edit | blame | history | raw

CODE-DESIGN-ANA-SEMI-ROOT-PREFLIGHT-ORCHESTRATION-V007-V034

0. 状态与唯一修复范围

  • owner：dev.developer.ana.cai。
  • predecessor：V033=24928/e8760982dc4b5efbbeab58e22f7db66cf67d14283d2d26b823f18fc88f0dc9b4；独立审核=HOLD/3/3；audit=311435/78733214578e76ce8792699f6ea87da5f22febebf8db52c79d6c08e84693629b。
  • 本版只关闭 BLOCK-V033-01/02/03：final pre-kill deadline、rescue interpreter identity、outer V002 32-field mapping。V033 已关闭的 plain-pipe/no-echo 不回退。
  • 本版仅计划，不执行 PowerShell/parent/child/rescue/taskkill，不物化 Y01-Y04，不创建 Y05-Y08/run，不连接数据库。

1. inherited no-regression

  • V033 parent=14599/c9e4ac6dec174a59ea2abfa63c257a511577d97b8e235b06de726163e0584eed、parser0、identity-provider timeout 2000ms、startup transcript timeout 5000ms；不变。
  • child/transcript/T13/T14、Y01-Y04 payload/path/profile 不变。
  • parent 与 rescue tool 均继续 login=false,tty=false,workdir=E:\mb-ms-doc\project-info；51206-byte stdin 不进入 combined output。
  • taskkill 继续为 C:\Windows\System32\taskkill.exe / 101376/56f8cc2c1790c389394733b84c3fb55e10977e9f0fe0c08110ac11f0fe47f05e / version 10.0.19041.1 (WinBuild.160101.0800)。

2. C0/C2 exact interpreter binding

C0 parent 与 C2 rescue 的 exec_command.shell 都必须逐字节等于：

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

固定 executable snapshot：bytes=455680；SHA-256=9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3；FileVersion=10.0.19041.1 (WinBuild.160101.0800)。禁止 shell=powershell、PATH lookup、alias、login shell、cmd.exe 或其他 interpreter。C0/C2 其余参数继承 V033 第 5 节。

3. V034 rescue wrapper 的两个 ordinal transform

以 V033 第 4 节 wrapper=4694/47b374888df31245a4bb0096bce66333ae426430e16cc29ee77c4b1175e8cf3a 为唯一前像，按顺序执行两个 count=1、ordinal replacements，其他 bytes 不变。

3.1 在唯一 main try{ 后插入 interpreter self-verification

  $self=[Diagnostics.Process]::GetCurrentProcess();$selfImage=[string]$self.MainModule.FileName
  if($selfImage-cne'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'){throw 'RESCUE_INTERPRETER_IMAGE'}
  $selfBytes=[IO.File]::ReadAllBytes($selfImage);if($selfBytes.Length-ne455680-or(Sha $selfBytes)-ne'9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3'){throw 'RESCUE_INTERPRETER_HASH'}
  if([Diagnostics.FileVersionInfo]::GetVersionInfo($selfImage).FileVersion-cne'10.0.19041.1 (WinBuild.160101.0800)'){throw 'RESCUE_INTERPRETER_VERSION'}

该 block 位于任何 WMI、target PID query 或 taskkill 之前。任一 mismatch/unknown 进入 existing catch，identity_status=UNKNOWN,taskkill_started=false,wrapper_exit_code=27。

3.2 在最终 p2 comparison 后、identity='VERIFIED' 前插入最后 deadline gate

  if($sw.ElapsedMilliseconds-ge3000){throw 'PREKILL_DEADLINE_FINAL'}

因此顺序固定为：p2 StartTime read → p2 SessionId read → p2 MainModule read → 三项 comparison → final sw<3000 → identity VERIFIED → taskkill Process.Start。late return 必须 taskkill_started=false；不得把第一次 deadline gate替代本 final gate。

