1.2 KiB
Phase 1.0AN: offline service lifecycle and copy audit
Status: FAIL_STOP_PRESENT_RESTART_AND_BOUNDED_COPY_UNPROVEN_TARGET_CODE_BLOCKED
Date: 2026-07-29
The hardened elfldr fork has a real fail-stop for its ptrace credential scope.
If restoration of the temporary auth ID fails, a process-global latch rejects
all later ptrace calls. After the current request and its cleanup attempt, the
socket service calls _exit(125).
That proves process termination, not safe recovery. No reviewed source owns a bounded restart, verifies the identity of a replacement service, or proves cleanup when startup-level credential restoration fails. Automatic restart is therefore forbidden.
The alternative pt_copyin route is also insufficient. It issues one blocking
PT_IO request and does not validate returned descriptor progress. The source
has neither a hard deadline/preemption mechanism for that call nor proof that a
successful return means the exact requested byte count. It cannot replace the
unsafe SDK mdbg_copyin merely because it changes fewer credentials.
The next work may only design a host-only preemption and service-owner architecture. No target source, build, connection, transfer, restart or device execution is authorized.