validation(device): isolated FR-014 v2 candidate after second audit

[Zhanfg]

Purpose

Second-audit physical FR-014 candidate only. Do not merge or publish as a general release.

Reviewed runtime base: f927a2738b7b3ae4cfc4a811897a1be9bc6acbe3.
Candidate head: a056541b99cbb2b3f64b6de404bfe040ba5745a4.

This v2 candidate supersedes the old 857e963... candidate for final physical evidence. The old package remains useful only as evidence for any test already in progress.

Audited candidate-only diff

Relative to the reviewed runtime base, candidate PR #8 changes only:

• removes module/FLASH_REVIEW_BLOCKED;
• adds inert module/FR014_DEVICE_CANDIDATE marker containing the reviewed base identity;
• changes repository-side scripts/package_module.sh so a candidate ZIP requires the marker and refuses the review blocker;
• adds CANDIDATE_V2_AUDIT.md.

No patch writer, restore, transaction, service, KPM, WebUI, ABI, installer, credential, or recovery runtime code differs from the reviewed base.

Second-audit fixes already included in the reviewed base

• boot-target resolution failures cannot invoke the imported destructive $MODPATH cleanup; helper trees survive target-resolution/abort failures;
• FR-014 clean preflight rejects historical KPM/key/binding/pending/recovery/flash state and an already KernelPatch-patched boot baseline;
• destructive candidate write requires a one-time root-only preflight receipt bound to exact target SHA, device/slot binding and candidate marker;
• the same write gate also requires a secure verified recovery-export receipt matching the exact current preflight boot SHA;
• candidate pre-patch stock boots are an explicit idle state and do not create false unresolved/bootloop state;
• rollback commit binds the exact backup filename as well as backup content SHA;
• uninstall preserves /data/adb/patchnest rescue credentials/backups/bindings instead of destroying them while boot may remain patched;
• KPM ZIP installation rejects traversal/duplicate/ambiguous entries, materializes only validated regular files, and enforces AArch64 ELF + kptools admission;
• KPM autoload requires an explicit marker and service revalidates every module before kernel load;
• Ed25519 verification uses SPKI DER + openssl pkeyutl -verify -rawin and has deployment-key positive/tamper negative tests;
• all direct kpatch kpm load paths are centralized behind kpatch_runtime_wrapper.sh + validate_kpm_file.sh; the reviewed ARM64 CLI is preserved as provenance-bound kpatch.real;
• FR-014 persistent/direct KPM paths are disabled except the explicitly unlocked diagnostic KPM_CYCLE path.

Exact v2 candidate CI

Exact candidate head a056541b99cbb2b3f64b6de404bfe040ba5745a4:

• Flash safety #222 — run 31273464054: PASS
• Build #294 — run 31273464107: PASS

Flash safety #222 executed and passed:

• baseline transactional writer contract;
• destructive write/rollback fault injection;
• exact pending backup identity mismatch rejection;
• boot-target resolution failure/helper-preservation contract;
• bootloop automatic recovery;
• FR-014 pre-patch idle state;
• strict clean FR-014 preflight;
• preflight + recovery-export one-time destructive-write authorization;
• KPM ZIP admission attack cases;
• KPM runtime/autoload admission;
• deployment Ed25519 positive/tamper negative cases;
• centralized kpatch runtime-wrapper admission;
• Magisk / KernelSU / APatch installer simulation;
• off-device recovery export;
• runtime ABI contract;
• deterministic candidate ZIP gate.

Build #294 passed source/WebUI validation and the full ARM64 package job: pinned dependency hashes, Public1158 userspace rebuild, kp-safemode build, ARM64 ABI checks, WebUI build, complete module validation, release-safety assembled-package validation, deterministic double-package comparison, and artifact upload.

Exact artifact identity

GitHub Actions artifact:

• artifact ID: 9026327034
• artifact name: patchnest-module-0.13.5-2-0.13.3
• GitHub artifact API digest: sha256:bf7c972785c79553aa1eb9ee3ab0b8c16bf40319c69b79fa53895cf5ae04bb0b

The downloadable outer artifact ZIP can be server-repacked and is not the flash identity. The exact installable inner module is:

• filename: PatchNest-Module.zip
• size: 1,984,705 bytes
• SHA-256: a9c7edba70f9c98daf3522599f75a65e4c78254da009b976e1ed6b12b5602ce5
• workflow sidecar reports the same SHA-256;
• independent post-download hashing reports the same SHA-256.

Direct inner-ZIP inspection confirmed:

• FR014_DEVICE_CANDIDATE present;
• FLASH_REVIEW_BLOCKED absent;
• no absolute / ../ / ./ / backslash archive paths;
• fr014_gate.sh, transaction/restore helpers, physical validation/recovery tools, hardened KPM installer/verifier, direct KPM validator and runtime wrapper all present;
• packaged kpatch, kptools, kp-safemode, and magiskboot are ARM64 Android ELF files;
• provenance/kpatch-public1158.json source commit is 7fed93c4e259a6edf191c1a9900874babb232c4b;
• provenance binary SHA 252a3fc0e1f674e78917bdfaa159e8274104e8a5a4eeda5d2c5720f939f33ee4 exactly matches the packaged pre-install bin/kpatch ELF.

Mandatory physical FR-014 sequence

Only the inner ZIP with SHA-256 a9c7edba70f9c98daf3522599f75a65e4c78254da009b976e1ed6b12b5602ce5 is accepted for final v2 evidence.

1. Install the exact v2 candidate on the supported ARM64 A/B test device.
2. Reboot once; the candidate remains in explicit pre-patch idle state while boot is still stock.
3. Run packaged device_validation.sh preflight. It must pass the clean baseline gate and create the root-only one-time receipt.
4. Run export_recovery_boot.sh with PATCHNEST_DEVICE_TEST_UNLOCK=RECOVERY_EXPORT.
5. Copy the exported original boot image + manifest off-device and independently verify the image SHA-256 on the host.
6. Only then initiate the normal PatchNest destructive patch. The transaction writer independently rechecks the preflight receipt, recovery-export receipt, exact boot SHA, device/slot identity, candidate identity and clean state before allowing the writer.
7. Cold boot and require sys.boot_completed=1.
8. Run device_validation.sh postboot; require hello1158, kpver, KPM query/list, secure committed credential, clean transaction state and live rollback eligibility.
9. Perform one normal reboot and repeat postboot validation.
10. Run rollback-negative; foreign-device/stale-byte binding copies must fail without modifying real boot/binding.
11. Optional diagnostic KPM only through the explicitly unlocked kpm-cycle; normal candidate KPM install/direct-load paths are blocked.
12. Exercise controlled auto-recovery with arm_auto_recovery.sh, allow exact bound restore + reboot, then run verify_auto_recovery.sh.
13. Independently exercise the manual exact transaction-bound restore path, reboot, then run postrestore and prove current boot bytes equal the restore receipt SHA/size.
14. Verify the off-device original boot image is usable bootloader/fastboot recovery material for failures too early for module scripts.
15. Attach device evidence bundles plus host-side SHA-256 evidence to PR review: harden flash-readiness gates before next release #5/validation(device): isolated FR-014 v2 candidate after second audit #8.

Only after those physical gates pass may PR #5 be marked ready and PatchNest be called truly flashable.