492 lines
34 KiB
JSON
492 lines
34 KiB
JSON
{
|
|
"schema_version": 1,
|
|
"schema_contract": {
|
|
"id": "chimera-gfx-phase-0.9a-anti-brick-design-v1",
|
|
"validator": "tests/test_phase09_transaction.py",
|
|
"host_simulator": "tools/simulate_phase09_transaction.py"
|
|
},
|
|
"status": "DESIGN_ONLY",
|
|
"phase": "PHASE_0_9A_OFFLINE_ANTI_BRICK",
|
|
"historical_status": "READ_ONLY_PREFLIGHT_BLOCKED",
|
|
"hardware_observed": false,
|
|
"ps5_connected": false,
|
|
"device_write_performed": false,
|
|
"files_transferred": false,
|
|
"target_execution_performed": false,
|
|
"target_artifact_created": false,
|
|
"installation_authorized": false,
|
|
"lifecycle_authorized": false,
|
|
"execution_authorized": false,
|
|
"transfer_authorized": false,
|
|
"automatic_retry": false,
|
|
"firmware_runtime_behavior": "UNPROVEN",
|
|
"stock_identification": "reference_only",
|
|
"payload_manager_backup": "HARD_BLOCKER",
|
|
"lifecycle_probe_in_scope": false,
|
|
"graphics_in_scope": false,
|
|
"retroarch_in_scope": false,
|
|
"host_simulation_is_hardware_evidence": false,
|
|
"immutable_phase08_evidence": [
|
|
{
|
|
"path": "docs/runtime/phase-0.8-read-only-preflight.md",
|
|
"sha256": "3fbe086175a6048176075f447ec1482074928e3b5282db97ea2169395fe1d508"
|
|
},
|
|
{
|
|
"path": "manifests/runtime/phase-0.8-read-only-preflight.json",
|
|
"sha256": "47d7f452f8799979fe99b3e6d56859f03544112725bf7e5b349eba5ed81b3322"
|
|
},
|
|
{
|
|
"path": "tests/test_phase08_preflight.py",
|
|
"sha256": "8a4ad7c70de28ffe3148fd3fd1f68c36a872c53c691c9068e1ff163970863c48"
|
|
}
|
|
],
|
|
"permanent_denylist_binding": {
|
|
"sha256": "4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63",
|
|
"status": "BLOCKED",
|
|
"permanent": true,
|
|
"execution_eligible": false
|
|
},
|
|
"source_evidence": {
|
|
"repository_head": "2c944d6d65a08f7e1c02f518721cde061b999329",
|
|
"hardened_elfldr_commit": "197623058f509eddde18868dafcb92fdcac66464",
|
|
"controlled_payload_manager_commit": "e23d94ff91233aa770e2342800c1467875bdef44",
|
|
"lifecycle_probe_source_commit": "fe08300339a13f899fb78ea404ada381a5cba87c",
|
|
"payload_manager_public_base_commit": "cfbc70f30f419b09bf2b52283f7409e2d3117ee1",
|
|
"elfldr_public_base_commit": "699e8bcff03e91e8d6ca6eba281af25c5a58d8c2"
|
|
},
|
|
"threat_control_profiles": [
|
|
{
|
|
"id": "A_WRONG_TARGET",
|
|
"possible_damage": "The wrong object is replaced, potentially removing the only working launcher or manager.",
|
|
"detection_before_mutation": "Require one stable no-follow object handle plus literal path token, mount ID, object ID, type, size and SHA-256; repeat identity immediately before mutation.",
|
|
"preventive_invariants": ["AB-001", "AB-003", "AB-004", "AB-007"],
|
|
"recovery": "Only a separately verified backup and an independent recovery executor could recover; neither is proven on PS5.",
|
|
"residual_risk": "Namespace races and platform object-identity semantics remain UNPROVEN.",
|
|
"phase_decision": "BLOCKED"
|
|
},
|
|
{
|
|
"id": "B_WRONG_PREIMAGE",
|
|
"possible_damage": "A modified or firmware-incompatible live object is treated as stock and overwritten.",
|
|
"detection_before_mutation": "Bind firmware, build manifest, path, mount, object ID, size and digest to one current stable observation.",
|
|
"preventive_invariants": ["AB-001", "AB-002", "AB-003", "AB-004"],
|
|
"recovery": "Do not mutate on any mismatch; post-mutation recovery is not an acceptable substitute.",
|
|
"residual_risk": "Current on-device identities and firmware behavior remain UNPROVEN.",
|
|
"phase_decision": "BLOCKED"
|
|
},
|
|
{
|
|
"id": "C_BACKUP_FAILURE",
|
|
"possible_damage": "Rollback bytes are absent, ambiguous, partial, corrupt or dependent on the failed component.",
|
|
"detection_before_mutation": "Create before staging, close, reopen, re-identify and rehash a separate object; verify capacity, mapping and an independent recovery executor.",
|
|
"preventive_invariants": ["AB-005", "AB-006", "AB-016", "AB-017"],
|
|
"recovery": "No live mutation is permitted until the backup and recovery path are proven.",
|
|
"residual_risk": "The byte-exact on-device Payload Manager backup is a HARD_BLOCKER.",
|
|
"phase_decision": "BLOCKED"
|
|
},
|
|
{
|
|
"id": "D_WRITE_POWER_LOSS",
|
|
"possible_damage": "Power loss can expose a missing or partial live path, lose directory metadata or leave an ambiguous active identity.",
