bytes and a terminal
|
|
frame. Metadata is checked before and after. A process-wide 20-second alarm
|
|
interrupts reads or sends; short progress is continued, while errors terminate
|
|
without reconnect or a second file open. The host parser requires exact length,
|
|
matching terminal metadata and an SQLite 3 header, then computes SHA-256.
|
|
|
|
The stock SDK linker script marks text RWE. The build tool accepts only the
|
|
pinned v0.41 script hash and mechanically derives a build-local variant whose
|
|
text segment is RE. The resulting 109,896-byte ELF has load flags RE/RW/RW and
|
|
SHA-256 `147b5bede0f0b5b7d2be903bc72ff0d0541a2cdc28eae7d86b6bf95e1978ebdf`;
|
|
two consecutive builds produced identical ELF bytes. Linker maps differ in
|
|
non-runtime build metadata and are not identity evidence.
|
|
|
|
Normal SDK CRT effects still apply, and runtime/cleanup are unproven. The ELF
|
|
is therefore inactive and transfer-/execution-ineligible. The one-shot host
|
|
runner and consumed-receipt gate exist but its tracked activation is inert; a
|
|
separate exact approval remains mandatory before any socket is opened.
|