This commit is contained in:
Chimera GFX release export
@@ -0,0 +1,610 @@
|
||||
# Safety and threat model
|
||||
|
||||
## Non-negotiable boundary
|
||||
|
||||
This project uses only userland behavior and public, open-source information.
|
||||
It excludes kernel and hypervisor code, exploit development, DRM bypass,
|
||||
proprietary SDK material, leaked or decrypted headers/binaries, direct MMIO or
|
||||
register writes, clock/SMU/fan control, boost settings, and firmware patches.
|
||||
|
||||
No payload or ELF may be transferred to or executed on a PS5 without explicit
|
||||
approval from Jens in the active task. There is no boot-time or automatic
|
||||
execution path.
|
||||
|
||||
Documented temporary process/kernel runtime changes made by the exact public
|
||||
loader or SDK may be classified as expected volatile, restored by the loader,
|
||||
or payload-process-local. They are not automatically unsafe. Persistent writes
|
||||
and unbounded or unknown effects remain hard blockers.
|
||||
|
||||
## Assets and adversaries
|
||||
|
||||
Protected assets include the console's stability, display availability, user
|
||||
data, network credentials, private repository credentials, and the accuracy of
|
||||
the project's compatibility claims.
|
||||
|
||||
Relevant failure or threat sources:
|
||||
|
||||
- an incorrect guessed ABI that corrupts stack or memory;
|
||||
- a command submission that hangs the GPU or display path;
|
||||
- unbounded waits or incomplete cleanup after partial initialization;
|
||||
- symbol presence being mistaken for compatible semantics;
|
||||
- firmware drift;
|
||||
- malicious or compromised upstream artifacts;
|
||||
- secrets entering logs, manifests, commits, or remote URLs;
|
||||
- a build or CI target silently becoming a deployment path.
|
||||
|
||||
## Phase-0 controls
|
||||
|
||||
| Risk | Control | Verification |
|
||||
|---|---|---|
|
||||
| ABI guess is called | No GNM declarations or calls; symbol addresses never escape | `phase0_safety_audit` test |
|
||||
| GPU work is submitted | No submit/draw/dispatch/flip call sites | source allowlist audit |
|
||||
| GPU memory changes | No GPU allocator, mapper, resource registration, or command buffer | source and build-graph audit |
|
||||
| Probe runs accidentally | target disabled by default; runtime acknowledgement; firmware gate | CMake tests and code review |
|
||||
| Unknown firmware runs | default is `NONE`; discovery build accepts only exact `9.60` | unit test, CMake gate, compatibility file |
|
||||
| Automatic deployment | no deploy/test/run target; output is compile artifact only | CMake audit |
|
||||
| Supply-chain substitution | immutable upstream commit and release SHA-256 | lock manifest and bootstrap script |
|
||||
| Secret disclosure | secret filename ignores, no credential scripts, boolean-only logs | repository scan before push |
|
||||
| Adapter accidentally claims hardware | compiled queries report unavailable and reject hardware requests | adapter tests |
|
||||
| Resource lifecycle leaks | context refuses destruction while child handles exist | mock integration tests |
|
||||
| Phase-1 target enters normal build | separate option defaults off and requires PS5 plus explicit SDL path | configure and source audit |
|
||||
| Pre-gate SDL side effect | candidate does not link SDL2main; gate precedes `SDL_Init` | source-order audit and ELF imports |
|
||||
| SDK CRT changes kernel state before `main` | classify exact effects; permanent legacy artifact remains blocked | pinned-source runtime audits and ADR-0010 |
|
||||
|
||||
## Probe side-effect statement
|
||||
|
||||
After its firmware gate, project code requests only system module loading,
|
||||
symbol lookup, boolean logging, and module unloading. It does not request a GNM
|
||||
operation. The pinned SDK source proves that `dlopen` can call
|
||||
`sceKernelLoadStartModule` and that `dlclose` can call
|
||||
`sceKernelStopUnloadModule`; module start/stop internals remain unknown.
|
||||
|
||||
More importantly, SDK v0.41's payload CRT runs before `main`. Its startup calls
|
||||
`__patch_init`, which writes process credential capability/attribute fields and
|
||||
syscall-address limits through the SDK's kernel read/write primitives. The CRT
|
||||
also sets libc `__isthreaded`, initializes syscall/kernel/log/rtld state, may
|
||||
load `libSceSysmodule.sprx`, allocates loader bookkeeping, relocates the
|
||||
payload, and runs constructors. Normal termination runs payload destructors;
|
||||
project `dlclose` requests module stop/unload only when this open loaded it.
|
||||
There is no guaranteed cleanup after a hang, crash, partial load, or failed
|
||||
stop/unload.
|
||||
|
||||
Therefore **no GPU mutation or rendering operation is requested by project
|
||||
code**. The existing ELF remains permanently ineligible by artifact-specific
|
||||
denylist, independently of the corrected Phase-0.6 classification model.
