boot(vol):
policy_uuid = vol.partitions[role=Data].uuid
local_proposed_hash = sep_cmd(11)
local_blessed_hash = sep_cmd(14)
policy = <disk1s1(Apple_APFS_ISC)>/<policy_uuid>/LocalPolicy/<local_proposed_hash || local_blessed_hash>.img4
# img4 -i policy.img4 -m manifest.img4
preboot_vol = vol.partitions[role=Preboot]
# muddy, maybe inaccurate, maybe hardcoded when not doing a boot to a custom OS
boot_dir = <preboot-vol>/boot/<policy.nsih>
[decrypt and boot <boot_dir>/usr/standalone/firmware/iBoot.img4> with <boot_dir>/usr/standalone/firmware/devicetree.img4]