4.5 KiB
Phase 1.0W: self-review and inactive shsrv client architecture
Status: INACTIVE_CLIENT_ARCHITECTURE_COMPLETE_NETWORK_IMPLEMENTATION_BLOCKED
Date: 2026-07-22
This phase reviewed and remediated the Phase-1.0V offline collector, then implemented only an offline dual-record policy and fake transport. It created no socket, DNS lookup, live CLI, device address, command sender, network transport, target code or target artifact. No device action occurred.
Self-review result
| Area | Finding | Result |
|---|---|---|
| Telnet subnegotiation | doubled IAC retained the wrong continuation state |
fixed and regression-tested |
| chunk accounting | empty chunks consumed the 256-chunk budget | fixed; empty chunks are ignored |
| expected paths | arbitrary exact strings could be retained | fixed; absolute normalized character-allowlisted paths only |
| firmware metadata | arbitrary S/W: text could reach sanitized output |
fixed; exact 9.60 or absent only |
| compile metadata | date/time shape was not constrained after parsing | fixed with strict format validation |
| numeric metadata | extreme decimal input could raise a raw parser failure | fixed to a generic fail-closed collector error |
| application buffer | bytearray is overwritten and cleared | logical discard only |
| physical memory | Python/runtime copies cannot be proven erased | UNPROVEN, unchanged |
| live protocol | negotiation replies, prompt and disconnect cleanup | UNPROVEN, no implementation |
The remediated collector is 7,429 bytes with SHA-256
f8a306dafee5d135919bec5afda789dd741e57f39803b7683fb8747c186db25c.
Inactive architecture
tools/phase10w_shsrv_client_policy.py validates two synthetic records:
- a manifest activation;
- a separate operator approval.
The following fields must match byte-for-value: collector hash, run ID,
target, source-bound port, window, literal path, command tokens, deadline and
expiry. Unknown fields fail closed, both records bind the policy hash, and the
approval must attest that the listener is already running. The policy returns
an immutable SessionPlan data object with no
connect/send/receive methods.
The tracked records are inactive and contain no values. The active path exists only as a unit-tested policy function; there is no CLI or transport that can use the returned plan.
Allowlisted future windows
| Window | Exact command tokens | Exact path | Identity value |
|---|---|---|---|
T2_GREETING_AND_HELP |
help |
forbidden | source-family fingerprint only |
T3_ONE_EXACT_PATH |
stat, then sum |
required, safe absolute normalized path | weak file correlation only |
Command tokens are policy data, not rendered shell lines. No formatter or sender is implemented, so the architecture cannot issue either sequence.
Fixed future limits
- source-bound port: 2323;
- one connection and no second open;
- maximum runtime deadline: 10 seconds;
- approval expiry: after explicit host time and within 15 minutes;
- retry, reconnect, resume and fallback: forbidden;
- transfer, execution, installation, autoload and device write: forbidden;
- explicit acceptance required for spawned shell, serial query, telemetry query, sanitized-only output and unproven physical memory erasure.
The fake transport records OPEN, allowlisted command tokens, RECEIVE and
CLOSE in memory. It has no network import or retry API.
Missing before any live implementation
- a consumed-attempt receipt durably created before socket open;
- exclusive sanitized output creation without overwrite;
- monotonic deadline enforcement and host clock acquisition;
- a network transport with exactly one connect and no name-discovery fallback;
- Telnet reply bytes and prompt/completion framing proven against source;
- lossless bounded receive feeding the remediated collector;
- deterministic half-close/close behavior;
- explicit redaction review for every error and exception path;
- a new inactive, hash-bound manifest and approval for that implementation.
These are design blockers, not authority requests.
Classification
- remediated offline collector:
SAFE_FOR_OFFLINE_MODEL_USE; - policy and fake transport:
SAFE_FOR_OFFLINE_ARCHITECTURE_TESTS; - exact deployed shsrv identity:
UNPROVEN; - live client implementation:
BLOCKED_NOT_PRESENT; - connection or device request:
NOT_AUTHORIZED.
The next permitted step is a separate offline-only phase for an inactive transport implementation with fake sockets. It must still perform no real connection and cannot reuse this phase as live authorization.