|
||||
|
||||
The firmware-9.60 capability artifact with SHA-256
|
||||
`4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63`
|
||||
is permanently blocked in `manifests/artifact-denylist.json`. Its manifest
|
||||
states `execution_eligible=false`, and all new manifests default to the same
|
||||
false value. `tools/check_artifact_execution_policy.py` must be the first
|
||||
static gate used by repository tooling and Payload Manager integrations:
|
||||
missing or false eligibility, malformed input, changed bytes, or a denylist
|
||||
match returns `DENY`. A pass is not execution authorization.
|
||||
|
||||
## Phase-0.5 startup result
|
||||
|
||||
The stock v0.41 CRT is `UNSAFE`. Omitting it is mechanically possible, but the
|
||||
loader caller and its return, cleanup, crash, and pre-entry behavior are
|
||||
`UNPROVEN`. No minimal startup source or ELF exists, and the corresponding
|
||||
CMake option fails closed. See `docs/runtime/` and
|
||||
`manifests/runtime/phase-0.5-startup-audit.json`.
|
||||
|
||||
## Phase-0.6 historical lifecycle result
|
||||
|
||||
The installed Payload Manager v0.3.1 and elfldr v0.23 are exact public-release
|
||||
matches. Temporary QA flag, credential, ptrace, mapping, and SDK startup
|
||||
effects are classified individually. The lifecycle still fails closed because
|
||||
it has `PERSISTENT_WRITE` and `UNBOUNDED_OR_UNKNOWN` effects: unbounded ptrace
|
||||
loops, no detached-child watchdog, unresolved return/reaping/cleanup,
|
||||
incomplete credential restoration, no launch-time hash check, and a manager
|
||||
upload path that writes `/data/pldmgr/payloads`.
|
||||
|
||||
That result remains immutable evidence for the unmodified public-release
|
||||
chain. It is not the current runtime profile.
|
||||
|
||||
## Phase-0.7 offline deployment-readiness result
|
||||
|
||||
The hardened elfldr and controlled Payload Manager close the Phase-0.6
|
||||
implementation blockers with bounded ptrace steps, complete checked credential
|
||||
restoration, centralized cleanup, a two-second kill/reap watchdog, exact
|
||||
same-file-descriptor hashing, and receiver-side digest/denylist enforcement.
|
||||
The lifecycle ELF is a normal SDK v0.41 payload that sends one notification
|
||||
and calls `_exit`.
|
||||
|
||||
The current `controlled-ps5-runtime` profile binds exact firmware 9.60, SDK,
|
||||
source commits, hashes, sizes, expected effects, a removable controlled
|
||||
artifact-directory write budget, no payload network, 2000 ms maximum runtime,
|
||||
and no retry. It is `READY_FOR_HARDENED_RUNTIME_DEPLOYMENT` only:
|
||||
`installed=false`, `execution_authorized=false`, `transferred=false`, and
|
||||
`executed=false`.
|
||||
|
||||
No PS5 connection, transfer, installation, or execution was used to reach
|
||||
this decision. Hardware behavior remains unproven. The normal CRT
|
||||
`__patch_init` path is process-local but means the lifecycle is not a
|
||||
kernelwrite-free artifact. The old blocked hash remains permanently denied.
|
||||
See `docs/runtime/phase-0.7-hardening.md` and
|
||||
`manifests/runtime/phase-0.7-offline-audit.json`.
|
||||
|
||||
## Phase-0.8 read-only preflight result
|
||||
|
||||
The offline collector-admissibility review is
|
||||
`READ_ONLY_PREFLIGHT_BLOCKED`. The exact Payload Manager v0.3.1 HTTP handler
|
||||
sets an in-process active flag for every non-`OPTIONS` request.
|
||||
`/autoload_status` additionally sets `autoload_triggered` and reads the
|
||||
autoload configuration. Direct filesystem collection has no pinned collector
|
||||
or proof excluding atime, audit-log, cache, metadata, service-state, or
|
||||
on-device-log changes.
|
||||
|
||||
No on-device session was started and no PS5 connection was made. Current
|
||||
firmware, live object identities, listeners, startup state, and rollback
|
||||
backups remain unobserved. The exact stock Payload Manager backup is therefore
|
||||
a hard open gate. Installation, lifecycle, execution, and automatic retry
|
||||
remain unauthorized. See `docs/runtime/phase-0.8-read-only-preflight.md` and
|
||||
`manifests/runtime/phase-0.8-read-only-preflight.json`.
