65 lines
2.8 KiB
Markdown
65 lines
2.8 KiB
Markdown
# Phase 0.9E future rescue payload contract
|
|
|
|
Date: 2026-07-18
|
|
|
|
This is a contract for a possible later Phase 0.9F. It is not target source,
|
|
build authorization, transfer authorization, or execution authorization.
|
|
Phase 0.9F design remains blocked while the exact bootstrap implementation and
|
|
output contract are missing.
|
|
|
|
## Requirements
|
|
|
|
| # | Requirement | Bootstrap support now |
|
|
|---:|---|---|
|
|
| 1 | loaded only through an independently proven bootstrap | `UNPROVEN` |
|
|
| 2 | never installed | payload policy can require it; bootstrap staging unknown |
|
|
| 3 | never added to autoload | payload policy can require it; actual trigger config unknown |
|
|
| 4 | never modifies elfldr or Manager | payload policy can require it |
|
|
| 5 | creates no device file | bootstrap behavior `UNKNOWN` |
|
|
| 6 | opens targets read-only | future payload requirement |
|
|
| 7 | sends only PS5-to-host file bytes | no current output channel |
|
|
| 8 | binary-safe framing | must be designed |
|
|
| 9 | exact byte count | must be designed |
|
|
| 10 | SHA-256 or complete host hashing | must be designed |
|
|
| 11 | rejects partial transfer | must be designed |
|
|
| 12 | no automatic retry | mandatory; current authorization false |
|
|
| 13 | one file per session | mandatory |
|
|
| 14 | no rename/unlink/upload/install/other-launch/autoload/mount/reboot/service control | mandatory |
|
|
| 15 | hard deadline | missing |
|
|
| 16 | host abort | missing |
|
|
| 17 | live installation untouched | bootstrap and payload both must prove this |
|
|
| 18 | separate output derived from exact bootstrap | missing |
|
|
| 19 | explicit crash/hang model | missing |
|
|
| 20 | no side-effect-free execution claim | mandatory disclosure |
|
|
|
|
## Required framing properties
|
|
|
|
A future design must bind:
|
|
|
|
- protocol version and request identifier;
|
|
- literal source path and component identity;
|
|
- expected exact byte count before accepting output;
|
|
- monotonically increasing chunk offset and bounded chunk length;
|
|
- final byte count and SHA-256;
|
|
- explicit success, rejection, timeout, abort, and short-read terminal states;
|
|
- no resume, reconnect retry, or third attempt;
|
|
- one connection/session and one component;
|
|
- host-side exclusive temporary output, close, reopen, size/hash, and partial
|
|
deletion/quarantine policy.
|
|
|
|
## Safety gates before any target source
|
|
|
|
Target source may not be created merely from this contract. A new phase must
|
|
first provide:
|
|
|
|
1. exact used bootstrap package and source/binary identity;
|
|
2. proof of independence from both components being recovered;
|
|
3. source-backed host-to-memory or safe temporary-staging semantics;
|
|
4. a bounded, binary-safe result channel;
|
|
5. a restart/reboot model;
|
|
6. a reviewed startup, deadline, abort, crash, and cleanup contract;
|
|
7. separate explicit authority to design target code.
|
|
|
|
Current machine decision:
|
|
`phase09f_rescue_payload_design_allowed=false`.
|