21 lines
783 B
Markdown
21 lines
783 B
Markdown
# ADR-0003: Fail-closed capability probe
|
|
|
|
- Status: accepted
|
|
- Date: 2026-07-16
|
|
|
|
## Decision
|
|
|
|
The PS5 probe is disabled in ordinary builds. A probe build embeds exactly one
|
|
approved firmware identifier, defaulting to `NONE`. Runtime requires an exact
|
|
firmware match and the literal `--acknowledge-read-only-probe` argument before
|
|
module loading. The checked-in firmware matrix is empty.
|
|
|
|
The platform shim may call only `dlopen`, `dlsym`, and `dlclose`. Logs contain
|
|
symbol names and booleans, never addresses. There is no deploy target.
|
|
|
|
## Consequences
|
|
|
|
Default artifacts cannot discover symbols on hardware. A deliberately gated
|
|
artifact still requires separate human authorization before transfer or
|
|
execution. Loader-internal side effects remain an explicitly recorded unknown.
|