46 lines
1.7 KiB
Markdown
46 lines
1.7 KiB
Markdown
# ADR-0010: Controlled runtime effects and Phase-0.6 gate
|
|
|
|
Status: accepted on 2026-07-17.
|
|
|
|
## Context
|
|
|
|
ADR-0009 asked whether a fully kernelwrite-free startup could be proven while
|
|
the exact loader was absent. The current task corrects the safety model:
|
|
documented, bounded, volatile runtime changes may be acceptable. Persistent
|
|
writes and unbounded or unknown effects remain hard blockers.
|
|
|
|
The installed Payload Manager and elfldr were subsequently identified exactly.
|
|
Their public source exposes both acceptable volatile effects and unresolved
|
|
unbounded paths.
|
|
|
|
## Decision
|
|
|
|
Classify each lifecycle effect as exactly one of:
|
|
|
|
- `EXPECTED_VOLATILE_RUNTIME_EFFECT`;
|
|
- `RESTORED_BY_LOADER`;
|
|
- `PAYLOAD_PROCESS_LOCAL`;
|
|
- `PERSISTENT_WRITE`;
|
|
- `UNBOUNDED_OR_UNKNOWN`.
|
|
|
|
Only the final two are categorical blockers. `__patch_init` is classified as
|
|
payload-process-local and is no longer an automatic blocker.
|
|
|
|
Every potentially eligible artifact must also have a profile named exactly
|
|
`controlled-ps5-runtime`, with exact firmware/loader/SDK/artifact identity,
|
|
an explicit list of expected volatile effects, zero persistent and filesystem
|
|
writes, no payload network, a maximum 2000 ms runtime, no retry, no hard
|
|
effects, and no hard blockers. Both the profile and static gate explicitly set
|
|
`execution_authorized=false`; static eligibility never grants execution
|
|
authority.
|
|
|
|
## Consequences
|
|
|
|
Phase 0.6 remains blocked because the exact chain has unbounded ptrace loops,
|
|
no payload watchdog, unresolved termination/cleanup, incomplete credential
|
|
restoration, no launch-time hash enforcement, and a persistent manager upload
|
|
path. No lifecycle source or ELF is built.
|
|
|
|
ADR-0009 and its Phase-0.5 evidence remain historical records. The permanent
|
|
artifact denylist is unchanged.
|