|
|
"detection_before_mutation": "Prove staging isolation, file and directory durability, and a single atomic switch primitive under interruption.",
|
|
"preventive_invariants": ["AB-007", "AB-008", "AB-009", "AB-011", "AB-012", "AB-013"],
|
|
"recovery": "Only a proven atomic old-or-new result plus an intact independent backup is acceptable.",
|
|
"residual_risk": "PS5 filesystem atomicity, exchange and durability are UNPROVEN.",
|
|
"phase_decision": "BLOCKED"
|
|
},
|
|
{
|
|
"id": "E_PROCESS_LIFECYCLE",
|
|
"possible_damage": "An active mapping, supervisor, autoload or retry starts unverified bytes or creates a crash loop.",
|
|
"detection_before_mutation": "Prove process/service/listener ownership, quiescence, supervisor behavior and authoritative autoload/retry state.",
|
|
"preventive_invariants": ["AB-010", "AB-013", "AB-014", "AB-020"],
|
|
"recovery": "Stop before switch on any active or unknown state; never rely on automatic restart.",
|
|
"residual_risk": "Current process, listener and service topology is unobserved.",
|
|
"phase_decision": "BLOCKED"
|
|
},
|
|
{
|
|
"id": "F_ROLLBACK_FAILURE",
|
|
"possible_damage": "Rollback restores wrong bytes, targets the wrong object, starts a service, or cannot run after the replaced component fails.",
|
|
"detection_before_mutation": "Bind rollback to the verified backup, target mapping, independent executor and post-rollback identity checks.",
|
|
"preventive_invariants": ["AB-006", "AB-015", "AB-016", "AB-017"],
|
|
"recovery": "A failed rollback verification is CATASTROPHIC/BLOCKED and never retried automatically.",
|
|
"residual_risk": "No independent on-device recovery path is proven.",
|
|
"phase_decision": "BLOCKED"
|
|
},
|
|
{
|
|
"id": "G_OPERATOR_ERROR",
|
|
"possible_damage": "Artifacts, firmware, approvals or phases are confused and a general status bypasses a specific hard gate.",
|
|
"detection_before_mutation": "Use component-specific manifests and approvals bound to one device, firmware, hash, size, action and expiry.",
|
|
"preventive_invariants": ["AB-018", "AB-019", "AB-020"],
|
|
"recovery": "Fail closed before mutation; one component window must be accepted or rolled back before another begins.",
|
|
"residual_risk": "Component order is not inferred without proven dependency evidence.",
|
|
"phase_decision": "BLOCKED"
|
|
}
|
|
],
|
|
"threat_model_items": [
|
|
{"id": "TM-A-01", "profile": "A_WRONG_TARGET", "scenario": "wrong_path", "severity": "CATASTROPHIC", "reason": "May replace an unrelated critical object."},
|
|
{"id": "TM-A-02", "profile": "A_WRONG_TARGET", "scenario": "wrong_mountpoint", "severity": "CATASTROPHIC", "reason": "Path text can name a different storage object."},
|
|
{"id": "TM-A-03", "profile": "A_WRONG_TARGET", "scenario": "symlink_junction_or_redirect", "severity": "CATASTROPHIC", "reason": "A redirect defeats the reviewed target mapping."},
|
|
{"id": "TM-A-04", "profile": "A_WRONG_TARGET", "scenario": "path_resolves_to_different_object_after_preflight", "severity": "CATASTROPHIC", "reason": "TOCTOU can switch the write target."},
|
|
{"id": "TM-A-05", "profile": "A_WRONG_TARGET", "scenario": "case_or_path_normalization_changes_identity", "severity": "HIGH", "reason": "Canonicalization may collapse distinct names."},
|
|
{"id": "TM-A-06", "profile": "A_WRONG_TARGET", "scenario": "target_replaced_between_check_and_write", "severity": "CATASTROPHIC", "reason": "The stable pre-image binding is lost."},
|
|
{"id": "TM-B-01", "profile": "B_WRONG_PREIMAGE", "scenario": "live_hash_differs_from_stock_reference", "severity": "HIGH", "reason": "Existing modifications could be destroyed."},
|
|
{"id": "TM-B-02", "profile": "B_WRONG_PREIMAGE", "scenario": "live_size_differs", "severity": "HIGH", "reason": "The observed object is not the approved pre-image."},
|
|
{"id": "TM-B-03", "profile": "B_WRONG_PREIMAGE", "scenario": "object_id_changes", "severity": "CATASTROPHIC", "reason": "The write would target an unverified object."},
|
|
{"id": "TM-B-04", "profile": "B_WRONG_PREIMAGE", "scenario": "firmware_differs", "severity": "HIGH", "reason": "Compatibility and recovery assumptions do not transfer."},
|
|
{"id": "TM-B-05", "profile": "B_WRONG_PREIMAGE", "scenario": "manifest_belongs_to_another_build", "severity": "HIGH", "reason": "Candidate and recovery evidence become invalid."},
|
|
