From 00f77f798580ecd100f573f0ec7ef542defa5bc2 Mon Sep 17 00:00:00 2001 From: ScottW514 Date: Sat, 8 Aug 2026 14:19:30 -0400 Subject: [PATCH] docs: Phase 4 update manager bench-verified end-to-end --- docs/UPDATE-SYSTEM.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/docs/UPDATE-SYSTEM.md b/docs/UPDATE-SYSTEM.md index 3f0df8e..358ae46 100644 --- a/docs/UPDATE-SYSTEM.md +++ b/docs/UPDATE-SYSTEM.md @@ -174,7 +174,13 @@ refuse the booted root slot, verify signature before writing, and re-verify the written filesystem. `GET /slots` inventory, `POST /boot` (probe-gated), `POST /update/{check,download,apply,upload}`, `POST /restore/factory` (archive md5 checked), `POST /system/reboot`. -Original design notes below. +**Bench-verified end-to-end 2026-08-08** (slot b as scratch, no +reboots): production-signed upload classified `forgefirm` and applied +(`signed:true`); dev-signed classified `unsigned`, apply refused until +`confirm_unsigned=1`; factory-2022 restore md5-verified and written; +boot-select flipped and reverted without reboot; path-traversal / +bogus-target / booted-root-slot writes all refused; `/slots` inventory +matched the physical layout. Original design notes below.