validation(device): isolated FR-014 v2 candidate after second audit - #8

Draft

Zhanfg wants to merge 152 commits into

mainfrom

validation/device-flash-candidate-v2

Commits on Aug 7, 2026

fix(runtime): fail closed on ABI handshake and correct KPM argv contract
Zhanfg
committed
c9014c7
fix(kpm): pass module args according to actual CLI contract
Zhanfg
committed
d2b1e42
docs(review): establish fail-closed flash-readiness gate
Zhanfg
committed
3f52d3c
safety(review): block installation until P0 flash gates close
Zhanfg
committed
c41c4f0
safety(review): abort install when flash review marker is present
Zhanfg
committed
be0ea69
fix(flash): use private unpatch workspace and target-bound recovery
Zhanfg
committed
36f6839
fix(flash): preserve real flash failure status
Zhanfg
committed
58cc166
fix(review): select verified backups without parsing ls
Zhanfg
committed
f84e5bf
fix(flash): add fail-closed partition and readback safety overrides
Zhanfg
committed
c86ec93
fix(flash): activate safety overrides in unpatch path
Zhanfg
committed
107de2f
fix(flash): activate fail-closed boot partition resolution
Zhanfg
committed
65dab4b
fix(review): keep verified backup selection POSIX-safe
Zhanfg
committed
6369d16

