validation: final destructive flash transaction hardening - #6

Closed

Zhanfg wants to merge 94 commits into

mainfrom

review/flash-readiness-final

Commits on Aug 7, 2026

fix(runtime): fail closed on ABI handshake and correct KPM argv contract
Zhanfg
committed
c9014c7
fix(kpm): pass module args according to actual CLI contract
Zhanfg
committed
d2b1e42
docs(review): establish fail-closed flash-readiness gate
Zhanfg
committed
3f52d3c
safety(review): block installation until P0 flash gates close
Zhanfg
committed
c41c4f0
safety(review): abort install when flash review marker is present
Zhanfg
committed
be0ea69
fix(flash): use private unpatch workspace and target-bound recovery
Zhanfg
committed
36f6839
fix(flash): preserve real flash failure status
Zhanfg
committed
58cc166
fix(review): select verified backups without parsing ls
Zhanfg
committed
f84e5bf
fix(flash): add fail-closed partition and readback safety overrides
Zhanfg
committed
c86ec93
fix(flash): activate safety overrides in unpatch path
Zhanfg
committed
107de2f
fix(flash): activate fail-closed boot partition resolution
Zhanfg
committed
65dab4b
fix(review): keep verified backup selection POSIX-safe
Zhanfg
committed
6369d16

