This commit is contained in:
Chimera GFX release export
@@ -0,0 +1,16 @@
|
||||
# Decision log
|
||||
|
||||
| Date | Decision | ADR | Status |
|
||||
|---|---|---|---|
|
||||
| 2026-07-16 | Create an independent `chimera-gfx` repository | ADR-0001 | accepted |
|
||||
| 2026-07-16 | Treat GNM export names as discovery evidence only | ADR-0002 | accepted |
|
||||
| 2026-07-16 | Keep the Phase-0 probe non-rendering and fail-closed | ADR-0003 | accepted |
|
||||
| 2026-07-16 | Use GPL-3.0-or-later for project code | ADR-0004 | accepted |
|
||||
| 2026-07-17 | Define the resource lifecycle through a non-rendering mock model | ADR-0005 | accepted |
|
||||
| 2026-07-17 | Keep the first VideoOut experiment behind pinned SDL2 | ADR-0006 | accepted |
|
||||
| 2026-07-17 | Bind every candidate to a machine-readable artifact manifest | ADR-0007 | accepted |
|
||||
| 2026-07-17 | Allowlist 9.60 for probe builds while blocking SDK-CRT execution | ADR-0008 | accepted |
|
||||
| 2026-07-17 | Block unproven minimal startup and permanently deny the legacy ELF | ADR-0009 | accepted |
|
||||
|
||||
New decisions that change safety, ABI, firmware, licensing, or adapter
|
||||
boundaries require a numbered ADR and an update here.
|
||||
@@ -0,0 +1,40 @@
|
||||
# Publication readiness
|
||||
|
||||
The current source tip is prepared for public review. The repository remains
|
||||
private until the history and security-contact decisions below are confirmed.
|
||||
|
||||
## Completed
|
||||
|
||||
- GPL-3.0-or-later license, contribution guidance, security policy, third-party
|
||||
notices, and a user-oriented README are present.
|
||||
- Development branches are consolidated into one reviewed candidate branch.
|
||||
- No generated ELF, SDK archive, crash dump, device capture, or other binary
|
||||
release artifact is tracked.
|
||||
- Current source paths and manifests contain no private LAN repository URL or
|
||||
operator-specific filesystem path.
|
||||
- Host builds, policy tests, JSON validation, large-object review, and current
|
||||
plus all-ref secret scans are part of the publication review.
|
||||
- CI actions, container images, SDK downloads, and source revisions are pinned;
|
||||
downloaded SDK bytes are verified before use. Distribution packages follow
|
||||
the security-updated repository attached to the pinned base image rather than
|
||||
stale exact package revisions.
|
||||
- `SECURITY.md` publishes a fixed private reporting address.
|
||||
- Pull requests from public forks cannot run on the self-hosted CI runner.
|
||||
- `tools/export-public-source.sh` creates a parentless source candidate, strips
|
||||
machine-local agent instructions, and rejects private deployment markers,
|
||||
forbidden secret files, generated binaries, and oversized files.
|
||||
|
||||
## Decisions required before changing visibility
|
||||
|
||||
1. **Release policy.** Recommended: publish reviewed source only. Do not attach
|
||||
runnable PS5 ELF artifacts; if that policy changes later, require reproducible
|
||||
builds, checksums, corresponding source, and a separate safety review.
|
||||
|
||||
Historical commits contain an old private LAN URL, operator-specific paths, and
|
||||
author email metadata. Keep that canonical history private and publish only the
|
||||
parentless export from a reviewed commit. Deleting branches is not a substitute
|
||||
for this export.
|
||||
|
||||
Generated payloads, crash dumps, SDK archives, local hardware captures, and
|
||||
unredacted operator records are not public source artifacts and must remain
|
||||
outside Git.
|
||||
@@ -0,0 +1,15 @@
|
||||
# ADR-0001: Standalone repository
|
||||
|
||||
- Status: accepted
|
||||
- Date: 2026-07-16
|
||||
|
||||
## Decision
|
||||
|
||||
`chimera-gfx` is a new repository and workspace, not a subdirectory, worktree,
|
||||
submodule, or branch of the existing Chimera project.
|
||||
|
||||
## Consequences
|
||||
|
||||
It has an independent Git history, private Gitea origin, license, CI, release
|
||||
policy, dependencies, and risk boundary. No path or build step refers to the
|
||||
existing Chimera repository.