{"id": "TM-B-06", "profile": "B_WRONG_PREIMAGE", "scenario": "modified_installation_treated_as_stock", "severity": "CATASTROPHIC", "reason": "Unknown required bytes could be irreversibly lost."},
|
|
{"id": "TM-C-01", "profile": "C_BACKUP_FAILURE", "scenario": "backup_missing", "severity": "CATASTROPHIC", "reason": "No rollback bytes exist."},
|
|
{"id": "TM-C-02", "profile": "C_BACKUP_FAILURE", "scenario": "backup_is_same_object_as_live", "severity": "CATASTROPHIC", "reason": "A switch or failure can destroy both identities."},
|
|
{"id": "TM-C-03", "profile": "C_BACKUP_FAILURE", "scenario": "backup_on_same_vulnerable_path", "severity": "CATASTROPHIC", "reason": "One namespace failure can remove both copies."},
|
|
{"id": "TM-C-04", "profile": "C_BACKUP_FAILURE", "scenario": "backup_partial", "severity": "CATASTROPHIC", "reason": "Partial bytes cannot restore the pre-image."},
|
|
{"id": "TM-C-05", "profile": "C_BACKUP_FAILURE", "scenario": "backup_hash_mismatch", "severity": "CATASTROPHIC", "reason": "Rollback bytes are not the verified pre-image."},
|
|
{"id": "TM-C-06", "profile": "C_BACKUP_FAILURE", "scenario": "backup_cannot_be_reopened", "severity": "HIGH", "reason": "Durability and later readability are unproven."},
|
|
{"id": "TM-C-07", "profile": "C_BACKUP_FAILURE", "scenario": "backup_mapping_ambiguous", "severity": "CATASTROPHIC", "reason": "Rollback may restore the wrong target."},
|
|
{"id": "TM-C-08", "profile": "C_BACKUP_FAILURE", "scenario": "recovery_tool_depends_on_replaced_component", "severity": "CATASTROPHIC", "reason": "The recovery executor may disappear with the failure."},
|
|
{"id": "TM-C-09", "profile": "C_BACKUP_FAILURE", "scenario": "insufficient_storage", "severity": "HIGH", "reason": "Writes or metadata allocation can fail partway."},
|
|
{"id": "TM-C-10", "profile": "C_BACKUP_FAILURE", "scenario": "backup_created_after_live_mutation", "severity": "CATASTROPHIC", "reason": "The only known-good pre-image may already be lost."},
|
|
{"id": "TM-D-01", "profile": "D_WRITE_POWER_LOSS", "scenario": "power_loss_before_staging", "severity": "LOW", "reason": "No live mutation should have occurred, but platform evidence is still required."},
|
|
{"id": "TM-D-02", "profile": "D_WRITE_POWER_LOSS", "scenario": "power_loss_during_staging", "severity": "HIGH", "reason": "A partial candidate must never become live."},
|
|
{"id": "TM-D-03", "profile": "D_WRITE_POWER_LOSS", "scenario": "power_loss_after_staging_before_verification", "severity": "HIGH", "reason": "Unverified staged bytes may persist."},
|
|
{"id": "TM-D-04", "profile": "D_WRITE_POWER_LOSS", "scenario": "power_loss_during_live_switch", "severity": "CATASTROPHIC", "reason": "The live identity can become missing or ambiguous."},
|
|
{"id": "TM-D-05", "profile": "D_WRITE_POWER_LOSS", "scenario": "power_loss_immediately_after_live_switch", "severity": "CATASTROPHIC", "reason": "Directory metadata may not be durable."},
|
|
{"id": "TM-D-06", "profile": "D_WRITE_POWER_LOSS", "scenario": "power_loss_before_directory_metadata_durable", "severity": "CATASTROPHIC", "reason": "The namespace may revert or lose the live entry."},
|
|
{"id": "TM-D-07", "profile": "D_WRITE_POWER_LOSS", "scenario": "partial_write", "severity": "CATASTROPHIC", "reason": "A partial live executable is unusable."},
|
|
{"id": "TM-D-08", "profile": "D_WRITE_POWER_LOSS", "scenario": "short_write", "severity": "HIGH", "reason": "Completion cannot be assumed from one write."},
|
|
{"id": "TM-D-09", "profile": "D_WRITE_POWER_LOSS", "scenario": "write_error", "severity": "HIGH", "reason": "The candidate or backup may be incomplete."},
|
|
{"id": "TM-D-10", "profile": "D_WRITE_POWER_LOSS", "scenario": "flush_or_fsync_error", "severity": "CATASTROPHIC", "reason": "Bytes may not survive interruption."},
|
|
{"id": "TM-D-11", "profile": "D_WRITE_POWER_LOSS", "scenario": "file_correct_directory_not_durable", "severity": "CATASTROPHIC", "reason": "The live path may still disappear."},
|
|
{"id": "TM-D-12", "profile": "D_WRITE_POWER_LOSS", "scenario": "new_file_wrong_metadata", "severity": "HIGH", "reason": "Ownership or mode may prevent startup or recovery."},
|
|
{"id": "TM-E-01", "profile": "E_PROCESS_LIFECYCLE", "scenario": "target_file_active", "severity": "HIGH", "reason": "Old mappings and replacement behavior are unproven."},
|
|
{"id": "TM-E-02", "profile": "E_PROCESS_LIFECYCLE", "scenario": "multiple_instances", "severity": "HIGH", "reason": "Quiescence and ownership become ambiguous."},