V034 wrapper 固定为：5327/e4cbea315b6eac825708ee596e509207986cc6f91d5bb76f47599786fe3eec6c；Windows PowerShell 5.1 parser=0；CR/LF/final=0/34/0x0A；PREKILL_DEADLINE_FINAL token=1；RESCUE_INTERPRETER_HASH token=1；四个 substitution placeholders 继续各一次。

4. outer V002 builder input record

outer coordinator 只从下列 frozen observations 构造 native terminal；不存在的 observation 必须为 null，禁止推断。

O = {
  c0_kind, c0_exit, c0_session_id, c0_output_status,
  identity_valid, identity_pid, identity_start_ticks, identity_os_session, identity_cmd_sha,
  c1_started, c1_kind, c1_exit, c1_output_status,
  c2_started, c2_kind, c2_exit, c2_output_status, wrapper_receipt_valid, wrapper_receipt,
  poll_started, poll_kind, poll_exit, poll_output_status,
  session_id_equal, call_cardinality_valid
}
  • kind enum：NOT_RUN|TERMINAL|LIVE_SESSION|ERROR|UNKNOWN；output status：NOT_RUN|IDENTITY_ONLY|IDENTITY_PLUS_TERMINAL|VALID_WRAPPER_JSON|INVALID|TRUNCATED|UNKNOWN。
  • C0/C1/C2/poll 的 exit 只有 kind=TERMINAL 且 tool 明确返回 INT32 时非 null。
  • wrapper_receipt 只有 C2 terminal、exact-one line、strict ANA.SEMI.STAGE.S.RESCUE.WRAPPER.V002、tool exit 与 receipt.wrapper_exit_code 相等时 valid。invalid/truncated/live/error 时 receipt 全部不可读取。
  • wrapper exact receipt 必须随 native handoff 原样携带并登记 bytes/hash；outer 32-field 只做下述无损 projection，不能改写 receipt 中已观测值。

5. 32-field builder：逐字段唯一赋值

字段顺序严格继承 V033 outer V002。UROWS 是四个 ordered Y01-Y04 9-key U rows。

# field exact assignment
1 schema_id literal ANA.SEMI.STAGE.S.OUTER.RESCUE.V002
2 terminal_state 第 6 节 precedence table 的唯一 literal
3 stop_code 第 6 节 precedence table 的唯一 literal
4 governance_exit_code literal INT32 27
5 source_session_id O.c0_session_id iff one live session observed；否则 null
6 parent_identity_status OBSERVED iff identity_valid=true；否则 UNKNOWN
7 parent_pid O.identity_pid iff identity_valid；否则 null
8 parent_start_ticks O.identity_start_ticks iff identity_valid；否则 null
9 parent_os_session_id O.identity_os_session iff identity_valid；否则 null
10 parent_commandline_sha256 O.identity_cmd_sha iff identity_valid；否则 null
11 initial_result_kind exact O.c0_kind
12 initial_output_status exact O.c0_output_status
13 transcript_write_started exact BOOL O.c1_started
14 transcript_write_result exact O.c1_kind
15 rescue_wrapper_started true iff C2 returns live or terminal；false iff explicit start-false before process；otherwise null
16 rescue_wrapper_result exact O.c2_kind；if not run literal NOT_RUN
17 rescue_wrapper_exit_code O.c2_exit iff C2 terminal；otherwise null
18 identity_revalidation valid receipt.identity_status mapped VERIFIED|MISMATCH|UNKNOWN；no valid receipt=NOT_RUN if C2 not run, else UNKNOWN
19 taskkill_started valid receipt.taskkill_started；invalid/missing receipt=null
20 taskkill_exited valid receipt.taskkill_exited；invalid/missing receipt=null
21 taskkill_exit_code valid receipt.taskkill_exit_code；invalid/missing receipt=null
22 taskkill_timed_out valid receipt.taskkill_timed_out；invalid/missing receipt=null
23 taskkill_liveness_unknown valid receipt.taskkill_liveness_unknown；invalid/missing receipt=null
24 parent_poll_started exact BOOL O.poll_started
25 parent_poll_result exact O.poll_kind；if not run literal NOT_RUN
26 parent_session_exited true iff the last operation on original session is terminal；false iff explicitly live；error/truncated/unknown/null session=null
27 parent_session_exit_code exit of that terminal original-session operation；otherwise null
28 tree_kill_confirmed true iff valid receipt identity VERIFIED + taskkill started/exited/exit0 + poll terminal；else false
29 authorization_consumed null
30 observed_existing_count null
31 valid_count null
32 rows literal UROWS