|
||||
@@ -0,0 +1,21 @@
|
||||
# ADR-0002: Export names are not ABI definitions
|
||||
|
||||
- Status: accepted
|
||||
- Date: 2026-07-16
|
||||
|
||||
## Context
|
||||
|
||||
The public PS5 Payload SDK v0.41 contains GNM export stubs but no GNM headers,
|
||||
structure definitions, or GPU samples.
|
||||
|
||||
## Decision
|
||||
|
||||
An export name proves only that the pinned stub set exposes that name. No C
|
||||
prototype, calling convention detail, structure layout, ownership rule, or
|
||||
semantic behavior is inferred from it. Phase 0 may resolve a name and record a
|
||||
boolean, but may not call the result.
|
||||
|
||||
## Consequences
|
||||
|
||||
Even `sceGnmAreSubmitsAllowed` is not called. Each future ABI must be accepted
|
||||
through a new evidence record before use.
|
||||
@@ -0,0 +1,20 @@
|
||||
# ADR-0003: Fail-closed capability probe
|
||||
|
||||
- Status: accepted
|
||||
- Date: 2026-07-16
|
||||
|
||||
## Decision
|
||||
|
||||
The PS5 probe is disabled in ordinary builds. A probe build embeds exactly one
|
||||
approved firmware identifier, defaulting to `NONE`. Runtime requires an exact
|
||||
firmware match and the literal `--acknowledge-read-only-probe` argument before
|
||||
module loading. The checked-in firmware matrix is empty.
|
||||
|
||||
The platform shim may call only `dlopen`, `dlsym`, and `dlclose`. Logs contain
|
||||
symbol names and booleans, never addresses. There is no deploy target.
|
||||
|
||||
## Consequences
|
||||
|
||||
Default artifacts cannot discover symbols on hardware. A deliberately gated
|
||||
artifact still requires separate human authorization before transfer or
|
||||
execution. Loader-internal side effects remain an explicitly recorded unknown.
|
||||
@@ -0,0 +1,15 @@
|
||||
# ADR-0004: GPL-3.0-or-later
|
||||
|
||||
- Status: accepted
|
||||
- Date: 2026-07-16
|
||||
|
||||
## Decision
|
||||
|
||||
Project-owned code is licensed GPL-3.0-or-later.
|
||||
|
||||
## Rationale
|
||||
|
||||
The planned RetroArch adapter targets a GPLv3 project and the PS5 Payload SDK is
|
||||
generally GPLv3-or-later. A common GPL-compatible project license keeps the
|
||||
combined distribution boundary understandable. Third-party code is not
|
||||
vendored and retains its own notices.
|
||||
@@ -0,0 +1,24 @@
|
||||
# ADR-0005: Versioned resource lifecycle and host present model
|
||||
|
||||
- Status: accepted
|
||||
- Date: 2026-07-17
|
||||
|
||||
## Decision
|
||||
|
||||
API version 2 includes opaque contexts, surfaces, and textures, plus sized
|
||||
descriptors for texture upload and present. Context destruction returns
|
||||
`RESOURCE_BUSY` while child handles exist. The version-1 `chimera_gfx_destroy`
|
||||
symbol remains as a void compatibility wrapper for childless contexts. The
|
||||
mock backend implements the complete ownership model in host memory and records
|
||||
deterministic present serials and content hashes.
|
||||
|
||||
The mock present is a state transition, not a graphical operation. It creates
|
||||
no window, accesses no display, and advertises both `NON_RENDERING` and
|
||||
`HOST_TEST_ONLY`. The PS5 backend is a separate compiled unit that refuses
|
||||
context creation with `SAFETY_POLICY`.
|
||||
|
||||
## Consequences
|
||||
|
||||
Adapter work can compile and test lifecycle assumptions before a hardware ABI
|
||||
exists. Future backends must preserve validation and cleanup semantics, but
|
||||
must not inherit mock capabilities without evidence.
|
||||
@@ -0,0 +1,29 @@
|
||||
# ADR-0006: Phase-1 VideoOut experiment stays behind SDL2
|
||||
|
||||
- Status: accepted
|
||||
- Date: 2026-07-17
|
||||
|
||||
## Context
|
||||
|
||||
The public SDK v0.41 exports VideoOut stubs but supplies no official VideoOut
|
||||
headers. The pinned PS5 SDL2 fork contains a working framebuffer route, but its
|
||||
backend declares opaque layouts with fields named `junk`. Those declarations
|
||||
are public source evidence of the upstream implementation, not a sufficiently
|
||||
proven ABI for duplication in `chimera-gfx`.