|
|
{"id": "TM-E-03", "profile": "E_PROCESS_LIFECYCLE", "scenario": "service_self_restarts", "severity": "CATASTROPHIC", "reason": "Unverified bytes could start automatically."},
|
|
{"id": "TM-E-04", "profile": "E_PROCESS_LIFECYCLE", "scenario": "listener_conflict", "severity": "MEDIUM", "reason": "Control and recovery channels may be unavailable."},
|
|
{"id": "TM-E-05", "profile": "E_PROCESS_LIFECYCLE", "scenario": "process_holds_old_file_or_mapping", "severity": "HIGH", "reason": "Observed path identity may differ from running code."},
|
|
{"id": "TM-E-06", "profile": "E_PROCESS_LIFECYCLE", "scenario": "watchdog_or_supervisor_auto_restart", "severity": "CATASTROPHIC", "reason": "It bypasses the execution approval gate."},
|
|
{"id": "TM-E-07", "profile": "E_PROCESS_LIFECYCLE", "scenario": "autoload_starts_candidate_before_verification", "severity": "CATASTROPHIC", "reason": "Unverified code can run automatically."},
|
|
{"id": "TM-E-08", "profile": "E_PROCESS_LIFECYCLE", "scenario": "automatic_retry_crash_loop", "severity": "CATASTROPHIC", "reason": "Repeated failure may prevent stable recovery."},
|
|
{"id": "TM-F-01", "profile": "F_ROLLBACK_FAILURE", "scenario": "rollback_uses_wrong_backup", "severity": "CATASTROPHIC", "reason": "The restored object is not the pre-image."},
|
|
{"id": "TM-F-02", "profile": "F_ROLLBACK_FAILURE", "scenario": "rollback_uses_wrong_target_path", "severity": "CATASTROPHIC", "reason": "Recovery can corrupt another object."},
|
|
{"id": "TM-F-03", "profile": "F_ROLLBACK_FAILURE", "scenario": "rollback_interrupted", "severity": "CATASTROPHIC", "reason": "Neither old nor new live identity may remain usable."},
|
|
{"id": "TM-F-04", "profile": "F_ROLLBACK_FAILURE", "scenario": "rollback_hash_wrong_after_restore", "severity": "CATASTROPHIC", "reason": "Recovery did not restore verified bytes."},
|
|
{"id": "TM-F-05", "profile": "F_ROLLBACK_FAILURE", "scenario": "rollback_auto_starts_service", "severity": "CATASTROPHIC", "reason": "Execution occurs before restored identity review."},
|
|
{"id": "TM-F-06", "profile": "F_ROLLBACK_FAILURE", "scenario": "rollback_requires_payload_manager", "severity": "CATASTROPHIC", "reason": "Payload Manager replacement can remove its own recovery path."},
|
|
{"id": "TM-F-07", "profile": "F_ROLLBACK_FAILURE", "scenario": "rollback_requires_elfldr", "severity": "CATASTROPHIC", "reason": "elfldr replacement can remove its own recovery path."},
|
|
{"id": "TM-G-01", "profile": "G_OPERATOR_ERROR", "scenario": "elfldr_and_manager_swapped", "severity": "CATASTROPHIC", "reason": "The wrong executable is installed into a critical role."},
|
|
{"id": "TM-G-02", "profile": "G_OPERATOR_ERROR", "scenario": "lifecycle_probe_treated_as_install_candidate", "severity": "CATASTROPHIC", "reason": "The probe is not a runtime replacement component."},
|
|
{"id": "TM-G-03", "profile": "G_OPERATOR_ERROR", "scenario": "wrong_firmware_or_build_selected", "severity": "HIGH", "reason": "Evidence and compatibility binding are invalid."},
|
|
{"id": "TM-G-04", "profile": "G_OPERATOR_ERROR", "scenario": "two_installation_phases_combined", "severity": "CATASTROPHIC", "reason": "A single failure can remove both recovery dependencies."},
|
|
{"id": "TM-G-05", "profile": "G_OPERATOR_ERROR", "scenario": "approval_reused_for_other_component", "severity": "HIGH", "reason": "Authority is not component or hash bound."},
|
|
{"id": "TM-G-06", "profile": "G_OPERATOR_ERROR", "scenario": "stale_manifest_used", "severity": "HIGH", "reason": "The approved identities may no longer match."},
|
|
{"id": "TM-G-07", "profile": "G_OPERATOR_ERROR", "scenario": "general_ready_overrides_specific_blocker", "severity": "CATASTROPHIC", "reason": "A hard stop can be silently bypassed."}
|
|
],
|
|
"anti_brick_invariants": [
|
|
{"id": "AB-001", "text": "No write without exact stable path, mount ID, object ID, type, size and pre-image SHA-256."},
|
|
{"id": "AB-002", "text": "A stock digest remains reference_only until observed on one stable on-device object."},
|
|
{"id": "AB-003", "text": "A digest match without object identity is insufficient."},
|
|
{"id": "AB-004", "text": "Object identity without a digest match is insufficient."},
|
|
{"id": "AB-005", "text": "The separate backup exists before staging and passes close, reopen, identity, size and digest verification."},
