23 lines
1.2 KiB
Markdown
23 lines
1.2 KiB
Markdown
# Phase 1.0AM: offline bounded copy and restore model
|
|
|
|
Status: `HOST_EXACT_PROGRESS_AND_RESTORE_MODEL_COMPLETE_TARGET_CODE_BLOCKED`
|
|
|
|
Date: 2026-07-29
|
|
|
|
The capability-free model replaces the unsafe semantics identified in Phase
|
|
1.0AL. It validates 64-bit source and destination ranges, bounds total size,
|
|
chunk count and synthetic ticks, rejects zero or oversized progress, and
|
|
accepts completion only at the exact requested byte count.
|
|
|
|
Auth ID and capabilities are both backed up before modification. Every field
|
|
that changed is independently restored on every exit, with separate failure
|
|
bits. A partial copy requires child termination and reap. Any credential
|
|
restore failure additionally requires termination of the now-untrusted service;
|
|
failure of either terminal cleanup operation is a hard error.
|
|
|
|
Successful exact copy keeps the child alive for subsequent loader stages. This
|
|
is only host-model behavior. The model imports no credential, process, memory,
|
|
clock, network or target interface and does not establish the undocumented
|
|
remote status semantics or firmware-9.60 behavior. Target implementation stays
|
|
blocked pending service-lifecycle ownership and source review.
|