|
||||
|
||||
## Decision
|
||||
|
||||
The first presentation candidate calls only public SDL2 APIs. A reviewed
|
||||
Zlib-licensed build overlay removes SDL's unrelated keyboard/IME initialization
|
||||
from this candidate. Project code does not copy a VideoOut prototype or data
|
||||
layout. The target is disabled by default, requires the PS5 toolchain and an
|
||||
explicit SDL build path, and embeds the same `NONE` firmware gate as the probe.
|
||||
|
||||
The candidate does not link SDL2main because that wrapper hides the splash
|
||||
screen before application-level firmware validation.
|
||||
|
||||
## Consequences
|
||||
|
||||
The upstream SDL backend remains the owner of VideoOut, direct memory, tiling,
|
||||
flip, and cleanup. Its unbounded flip wait is a known hardware-test blocker;
|
||||
successful offline compilation is not runtime approval or ABI proof.
|
||||
@@ -0,0 +1,15 @@
|
||||
# ADR-0007: Artifact provenance is machine-readable and fail-closed
|
||||
|
||||
- Status: accepted
|
||||
- Date: 2026-07-17
|
||||
|
||||
## Decision
|
||||
|
||||
Every review or hardware candidate uses artifact-manifest schema version 1.
|
||||
The manifest binds filename, size, SHA-256, target, clean source commit,
|
||||
toolchain pins, optional SDL commit, firmware gate, and explicit non-execution
|
||||
state. Generation and verification are separate tested tools.
|
||||
|
||||
An artifact with firmware identifier `NONE` is never allowlisted. Any rebuild,
|
||||
including a firmware-specific rebuild, creates a new digest and therefore
|
||||
requires a new artifact-specific approval.
|
||||
@@ -0,0 +1,39 @@
|
||||
# ADR-0008: Firmware 9.60 is build-allowlisted; SDK-CRT execution is blocked
|
||||
|
||||
- Status: accepted
|
||||
- Date: 2026-07-17
|
||||
|
||||
## Context
|
||||
|
||||
Jens reported exact PS5 firmware `9.60` and authorized an offline-only,
|
||||
non-rendering capability-probe build and audit. Transfer, connection, execution,
|
||||
VideoOut, framebuffer/GPU/GNM mutation, draw, dispatch, submit, flip, MMIO,
|
||||
register writes, and kernel/firmware changes remain prohibited.
|
||||
|
||||
The pinned public SDK v0.41 source was audited beyond project `main`. Its
|
||||
payload startup calls `__patch_init` before `main`. That function changes the
|
||||
current process's kernel credential fields and syscall-address bounds using the
|
||||
SDK kernel read/write path. The SDK rtld also ensures `libSceSysmodule.sprx` is
|
||||
available during startup. A later project `dlopen` can load/start
|
||||
`libSceGnmDriver.sprx`; `dlclose` can stop/unload it.
|
||||
|
||||
## Decision
|
||||
|
||||
The discovery manifest and probe configure gate accept exactly `9.60`; the
|
||||
default remains `NONE`. This allowlist entry authorizes only a reproducible
|
||||
offline build. Phase-1 VideoOut rejects every non-`NONE` firmware gate.
|
||||
|
||||
The resulting 9.60 ELF is named `offline-audit-only`, records zero transfer and
|
||||
execution, and is not execution-eligible. No literal execution approval is
|
||||
offered while the linked SDK CRT performs kernel writes before the project gate.
|
||||
|
||||
## Consequences
|
||||
|
||||
- Project code still invokes no resolved GNM pointer and contains no rendering,
|
||||
submit, draw, dispatch, flip, or GPU-memory operation.
|
||||
- The artifact is useful for deterministic compilation, import/disassembly
|
||||
review, hashing, and future startup research only.
|
||||
- A new ADR and a new hash-bound build are required after a public,
|
||||
kernelwrite-free startup/loader route is proven.
|
||||
- Transfer or execution of this artifact would violate the current safety
|
||||
policy even if Jens later supplied a generic execution approval.