|
|
{"id": "AB-006", "text": "Backup and recovery do not depend on the candidate or replaced component."},
|
|
{"id": "AB-007", "text": "Never overwrite a live executable in place."},
|
|
{"id": "AB-008", "text": "Stage under a separate inactive identity."},
|
|
{"id": "AB-009", "text": "Reopen and hash the staged candidate before activation; bytes equal the offline-approved artifact."},
|
|
{"id": "AB-010", "text": "No autoload, retry, service restart or boot starts the candidate."},
|
|
{"id": "AB-011", "text": "Switch only with a separately proven transactional or atomic primitive."},
|
|
{"id": "AB-012", "text": "Unproven atomicity or durability blocks installation."},
|
|
{"id": "AB-013", "text": "Verify live identity after switch; execution is a later separate approval."},
|
|
{"id": "AB-014", "text": "At most one manual execution and zero automatic retries."},
|
|
{"id": "AB-015", "text": "Failed post-switch verification enters ROLLBACK_REQUIRED, never execution."},
|
|
{"id": "AB-016", "text": "Rollback uses only the preverified backup and exact target mapping."},
|
|
{"id": "AB-017", "text": "After rollback, re-establish size, SHA-256, object identity and relevant metadata."},
|
|
{"id": "AB-018", "text": "Hardened elfldr and controlled Payload Manager are never replaced in one uninterrupted transaction."},
|
|
{"id": "AB-019", "text": "The lifecycle probe is never an installation candidate."},
|
|
{"id": "AB-020", "text": "No later phase begins without separate human permission."}
|
|
],
|
|
"transaction_states": [
|
|
"OFFLINE_ONLY",
|
|
"OBSERVATION_NOT_AUTHORIZED",
|
|
"OBSERVATION_AUTHORIZED",
|
|
"DEVICE_IDENTITY_OBSERVED",
|
|
"LIVE_OBJECTS_VERIFIED",
|
|
"BACKUP_NOT_PRESENT",
|
|
"BACKUP_CREATION_NOT_AUTHORIZED",
|
|
"BACKUP_CREATION_AUTHORIZED",
|
|
"BACKUP_CREATED",
|
|
"BACKUP_REOPENED_AND_VERIFIED",
|
|
"RECOVERY_PATH_VERIFIED",
|
|
"CANDIDATE_NOT_AUTHORIZED",
|
|
"CANDIDATE_APPROVED_OFFLINE",
|
|
"STAGING_NOT_AUTHORIZED",
|
|
"STAGING_AUTHORIZED",
|
|
"CANDIDATE_STAGED",
|
|
"CANDIDATE_REOPENED_AND_VERIFIED",
|
|
"TARGET_NOT_QUIESCENT",
|
|
"TARGET_QUIESCENT",
|
|
"SWITCH_NOT_AUTHORIZED",
|
|
"SWITCH_AUTHORIZED",
|
|
"SWITCH_IN_PROGRESS",
|
|
"POST_SWITCH_VERIFY",
|
|
"MANUAL_EXECUTION_NOT_AUTHORIZED",
|
|
"MANUAL_EXECUTION_AUTHORIZED",
|
|
"ONE_SHOT_EXECUTION",
|
|
"ACCEPTED",
|
|
"ROLLBACK_REQUIRED",
|
|
"ROLLBACK_AUTHORIZED",
|
|
"ROLLBACK_IN_PROGRESS",
|
|
"ROLLBACK_VERIFIED",
|
|
"BLOCKED"
|
|
],
|
|
"allowed_transitions": [
|
|
"OFFLINE_ONLY->OBSERVATION_NOT_AUTHORIZED",
|
|
"OBSERVATION_NOT_AUTHORIZED->OBSERVATION_AUTHORIZED",
|
|
"OBSERVATION_AUTHORIZED->DEVICE_IDENTITY_OBSERVED",
|
|
"DEVICE_IDENTITY_OBSERVED->LIVE_OBJECTS_VERIFIED",
|
|
"LIVE_OBJECTS_VERIFIED->BACKUP_NOT_PRESENT",
|
|
"BACKUP_NOT_PRESENT->BACKUP_CREATION_NOT_AUTHORIZED",
|
|
"BACKUP_CREATION_NOT_AUTHORIZED->BACKUP_CREATION_AUTHORIZED",
|
|
"BACKUP_CREATION_AUTHORIZED->BACKUP_CREATED",
|
|
"BACKUP_CREATED->BACKUP_REOPENED_AND_VERIFIED",
|
|
"BACKUP_REOPENED_AND_VERIFIED->RECOVERY_PATH_VERIFIED",
|
|
"RECOVERY_PATH_VERIFIED->CANDIDATE_NOT_AUTHORIZED",
|
|
"CANDIDATE_NOT_AUTHORIZED->CANDIDATE_APPROVED_OFFLINE",
|
|
"CANDIDATE_APPROVED_OFFLINE->STAGING_NOT_AUTHORIZED",
|
|
"STAGING_NOT_AUTHORIZED->STAGING_AUTHORIZED",
|
|
"STAGING_AUTHORIZED->CANDIDATE_STAGED",
|
|
"CANDIDATE_STAGED->CANDIDATE_REOPENED_AND_VERIFIED",
|
|
"CANDIDATE_REOPENED_AND_VERIFIED->TARGET_NOT_QUIESCENT",
|
|
"TARGET_NOT_QUIESCENT->TARGET_QUIESCENT",
|
|
"TARGET_QUIESCENT->SWITCH_NOT_AUTHORIZED",
|
|
"SWITCH_NOT_AUTHORIZED->SWITCH_AUTHORIZED",
|
|
"SWITCH_AUTHORIZED->SWITCH_IN_PROGRESS",
|
|
"SWITCH_IN_PROGRESS->POST_SWITCH_VERIFY",
|
|
"POST_SWITCH_VERIFY->MANUAL_EXECUTION_NOT_AUTHORIZED",
|
|
"MANUAL_EXECUTION_NOT_AUTHORIZED->MANUAL_EXECUTION_AUTHORIZED",
|
|
"MANUAL_EXECUTION_AUTHORIZED->ONE_SHOT_EXECUTION",
|
|
"ONE_SHOT_EXECUTION->ACCEPTED",
|
|
"POST_SWITCH_VERIFY->ROLLBACK_REQUIRED",
|
|
"ROLLBACK_REQUIRED->ROLLBACK_AUTHORIZED",
|
|
"ROLLBACK_AUTHORIZED->ROLLBACK_IN_PROGRESS",
|
|
"ROLLBACK_IN_PROGRESS->ROLLBACK_VERIFIED",
|
|
"ANY_ERROR_MISMATCH_TIMEOUT_OR_UNKNOWN->BLOCKED"
|
|
],
|
|
"forbidden_transitions": [
|
|
"automatic_transition_across_any_authorization_state",
|
|
"automatic_retry",
|
|
"autoload",
|
|
"in_place_overwrite",
|
|
"two_step_rename_with_missing_live_gap",
|
|
"post_switch_direct_to_execution",
