138 lines
6.1 KiB
Markdown
138 lines
6.1 KiB
Markdown
# Phase 0.8 read-only on-device preflight
|
|
|
|
Audit date: 2026-07-18. Decision:
|
|
**READ_ONLY_PREFLIGHT_BLOCKED**.
|
|
|
|
This is an offline admissibility audit. No on-device preflight session was
|
|
started, no connection to the PS5 was made, and no collector was run against
|
|
the PS5. No file, configuration, service, process, artifact, autoload setting,
|
|
or retry state on the console was touched. Local documentation and manifest
|
|
changes are outside that console-action statement.
|
|
|
|
The attached preflight form requires both an exact permission record and a
|
|
collector whose reads demonstrably cannot change atime, audit logs, caches,
|
|
metadata, process state, or on-device logs. Neither condition can currently be
|
|
filled truthfully. The form's own fail-closed rule therefore requires
|
|
`STOP-RO`.
|
|
|
|
## Authorization record
|
|
|
|
| Field | Recorded value |
|
|
|---|---|
|
|
| explicit read-only preflight permission | absent; no exact text/reference was supplied |
|
|
| connection authorized | `false` |
|
|
| installation authorized | `false` |
|
|
| lifecycle authorized | `false` |
|
|
| execution authorized | `false` |
|
|
| automatic retry | `false` |
|
|
|
|
The request to read and act on a blank checklist is not recorded as an exact,
|
|
artifact-independent authorization sentence. This finding alone prevents an
|
|
on-device session. It does not prevent this offline source audit.
|
|
|
|
## Collector review
|
|
|
|
### Stock Payload Manager HTTP
|
|
|
|
The exact public v0.3.1 source is commit
|
|
`cfbc70f30f419b09bf2b52283f7409e2d3117ee1`.
|
|
|
|
This candidate is **UNSAFE for the Phase-0.8 read-only contract**:
|
|
|
|
- `src/http_server.c:131-152` calls `log_server_set_active()` for every
|
|
non-`OPTIONS` request before route dispatch;
|
|
- `src/log_server.c:20-23` implements that call by writing
|
|
`server_active_flag = 1`;
|
|
- `src/http_server.c:847-871` dispatches `/autoload_status` to
|
|
`pldmgr_autoload_get_status()` and opens
|
|
`/data/pldmgr/autoload.txt`;
|
|
- `src/autoload.c:44-48` writes `autoload_triggered = 1`; the worker at
|
|
`src/autoload.c:78-93` uses that flag to leave its frontend-wait state and
|
|
start the countdown;
|
|
- `src/http_server.c:911-930` also opens the autoload file for `/get_config`;
|
|
- non-noisy routes call `pldmgr_log()` at `src/http_server.c:479-481`;
|
|
`src/log_server.c:25-55` prints to stdout and mutates the in-process ring,
|
|
log version, mutex/condition state, and waiting clients.
|
|
|
|
Even `/version`, which is filtered from the explicit request log, first calls
|
|
`log_server_set_active()`. Therefore an apparently informational endpoint is
|
|
not sufficient evidence of a no-side-effect collector. `/autoload_status`
|
|
must not be used at all under this contract.
|
|
|
|
Pinned source-file SHA-256 values:
|
|
|
|
| File | SHA-256 |
|
|
|---|---|
|
|
| `src/http_server.c` | `35cf5d8f0dd44cf64ceab5e4b0ecc09413c82d7e9946ba9de2ca4b1898631fdd` |
|
|
| `src/autoload.c` | `7051cab3ee1a3e0b9f6498000565eb9e160b9c63efa1771f250e98ec3aa4ae67` |
|
|
| `src/log_server.c` | `659095f43df1bbe8eb24acb165f027edc277af1e60aabb26ba9e3920b233d6f1` |
|
|
|
|
### Direct filesystem or process collector
|
|
|
|
No exact collector, version, source, transport, or operation set was supplied.
|
|
No evidence proves `noatime` behavior, suppression of audit records, absence
|
|
of caches, absence of network/service counters, or absence of on-device
|
|
logging. Classifying these effects as “probably harmless” would contradict the
|
|
required `Onbekend -> STOP-RO` rule.
|
|
|
|
Historical Phase-0.6 endpoint observations are not reused as current
|
|
Phase-0.8 evidence. They lack current pre/post identity and were gathered
|
|
under a different, less strict observation boundary.
|
|
|
|
## Gate state
|
|
|
|
| Preflight section | Review | Reason |
|
|
|---|---|---|
|
|
| permission | `STOP-RO` | exact permission text/reference absent |
|
|
| collector | `STOP-RO` | side-effect freedom unproven |
|
|
| stock HTTP collector | `STOP-RO` | proven process-state mutations |
|
|
| two-source firmware 9.60 | `STOP-GATE` | one user attestation, no two current device sources |
|
|
| live elfldr path/object/hash | `STOP-GATE` | no current admissible observation |
|
|
| live Payload Manager path/object/hash | `STOP-GATE` | no current admissible observation |
|
|
| processes/services/listeners | `STOP-GATE` | current topology and ownership absent |
|
|
| autoload/startup/retry | `STOP-GATE` | authoritative sources not collected |
|
|
| separate backup destination | `STOP-GATE` | device, space, and reserve unproven |
|
|
| stock elfldr rollback backup | `STOP-GATE` | exact separate backup unproven |
|
|
| stock Payload Manager rollback backup | `HARD STOP-GATE` | exact separate on-device backup unproven |
|
|
|
|
The expected stock identities remain reference values only:
|
|
|
|
- elfldr: 397000 bytes,
|
|
`092d16ee0ede0c494947efd38d1a17bbd7cc4b022d3858ea898833c188c703e8`;
|
|
- Payload Manager: 2050320 bytes,
|
|
`518740adbacccb9094fadb07dd424c53ee290f38306449ccc9d6957fdf813c0b`.
|
|
|
|
They are not claims about the console's current state.
|
|
|
|
## Minimum evidence to reopen
|
|
|
|
1. Exact permission text and a stable task reference authorizing only this
|
|
read-only preflight, while leaving installation, lifecycle execution,
|
|
transfer, artifact execution, and automatic retry unauthorized.
|
|
2. A pinned public collector and transport with a complete source and
|
|
environment proof excluding file, atime, metadata, audit-log, cache,
|
|
process-state, service-state, network-state, and on-device-log mutation.
|
|
3. Two authoritative current firmware sources that agree exactly on `9.60`.
|
|
4. A side-effect-free collection plan for current object identities, full
|
|
metadata, hashes, process/service ownership, ports 8084/8085/9021, and all
|
|
autoload/startup/retry sources, including stable pre/post observations.
|
|
5. Proof that separate, already-present, byte-exact rollback objects exist.
|
|
The stock Payload Manager backup is a hard gate.
|
|
|
|
The stock Payload Manager HTTP interface cannot satisfy item 2 without a
|
|
different, separately reviewed implementation. No workaround is attempted.
|
|
|
|
## Final state
|
|
|
|
- dataset complete: `false`;
|
|
- open STOP-RO: `true`;
|
|
- open STOP-GATE: `true`;
|
|
- Payload Manager backup exact/current: `UNPROVEN`;
|
|
- installation approval: **NOT AUTHORIZED**;
|
|
- lifecycle approval: **NOT AUTHORIZED**;
|
|
- execution authorized: `false`;
|
|
- automatic retry: `false`.
|
|
|
|
The complete machine-readable record is
|
|
`manifests/runtime/phase-0.8-read-only-preflight.json`.
|