Commits on Aug 8, 2026

fix(flash): make boot patch transaction fail-closed
Zhanfg
committed
b3c8778
test(flash): lock transactional patch safety contract
Zhanfg
committed
4ac08fb
ci(flash): enforce pre-flash safety invariants
Zhanfg
committed
1aaa359
fix(flash): preserve verified write failure status
Zhanfg
committed
668fa28
feat(flash): add transactional Public1158 superkey lifecycle
Zhanfg
committed
a23bfb9
feat(flash): bind Public1158 superkey transaction to image write
Zhanfg
committed
09ac096
test(flash): verify transactional superkey contract
Zhanfg
committed
00bb7e2
ci(flash): lint superkey safety lifecycle
Zhanfg
committed
9f7fb3b
build(module): pin reviewed Public1158 CLI source commit
Zhanfg
committed
b2258cf
build(module): compile pinned Public1158 CLI instead of mixing Next ABI
Zhanfg
committed
f057f5b
build(module): eliminate mixed userspace/kernel ABI package
Zhanfg
committed
7425d80
test(flash): keep repo root discovery POSIX-clean
Zhanfg
committed
ee71653
fix(runtime): gate lifecycle operations by explicit ABI profile
Zhanfg
committed
7269dd4
build(module): pin event-capable Public1158 CLI head
Zhanfg
committed
9a69bd3
build(module): add deterministic ZIP packager
Zhanfg
committed
e7eb227
build(module): prove deterministic local package bytes
Zhanfg
committed
bd92096
ci(module): prove final ZIP byte reproducibility
Zhanfg
committed
9a72261
fix(package): store canonical module root paths
Zhanfg
committed
6290be1
test(runtime): lock ABI capability boundaries
Zhanfg
committed
2dddddd
test(runtime): make capability guard ordering assertion exact
Zhanfg
committed
fc109ff
ci(runtime): enforce ABI capability boundaries
Zhanfg
committed
d6726fe
fix(webui): preserve KPM argv values when spawning patcher
Zhanfg
committed
ea6a0df
feat(recovery): bind rollback to device and verified flash transaction
Zhanfg
committed
8806869
feat(recovery): load transaction identity helpers with flash safety
Zhanfg
committed
8a3b5be
feat(recovery): commit rollback transaction before Public1158 key
Zhanfg
committed
685768e
feat(recovery): bind rollback to exact written byte range
Zhanfg
committed
87722c2
fix(recovery): restore only the exact bound flash transaction
Zhanfg
committed
1705264
test(recovery): enforce device-bound exact rollback transaction
Zhanfg
committed
507c373
ci(recovery): lint transaction-bound rollback helper
Zhanfg
committed
3314ce8
test(device): add auditable physical flash lifecycle harness
Zhanfg
committed
1a0fb5f
ci(device): lint physical validation evidence harness
Zhanfg
committed
75e7a61
fix(device): bind evidence checks to installed patch context
Zhanfg
committed
1d7d457
fix(recovery): confine synthetic device identity to tests
Zhanfg
committed
5e43d83
ci(recovery): scope synthetic device identity to test step
Zhanfg
committed
63d94f4
docs(review): close static gates and isolate physical validation
Zhanfg
committed
928f44c
fix(auth): make superkey commit one-way atomic
Zhanfg
committed
a4be624
test(auth): keep root ownership strict outside CI transaction mode
Zhanfg
committed
4f5741e
fix(recovery): make rollback binding atomic after key commit
Zhanfg
committed
1f1d6dc
fix(auth): add crash-recoverable pending superkey state
Zhanfg
committed
410e191
fix(runtime): recover interrupted Public1158 key promotion safely
Zhanfg
committed
3156b00
test(auth): cover pending-key crash consistency
Zhanfg
committed
c31883b
fix(flash): add durable pending transaction state
Zhanfg
committed
33d7f11
fix(flash): add verified destructive write transaction
Zhanfg
committed
e80a1b5
fix(auth): stage pending key only at destructive commit
Zhanfg
committed
37f3387
fix(flash): make boot patch destructive write transactional
Zhanfg
committed
93b3bce
fix(service): bind pending credential recovery to written transaction
Zhanfg
committed
82897db
fix(restore): make unpatch transaction-bound only
Zhanfg
committed
144a6a8
test(flash): inject destructive write and rollback failures
Zhanfg
committed
ca4d5eb
ci(flash): run destructive failure-injection contract
Zhanfg
committed
8d86e84
test(device): close rollback negative and post-restore evidence loop
Zhanfg
committed
9df238e
fix(recovery): require written transaction and rebuild binding after crash
Zhanfg
committed
81e4cd9
fix(recovery): rebuild rollback binding after pending key recovery
Zhanfg
committed
e7c265d
fix(restore): retry exact backup after possible partial write
Zhanfg
committed
43c8d0c
test(flash): cover crash binding recovery and restore retry
Zhanfg
committed
865d5f9
feat(device): package physical validation harness
Zhanfg
committed
0cb4d4b
refactor(device): make packaged harness canonical
Zhanfg
committed
b2b7328
fix(install): set executable permissions for flash and validation scripts
Zhanfg
committed
48633f8
test(package): enforce flash-safety files in final ZIP
Zhanfg
committed
5300c30
ci(flash): validate packaged device harness and archive gate
Zhanfg
committed
a0b787a
test(flash): align baseline contract with transactional writer
Zhanfg
committed
32d5501
fix(boot): make bootloop recovery actually restore bound backup
Zhanfg
committed
c75c6c7
test(boot): execute automatic rollback trigger contract
Zhanfg
committed
d1d226f
ci(boot): execute bootloop automatic recovery contract
Zhanfg
committed
7c2f9a7
feat(device): add controlled auto-recovery validation trigger
Zhanfg
committed
d5fcf3e
feat(device): verify automatic rollback after reboot
Zhanfg
committed
2b86657
fix(install): install automatic recovery validation tools
Zhanfg
committed
51f04ec
test(package): require automatic recovery validation tools
Zhanfg
committed
e984ae9
ci(device): validate packaged automatic recovery tools
Zhanfg
committed
7856632
test(flash): source superkey helper in parent transaction scope
Zhanfg
committed
5f770cf
fix(install): use manager-provided MODPATH without hardcoded module copy
Zhanfg
committed
399b88a
test(install): execute cross-manager MODPATH installer contract
Zhanfg
committed
d87866f
