boot(vol):
    policy_uuid = vol.partitions[role=Data].uuid
    local_proposed_hash = sep_cmd(11)
    local_blessed_hash = sep_cmd(14)
    policy = <disk1s1(Apple_APFS_ISC)>/<policy_uuid>/LocalPolicy/<local_proposed_hash || local_blessed_hash>.img4
    # img4 -i policy.img4 -m manifest.img4
    preboot_vol = vol.partitions[role=Preboot]
    # muddy, maybe inaccurate, maybe hardcoded when not doing a boot to a custom OS
    boot_dir = <preboot-vol>/boot/<policy.nsih>
    [decrypt and boot <boot_dir>/usr/standalone/firmware/iBoot.img4> with <boot_dir>/usr/standalone/firmware/devicetree.img4]