132 lines
4.6 KiB
Markdown
132 lines
4.6 KiB
Markdown
# Phase 0.8 future bounded-observation permission template
|
|
|
|
Status: **TEMPLATE ONLY — NOT AUTHORIZED**.
|
|
|
|
This file is not permission. Empty, `null`, zero, missing, ambiguous, expired,
|
|
or inconsistent input means `STOP`. Copying, editing, signing, or committing
|
|
the template does not itself authorize a connection, transfer, or execution.
|
|
Authorization can exist only through a new exact statement from Jens in the
|
|
active task after the proposed method and its complete effect contract have
|
|
been reviewed.
|
|
|
|
The template may describe only a separately named bounded-observation phase.
|
|
It cannot authorize installation, rollback creation, lifecycle execution,
|
|
autoload, retry, graphics work, or RetroArch work.
|
|
|
|
## Machine-readable default state
|
|
|
|
The validator requires every authority value below to remain `false` in the
|
|
repository template and every request-specific field to remain unfilled.
|
|
|
|
<!-- BEGIN PHASE08_BOUNDED_OBSERVATION_TEMPLATE -->
|
|
```json
|
|
{
|
|
"template_only": true,
|
|
"authorized": false,
|
|
"execution_authorized": false,
|
|
"transfer_authorized": false,
|
|
"installation_authorized": false,
|
|
"lifecycle_authorized": false,
|
|
"automatic_retry": false,
|
|
"required_fields": {
|
|
"exact_user_statement": null,
|
|
"authorization_date": null,
|
|
"expiration_time": null,
|
|
"device_identity": null,
|
|
"exact_purpose": null,
|
|
"exact_observations": null,
|
|
"method_or_collector_id": null,
|
|
"source_commit": null,
|
|
"collector_file_size": null,
|
|
"collector_sha256": null,
|
|
"firmware_gate": null,
|
|
"maximum_runtime_ms": null,
|
|
"maximum_execution_count": null,
|
|
"maximum_transfer_count": null,
|
|
"network_behavior": null,
|
|
"output_channel": null,
|
|
"allowed_volatile_effects": null,
|
|
"prohibited_persistent_effects": null,
|
|
"stop_criteria": null,
|
|
"cleanup_requirements": null,
|
|
"reporting_requirements": null,
|
|
"explicit_installation_exclusion": null,
|
|
"explicit_lifecycle_probe_exclusion": null,
|
|
"explicit_autoload_and_retry_exclusion": null,
|
|
"explicit_graphics_and_retroarch_exclusion": null,
|
|
"revocation_method": null,
|
|
"manual_confirmation_template_does_not_authorize": null
|
|
},
|
|
"fixed_exclusions": {
|
|
"installation": true,
|
|
"lifecycle_probe": true,
|
|
"autoload": true,
|
|
"automatic_retry": true,
|
|
"gnm": true,
|
|
"videoout": true,
|
|
"sdl": true,
|
|
"retroarch": true
|
|
}
|
|
}
|
|
```
|
|
<!-- END PHASE08_BOUNDED_OBSERVATION_TEMPLATE -->
|
|
|
|
## Required human review fields
|
|
|
|
Every field below must be supplied in a later review package. Do not fill it
|
|
in this repository template.
|
|
|
|
- Exact user statement:
|
|
- Authorization date and timezone:
|
|
- Expiration time and timezone:
|
|
- Device identity:
|
|
- Exact purpose:
|
|
- Exact observations:
|
|
- Method or collector ID:
|
|
- Source repository and commit:
|
|
- Collector filename:
|
|
- Collector byte size:
|
|
- Collector SHA-256:
|
|
- Exact firmware gate:
|
|
- Maximum runtime:
|
|
- Maximum execution count:
|
|
- Maximum transfer count:
|
|
- Network behavior, addresses, ports, direction, and connection count:
|
|
- Output channel and maximum output:
|
|
- Exhaustive allowed volatile effects:
|
|
- Exhaustive forbidden persistent and functional effects:
|
|
- STOP criteria:
|
|
- Cleanup requirements:
|
|
- Reporting and raw-evidence requirements:
|
|
- Explicit installation exclusion:
|
|
- Explicit lifecycle-probe exclusion:
|
|
- Explicit autoload and retry exclusion:
|
|
- Explicit GNM, VideoOut, SDL, and RetroArch exclusion:
|
|
- Revocation method and immediate-stop behavior:
|
|
- Manual confirmation that this template is not authorization:
|
|
|
|
No artifact ID, filename, size, SHA-256, path, ABI, syscall, loader contract,
|
|
transport, or execution mechanism is implied by these empty fields.
|
|
|
|
## Mandatory future effect boundary
|
|
|
|
A future request must enumerate every allowed category-C volatile effect
|
|
before authorization. All category-A persistent mutations and category-B
|
|
functional mutations remain prohibited unless a different, explicitly
|
|
mutating phase is designed and separately authorized.
|
|
|
|
Unknown behavior, an unspecified effect, an identity mismatch, a partial
|
|
dataset, a timeout, an expired authorization, a count overrun, an unexpected
|
|
log, or cleanup uncertainty means immediate `STOP` with no automatic retry.
|
|
|
|
The approved observation count, transfer count, and execution count—if any—
|
|
must be literal bounded integers. No value carries into rollback preparation,
|
|
installation, lifecycle testing, graphics, or RetroArch.
|
|
|
|
## Revocation
|
|
|
|
Jens may revoke a later authorization at any time before or during the
|
|
authorized window. Revocation, ambiguity, interruption, or conflicting
|
|
instructions causes fail-closed stop. Revocation never triggers cleanup that
|
|
was not already explicitly reviewed and authorized.
|