review: harden flash-readiness gates before next release

[Zhanfg]

Status

SECOND STATIC/DYNAMIC AUDIT CLOSED ON REVIEW BASE; PHYSICAL FR-014 STILL OPEN. DO NOT MERGE OR RELEASE YET.

PR #5 remains Draft and keeps module/FLASH_REVIEW_BLOCKED.

Current reviewed runtime base

f927a2738b7b3ae4cfc4a811897a1be9bc6acbe3

Exact same-head formal review checks:

• Flash safety #221 — run 31273286848: PASS
• Build #293 — run 31273286854: PASS

The second audit intentionally invalidated the older FR-014 candidate 857e963... for final evidence. A new isolated candidate is PR #8.

What the second audit additionally closed

Beyond the earlier transaction/readback/superkey/rollback work, this pass found and fixed several release-blocking or validation-corrupting paths:

• target-resolution failure could reach an imported installer abort() that recursively deleted the installed patch/ recovery-helper directory; runtime failure paths now terminate without deleting persistent helpers, and the imported helper itself is de-risked;
• clean FR-014 preflight now rejects old KPMs, historical key/binding/pending/recovery/flash/restore state, nonzero historical boot count, unmarked unblocked packages, and an already KernelPatch-patched baseline;
• an FR-014 destructive write requires a one-time root-only preflight receipt bound to exact boot SHA, device/slot identity and candidate marker;
• that write gate also requires a secure recovery_export.json whose target/SHA still match the exact live preflight boot;
• state/KPM changes after preflight invalidate the write authorization before flash_image is reached;
• candidate pre-patch stock boots are an explicit idle state, so installation + first reboot does not falsely mark unresolved or arm bootloop recovery before PatchNest has ever touched boot;
• pending transaction commit additionally binds the exact rollback backup filename, not merely its content digest;
• uninstall preserves /data/adb/patchnest rescue credentials/backups/bindings because uninstalling a root-manager module does not itself restore boot;
• KPM ZIP extraction no longer lets unzip materialize archive metadata/paths directly; entries are vetted and emitted as regular files, with traversal/duplicate/ambiguous package rejection;
• KPM binaries are admitted as ELF64 little-endian AArch64 and must pass kptools -l -M;
• service honors explicit .autoload markers and revalidates KPMs immediately before kernel load;
• Ed25519 verification now uses a real SPKI DER public-key object and openssl pkeyutl -verify -rawin, with deployment-key positive and tamper/malformed/symlink negative tests;
• all direct kpatch kpm load paths, including bare WebUI uploads, are centralized behind kpatch_runtime_wrapper.sh + validate_kpm_file.sh; the reviewed ARM64 binary is provenance-checked and preserved as kpatch.real during installation;
• FR-014 candidate normal KPM installation/direct load is disabled; only the separately unlocked diagnostic KPM_CYCLE path may load a candidate module.

Expanded dynamic safety matrix

Flash safety #221 executed and passed:

1. baseline transactional flash contract;
2. destructive first-write/readback failure injection and verified rollback;
3. write + rollback fatal evidence retention;
4. exact pending backup filename identity mismatch rejection;
5. target-resolution failure and non-destructive abort/helper-preservation regression;
6. bootloop automatic transaction-bound recovery;
7. FR-014 pre-patch idle state;
8. strict clean FR-014 preflight positive/negative cases;
9. preflight + recovery-export one-time destructive-write authorization and no-writer negative cases;
10. KPM ZIP traversal/architecture/ambiguity/autoload admission;
11. KPM runtime/autoload second-stage admission;
12. Ed25519 deployment-key positive/tamper negative verification;
13. centralized runtime kpatch wrapper admission and fail-closed missing-helper/real-CLI cases;
14. Magisk / KernelSU / APatch installer simulation;
15. off-device recovery export contract;
16. runtime ABI contract and deterministic ZIP gate.

Build #293 additionally passed source/WebUI checks, pinned dependency hashes, Android ARM64 Public1158 CLI rebuild, kp-safemode, ABI inspection, final module validation, assembled-package release-safety validation, deterministic double packaging and artifact upload.

Current physical candidate

Draft PR #8: validation/device-flash-candidate-v2

Reviewed runtime base: f927a2738b7b3ae4cfc4a811897a1be9bc6acbe3
Candidate head: a056541b99cbb2b3f64b6de404bfe040ba5745a4

Candidate exact-head checks:

• Flash safety #222 — run 31273464054: PASS
• Build #294 — run 31273464107: PASS

Exact installable v2 module ZIP:

• filename: PatchNest-Module.zip
• size: 1,984,705 bytes
• SHA-256: a9c7edba70f9c98daf3522599f75a65e4c78254da009b976e1ed6b12b5602ce5

Relative to the reviewed runtime base, PR #8 changes runtime behavior only by removing FLASH_REVIEW_BLOCKED and adding the inert FR014_DEVICE_CANDIDATE marker. Candidate packaging additionally requires that marker and rejects the blocker.

Remaining release blocker — physical FR-014

A real supported ARM64 A/B device must still prove the exact v2 ZIP through the full lifecycle:

• clean pre-patch preflight;
• verified original-boot recovery export copied off-device with host-side SHA evidence;
• destructive patch + exact-range readback;
• cold boot to sys.boot_completed=1;
• hello1158, kpver, KPM query/list, secure credential/transaction state;
• second normal reboot + second postboot validation;
• rollback negative tests;
• optional explicitly unlocked diagnostic KPM cycle;
• controlled automatic transaction-bound recovery;
• independent manual transaction-bound restore;
• postrestore byte-for-byte proof;
• bootloader/fastboot recovery-material verification using the off-device original boot image.

Do not remove FLASH_REVIEW_BLOCKED, mark PR #5 ready, merge it, or publish a release until the physical evidence is attached and reviewed.