55 lines
2.4 KiB
Markdown
55 lines
2.4 KiB
Markdown
# Phase 1.0G offline one-shot runner
|
|
|
|
Phase 1.0G prepares only the host-side policy boundary for a possible later
|
|
single run of the unchanged Phase-1.0F interval diagnostic. It did not connect
|
|
to a PS5, transfer or execute an artifact, or receive device output. The
|
|
tracked manifest and approval template are deliberately inactive.
|
|
|
|
## Bound identity
|
|
|
|
- runner repository: `chimera-retroarch`
|
|
- runner commit: `55e873df12f4dd099c082d4a26b225644b8e0567`
|
|
- target source commit: `0eaf68d6de4dc9757d85cc7ad5c714b1d151c8f8`
|
|
- artifact: `retroarch_ps5_interval_diag.elf`
|
|
- size: `1845152`
|
|
- SHA-256: `e8bfc01c61bfb14b5814280a6e5442f1a5ad05ace5439d1c09e7e5ee00cd0055`
|
|
- protocol: `CHD10F01`, version 1, fixed 64-byte frames
|
|
|
|
The target source and artifact are unchanged from Phase 1.0F. No ELF, map,
|
|
device address or active approval is tracked here.
|
|
|
|
## Fail-closed order
|
|
|
|
For any future separately authorized attempt, the runner must perform these
|
|
steps in order:
|
|
|
|
1. reject an existing trace;
|
|
2. read and hash the active manifest, local approval and actual ELF;
|
|
3. require the exact artifact, firmware, F protocol, target and limits;
|
|
4. require all four positive permissions: connection, transfer, execution and
|
|
result reception;
|
|
5. reject installation, autoload, device write, retry, reconnect, resume and
|
|
automatic reboot;
|
|
6. derive a filesystem-safe unique run identifier;
|
|
7. exclusively create and `fsync` a consumed-attempt receipt before opening a
|
|
socket;
|
|
8. only then allow one connect, one complete send, one write-half-close and one
|
|
bounded receive;
|
|
9. exclusively create the local result trace without overwrite.
|
|
|
|
The durable pre-connect receipt intentionally consumes the attempt if the host
|
|
crashes after authorization but before or during transport. Reusing the same
|
|
run identifier is rejected. There is no automatic recovery, retry or reconnect.
|
|
|
|
## Current state
|
|
|
|
`protocol_activation_authorized=false`, the run identifier and tracked target
|
|
are null, artifact eligibility is false and every authorization is false. The
|
|
runner cannot be activated by a command-line protocol switch. A later device
|
|
action would need a new exact permission and an untracked, reviewed local
|
|
approval record; this document grants none.
|
|
|
|
Fake-socket tests prove only host policy and parser behavior. They are not PS5,
|
|
firmware, SDL, VideoOut, rendering, exit or cleanup evidence. Existing SDK CRT
|
|
effects and the unproven D02-to-D03 runtime interval remain unchanged.
|