1.7 KiB
ADR-0010: Controlled runtime effects and Phase-0.6 gate
Status: accepted on 2026-07-17.
Context
ADR-0009 asked whether a fully kernelwrite-free startup could be proven while the exact loader was absent. The current task corrects the safety model: documented, bounded, volatile runtime changes may be acceptable. Persistent writes and unbounded or unknown effects remain hard blockers.
The installed Payload Manager and elfldr were subsequently identified exactly. Their public source exposes both acceptable volatile effects and unresolved unbounded paths.
Decision
Classify each lifecycle effect as exactly one of:
EXPECTED_VOLATILE_RUNTIME_EFFECT;RESTORED_BY_LOADER;PAYLOAD_PROCESS_LOCAL;PERSISTENT_WRITE;UNBOUNDED_OR_UNKNOWN.
Only the final two are categorical blockers. __patch_init is classified as
payload-process-local and is no longer an automatic blocker.
Every potentially eligible artifact must also have a profile named exactly
controlled-ps5-runtime, with exact firmware/loader/SDK/artifact identity,
an explicit list of expected volatile effects, zero persistent and filesystem
writes, no payload network, a maximum 2000 ms runtime, no retry, no hard
effects, and no hard blockers. Both the profile and static gate explicitly set
execution_authorized=false; static eligibility never grants execution
authority.
Consequences
Phase 0.6 remains blocked because the exact chain has unbounded ptrace loops, no payload watchdog, unresolved termination/cleanup, incomplete credential restoration, no launch-time hash enforcement, and a persistent manager upload path. No lifecycle source or ELF is built.
ADR-0009 and its Phase-0.5 evidence remain historical records. The permanent artifact denylist is unchanged.