|
|
"combined_component_installation",
|
|
"second_component_before_first_accepted_or_rolled_back",
|
|
"lifecycle_probe_to_installation_candidate",
|
|
"lifecycle_transition",
|
|
"graphics_transition",
|
|
"retroarch_transition",
|
|
"general_ready_overrides_specific_blocker"
|
|
],
|
|
"approval_gates": [
|
|
{"id": "observation", "authorized": false, "separate_human_approval_required": true},
|
|
{"id": "backup_creation", "authorized": false, "separate_human_approval_required": true},
|
|
{"id": "staging", "authorized": false, "separate_human_approval_required": true},
|
|
{"id": "switch", "authorized": false, "separate_human_approval_required": true},
|
|
{"id": "one_shot_execution", "authorized": false, "separate_human_approval_required": true},
|
|
{"id": "rollback", "authorized": false, "separate_human_approval_required": true}
|
|
],
|
|
"power_loss_boundaries": [
|
|
{"id": "before_backup_write", "before": "verified old live; no backup write", "possible_objects": "old live only", "visible_live": "old live", "backup": "absent", "automatic_start": false, "independent_recovery": "not needed before mutation", "recoverable": "UNPROVEN", "result": "UNPROVEN"},
|
|
{"id": "during_backup_write", "before": "old live intact; backup creation authorized", "possible_objects": "old live plus partial backup", "visible_live": "old live", "backup": "partial and invalid", "automatic_start": false, "independent_recovery": "old live must remain independent", "recoverable": "UNPROVEN", "result": "UNPROVEN"},
|
|
{"id": "after_backup_write_before_flush", "before": "backup bytes written but not durable", "possible_objects": "old live plus volatile backup", "visible_live": "old live", "backup": "not durable", "automatic_start": false, "independent_recovery": "unproven", "recoverable": "UNPROVEN", "result": "UNPROVEN"},
|
|
{"id": "after_flush_before_reopen_hash", "before": "backup flush requested", "possible_objects": "old live plus unverified backup", "visible_live": "old live", "backup": "not reopened or rehashed", "automatic_start": false, "independent_recovery": "unproven", "recoverable": "UNPROVEN", "result": "UNPROVEN"},
|
|
{"id": "during_candidate_staging", "before": "verified backup; separate candidate write", "possible_objects": "old live, verified backup, partial candidate", "visible_live": "old live", "backup": "must remain intact", "automatic_start": false, "independent_recovery": "must not use candidate", "recoverable": "UNPROVEN", "result": "UNPROVEN"},
|
|
{"id": "after_candidate_staging_before_verification", "before": "candidate present but unverified", "possible_objects": "old live, verified backup, unverified candidate", "visible_live": "old live", "backup": "must remain intact", "automatic_start": false, "independent_recovery": "old live remains primary", "recoverable": "UNPROVEN", "result": "UNPROVEN"},
|
|
{"id": "immediately_before_live_switch", "before": "candidate and backup verified; target quiescent", "possible_objects": "old live, verified backup, verified candidate", "visible_live": "old live", "backup": "verified", "automatic_start": false, "independent_recovery": "required", "recoverable": "UNPROVEN", "result": "UNPROVEN"},
|
|
{"id": "during_live_switch", "before": "atomic switch requested", "possible_objects": "must be exactly complete old or complete new; platform behavior unknown", "visible_live": "UNPROVEN", "backup": "must remain verified", "automatic_start": false, "independent_recovery": "required", "recoverable": "UNPROVEN", "result": "UNPROVEN"},
|
|
{"id": "immediately_after_live_switch", "before": "namespace switch returned", "possible_objects": "new live plus backup if atomic; directory durability unknown", "visible_live": "UNPROVEN", "backup": "must remain verified", "automatic_start": false, "independent_recovery": "required", "recoverable": "UNPROVEN", "result": "UNPROVEN"},
|
|
{"id": "after_switch_before_live_hash", "before": "candidate nominally live but not verified", "possible_objects": "new live or ambiguous namespace plus backup", "visible_live": "unverified", "backup": "must remain verified", "automatic_start": false, "independent_recovery": "required", "recoverable": "UNPROVEN", "result": "UNPROVEN"},
|
|