Commits on Aug 8, 2026

fix(flash): make boot patch transaction fail-closed
Zhanfg
committed
b3c8778
test(flash): lock transactional patch safety contract
Zhanfg
committed
4ac08fb
ci(flash): enforce pre-flash safety invariants
Zhanfg
committed
1aaa359
fix(flash): preserve verified write failure status
Zhanfg
committed
668fa28
feat(flash): add transactional Public1158 superkey lifecycle
Zhanfg
committed
a23bfb9
feat(flash): bind Public1158 superkey transaction to image write
Zhanfg
committed
09ac096
test(flash): verify transactional superkey contract
Zhanfg
committed
00bb7e2
ci(flash): lint superkey safety lifecycle
Zhanfg
committed
9f7fb3b
build(module): pin reviewed Public1158 CLI source commit
Zhanfg
committed
b2258cf
build(module): compile pinned Public1158 CLI instead of mixing Next ABI
Zhanfg
committed
f057f5b
build(module): eliminate mixed userspace/kernel ABI package
Zhanfg
committed
7425d80
test(flash): keep repo root discovery POSIX-clean
Zhanfg
committed
ee71653
fix(runtime): gate lifecycle operations by explicit ABI profile
Zhanfg
committed
7269dd4
build(module): pin event-capable Public1158 CLI head
Zhanfg
committed
9a69bd3
build(module): add deterministic ZIP packager
Zhanfg
committed
e7eb227
build(module): prove deterministic local package bytes
Zhanfg
committed
bd92096
ci(module): prove final ZIP byte reproducibility
Zhanfg
committed
9a72261
fix(package): store canonical module root paths
Zhanfg
committed
6290be1
test(runtime): lock ABI capability boundaries
Zhanfg
committed
2dddddd
test(runtime): make capability guard ordering assertion exact
Zhanfg
committed
fc109ff
ci(runtime): enforce ABI capability boundaries
Zhanfg
committed
d6726fe
fix(webui): preserve KPM argv values when spawning patcher
Zhanfg
committed
ea6a0df
feat(recovery): bind rollback to device and verified flash transaction
Zhanfg
committed
8806869
feat(recovery): load transaction identity helpers with flash safety
Zhanfg
committed
8a3b5be
feat(recovery): commit rollback transaction before Public1158 key
Zhanfg
committed
685768e
feat(recovery): bind rollback to exact written byte range
Zhanfg
committed
87722c2
fix(recovery): restore only the exact bound flash transaction
Zhanfg
committed
1705264
test(recovery): enforce device-bound exact rollback transaction
Zhanfg
committed
507c373
ci(recovery): lint transaction-bound rollback helper
Zhanfg
committed
3314ce8
test(device): add auditable physical flash lifecycle harness
Zhanfg
committed
1a0fb5f
ci(device): lint physical validation evidence harness
Zhanfg
committed
75e7a61
fix(device): bind evidence checks to installed patch context
Zhanfg
committed
1d7d457
fix(recovery): confine synthetic device identity to tests
Zhanfg
committed
5e43d83
ci(recovery): scope synthetic device identity to test step
Zhanfg
committed
63d94f4
docs(review): close static gates and isolate physical validation
Zhanfg
committed
928f44c
fix(auth): make superkey commit one-way atomic
Zhanfg
committed
a4be624
test(auth): keep root ownership strict outside CI transaction mode
Zhanfg
committed
4f5741e
fix(recovery): make rollback binding atomic after key commit
Zhanfg
committed
1f1d6dc
fix(auth): add crash-recoverable pending superkey state
Zhanfg
committed
410e191
fix(runtime): recover interrupted Public1158 key promotion safely
Zhanfg
committed
3156b00
test(auth): cover pending-key crash consistency
Zhanfg
committed
c31883b
fix(flash): add durable pending transaction state
Zhanfg
committed
33d7f11
fix(flash): add verified destructive write transaction
Zhanfg
committed
e80a1b5
fix(auth): stage pending key only at destructive commit
Zhanfg
committed
37f3387
fix(flash): make boot patch destructive write transactional
Zhanfg
committed
93b3bce
fix(service): bind pending credential recovery to written transaction
Zhanfg
committed
82897db
fix(restore): make unpatch transaction-bound only
Zhanfg
committed
144a6a8
test(flash): inject destructive write and rollback failures
Zhanfg
committed
ca4d5eb
ci(flash): run destructive failure-injection contract
Zhanfg
committed
8d86e84
test(device): close rollback negative and post-restore evidence loop
Zhanfg
committed
9df238e
fix(recovery): require written transaction and rebuild binding after crash
Zhanfg
committed
81e4cd9
fix(recovery): rebuild rollback binding after pending key recovery
Zhanfg
committed
e7c265d
fix(restore): retry exact backup after possible partial write
Zhanfg
committed
43c8d0c
test(flash): cover crash binding recovery and restore retry
Zhanfg
committed
865d5f9
feat(device): package physical validation harness
Zhanfg
committed
0cb4d4b
refactor(device): make packaged harness canonical
Zhanfg
committed
b2b7328
fix(install): set executable permissions for flash and validation scripts
Zhanfg
committed
48633f8
test(package): enforce flash-safety files in final ZIP
Zhanfg
committed
5300c30
ci(flash): validate packaged device harness and archive gate
Zhanfg
committed
a0b787a
test(flash): align baseline contract with transactional writer
Zhanfg
committed
32d5501
fix(boot): make bootloop recovery actually restore bound backup
Zhanfg
committed
c75c6c7
test(boot): execute automatic rollback trigger contract
Zhanfg
committed
d1d226f
ci(boot): execute bootloop automatic recovery contract
Zhanfg
committed
7c2f9a7
feat(device): add controlled auto-recovery validation trigger
Zhanfg
committed
d5fcf3e
feat(device): verify automatic rollback after reboot
Zhanfg
committed
2b86657
fix(install): install automatic recovery validation tools
Zhanfg
committed
51f04ec
test(package): require automatic recovery validation tools
Zhanfg
committed
e984ae9
ci(device): validate packaged automatic recovery tools
Zhanfg
committed
7856632
test(flash): source superkey helper in parent transaction scope
Zhanfg
committed
5f770cf
fix(install): use manager-provided MODPATH without hardcoded module copy
Zhanfg
committed
399b88a
test(install): execute cross-manager MODPATH installer contract
Zhanfg
committed
d87866f
ci(install): execute cross-manager installer contract
Zhanfg
committed
7ac7206
fix(restore): parse JSON booleans with extended regex
Zhanfg
committed
9a298d0
fix(device): parse restore receipt booleans correctly
Zhanfg
committed
91e2b6a
fix(device): derive module directory from packaged harness path
Zhanfg
committed
3a3fd50
feat(recovery): export verified pre-reboot boot recovery image
Zhanfg
committed
386e3df
fix(install): require off-device recovery export tool
Zhanfg
committed
4e55624
test(package): require off-device recovery export tool
Zhanfg
committed
7926848
test(recovery): execute verified boot recovery export
Zhanfg
committed
c626f0a
ci(recovery): execute off-device recovery export contract
Zhanfg
committed
f1703c9
test(install): include recovery export in fake module
Zhanfg
committed
3b88ce8
test(recovery): create Android temp root in CI harness
Zhanfg
committed
9154127