|
||||
@@ -0,0 +1,43 @@
|
||||
# ADR-0009: Block unproven minimal startup and permanently deny legacy ELF
|
||||
|
||||
Status: accepted
|
||||
Date: 2026-07-17
|
||||
|
||||
## Context
|
||||
|
||||
SDK v0.41's stock `crt1.o` performs prohibited kernel credential and
|
||||
syscall-bound writes before project `main`. Phase 0.5 tested whether omitting
|
||||
the CRT could support a deterministic freestanding entry. Compiler and linker
|
||||
evidence proves omission is mechanically possible, but no exact pinned loader
|
||||
caller is locally available to prove stack, argument ownership, safe return,
|
||||
post-return cleanup, crash handling, or pre-entry process changes.
|
||||
|
||||
The already-built firmware-9.60 capability probe has SHA-256
|
||||
`4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63`
|
||||
and must remain permanently blocked.
|
||||
|
||||
## Decision
|
||||
|
||||
Do not create a minimal-startup source or PS5 ELF while the caller contract is
|
||||
unproven. Keep `CHIMERA_GFX_BUILD_PS5_MINIMAL_STARTUP` as an unconditional
|
||||
configure-time failure with the evidence blocker stated in its message.
|
||||
|
||||
Require every artifact manifest to state `execution_eligible` explicitly. New
|
||||
manifests default to false. Maintain a permanent SHA-256 denylist and a
|
||||
fail-closed policy tool that refuses false eligibility, malformed records,
|
||||
changed bytes, or a denylist match. Passing this static layer does not grant
|
||||
execution authority.
|
||||
|
||||
## Consequences
|
||||
|
||||
- no Phase-0.5 PS5 ELF, linker map, artifact disassembly, or artifact hash
|
||||
exists;
|
||||
- stock CRT evidence remains available for review without making a safe-runtime
|
||||
claim;
|
||||
- the legacy firmware-9.60 ELF cannot become eligible through a later manifest
|
||||
edit or approval record;
|
||||
- a Payload Manager can consume the JSON policy tool, but the manager's own
|
||||
implementation remains outside this repository and cannot be claimed
|
||||
reviewed here;
|
||||
- work may continue through mock/software backends or a separately scoped
|
||||
Linux-on-PS5 backend.
|
||||
@@ -0,0 +1,45 @@
|
||||
# ADR-0010: Controlled runtime effects and Phase-0.6 gate
|
||||
|
||||
Status: accepted on 2026-07-17.
|
||||
|
||||
## Context
|
||||
|
||||
ADR-0009 asked whether a fully kernelwrite-free startup could be proven while
|
||||
the exact loader was absent. The current task corrects the safety model:
|
||||
documented, bounded, volatile runtime changes may be acceptable. Persistent
|
||||
writes and unbounded or unknown effects remain hard blockers.
|
||||
|
||||
The installed Payload Manager and elfldr were subsequently identified exactly.
|
||||
Their public source exposes both acceptable volatile effects and unresolved
|
||||
unbounded paths.
|
||||
|
||||
## Decision
|
||||
|
||||
Classify each lifecycle effect as exactly one of:
|
||||
|
||||
- `EXPECTED_VOLATILE_RUNTIME_EFFECT`;
|
||||
- `RESTORED_BY_LOADER`;
|
||||
- `PAYLOAD_PROCESS_LOCAL`;
|
||||
- `PERSISTENT_WRITE`;
|
||||
- `UNBOUNDED_OR_UNKNOWN`.
|
||||
|
||||
Only the final two are categorical blockers. `__patch_init` is classified as
|
||||
payload-process-local and is no longer an automatic blocker.
|
||||
|
||||
Every potentially eligible artifact must also have a profile named exactly
|
||||
`controlled-ps5-runtime`, with exact firmware/loader/SDK/artifact identity,
|
||||
an explicit list of expected volatile effects, zero persistent and filesystem
|
||||
writes, no payload network, a maximum 2000 ms runtime, no retry, no hard
|
||||
effects, and no hard blockers. Both the profile and static gate explicitly set
|
||||
`execution_authorized=false`; static eligibility never grants execution
|
||||
authority.
|
||||
|
||||
## Consequences
|
||||
|
||||
Phase 0.6 remains blocked because the exact chain has unbounded ptrace loops,
|
||||
no payload watchdog, unresolved termination/cleanup, incomplete credential
|
||||
restoration, no launch-time hash enforcement, and a persistent manager upload
|
||||
path. No lifecycle source or ELF is built.
|
||||
|
||||
ADR-0009 and its Phase-0.5 evidence remain historical records. The permanent
|
||||
artifact denylist is unchanged.