{"id": "after_live_hash_before_execution", "before": "post-switch hash recorded; execution still unauthorized", "possible_objects": "verified new live plus backup if platform durable", "visible_live": "new live", "backup": "must remain verified", "automatic_start": false, "independent_recovery": "required", "recoverable": "UNPROVEN", "result": "UNPROVEN"},
|
|
{"id": "during_first_manual_execution", "before": "separate one-shot execution gate", "possible_objects": "new live plus backup", "visible_live": "new live", "backup": "must remain verified", "automatic_start": false, "independent_recovery": "must work without executed component", "recoverable": "UNPROVEN", "result": "UNPROVEN"},
|
|
{"id": "during_rollback", "before": "rollback separately authorized", "possible_objects": "must be complete new or complete old plus intact backup", "visible_live": "UNPROVEN", "backup": "must remain verified", "automatic_start": false, "independent_recovery": "required", "recoverable": "UNPROVEN", "result": "UNPROVEN"},
|
|
{"id": "after_rollback_before_recovery_verification", "before": "rollback switch returned", "possible_objects": "restored old live if atomic and durable", "visible_live": "unverified restored object", "backup": "must remain verified", "automatic_start": false, "independent_recovery": "required", "recoverable": "UNPROVEN", "result": "UNPROVEN"}
|
|
],
|
|
"backup_conditions": [
|
|
"created_before_any_live_mutation",
|
|
"exact_source_object_and_restore_target_recorded",
|
|
"source_stable_during_read",
|
|
"all_bytes_read",
|
|
"exact_size",
|
|
"exact_sha256",
|
|
"separate_object",
|
|
"closed_reopened_reidentified_and_rehashed",
|
|
"storage_medium_and_mount_recorded",
|
|
"capacity_and_metadata_reserve_proven",
|
|
"not_removed_by_autoload_cleanup_or_packaging",
|
|
"not_replaced_by_candidate",
|
|
"mapping_not_derived_from_glob_or_basename",
|
|
"rollback_requires_no_target_path_guess",
|
|
"strongly_recommended_second_off_device_copy_requires_separate_future_transfer_approval"
|
|
],
|
|
"recovery_conditions": [
|
|
"recovery_start_mechanism_exactly_identified",
|
|
"recovery_executor_exactly_identified",
|
|
"recovery_executor_is_not_the_replaced_component",
|
|
"works_if_elfldr_does_not_start",
|
|
"works_if_payload_manager_does_not_start",
|
|
"works_without_autoload",
|
|
"works_without_replaced_component_network_listener",
|
|
"second_independent_recovery_path_is_proven",
|
|
"post_rollback_size_hash_object_identity_and_metadata_verified"
|
|
],
|
|
"filesystem_evidence_requirements": [
|
|
"filesystem_type",
|
|
"mount_identity",
|
|
"read_write_status",
|
|
"atomic_rename_or_exchange_support",
|
|
"replace_existing_file_semantics",
|
|
"file_flush_durability",
|
|
"directory_flush_durability",
|
|
"power_loss_behavior",
|
|
"symlink_no_follow_semantics",
|
|
"stable_open_object_identity",
|
|
"ownership_and_mode_preservation",
|
|
"available_space_and_metadata_capacity",
|
|
"maximum_file_size",
|
|
"behavior_while_target_process_has_file_open"
|
|
],
|
|
"unproven_platform_properties": [
|
|
"exact_current_firmware_from_two_device_sources",
|
|
"current_live_paths_mounts_objects_sizes_and_hashes",
|
|
"filesystem_type_and_mount_semantics",
|
|
"atomic_exchange_or_transactional_switch",
|
|
"file_and_directory_flush_durability",
|
|
"power_loss_namespace_behavior",
|
|
"no_follow_and_stable_object_identity",
|
|
"ownership_mode_and_metadata_preservation",
|
|
"capacity_and_maximum_file_size",
|
|
"open_executable_replacement_behavior",
|
|
"process_service_listener_and_supervisor_topology",
|
|
"autoload_and_retry_state",
|
|
"independent_recovery_executor",
|
|
"second_independent_recovery_path",
|
|
"byte_exact_reopenable_on_device_payload_manager_backup"
|
|
],
|
|
"component_models": [
|
|
{
|
|
"component": "hardened_elfldr",
|
|
"live_preimage": {
|
|
"classification": "reference_only",
|
|
"path": null,
|
|
"mount_id": null,
|
|
"object_id": null,
|
|
"size": 397000,
|
|
"sha256": "092d16ee0ede0c494947efd38d1a17bbd7cc4b022d3858ea898833c188c703e8",
|
|
"current_device_match": "UNPROVEN"
|
|
},
|
|
"backup": {"status": "STOP_GATE", "on_device_present": "UNPROVEN", "reopened_and_verified": false},
|
|
"candidate": {
|
|
"classification": "exact_offline_reviewed_reference",
|
|
"size": 397000,
|
|
"sha256": "63e810982471eb40cae3a20aa9df9a0a02892f420e429874fae4e99aa400b561",
|
|
"source_commit": "197623058f509eddde18868dafcb92fdcac66464"
|
|
},
|
|
"target_mapping": {"live_path": null, "backup_path": null, "staging_path": null, "status": "UNPROVEN"},
|
|