|
||||
|
||||
## Phase-0.9A anti-brick design result
|
||||
|
||||
The offline anti-brick layer is `DESIGN_ONLY`. It models exact pre-image
|
||||
identity, separate reopened backup, inactive staging, quiescence, an atomic
|
||||
switch, post-switch verification and separately authorized rollback. No such
|
||||
PS5 switch or recovery primitive is claimed. All fourteen interruption
|
||||
boundaries remain `UNPROVEN`, so the design is not installation-suitable.
|
||||
|
||||
The host simulator performs only in-memory logical writes and cannot connect,
|
||||
transfer, install, execute, open a target artifact or start a compiler. Its
|
||||
synthetic atomic primitive is fault-test scaffolding, not hardware evidence.
|
||||
The byte-exact on-device Payload Manager backup and recovery independent of
|
||||
both elfldr and Payload Manager remain catastrophic hard gates. No
|
||||
authorization is granted and automatic retry remains false.
|
||||
|
||||
## Phase-0.9B observer feasibility result
|
||||
|
||||
The offline result is `BLOCKED`. Normal SDK v0.41 startup is not
|
||||
kernelwrite-free because `_start()` reaches `__patch_init()` before `main`.
|
||||
Omitting the CRT is mechanically possible, but safe custom entry, return/exit,
|
||||
crash handling and loader cleanup remain `UNPROVEN`.
|
||||
|
||||
The hash-bound hardened elfldr route deliberately gives the payload no
|
||||
stdout/stderr socket, and the controlled Payload Manager transport does not
|
||||
receive payload output. Notifications, klog and stock manager HTTP are not a
|
||||
proven bounded non-persistent result channel. No observer source, target, ELF,
|
||||
linker map or package was created. All device authorizations remain false, and
|
||||
no PS5 action occurred. See
|
||||
`docs/runtime/phase-0.9b-observer-static-audit.md`.
|
||||
|
||||
## Phase-0.9C execution-feasibility result
|
||||
|
||||
The offline classification is
|
||||
`BLOCKED_MULTIPLE_FOUNDATIONAL_CONTRACTS`. Source review proves that a normal
|
||||
SDK entry is side-effecting before `main`; a freestanding entry has no closed
|
||||
stack/BSS/relocation/TLS, read, monotonic-time, return, exit, or cleanup
|
||||
contract. A normal `ret` resumes an unproven SceSpZeroConf continuation, and a
|
||||
watchdog kill is not accepted as safe exit.
|
||||
|
||||
The 4096-byte D1 result format passes deterministic host tests, but no current
|
||||
caller-owned target buffer, copy-out, cleanup finalizer, or manager delivery
|
||||
exists. Firmware source two is absent; an SDK export name alone is not an ABI.
|
||||
Filesystem and platform reads may still affect metadata, atime, audit, caches,
|
||||
counters, service/security state, open bookkeeping, accounting, object
|
||||
lifetime, or races. No target source, ELF, map or package was built, and no PS5
|
||||
action or authorization occurred. See
|
||||
`docs/runtime/phase-0.9c-static-audit.md`.
|
||||
|
||||
## Phase-0.9D existing-stack readback result
|
||||
|
||||
The offline decision is `BLOCKED_NO_READBACK_PATH`. The full and controlled
|
||||
Payload Manager profiles contain uploads, installs, deletes, launch-time file
|
||||
reads, directory/configuration observations, and process actions, but no
|
||||
binary-safe file-download response. Hardened elfldr returns fixed status text;
|
||||
its controlled manager transport sends and closes without receiving component
|
||||
bytes.
|
||||
|
||||
The full-profile `server_active_flag` is process-local and only suppresses a
|
||||
fallback notification in audited source. It is `LOW_VOLATILE`, but has no
|
||||
in-process reset and must be explicitly accepted in any future permission.
|
||||
`/autoload_status` is excluded because it sets `autoload_triggered` and can
|
||||
alter worker timing. No PS5 was contacted, no file was transferred, and no
|
||||
target, observer, client, backup, package, staging action, or authorization was
|
||||
created. See `docs/runtime/phase-0.9d-readback-feasibility.md`.
|
||||
|
||||
## Phase-0.9E bootstrap provenance gate
|
||||
|
||||
The exact external exploit/host and rudimentary port-9020 listener must be
|
||||
available and provenance-bound before they can be considered an independent
|
||||
rescue executor. A matching filename, an opaque console backup, a public
|
||||
upstream, a generic sender command, or a conceptual dependency graph is not
|
||||
enough. Unknown filesystem staging or autoload effects are brick-relevant and
|
||||
remain hard stops.
|
||||
|
||||
No Phase-0.9F target design is authorized while the receive, mapping,
|
||||
entrypoint, live-file, output, cleanup, crash, and reboot contracts are
|
||||
missing. Phase 0.9E permits only local hashing, source/binary inspection,
|
||||
schemas, manifests, and host-only policy tests. It permits no network socket,
|
||||
device client, transfer, target build, payload, install, execution, autoload,
|
||||
retry, or recovery action.
