73 lines
2.8 KiB
Markdown
73 lines
2.8 KiB
Markdown
# Chimera Payload Manager artifact policy contract
|
|
|
|
The controlled Phase-0.7 Payload Manager is maintained in the separate private
|
|
`chimera-ps5-payload-manager` repository. This repository supplies the
|
|
hash-bound artifact and runtime profile that the manager must enforce.
|
|
|
|
## Same-file-descriptor launch boundary
|
|
|
|
The controlled manager:
|
|
|
|
1. opens the selected artifact once with read-only, no-follow, close-on-exec
|
|
flags;
|
|
2. requires a regular file and exact compiled byte size;
|
|
3. hashes that same file descriptor;
|
|
4. rejects the permanent denylist and every metadata mismatch;
|
|
5. rewinds and streams that same descriptor;
|
|
6. checks descriptor identity and path identity after streaming;
|
|
7. sends an exact versioned header over loopback only;
|
|
8. uses a compiled exact artifact ID, SHA-256, size, firmware 9.60, 2000 ms
|
|
timeout, and `retry=false`.
|
|
|
|
There is no path reopen between hash and stream. A symlink, truncation,
|
|
replacement, digest mismatch, denylist match, wrong route, wrong firmware,
|
|
non-loopback destination, or post-stream identity change fails closed.
|
|
|
|
## Controlled upload boundary
|
|
|
|
The upload route accepts only the controlled directory, creates an exclusive
|
|
no-follow temporary file, writes and synchronizes it, verifies exact content,
|
|
then atomically renames it. Upload never autoloads or executes the artifact.
|
|
The removable application write is explicit in the Phase-0.7 budget; it is not
|
|
a firmware write.
|
|
|
|
## Receiver enforcement
|
|
|
|
The hardened elfldr independently hashes the received bytes, validates the
|
|
exact artifact ID/size/firmware/digest/timeout/no-retry header, and enforces the
|
|
permanent denylist. Sender metadata alone is therefore insufficient.
|
|
|
|
The legacy route is classified `UNVERIFIED_LEGACY` and is not a controlled
|
|
Chimera launch path.
|
|
|
|
## Repository static gate
|
|
|
|
Before preparing a later action, the exact lifecycle bytes must also pass:
|
|
|
|
```text
|
|
python3 tools/check_artifact_execution_policy.py \
|
|
--manifest <artifact-manifest.json> \
|
|
--denylist manifests/artifact-denylist.json \
|
|
--artifact <exact-local-artifact> \
|
|
--runtime-profile manifests/runtime/controlled-ps5-runtime-profile.json \
|
|
--firmware 9.60
|
|
```
|
|
|
|
Only `PASS_STATIC_DEPLOYMENT_ELIGIBILITY_GATE` is accepted. The result always
|
|
contains `execution_authorized=false`; it is preparation evidence, not
|
|
permission.
|
|
|
|
## Permanent denial
|
|
|
|
SHA-256 `4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63`
|
|
must always return `ARTIFACT_PERMANENTLY_DENYLISTED`, regardless of metadata,
|
|
runtime profile, or later generic approval. The entry is also copied into both
|
|
hardened consumers.
|
|
|
|
## Current action state
|
|
|
|
No hardened binary is installed. No lifecycle artifact has been transferred
|
|
or executed. A separate exact-hash installation approval is required first;
|
|
after successful installation verification, lifecycle transfer and one-time
|
|
execution require another artifact-specific approval.
|