|
||||
@@ -0,0 +1,49 @@
|
||||
# ADR-0011: Phase-0.7 hardened controlled runtime
|
||||
|
||||
- Status: accepted for offline deployment preparation
|
||||
- Date: 2026-07-17
|
||||
- Decision: `READY_FOR_HARDENED_RUNTIME_DEPLOYMENT`
|
||||
|
||||
## Context
|
||||
|
||||
Phase 0.6 identified exact upstream loader and Payload Manager versions but
|
||||
found unbounded ptrace completion, incomplete credential restoration, missing
|
||||
reaping/watchdog behavior, and a path-based unhashed launch route. Those
|
||||
findings were implementation inputs, not permanent platform blockers.
|
||||
|
||||
Jens explicitly confirmed exact firmware 9.60. Independent device attestation
|
||||
is therefore not a Phase-0.7 blocker. The controlled upload below
|
||||
`/data/pldmgr/payloads/chimera-controlled` is an allowed, removable
|
||||
application write and is not a firmware write.
|
||||
|
||||
## Decision
|
||||
|
||||
Use private GPL-3.0 hardening forks based on:
|
||||
|
||||
- elfldr `699e8bcff03e91e8d6ca6eba281af25c5a58d8c2`;
|
||||
- Payload Manager `cfbc70f30f419b09bf2b52283f7409e2d3117ee1`;
|
||||
- PS5 Payload SDK `d2e2e585740362976a39fdd5ccf390f199a7bc37`.
|
||||
|
||||
The controlled route is a versioned loopback-only protocol with exact
|
||||
firmware, artifact ID, size, SHA-256, timeout, and no-retry metadata. elfldr
|
||||
rehashes received bytes, enforces the permanent denylist, applies bounded
|
||||
ptrace steps and cleanup, and reaps the child through a two-second watchdog.
|
||||
The controlled manager is compiled for one exact lifecycle artifact and opens,
|
||||
hashes, rewinds, and streams one no-follow file descriptor.
|
||||
|
||||
The lifecycle probe uses normal SDK v0.41 startup, performs one
|
||||
`sceKernelSendNotificationRequest`, and calls `_exit`; it does not return
|
||||
through `payload_terminate`.
|
||||
|
||||
## Consequences
|
||||
|
||||
The three ELFs are eligible for a later, separately authorized hardened
|
||||
runtime installation. This decision does not authorize installation,
|
||||
transfer, or execution. The previously blocked SHA-256
|
||||
`4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63`
|
||||
remains permanently denied.
|
||||
|
||||
Normal SDK startup still reaches documented process-local patch and runtime
|
||||
initialization. The existing elfldr bootstrap still enables volatile QA flags.
|
||||
Both facts are explicit expected runtime effects; neither is silently claimed
|
||||
kernelwrite-free.
|
||||
@@ -0,0 +1,38 @@
|
||||
# ADR-0012: Phase-1.0J first-frame identity
|
||||
|
||||
- Status: accepted for offline diagnostic construction
|
||||
- Date: 2026-07-22
|
||||
- Decision: `FIRST_FRAME_INDEX_ZERO_SOURCE_CONSISTENCY_ONLY`
|
||||
|
||||
## Context
|
||||
|
||||
The consumed Phase-1.0H run submitted the diagnostic buffer with
|
||||
`sceVideoOutSubmitFlip(handle, 0, 1, 0)` and received `-1`. The diagnostic
|
||||
helper used buffer zero, while the patched normal SDL update path started its
|
||||
frame counter at one. The public PS5 SDL source at commit
|
||||
`0baf4ac49382b537ba449901b5b6d0d189bb1fbb` starts that normal counter at
|
||||
zero. Phase 1.0I classified the mismatch as a strong source candidate, not a
|
||||
proven firmware root cause.
|
||||
|
||||
## Decision
|
||||
|
||||
The Phase-1.0J SDL overlay defines one compile-time source of truth,
|
||||
`CHIMERA_PS5_FIRST_FRAME_INDEX`, with value zero. The early diagnostic copy,
|
||||
the early diagnostic submit and the normal update counter all derive their
|
||||
initial index from that macro.
|
||||
|
||||
Zero is selected because it preserves the already-audited diagnostic tuple
|
||||
and agrees with the public SDL source. It is not selected on the basis of an
|
||||
unpublished ABI or an inferred firmware requirement.