|
||||
|
||||
Phase 0.9E-R permits only bounded official `Gezine/Y2JB` GitHub acquisition
|
||||
and private-origin push. Official metadata excludes every current release
|
||||
asset from matching the local backup, and official source contains no
|
||||
port-9020 listener implementation. The ignored official source tree is
|
||||
inspection-only; downloaded code was not executed. No outer association may
|
||||
be promoted to opaque inner provenance, and neither an operator attestation
|
||||
nor host tests are runtime evidence. All device, build, transfer, execution,
|
||||
installation, lifecycle, autoload, write, and retry authorizations remain
|
||||
false.
|
||||
|
||||
Phase 0.9E-R2 permits only host-side hashing, bounded browser metadata copies,
|
||||
the exact MediaFire object page, one mandatory official backup, and
|
||||
source-motivated community assets. Downloaded archives are static evidence:
|
||||
never execute or restore them, never track them, and remove temporary copies.
|
||||
The SIECAF parser is read-only and may inspect only public fixed-width
|
||||
structural metadata; it may not decrypt, guess keys, extract, write, or invoke
|
||||
`ps5-bar-tool`. MediaFire metadata, structural similarity, and an inner match
|
||||
would each remain non-runtime evidence. The actual result is
|
||||
`LOCAL_BACKUP_UNCORRELATED`, so Phase 0.9F and every authorization remain
|
||||
blocked.
|
||||
|
||||
## Phase-1.0E inherited result boundary
|
||||
|
||||
Prior RUN A and RUN B permissions were artifact-specific and consumed. RUN A
|
||||
visibly reached C1; RUN B produced an unreadable notification and no exact
|
||||
D-stage may be inferred. Phase 1.0E may record those observations and build a
|
||||
new execution-ineligible diagnostic candidate offline. Its later exact
|
||||
one-shot authorization was consumed on 2026-07-22.
|
||||
|
||||
The only added target operation is one nonblocking `send` attempt per reached
|
||||
D-stage through stdout inherited from hardened elfldr's legacy raw-ELF
|
||||
connection. It may not open a target socket, connect, listen, read requests,
|
||||
retry, write the device filesystem, install or activate autoload. The host may
|
||||
model one connect/send/write-half-close/bounded receive with fake sockets, but
|
||||
no real device use occurs without new exact artifact-specific permission that
|
||||
also names result reception. EOF, timeout, partial frames and send failure are
|
||||
terminal, never retry triggers. The normal SDK CRT effects remain explicit;
|
||||
this result channel is not side-effect-free. RUN C used the permitted single
|
||||
connection and validated D00-D02 before remote EOF. It did not retry or
|
||||
reconnect. D03, SDL, VideoOut, rendering, terminal status and cleanup remain
|
||||
unproven. All authorization fields and artifact eligibility are now false.
|
||||
|
||||
## Phase-1.0F startup interval boundary
|
||||
|
||||
Phase 1.0F may prepare an exact artifact offline to place I00-I14 checkpoints
|
||||
inside the source interval after D02 and through entry to D03. These
|
||||
checkpoints may only reuse the existing nonblocking, signal-suppressed inherited
|
||||
stdout send. They do not send notifications and may not add a socket, connect,
|
||||
listener, receive path, address, port, filesystem write, install, autoload,
|
||||
retry or reconnect.
|
||||
|
||||
The distinct `CHD10F01` parser remains offline-only: the live CLI is not
|
||||
activated for it and must continue to reject the ineligible manifest. Normal
|
||||
SDK CRT patch effects and the existing SDL/VideoOut imports remain explicit;
|
||||
the artifact is not side-effect-free and static success is not hardware
|
||||
evidence. No prior authorization carries forward. Device connection, transfer,
|
||||
result reception and execution each require a new exact permission.
|
||||
|
||||
## Phase-1.0G one-shot runner boundary
|
||||
|
||||
Phase 1.0G may prepare and host-test a manifest-driven runner, but its tracked
|
||||
manifest and approval template remain inactive. The interval protocol cannot
|
||||
be selected through a free command-line switch. Activation requires both an
|
||||
exact active manifest and a separate untracked local approval whose artifact,
|
||||
firmware, target, protocol, limits and unique run identifier agree.
|
||||
|
||||
The runner must rehash the actual artifact before transport and exclusively
|
||||
create and `fsync` a consumed-attempt receipt before opening a socket. This
|
||||
fail-closed receipt prevents a host crash from silently making the same
|
||||
permission reusable. Retry, reconnect, resume and trace overwrite remain
|
||||
forbidden. The current repository contains no active target, run identifier or
|
||||
authorization; no device action is allowed by Phase 1.0G itself.