"recovery_dependency": "UNPROVEN",
|
|
"process_service_status": "UNPROVEN",
|
|
"listener_status": "UNPROVEN",
|
|
"autoload_status": "UNPROVEN",
|
|
"approval": false,
|
|
"staging": "NOT_AUTHORIZED",
|
|
"switch": {"authorized": false, "primitive": "UNPROVEN", "atomicity": "UNPROVEN", "durability": "UNPROVEN"},
|
|
"post_switch_verification": "NOT_PERFORMED",
|
|
"manual_execution": "NOT_AUTHORIZED",
|
|
"accepted": false,
|
|
"rollback": "NOT_AUTHORIZED"
|
|
},
|
|
{
|
|
"component": "controlled_payload_manager",
|
|
"live_preimage": {
|
|
"classification": "reference_only",
|
|
"path": null,
|
|
"mount_id": null,
|
|
"object_id": null,
|
|
"size": 2050320,
|
|
"sha256": "518740adbacccb9094fadb07dd424c53ee290f38306449ccc9d6957fdf813c0b",
|
|
"current_device_match": "UNPROVEN"
|
|
},
|
|
"backup": {"status": "HARD_BLOCKER", "on_device_present": "UNPROVEN", "reopened_and_verified": false},
|
|
"candidate": {
|
|
"classification": "exact_offline_reviewed_reference",
|
|
"size": 99560,
|
|
"sha256": "8fecf8241a46246eddbd21e8bb4d875f5d76f1f4f4c6a11384df1f131aa5e5b1",
|
|
"source_commit": "e23d94ff91233aa770e2342800c1467875bdef44"
|
|
},
|
|
"target_mapping": {"live_path": null, "backup_path": null, "staging_path": null, "status": "UNPROVEN"},
|
|
"recovery_dependency": "UNPROVEN",
|
|
"process_service_status": "UNPROVEN",
|
|
"listener_status": "UNPROVEN",
|
|
"autoload_status": "UNPROVEN",
|
|
"approval": false,
|
|
"staging": "NOT_AUTHORIZED",
|
|
"switch": {"authorized": false, "primitive": "UNPROVEN", "atomicity": "UNPROVEN", "durability": "UNPROVEN"},
|
|
"post_switch_verification": "NOT_PERFORMED",
|
|
"manual_execution": "NOT_AUTHORIZED",
|
|
"accepted": false,
|
|
"rollback": "NOT_AUTHORIZED"
|
|
}
|
|
],
|
|
"component_order": {
|
|
"selected": null,
|
|
"reason": "No order is inferred without proven dependency and independent recovery evidence.",
|
|
"combined_install_all": false,
|
|
"second_component_requires_first_accepted_or_fully_rolled_back": true
|
|
},
|
|
"switch_preference": [
|
|
"side_by_side_or_dual_slot_without_removing_stock",
|
|
"proven_atomic_exchange",
|
|
"proven_transactional_snapshot",
|
|
"other_method_only_after_separate_proof"
|
|
],
|
|
"blockers": [
|
|
{"id": "READ_ONLY_PREFLIGHT_BLOCKED", "severity": "HARD_STOP"},
|
|
{"id": "PAYLOAD_MANAGER_BACKUP_NOT_BYTE_EXACT_ON_DEVICE", "severity": "HARD_STOP"},
|
|
{"id": "NO_PROVEN_POWER_LOSS_SAFE_SWITCH", "severity": "HARD_STOP"},
|
|
{"id": "FILESYSTEM_ATOMICITY_UNPROVEN", "severity": "STOP"},
|
|
{"id": "FILE_DURABILITY_UNPROVEN", "severity": "STOP"},
|
|
{"id": "DIRECTORY_DURABILITY_UNPROVEN", "severity": "STOP"},
|
|
{"id": "RECOVERY_INDEPENDENCE_UNPROVEN", "severity": "HARD_STOP"},
|
|
{"id": "CURRENT_LIVE_IDENTITIES_UNPROVEN", "severity": "STOP"},
|
|
{"id": "CURRENT_PROCESS_AND_SERVICE_TOPOLOGY_UNPROVEN", "severity": "STOP"},
|
|
{"id": "FIRMWARE_RUNTIME_BEHAVIOR_UNPROVEN", "severity": "STOP"},
|
|
{"id": "COMPONENT_ORDER_UNPROVEN", "severity": "STOP"},
|
|
{"id": "ALL_DEVICE_ACTION_AUTHORIZATIONS_FALSE", "severity": "STOP"},
|
|
{"id": "ANY_UNSAFE_OR_UNPROVEN_POWER_LOSS_BOUNDARY", "severity": "HARD_STOP"}
|
|
],
|
|
"proof_requirements_before_future_bounded_observation": [
|
|
"new exact observation-only human authorization",
|
|
"exact collector identity and complete side-effect contract",
|
|
"collector bounded runtime and fail-closed cleanup",
|
|
"two current authoritative firmware observations",
|
|
"no installation transfer execution lifecycle autoload retry graphics or RetroArch authority",
|
|
"exact raw output and reviewer evidence contract",
|
|
"immutable Phase-0.8 and Phase-0.8R blockers preserved"
|
|
],
|
|
"prohibited_actions": [
|
|
"connect_to_ps5",
|
|
"use_usb_or_device_transport",
|
|
"transfer_file",
|
|
"execute_target_code",
|
|
"install_or_replace_component",
|
|
"create_on_device_backup",
|
|
"change_configuration",
|
|
"activate_autoload_or_retry",
|
|
"start_stop_or_signal_process_or_service",
|
|
"build_target_elf_self_sprx_pkg_or_payload",
|
|
"build_or_run_lifecycle_probe",
|
|
"generate_device_install_commands",
|
|
"modify_hardened_elfldr_production_code",
|
|
"modify_payload_manager_production_code",
|
|
"modify_lifecycle_probe_code",
|
|
"modify_target_toolchain",
|
|
"modify_graphics_sdl_or_retroarch_code",
|
|
"contact_network_gitea_or_upstream",
|
|
"install_packages",
|
|
"commit_or_push"
|
|
]
|
|
}
|