|
||||
|
||||
## Consequences
|
||||
|
||||
The internal zero-versus-one inconsistency is removed and can be checked in
|
||||
source, linker-map and disassembly evidence. This decision does not prove that
|
||||
buffer zero is accepted on firmware 9.60, that the fourth flip argument has
|
||||
the required semantics, or that the old mismatch caused the Phase-1.0H
|
||||
failure.
|
||||
|
||||
Phase 1.0J remains an offline artifact phase. A separately reviewed exact
|
||||
artifact and new explicit permission would be required before any connection,
|
||||
transfer, result reception or execution.
|
||||
@@ -0,0 +1,131 @@
|
||||
# Phase 0.8 future bounded-observation permission template
|
||||
|
||||
Status: **TEMPLATE ONLY — NOT AUTHORIZED**.
|
||||
|
||||
This file is not permission. Empty, `null`, zero, missing, ambiguous, expired,
|
||||
or inconsistent input means `STOP`. Copying, editing, signing, or committing
|
||||
the template does not itself authorize a connection, transfer, or execution.
|
||||
Authorization can exist only through a new exact statement from Jens in the
|
||||
active task after the proposed method and its complete effect contract have
|
||||
been reviewed.
|
||||
|
||||
The template may describe only a separately named bounded-observation phase.
|
||||
It cannot authorize installation, rollback creation, lifecycle execution,
|
||||
autoload, retry, graphics work, or RetroArch work.
|
||||
|
||||
## Machine-readable default state
|
||||
|
||||
The validator requires every authority value below to remain `false` in the
|
||||
repository template and every request-specific field to remain unfilled.
|
||||
|
||||
<!-- BEGIN PHASE08_BOUNDED_OBSERVATION_TEMPLATE -->
|
||||
```json
|
||||
{
|
||||
"template_only": true,
|
||||
"authorized": false,
|
||||
"execution_authorized": false,
|
||||
"transfer_authorized": false,
|
||||
"installation_authorized": false,
|
||||
"lifecycle_authorized": false,
|
||||
"automatic_retry": false,
|
||||
"required_fields": {
|
||||
"exact_user_statement": null,
|
||||
"authorization_date": null,
|
||||
"expiration_time": null,
|
||||
"device_identity": null,
|
||||
"exact_purpose": null,
|
||||
"exact_observations": null,
|
||||
"method_or_collector_id": null,
|
||||
"source_commit": null,
|
||||
"collector_file_size": null,
|
||||
"collector_sha256": null,
|
||||
"firmware_gate": null,
|
||||
"maximum_runtime_ms": null,
|
||||
"maximum_execution_count": null,
|
||||
"maximum_transfer_count": null,
|
||||
"network_behavior": null,
|
||||
"output_channel": null,
|
||||
"allowed_volatile_effects": null,
|
||||
"prohibited_persistent_effects": null,
|
||||
"stop_criteria": null,
|
||||
"cleanup_requirements": null,
|
||||
"reporting_requirements": null,
|
||||
"explicit_installation_exclusion": null,
|
||||
"explicit_lifecycle_probe_exclusion": null,
|
||||
"explicit_autoload_and_retry_exclusion": null,
|
||||
"explicit_graphics_and_retroarch_exclusion": null,
|
||||
"revocation_method": null,
|
||||
"manual_confirmation_template_does_not_authorize": null
|
||||
},
|
||||
"fixed_exclusions": {
|
||||
"installation": true,
|
||||
"lifecycle_probe": true,
|
||||
"autoload": true,
|
||||
"automatic_retry": true,
|
||||
"gnm": true,
|
||||
"videoout": true,
|
||||
"sdl": true,
|
||||
"retroarch": true
|
||||
}
|
||||
}
|
||||
```
|
||||
<!-- END PHASE08_BOUNDED_OBSERVATION_TEMPLATE -->
|
||||
|
||||
## Required human review fields
|
||||
|
||||
Every field below must be supplied in a later review package. Do not fill it
|
||||
in this repository template.