|
||||
|
||||
The later exact Phase-1.0G authorization was consumed by one attempt. Valid
|
||||
frames ended at I03 and ordinary stdout proved the deliberate no-argument,
|
||||
no-menu help/exit path before I04. There was no retry or reconnect. This result
|
||||
does not authorize another action and does not prove SDL, VideoOut, rendering
|
||||
or terminal cleanup.
|
||||
|
||||
## Phase-1.0H startup-argument boundary
|
||||
|
||||
Phase 1.0H may correct only the proven `!HAVE_MENU && argc == 1` exit. The
|
||||
reviewed profile adds RetroArch's existing verbose flag, generating `-v`, and
|
||||
must retain null content/config/core paths, static contentless core, write
|
||||
firewall, bounded runtime and the inherited one-send-per-stage stream. It must
|
||||
allow H only through an exact active manifest plus separate matching local
|
||||
approval, never a free protocol switch. No target, run ID, retry, reconnect,
|
||||
installation, autoload or device-write authority may be tracked by default.
|
||||
|
||||
The exact H artifact is offline evidence only. It remains transfer-, execution-
|
||||
and installation-ineligible, and all authorizations are false. Phase-1.0G
|
||||
authority was consumed and cannot authorize H. A later action requires a new
|
||||
exact artifact-specific permission; static success does not prove I04, SDL,
|
||||
VideoOut, rendering, terminal status or cleanup.
|
||||
|
||||
The later exact Phase-1.0H authorization was consumed once. Its trace reached
|
||||
I04, SDL2 video, VideoOut open and buffer registration, then the first flip
|
||||
submit returned `-1` and SDL init returned `-1`. The diagnostic pattern was
|
||||
copied into mapped display memory before the failed submit. D12 also records a
|
||||
write-firewall rejection during configuration parsing; the exact requested
|
||||
operation is unobserved. No retry is authorized. Do not infer a visible frame,
|
||||
runloop entry, complete cleanup or safe exit.
|
||||
|
||||
## Phase-1.0I offline postmortem boundary
|
||||
|
||||
Phase 1.0I may inspect only the consumed H trace, exact source, ignored local
|
||||
artifact/map and disassembly. It proves the submitted tuple
|
||||
`(handle, 0, 1, 0)` and narrows E118 to linked `OPEN` or `STREAM` wrappers. It
|
||||
does not know the exact blocked operation, original submit `errno`, VideoOut
|
||||
argument semantics or root cause. The diagnostic/normal frame-zero/frame-one
|
||||
mismatch is a source candidate only.
|
||||
|
||||
No target build, artifact, device client, connection, transfer, execution,
|
||||
result reception or retry belongs to Phase 1.0I. A later offline design must
|
||||
capture errno before reporting, transmit the exact write operation and stop
|
||||
before I04 on a firewall shutdown. Selecting a different frame ID requires a
|
||||
new ADR, new artifact audit and separate future authorization.
|
||||
|
||||
## Phase-1.0O consumed write-free result
|
||||
|
||||
The exact M artifact was transferred and executed once. The exclusive receipt
|
||||
was created before the only connection; there was one send, zero retries and
|
||||
zero reconnects. No installation, autoload, persistent staging or device
|
||||
filesystem write occurred. The diagnostic pattern did mutate mapped display
|
||||
memory and one VideoOut flip submit was attempted, as bounded by the approval.
|
||||
|
||||
The run passed I04 with no D13, then reproduced the first flip-submit failure.
|
||||
D07 reports `-1` and saved errno `0`; E104 is the overlay's generic
|
||||
`framebuffer_fail` label after that failure, not proof of an allocation fault.
|
||||
The subsequent D04 after terminal-flagged D12 prevents a successful terminal
|
||||
classification. Do not infer visible output, event-wait behavior, complete
|
||||
cleanup or safe exit. The authorization is consumed and no action carries.
|
||||
|
||||
## Phase-1.0P offline VideoOut analysis
|
||||
|
||||
Phase 1.0P performs source, map, relocation and disassembly inspection only.
|
||||
It proves the consumed artifact called `sceVideoOutSubmitFlip(handle,0,1,0)`
|
||||
and received `-1` with saved errno `0`. It does not prove the semantic ABI,
|
||||
opaque buffer contract, flip ownership, visible presentation or cleanup.
|
||||
|
||||
An exported symbol name is not permission to call a status or flip-master
|
||||
function. No argument experiment, target build, parser relaxation or device
|
||||
action is permitted by this analysis. The D12-before-D04 order is
|
||||
source-deterministic, and D12 remains a shutdown request rather than proof of
|
||||
lifecycle completion.
|
||||
|
||||
## Phase-1.0Q public evidence boundary
|
||||
|
||||
The bounded official-source inventory found no independent PS5 VideoOut ABI.
|
||||
SDK v0.41 provides export names only; the PS5 declarations and opaque records
|
||||
originate together in one SDL lineage, and relevant official ports consume
|
||||
that same fork. OpenOrbis defines only the analogous PS4 contract.
