chimera-gfx-Public/docs/runtime/phase-0.9d-off-device-backup-contract.md

Phase 0.9D off-device backup contract

Date: 2026-07-18 Status: DESIGN_ONLY; no readback route currently satisfies this contract.

Invariants

A future host workflow shall process one component per separately authorized session. It shall contain no upload, create-on-device, rename, unlink, delete, chmod, chown, launch, process/service action, mount action, configuration change, /autoload_status, automatic resume, or automatic retry.

The host must:

1. record an approved literal source path without inference;
2. record non-secret device identity, session identity, route, raw request/response metadata, and exact client source commit;
3. create a new local temporary output exclusively and refuse overwrite;
4. receive in binary mode while counting every byte;
5. reject timeout, protocol error, unexpected EOF, short transfer, surplus bytes, missing expected length, or any partial output as TRANSFER_INCOMPLETE then INVALID;
6. close the file, reopen it, record its exact size, and compute SHA-256;
7. start a new connection and session for a second new exclusive local temporary file, with no reused partial bytes;
8. close, reopen, size, and hash the second file;
9. compare exact sizes, SHA-256 values, and every byte;
10. make no automatic third attempt when the copies differ.

If a transport cannot provide a trustworthy expected byte count, the host may save an exploratory copy only as SOURCE_MAPPING_PARTIAL; it cannot classify the transfer as byte-exact source attestation. The current stack has the stronger blocker that it does not return arbitrary file bytes at all.

State machine

stateDiagram-v2
    [*] --> TRANSFER_NOT_STARTED
    TRANSFER_NOT_STARTED --> TRANSFER_INCOMPLETE: first byte accepted
    TRANSFER_INCOMPLETE --> INVALID: timeout / short read / framing error
    TRANSFER_INCOMPLETE --> HOST_COPY_RECEIVED: exact complete response
    HOST_COPY_RECEIVED --> HOST_COPY_REOPENED: close + reopen
    HOST_COPY_REOPENED --> HOST_COPY_HASHED: size + SHA-256
    HOST_COPY_HASHED --> SECOND_COPY_CREATED: new session/output
    SECOND_COPY_CREATED --> SECOND_COPY_REOPENED: exact receive + close/reopen
    SECOND_COPY_REOPENED --> SECOND_COPY_HASHED: size + SHA-256
    SECOND_COPY_HASHED --> INVALID: size/hash/byte mismatch
    SECOND_COPY_HASHED --> COPIES_MATCH: size/hash/all bytes equal
    COPIES_MATCH --> SOURCE_MAPPING_PARTIAL: path/object identity incomplete
    COPIES_MATCH --> SOURCE_MAPPING_VERIFIED: independent source mapping proven

Required status vocabulary:

• TRANSFER_NOT_STARTED
• TRANSFER_INCOMPLETE
• HOST_COPY_RECEIVED
• HOST_COPY_REOPENED
• HOST_COPY_HASHED
• SECOND_COPY_CREATED
• SECOND_COPY_REOPENED
• SECOND_COPY_HASHED
• COPIES_MATCH
• SOURCE_MAPPING_PARTIAL
• SOURCE_MAPPING_VERIFIED
• INVALID

Classification boundaries

OFF_DEVICE_BACKUP_VALID is allowed only after the two closed-and-reopened local copies have identical sizes, SHA-256 values, and bytes. It says nothing about the current live source path unless source mapping was independently proven.

RECOVERY_PROVEN is forbidden in this phase. A matching host backup is not proof that any actor can safely restore it, survive power loss, retain the old live file, or recover without the component being replaced.

The contract is intentionally descriptive. Phase 0.9D creates no client, script, device command, backup, or transfer package.