Validator MUST reject：session/cardinality drift；non-null exit without terminal；receipt/tool-exit mismatch；taskkill exit without started+exited；identity VERIFIED without valid receipt；tree=true without全部 conjuncts；parent exit without parent_exited=true；任何 native row 非 U；任何 29-31 非 null。Reject 后仍生成第 6 节 EVIDENCE_MAPPING_UNKNOWN terminal，所有不可证明 wrapper/taskkill/parent-exit fields 置 null，禁止继续 call。

6. terminal/stop precedence 与 mutually exclusive observation classes

按顺序 first-match；每类均先执行第 5 节 32-field projection，然后只设置 fields 2/3。

class exact predicate terminal_state stop_code
B00 call_cardinality invalid or session_id unequal or builder-validator reject OUTER_EVIDENCE_MAPPING_UNKNOWN EVIDENCE_MAPPING_UNKNOWN
B01 C0 terminal/error/truncated and not exact identity+V003 normal wire PARENT_INITIAL_RESULT_INVALID PARENT_INITIAL_RESULT
B02 C0 live but identity invalid；C4 drain not exact governance27 V003 PARENT_IDENTITY_OUTPUT_INVALID_LIVENESS_UNKNOWN PARENT_IDENTITY_WIRE
B03 C1 terminal but aggregate is not exact identity+V003 normal wire PARENT_TERMINAL_WIRE_INVALID PARENT_TERMINAL_WIRE
B04 valid wrapper receipt identity_status=MISMATCH and taskkill_started=false RESCUE_IDENTITY_MISMATCH_NO_KILL IDENTITY_REVALIDATION_MISMATCH
B05 valid wrapper receipt stop in RESCUE_INTERPRETER_IMAGE|RESCUE_INTERPRETER_HASH|RESCUE_INTERPRETER_VERSION RESCUE_INTERPRETER_NOT_PROVEN_NO_KILL exact receipt.stop_code
B06 valid wrapper receipt stop=PREKILL_DEADLINE_FINAL, taskkill_started=false RESCUE_PREKILL_DEADLINE_NO_KILL PREKILL_DEADLINE_FINAL
B07 tree_kill_confirmed=true OUTER_TIMEOUT_TREE_KILLED_PACKAGE_UNKNOWN OUTER_TIMEOUT_RESCUE
B08 C2 terminal valid receipt with taskkill nonzero RESCUE_TASKKILL_NONZERO TASKKILL_NONZERO
B09 C2 terminal valid receipt with taskkill_timed_out=true or liveness_unknown=true RESCUE_TASKKILL_TIMEOUT_OR_UNKNOWN exact receipt.stop_code
B10 C2 explicit start-false/error, no receipt RESCUE_WRAPPER_NOT_STARTED_OR_UNOBSERVED RESCUE_WRAPPER_START
B11 C2 live/truncated/invalid terminal receipt RESCUE_WRAPPER_RESULT_UNKNOWN RESCUE_WRAPPER_RESULT
B12 poll live/error/truncated/unknown after any rescue OUTER_OR_RESCUE_LIVENESS_UNKNOWN OUTER_RESCUE_UNKNOWN
B13 other valid receipt/taskkill/poll terminal combination not above OUTER_RESCUE_FAILED_CLOSED exact receipt.stop_code or OUTER_RESCUE_FAILED

Normal path is outside builder：仅 C0/C1/C4 aggregate exact identity + exact V003 JSON 时直接采用 V003；不得把 V003 normal terminal改写为 V002。