ci(install): execute cross-manager installer contract
Zhanfg
committed
7ac7206
fix(restore): parse JSON booleans with extended regex
Zhanfg
committed
9a298d0
fix(device): parse restore receipt booleans correctly
Zhanfg
committed
91e2b6a
fix(device): derive module directory from packaged harness path
Zhanfg
committed
3a3fd50
feat(recovery): export verified pre-reboot boot recovery image
Zhanfg
committed
386e3df
fix(install): require off-device recovery export tool
Zhanfg
committed
4e55624
test(package): require off-device recovery export tool
Zhanfg
committed
7926848
test(recovery): execute verified boot recovery export
Zhanfg
committed
c626f0a
ci(recovery): execute off-device recovery export contract
Zhanfg
committed
f1703c9
test(install): include recovery export in fake module
Zhanfg
committed
3b88ce8
test(recovery): create Android temp root in CI harness
Zhanfg
committed
9154127
fix(safety): make boot resolution failures non-destructive
Zhanfg
committed
33872ef
fix(safety): propagate boot resolution failure without cleanup side effects
Zhanfg
committed
01276a1
fix(safety): override upstream destructive abort in patch runtime
Zhanfg
committed
855dc94
fix(validation): require clean FR-014 physical baseline
Zhanfg
committed
f2af75b
test(safety): prove target resolution failure preserves recovery helpers
Zhanfg
committed
5ad70e1
test(validation): execute clean FR-014 preflight gates
Zhanfg
committed
af0c942
ci(safety): execute resolution and FR-014 clean-baseline regressions
Zhanfg
committed
c296d18
fix(transaction): bind pending record to exact backup filename
Zhanfg
committed
3846e50
test(transaction): reject pending backup filename mismatch
Zhanfg
committed
d4eaccc
ci(transaction): execute exact backup-name binding regression
Zhanfg
committed
d91f6ca
fix(safety): preserve abort termination without destructive cleanup
Zhanfg
committed
45b67ce
test(safety): execute non-destructive abort override
Zhanfg
committed
5970d38
fix(safety): remove destructive abort and eval fallback from runtime helper
Zhanfg
committed
d03a36e
feat(validation): add one-time FR-014 destructive-write receipt gate
Zhanfg
committed
53a2051
fix(validation): require one-time FR-014 preflight before candidate write
Zhanfg
committed
9edf99f
fix(validation): bind candidate write to one-time preflight receipt
Zhanfg
committed
430d86e
fix(package): require FR-014 gate helper at install time
Zhanfg
committed
d5b850a
fix(package): require FR-014 gate in deterministic archive
Zhanfg
committed
c6a719a
fix(validation): fail closed if candidate preflight helper is missing
Zhanfg
committed
258946a
test(validation): verify FR-014 preflight receipt and strict baseline
Zhanfg
committed
b4caa26
test(validation): execute one-time FR-014 write authorization gate
Zhanfg
committed
b008893
test(installer): require FR-014 gate helper across managers
Zhanfg
committed
2332113
ci(validation): execute one-time FR-014 write gate contract
Zhanfg
committed
94b30cb
fix(uninstall): preserve boot-critical recovery state
Zhanfg
committed
8d6023f
test(package): add release-safety package validator
Zhanfg
committed
e96b922
ci(package): run release-safety validator on assembled module
Zhanfg
committed
7876bb0
fix(validation): keep unpatched FR-014 candidate in idle boot state
Zhanfg
committed
6716603
fix(runtime): separate FR-014 prepatch idle state and gate KPM autoload
Zhanfg
committed
820eac8
fix(kpm): validate archive and ARM64 module before root install
Zhanfg
committed
05486ce
fix(validation): require matching recovery export before candidate write
Zhanfg
committed
6aa145b
test(validation): enforce recovery export and clean state at candidate write
Zhanfg
committed
b039ab2
fix(kpm): materialize validated ZIP entries as regular files only
Zhanfg
committed
f71629c
test(validation): execute FR-014 prepatch idle boot state
Zhanfg
committed
7819365
test(kpm): execute safe archive and ARM64 admission contract
Zhanfg
committed
d088817
test(kpm): execute service autoload and runtime binary admission
Zhanfg
committed
b0a76de
ci(safety): cover candidate idle and KPM admission dynamically
Zhanfg
committed
7224202
fix(kpm): verify Ed25519 signatures with SPKI DER and pkeyutl
Zhanfg
committed
dc467e6
test(kpm): execute deployment Ed25519 verification vector
Zhanfg
committed
ea7da4d
test(package): require hardened KPM runtime components
Zhanfg
committed
df99b1f
fix(package): require hardened KPM and uninstall components
Zhanfg
committed
b998044
ci(kpm): execute Ed25519 signature verification contract
Zhanfg
committed
ce6c30f
test(package): ignore comments when detecting executable eval
Zhanfg
committed
6418e8c
fix(kpm): gate direct KPM loads through runtime admission helper
Zhanfg
committed
0fb656d
fix(kpm): allow only explicit FR-014 diagnostic-cycle context
Zhanfg
committed
5f93206
fix(kpm): centralize direct KPM load admission in runtime wrapper
Zhanfg
committed
71779a9
fix(kpm): reuse explicit diagnostic unlock for candidate direct load
Zhanfg
committed
3711182
fix(kpm): install central kpatch runtime admission wrapper
Zhanfg
committed
a9413bd
test(installer): verify kpatch runtime wrapper installation across managers
Zhanfg
committed
6d6bfc2
test(package): require centralized direct KPM runtime guard
Zhanfg
committed
2f07bc2
fix(package): require runtime KPM guard components
Zhanfg
committed
4eafe3c
test(kpm): execute centralized kpatch runtime admission wrapper
Zhanfg
committed
ca78fd8
ci(kpm): execute centralized runtime wrapper contract
Zhanfg
committed
4318f34
test(kpm): annotate generated wrapper fixtures for ShellCheck
Zhanfg
committed
433998c
test(kpm): run Android wrapper through host shell in CI
Zhanfg
committed
f927a27
validation: unlock isolated FR-014 v2 candidate only
Zhanfg
committed
fd02224
validation: mark isolated FR-014 v2 device candidate
Zhanfg
committed
3c79d5e
validation: require candidate marker and reject review blocker
Zhanfg
committed
fb275c8
validation: record v2 candidate runtime diff policy
Zhanfg
committed
a056541