chimera-gfx-Public/docs/runtime/phase-0.9e-future-rescue-payload-contract.md

Phase 0.9E future rescue payload contract

Date: 2026-07-18

This is a contract for a possible later Phase 0.9F. It is not target source, build authorization, transfer authorization, or execution authorization. Phase 0.9F design remains blocked while the exact bootstrap implementation and output contract are missing.

Requirements

#	Requirement	Bootstrap support now
1	loaded only through an independently proven bootstrap	UNPROVEN
2	never installed	payload policy can require it; bootstrap staging unknown
3	never added to autoload	payload policy can require it; actual trigger config unknown
4	never modifies elfldr or Manager	payload policy can require it
5	creates no device file	bootstrap behavior UNKNOWN
6	opens targets read-only	future payload requirement
7	sends only PS5-to-host file bytes	no current output channel
8	binary-safe framing	must be designed
9	exact byte count	must be designed
10	SHA-256 or complete host hashing	must be designed
11	rejects partial transfer	must be designed
12	no automatic retry	mandatory; current authorization false
13	one file per session	mandatory
14	no rename/unlink/upload/install/other-launch/autoload/mount/reboot/service control	mandatory
15	hard deadline	missing
16	host abort	missing
17	live installation untouched	bootstrap and payload both must prove this
18	separate output derived from exact bootstrap	missing
19	explicit crash/hang model	missing
20	no side-effect-free execution claim	mandatory disclosure

Required framing properties

A future design must bind:

• protocol version and request identifier;
• literal source path and component identity;
• expected exact byte count before accepting output;
• monotonically increasing chunk offset and bounded chunk length;
• final byte count and SHA-256;
• explicit success, rejection, timeout, abort, and short-read terminal states;
• no resume, reconnect retry, or third attempt;
• one connection/session and one component;
• host-side exclusive temporary output, close, reopen, size/hash, and partial deletion/quarantine policy.

Safety gates before any target source

Target source may not be created merely from this contract. A new phase must first provide:

1. exact used bootstrap package and source/binary identity;
2. proof of independence from both components being recovered;
3. source-backed host-to-memory or safe temporary-staging semantics;
4. a bounded, binary-safe result channel;
5. a restart/reboot model;
6. a reviewed startup, deadline, abort, crash, and cleanup contract;
7. separate explicit authority to design target code.

Current machine decision: phase09f_rescue_payload_design_allowed=false.