7. required negative mapping vectors

以下 vectors 必须由 builder/validator static self-check 逐字段比较 32/32；copy(x) 表示从 exact observed tool/receipt value 原样复制，不是 family/any。

id observation required projection highlights
N01-T C0 terminal exit=27, invalid output initial=TERMINAL/INVALID; session/pid/write/wrapper/taskkill/poll=null or NOT_RUN；parent_exited=true,parent_exit=27；B01
N01-E C0 ERROR, no session initial=ERROR/UNKNOWN; parent_exited/exit=null；B01
N05-T valid mismatch receipt, C3 terminal exit27 wrapper=true/TERMINAL/27；revalidation=MISMATCH；taskkill=false/false/null/false/false；poll=true/TERMINAL；parent=true/27；B04
N05-L same mismatch receipt, C3 live same wrapper/taskkill；poll=true/LIVE_SESSION；parent=false/null；B04
N05-E same mismatch receipt, C3 error same wrapper/taskkill；poll=true/ERROR；parent=null/null；B04
N06-T valid receipt stop PREKILL_DEADLINE_FINAL, C3 terminal revalidation=UNKNOWN；taskkill=false/false/null/false/false；parent=true/copy(exit)；B06
N09-N valid VERIFIED receipt, taskkill started/exited/nonzero, C3 terminal taskkill=true/true/copy(nonzero)/false/false；tree=false；B08
N09-X valid VERIFIED receipt, taskkill timeout/liveness unknown, C3 live copy all five taskkill receipt fields；parent=false/null；tree=false；B09 before B12
N10-S C2 explicit start-false wrapper=false/ERROR/null；revalidation=UNKNOWN；all taskkill=null；poll copied；B10
N10-E C2 tool ERROR, start unknown wrapper=null/ERROR/null；revalidation=UNKNOWN；all taskkill=null；poll copied；B10
N11-L C2 live after 10s wrapper=true/LIVE_SESSION/null；all receipt/taskkill=null；poll copied；B11
N11-X C2 terminal truncated/invalid JSON wrapper=true/TERMINAL/copy(exit)；revalidation/taskkill=UNKNOWN/null；poll copied；B11

N01/N05/N06/N09/N10/N11 必须分别覆盖 terminal/live/error 所允许的 parent poll 状态；builder 仅改变 fields 25-27，其他 fields 字面保持不变。所有 negative vectors 的 fields 29-31=null、rows=UROWS、governance=27。

8. fixed inherited native literals and audit gate

  • V033 T17=1627/3f9493c83dd0cce10fb5e341d804e6b53436e9544fa5c3c1b0c536a09b98c28f、T18=1699/681a31f657227c026b359f414151072e51065b65fdff29fc2fe4af7db9b30979、T19=1691/ba9cf790c0f631f27df893c03032c3aa08d45d86e2ada1757bd277797f21a6a9、T20=1703/f4a93036cb42099e9694b2b1978f9f0ea285af2800ae9a068f53ad65c1cf9f5b 继续是 representative canonical vectors；V034 builder table supersedes V033 的 family/any 描述。
  • independent reviewer 必须重算 wrapper transform/hash/parser、absolute interpreter snapshot、final deadline adjacency、32-field assignments、B00-B13 precedence 和 N01/N05/N06/N09/N10/N11 negatives。
  • reviewer PASS 前不得请求 management authorization；PASS 也不是执行授权。

9. zero state / prohibitions

  • Y01-Y04=ABSENT_4_OF_4；Y05-Y08/run absent；parent/child/rescue/taskkill/candidate未执行。
  • Stage S/Stage V/database authorization=NOT_ISSUED/NOT_ISSUED/NOT_ISSUED；formal=0；BATCH-001=HELD；darkline_restored=false。
  • 禁止旧 candidate/A001 复用；禁止 source materialization、PowerShell/Python/csc/node/mysql/SQL/database/network/credential/formal target/R3/BATCH-001/YAML/.mbx/binding/session/role/permission/Git mutation。