|
||||
|
||||
Do not promote source repetition, a successful registration return, a PS4
|
||||
constant or an exported status/flip-master name into PS5 semantic proof. No
|
||||
submit parameter, buffer layout, ownership state or error interpretation may
|
||||
change from Phase 1.0Q, and no target or device action is authorized.
|
||||
|
||||
## Phase-1.0R launch-context boundary
|
||||
|
||||
The exact PS5 SDL2main adds no application ID, title identity, LNC setup,
|
||||
VideoOut ownership or process creation. Its `LoadExec("exit")` occurs only
|
||||
after `SDL_main` returns, and the tested RetroArch path already performs SDL's
|
||||
splash-hide call before VideoOut open. Direct and Payload Manager raw-ELF
|
||||
routes use the same hardened elfldr process constructor.
|
||||
|
||||
Do not treat PacBrew packaging, `homebrew.js` path/argument descriptors,
|
||||
LakeSnes documentation, or the non-unique LNC log as proof of a different
|
||||
working display context. The exact hbldr/shsrv launcher and runtime active-app
|
||||
state are unbound. Keep
|
||||
`NO_SOURCE_PROVEN_LAUNCH_CONTEXT_FIX_TARGET_CHANGE_BLOCKED`: no SDL2main,
|
||||
LNC/SystemService, submit, VideoOut, target-build, transfer or execution
|
||||
change is authorized.
|
||||
|
||||
## Phase-1.0S hbldr/shsrv boundary
|
||||
|
||||
Official source proves that hbldr is materially different from raw elfldr: it
|
||||
launches a BigApp through SystemService and replaces the resulting process
|
||||
with a device-resident ELF. This is source evidence for a launch-context
|
||||
difference, not proof of VideoOut permission, visible output, safe cleanup or
|
||||
firmware-9.60 behavior. The exact deployed shsrv identity is unknown.
|
||||
|
||||
Never invoke or copy the existing route under this gate. It may kill the
|
||||
running BigApp, performs kernel/ptrace process changes, lacks a hard deadline,
|
||||
requires prior target staging, and current versions may remount `/system_ex`
|
||||
and create persistent `FAKE00000` content without an atomic write, rollback or
|
||||
power-loss protocol. Keep
|
||||
`BIGAPP_CONTEXT_SOURCE_PROVEN_DEPLOYED_IDENTITY_UNPROVEN_DEVICE_PATH_BLOCKED`.
|
||||
No port-2323 connection, shsrv request/deployment, hbldr command, target build,
|
||||
device file, app termination, remount, transfer or execution is authorized.
|
||||
|
||||
## Phase-1.0T inactive shsrv identity boundary
|
||||
|
||||
The current shsrv source spawns a shell for every accepted connection and its
|
||||
greeting automatically queries and transmits model, serial number, firmware,
|
||||
temperatures and CPU frequency. Therefore a nominally read-only `help` request
|
||||
is not side-effect-free and risks disclosing a device identifier. Phase 1.0T
|
||||
contains no connector and authorizes no connection.
|
||||
|
||||
The offline parser must receive an already supplied transcript on stdin. It
|
||||
must never persist raw input, serial, model or telemetry, and may retain file
|
||||
metadata only for an independently supplied literal absolute path. `help`
|
||||
identifies at most a source family; `stat` is metadata only; `sum` is a weak
|
||||
16-bit rotating checksum and may cause atime/cache/accounting effects. None
|
||||
can prove an exact binary. Wildcards, path discovery, content commands,
|
||||
`hbldr`, launch, writes, signals, mounts, retry and reconnect remain forbidden.
|
||||
All future windows are `DESIGNED_NOT_ACTIVE` and require separate exact review.
|
||||
|
||||
## Phase-1.0U bounded local inventory
|
||||
|
||||
Phase 1.0U found no deployed shsrv candidate within the declared Chimera,
|
||||
attachment, known-download and ZIP-entry-name scope. This is not a global host
|
||||
or device absence claim. The official source checkout, host telnet wrapper and
|
||||
PacBrew recipe remain non-deployed references and must never be substituted
|
||||
for exact installed bytes. No discovered script or binary was executed.
|
||||
|
||||
The inventory grants no connection, shell command, target build, transfer,
|
||||
execution, installation, write, retry or launch-context experiment. Only the
|
||||
next offline inactive collector-design phase may proceed. A future live
|
||||
collector remains blocked behind a new exact approval and the Phase-1.0T
|
||||
serial/telemetry side-effect acceptance.
|
||||
|
||||
## Phase-1.0V inactive collector-model boundary
|
||||
|
||||
Phase 1.0V is an offline stdin model with no network transport. It bounds raw
|
||||
and sanitized input to 65,536 bytes, permits at most 256 chunks, rejects
|
||||
incomplete Telnet controls and invalid UTF-8, and seals after one result. It
|
||||
retains only the Phase-1.0T sanitized record. The internal bytearray is cleared,
|
||||
but physical memory erasure is not proven.
