96 lines
4.8 KiB
Markdown
96 lines
4.8 KiB
Markdown
# Phase 1.0X: inactive injected transport and local evidence
|
|
|
|
Status: `INACTIVE_INJECTED_TRANSPORT_COMPLETE_LIVE_PROTOCOL_BLOCKED`
|
|
|
|
Date: 2026-07-22
|
|
|
|
Phase 1.0X implements only host-side orchestration around an injected adapter.
|
|
It has no socket or DNS import, live CLI, target address, port, command-byte
|
|
formatter, Telnet reply generator or prompt detector. All tests use synthetic
|
|
bytes and a fake monotonic clock. No device action occurred.
|
|
|
|
## Source audit before implementation
|
|
|
|
The clean official shsrv reference tree at commit
|
|
`6f320637d56d344a0e7797753099e33238bbf146` proves the following source
|
|
behavior in `sh.c`:
|
|
|
|
- `sh_thread` calls `chdir("/")` and `setenv("PWD", "/", 0)`;
|
|
- `sh_prompt` reads `PWD`, falls back to `getcwd`, writes `%s$ ` and flushes;
|
|
- the greeting automatically reads and emits serial, firmware, temperature
|
|
and CPU-frequency data;
|
|
- `sh_thread` emits a prompt before input and again after each command path.
|
|
|
|
This does not prove the exact deployed binary or live byte stream. In
|
|
particular, `setenv` does not overwrite a pre-existing `PWD`, Telnet negotiation
|
|
may be fragmented, and the exact relationship between command echo, output and
|
|
the next prompt is not bound to deployed firmware-9.60 bytes. Phase 1.0X
|
|
therefore passes abstract boundary labels and command tokens to a fake adapter;
|
|
it never guesses wire bytes.
|
|
|
|
## Implemented offline controls
|
|
|
|
`tools/phase10x_inactive_transport.py` provides:
|
|
|
|
1. an injected adapter protocol with `open_once`, boundary receive,
|
|
allowlisted command-token send and `close_once` methods;
|
|
2. an injected monotonic clock and a single absolute deadline;
|
|
3. a consumed-attempt receipt created with `O_CREAT|O_EXCL`, flushed with
|
|
`fsync`, closed and reopened before adapter open;
|
|
4. one pass through the Phase-1.0W immutable session plan and remediated
|
|
Phase-1.0V collector;
|
|
5. exclusive sanitized JSON output, also flushed, closed and reopened;
|
|
6. normalized adapter and collector failures that retain neither raw error
|
|
messages nor exception causes;
|
|
7. deterministic close after every adapter-open attempt, including an open
|
|
operation that raises.
|
|
|
|
The receipt intentionally excludes the target address. Sanitized output binds
|
|
the receipt SHA-256 and never contains the raw transcript. The evidence store
|
|
has no overwrite, delete or cleanup operation. A partial local file left by a
|
|
host crash is invalid evidence and permanently consumes that run ID.
|
|
|
|
## Proven and unproven properties
|
|
|
|
| Property | Classification | Basis |
|
|
|---|---|---|
|
|
| receipt precedes adapter open | `SAFE_OFFLINE` | code order plus fake-adapter assertion |
|
|
| leaf-file overwrite resistance | `SAFE_OFFLINE` | `O_EXCL` plus repeated-run tests |
|
|
| file content flush/reopen/hash | `SAFE_OFFLINE` | `fsync`, close, reopen and byte comparison |
|
|
| raw transcript/target exclusion | `SAFE_OFFLINE` | output schema and tests |
|
|
| one-shot/no retry | `SAFE_OFFLINE` | no retry API or loop; consumed run ID |
|
|
| deterministic injected-adapter close | `SAFE_OFFLINE` | fault-injection tests |
|
|
| directory-entry durability | `UNPROVEN` | containing directory is not fsynced |
|
|
| hostile/symlinked evidence root | `UNPROVEN` | root must be a trusted caller-owned host path |
|
|
| deadline during a blocking adapter call | `UNPROVEN` | only pre/post checks and remaining budget are passed |
|
|
| exact live prompt and Telnet replies | `UNPROVEN` | no deployed byte-bound protocol evidence |
|
|
| live socket cleanup | `UNPROVEN` | no live socket implementation exists |
|
|
| firmware-9.60 behavior | `UNPROVEN` | host-only synthetic tests |
|
|
|
|
The missing directory fsync is not hidden by file fsync. A future platform
|
|
implementation must define a safe cross-platform directory-durability contract
|
|
or retain this limitation. Likewise, a future transport must enforce OS-level
|
|
timeouts so an adapter call cannot outlive the absolute deadline.
|
|
|
|
## Fault model
|
|
|
|
The 18 host tests cover receipt ordering, one-shot command order, sanitization,
|
|
target exclusion, duplicate run and output rejection, deadline expiry, open/
|
|
receive/send/close faults, boundary limits, malformed transcript rejection,
|
|
reopen/hash validation and absence of cleanup, CLI and socket imports. These
|
|
tests are architecture evidence only and make no hardware or network claim.
|
|
|
|
## Decision
|
|
|
|
- inactive injected orchestration: `SAFE_FOR_OFFLINE_FAKE_ADAPTER_TESTS`;
|
|
- local exclusive file-content evidence: `SAFE_OFFLINE_WITH_DIRECTORY_DURABILITY_UNPROVEN`;
|
|
- exact deployed shsrv identity: `UNPROVEN`;
|
|
- live protocol framing: `BLOCKED_UNPROVEN`;
|
|
- live network adapter: `BLOCKED_NOT_PRESENT`;
|
|
- connection, request or result reception: `NOT_AUTHORIZED`.
|
|
|
|
The next permitted step is an offline, source-bound audit of exact prompt,
|
|
Telnet negotiation and command-completion framing. It may extend fake protocol
|
|
models, but it may not add a socket, address, live CLI, connection or device
|
|
request.
|