96 lines
4.5 KiB
Markdown
96 lines
4.5 KiB
Markdown
# Phase 1.0W: self-review and inactive shsrv client architecture
|
|
|
|
Status: `INACTIVE_CLIENT_ARCHITECTURE_COMPLETE_NETWORK_IMPLEMENTATION_BLOCKED`
|
|
|
|
Date: 2026-07-22
|
|
|
|
This phase reviewed and remediated the Phase-1.0V offline collector, then
|
|
implemented only an offline dual-record policy and fake transport. It created
|
|
no socket, DNS lookup, live CLI, device address, command sender, network
|
|
transport, target code or target artifact. No device action occurred.
|
|
|
|
## Self-review result
|
|
|
|
| Area | Finding | Result |
|
|
|---|---|---|
|
|
| Telnet subnegotiation | doubled `IAC` retained the wrong continuation state | fixed and regression-tested |
|
|
| chunk accounting | empty chunks consumed the 256-chunk budget | fixed; empty chunks are ignored |
|
|
| expected paths | arbitrary exact strings could be retained | fixed; absolute normalized character-allowlisted paths only |
|
|
| firmware metadata | arbitrary `S/W:` text could reach sanitized output | fixed; exact `9.60` or absent only |
|
|
| compile metadata | date/time shape was not constrained after parsing | fixed with strict format validation |
|
|
| numeric metadata | extreme decimal input could raise a raw parser failure | fixed to a generic fail-closed collector error |
|
|
| application buffer | bytearray is overwritten and cleared | logical discard only |
|
|
| physical memory | Python/runtime copies cannot be proven erased | `UNPROVEN`, unchanged |
|
|
| live protocol | negotiation replies, prompt and disconnect cleanup | `UNPROVEN`, no implementation |
|
|
|
|
The remediated collector is 7,429 bytes with SHA-256
|
|
`f8a306dafee5d135919bec5afda789dd741e57f39803b7683fb8747c186db25c`.
|
|
|
|
## Inactive architecture
|
|
|
|
`tools/phase10w_shsrv_client_policy.py` validates two synthetic records:
|
|
|
|
1. a manifest activation;
|
|
2. a separate operator approval.
|
|
|
|
The following fields must match byte-for-value: collector hash, run ID,
|
|
target, source-bound port, window, literal path, command tokens, deadline and
|
|
expiry. Unknown fields fail closed, both records bind the policy hash, and the
|
|
approval must attest that the listener is already running. The policy returns
|
|
an immutable `SessionPlan` data object with no
|
|
connect/send/receive methods.
|
|
|
|
The tracked records are inactive and contain no values. The active path exists
|
|
only as a unit-tested policy function; there is no CLI or transport that can
|
|
use the returned plan.
|
|
|
|
## Allowlisted future windows
|
|
|
|
| Window | Exact command tokens | Exact path | Identity value |
|
|
|---|---|---|---|
|
|
| `T2_GREETING_AND_HELP` | `help` | forbidden | source-family fingerprint only |
|
|
| `T3_ONE_EXACT_PATH` | `stat`, then `sum` | required, safe absolute normalized path | weak file correlation only |
|
|
|
|
Command tokens are policy data, not rendered shell lines. No formatter or
|
|
sender is implemented, so the architecture cannot issue either sequence.
|
|
|
|
## Fixed future limits
|
|
|
|
- source-bound port: 2323;
|
|
- one connection and no second open;
|
|
- maximum runtime deadline: 10 seconds;
|
|
- approval expiry: after explicit host time and within 15 minutes;
|
|
- retry, reconnect, resume and fallback: forbidden;
|
|
- transfer, execution, installation, autoload and device write: forbidden;
|
|
- explicit acceptance required for spawned shell, serial query, telemetry
|
|
query, sanitized-only output and unproven physical memory erasure.
|
|
|
|
The fake transport records `OPEN`, allowlisted command tokens, `RECEIVE` and
|
|
`CLOSE` in memory. It has no network import or retry API.
|
|
|
|
## Missing before any live implementation
|
|
|
|
- a consumed-attempt receipt durably created before socket open;
|
|
- exclusive sanitized output creation without overwrite;
|
|
- monotonic deadline enforcement and host clock acquisition;
|
|
- a network transport with exactly one connect and no name-discovery fallback;
|
|
- Telnet reply bytes and prompt/completion framing proven against source;
|
|
- lossless bounded receive feeding the remediated collector;
|
|
- deterministic half-close/close behavior;
|
|
- explicit redaction review for every error and exception path;
|
|
- a new inactive, hash-bound manifest and approval for that implementation.
|
|
|
|
These are design blockers, not authority requests.
|
|
|
|
## Classification
|
|
|
|
- remediated offline collector: `SAFE_FOR_OFFLINE_MODEL_USE`;
|
|
- policy and fake transport: `SAFE_FOR_OFFLINE_ARCHITECTURE_TESTS`;
|
|
- exact deployed shsrv identity: `UNPROVEN`;
|
|
- live client implementation: `BLOCKED_NOT_PRESENT`;
|
|
- connection or device request: `NOT_AUTHORIZED`.
|
|
|
|
The next permitted step is a separate offline-only phase for an inactive
|
|
transport implementation with fake sockets. It must still perform no real
|
|
connection and cannot reuse this phase as live authorization.
|