|
||||
|
||||
The tracked activation and approval remain empty and false. Do not add an
|
||||
address, port, command, socket, connect/send path, automatic reply, persistent
|
||||
raw transcript, retry, reconnect, resume or fallback under this phase. Host
|
||||
model success is not device, prompt, cleanup or deployed-identity evidence.
|
||||
|
||||
## Phase-1.0W reviewed inactive client architecture
|
||||
|
||||
Self-review remediates doubled-IAC state, empty-chunk accounting, path
|
||||
allowlisting, firmware/compile metadata validation and numeric-parser error
|
||||
normalization. Physical memory erasure remains unproven. The new policy accepts
|
||||
only synthetic dual records and returns a frozen data plan; the fake transport
|
||||
has no network primitives.
|
||||
|
||||
Keep the tracked activation and approval empty. Port 2323, one connection,
|
||||
ten-second deadline and T2/T3 command tokens are future constraints, not
|
||||
authority. A consumed receipt, exclusive sanitized output, monotonic deadline,
|
||||
network transport, Telnet reply/prompt contract and deterministic close remain
|
||||
missing. Do not connect, render shell lines or issue a request under this phase.
|
||||
|
||||
## Phase-1.0X inactive injected transport
|
||||
|
||||
The X orchestrator accepts only an already validated immutable session plan,
|
||||
an injected adapter, an injected monotonic clock and a caller-owned host
|
||||
evidence directory. Repository tests supply only fake adapters. The consumed
|
||||
receipt is exclusively created and file-flushed before adapter open. Output is
|
||||
sanitized, exclusively created and bound to the reopened receipt hash. There
|
||||
is no overwrite, delete, raw-transcript persistence, target persistence, retry
|
||||
or second open.
|
||||
|
||||
Do not interpret file `fsync` as directory-entry durability. A partial file is
|
||||
invalid and deliberately not cleaned up; the run remains consumed. Deadline
|
||||
checks surround adapter boundaries but cannot preempt a blocking real adapter.
|
||||
Exact prompt and Telnet framing, OS socket timeouts, live close behavior and
|
||||
deployed shsrv identity remain blockers. No real adapter, address, port,
|
||||
connection, request or authority may be added under X.
|
||||
|
||||
## Phase-1.0Y offline shsrv framing
|
||||
|
||||
The Y model accepts synthetic bytes only. It distinguishes raw v0.7-v0.8 from
|
||||
`libtelnet`/NVT v0.9-v0.19, never opens a transport and never formats a command.
|
||||
Neither audited family proactively negotiates or server-echoes input. Current
|
||||
source rejects unsupported `WILL`/`DO`; legacy source passes Telnet controls
|
||||
into the shell. Future Chimera input must therefore emit no IAC commands.
|
||||
|
||||
A terminal `$ ` is not a live completion proof. `PWD` is not forcibly
|
||||
overwritten, the external Telnet client's local echo is undefined, wire chunks
|
||||
are arbitrary, and current pipe/socket handlers do not complete short writes.
|
||||
The server also has no bounded session deadline. Preserve deadline-based
|
||||
partial-result rejection, keep all authority false, and do not add a real
|
||||
network adapter under Y.
|
||||
|
||||
## Phase-1.0Z offline passive batch
|
||||
|
||||
The Z contract produces one target-free ASCII/LF byte batch from a validated W
|
||||
plan. It permits only `help`, or ordered `stat` and `sum` for one normalized
|
||||
literal path. NUL, CR, IAC and shell separators cannot enter the batch. It has
|
||||
no CLI, address, transport, clock or file output and authorizes no device use.
|
||||
|
||||
Incoming IAC fails closed; the model never sends a Telnet reply. Prompt text
|
||||
and remote EOF are not completion boundaries. Only an explicit synthetic
|
||||
hard-deadline event can seal, and incomplete help/stat/sum output remains
|
||||
invalid. This does not prove live timeout preemption. A future T3 read may
|
||||
still cause atime, cache, accounting and scheduler effects, while the automatic
|
||||
sensitive greeting and shell/connection state require explicit acceptance.
|
||||
Keep all authority false and add no real adapter under Z.
|
||||
|
||||
## Phase-1.0AA offline fake-adapter integration
|
||||
|
||||
AA accepts only exact built-in fake adapter, fake clock and fake evidence-store
|
||||
types. Subclasses and arbitrary injected implementations are rejected, so the
|
||||
module cannot be repurposed as a live transport boundary. It creates an
|
||||
exclusive consumed receipt before fake open, permits one complete Z batch,
|
||||
seals only at a valid synthetic hard deadline and closes exactly once.
|
||||
|
||||
EOF, blocked receive, early or missing deadline, data at/after deadline, IAC,
|
||||
partial output and evidence collisions are failures. A receipt remains after a
|
||||
failed fake attempt; no cleanup deletes it. Logical event-buffer clearing does
|
||||
not prove physical erasure. Host `fsync` does not prove directory-entry
|
||||
durability, and the synthetic clock cannot prove OS preemption. Keep every
|
||||
authorization false and do not add a network adapter or device action under AA.
|
||||
|
||||
## Phase-1.0AB offline live-adapter feasibility
|
||||
|
||||
AB binds the local Python 3.13.2 Windows socket/select implementation but adds
|
||||
no network import or adapter. Its trace model accepts synthetic operations only
|
||||
and requires receipt-before-creation, nonblocking-before-connect, readiness and
|
||||
`SO_ERROR`, positive bounded send/receive progress, deadline-only sealing,
|
||||
sanitization, local close and then output.
|
||||
|
||||
Selector timeout is a maximum requested wait, not proof that host scheduling
|
||||
cannot overshoot. Local `close` is not proof of remote shsrv/process cleanup.
|
||||
Numeric-address parsing and the exact accepted Windows pending-connect error set
|
||||
still require implementation review. Keep live implementation, socket creation,
|
||||
DNS, target retention, connection and request as hard stops under AB.
|
||||
|
||||
## Phase-1.0AC offline dormant-adapter boundary
|
||||
|
||||
AC executes only against the exact built-in fake syscall facade and fake
|
||||
clock. A precommitted receipt marker must precede synthetic creation;
|
||||
nonblocking setup precedes synthetic connect; partial progress is explicit;
|
||||
EOF, zero progress and data at the deadline fail. One fake local close is
|
||||
attempted after every successfully opened path. Unused fake events are logically discarded,
|
||||
which does not prove physical erasure or remote cleanup.
|
||||
|
||||
The module has no live adapter protocol, socket/selector import, DNS, address,
|
||||
CLI, real clock or file output. All authorization remains false. AC permits
|
||||
only a later offline inactive numeric-target/activation design; it does not
|
||||
permit a transport implementation, connection, request or device action.
|
||||
|
||||
## Controls required before Phase 1
|
||||
|
||||
Phase 1 cannot begin until all of the following are recorded in a new ADR:
|
||||
|
||||
1. explicit hardware-test approval;
|
||||
2. an allowlisted firmware and reproducible console identification method;
|
||||
3. proven function signatures and data layouts from acceptable public sources;
|
||||
4. a bounded timeout and operator recovery plan;
|
||||
5. independently reviewed cleanup and crash-log paths;
|
||||
6. a one-step-at-a-time test case with an SDL software/VideoOut fallback;
|
||||
7. an explicit statement of exactly which buffer or GPU state may mutate.
|
||||
|
||||
Approval for one test does not authorize later tests.
|
||||
|
||||
## Timeout, watchdog, cleanup, and logs
|
||||
|
||||
The Phase-0 loop is statically bounded by the 21-entry manifest and always
|
||||
attempts module cleanup after lookup begins. Dynamic-loader calls do not expose
|
||||
a documented cancellation API, so an in-process forced timeout would risk
|
||||
leaking loader state. The default `NONE` gate blocks the project-requested
|
||||
module open. The 9.60 build gate does not remove the SDK CRT blocker and grants
|
||||
no execution authority.
|
||||
|
||||
Before any approved hardware observation, a separate supervisor design must
|
||||
define a wall-clock deadline, progress events, operator-visible failure state,
|
||||
and a recovery action that does not kill a thread while it owns loader or GPU
|
||||
state. The probe already emits deterministic JSON-line stage events suitable
|
||||
for a redacted crash/timeout log; it never emits addresses. Later GPU phases
|
||||
must add explicit per-operation deadlines and prove cleanup for each partially
|
||||
completed state transition.
|
||||
|
||||
## Disabled Phase-1 candidate
|
||||
|
||||
The candidate source contains one SDL window-surface update, but it is outside
|
||||
every default target and automated test. Its default `NONE` build exits before
|
||||
SDL initialization. Project code contains no direct VideoOut or GNM prototype.
|
||||
The pinned SDL backend's flip-event wait has no proven finite timeout; this is
|
||||
recorded as a hardware blocker rather than hidden behind a forced thread kill.
|
||||
See `docs/phase1/HARDWARE_TEST_PLAN.md`.
|
||||
|
||||
## Incident rule
|
||||
|
||||
On an unexpected return code, missing cleanup confirmation, display anomaly,
|
||||
hang, reset, or firmware mismatch: stop, preserve non-sensitive logs, mark the
|
||||
compatibility entry as failed or unknown, and do not retry automatically.
|
||||
Reference in New Issue
Block a user