|
||||
|
||||
- Exact user statement:
|
||||
- Authorization date and timezone:
|
||||
- Expiration time and timezone:
|
||||
- Device identity:
|
||||
- Exact purpose:
|
||||
- Exact observations:
|
||||
- Method or collector ID:
|
||||
- Source repository and commit:
|
||||
- Collector filename:
|
||||
- Collector byte size:
|
||||
- Collector SHA-256:
|
||||
- Exact firmware gate:
|
||||
- Maximum runtime:
|
||||
- Maximum execution count:
|
||||
- Maximum transfer count:
|
||||
- Network behavior, addresses, ports, direction, and connection count:
|
||||
- Output channel and maximum output:
|
||||
- Exhaustive allowed volatile effects:
|
||||
- Exhaustive forbidden persistent and functional effects:
|
||||
- STOP criteria:
|
||||
- Cleanup requirements:
|
||||
- Reporting and raw-evidence requirements:
|
||||
- Explicit installation exclusion:
|
||||
- Explicit lifecycle-probe exclusion:
|
||||
- Explicit autoload and retry exclusion:
|
||||
- Explicit GNM, VideoOut, SDL, and RetroArch exclusion:
|
||||
- Revocation method and immediate-stop behavior:
|
||||
- Manual confirmation that this template is not authorization:
|
||||
|
||||
No artifact ID, filename, size, SHA-256, path, ABI, syscall, loader contract,
|
||||
transport, or execution mechanism is implied by these empty fields.
|
||||
|
||||
## Mandatory future effect boundary
|
||||
|
||||
A future request must enumerate every allowed category-C volatile effect
|
||||
before authorization. All category-A persistent mutations and category-B
|
||||
functional mutations remain prohibited unless a different, explicitly
|
||||
mutating phase is designed and separately authorized.
|
||||
|
||||
Unknown behavior, an unspecified effect, an identity mismatch, a partial
|
||||
dataset, a timeout, an expired authorization, a count overrun, an unexpected
|
||||
log, or cleanup uncertainty means immediate `STOP` with no automatic retry.
|
||||
|
||||
The approved observation count, transfer count, and execution count—if any—
|
||||
must be literal bounded integers. No value carries into rollback preparation,
|
||||
installation, lifecycle testing, graphics, or RetroArch.
|
||||
|
||||
## Revocation
|
||||
|
||||
Jens may revoke a later authorization at any time before or during the
|
||||
authorized window. Revocation, ambiguity, interruption, or conflicting
|
||||
instructions causes fail-closed stop. Revocation never triggers cleanup that
|
||||
was not already explicitly reviewed and authorized.
|
||||
@@ -0,0 +1,69 @@
|
||||
# Phase 0.9 future backup-creation approval template
|
||||
|
||||
Status: **TEMPLATE ONLY — NOT AUTHORIZED**.
|
||||
|
||||
This template is for one possible future backup-creation change window for one
|
||||
component. It cannot authorize observation collection, staging, switch,
|
||||
installation, execution, lifecycle, autoload, retry or a second component.
|
||||
|
||||
<!-- BEGIN PHASE09_BACKUP_CREATION_TEMPLATE -->
|
||||
```json
|
||||
{
|
||||
"template_only": true,
|
||||
"template_action": "backup_creation",
|
||||
"authorized": false,
|
||||
"installation_authorized": false,
|
||||
"execution_authorized": false,
|
||||
"transfer_authorized": false,
|
||||
"lifecycle_authorized": false,
|
||||
"automatic_retry": false,
|
||||
"required_fields": {
|
||||
"exact_user_statement": null,
|
||||
"active_task_id": null,
|
||||
"authorization_issued_at": null,
|
||||
"authorization_expires_at": null,
|
||||
"device_identity": null,
|
||||
"firmware_exact": null,
|
||||
"component": null,
|
||||
"exact_action": null,
|
||||
"maximum_action_count": null,
|
||||
"maximum_runtime_ms": null,
|
||||
"live_path": null,
|
||||
"live_mount_id": null,
|
||||
"live_object_id": null,
|
||||
"live_type": null,
|
||||
"live_size": null,
|
||||
"live_sha256": null,
|
||||
"backup_path": null,
|
||||
"backup_mount_id": null,
|
||||
"minimum_free_bytes_and_metadata_reserve": null,
|
||||
"reopen_and_rehash_contract": null,
|
||||
"target_mapping": null,
|
||||
"independent_recovery_executor": null,
|
||||
"second_independent_recovery_path": null,
|
||||
"allowed_persistent_effects": null,
|
||||
"forbidden_effects": null,
|
||||
"cleanup_contract": null,
|
||||
"stop_conditions": null,
|
||||
"revocation_method": null,
|
||||
"reviewer": null
|
||||
},
|
||||
"fixed_exclusions": {
|
||||
"staging": true,
|
||||
"switch": true,
|
||||
"installation": true,
|
||||
"execution": true,
|
||||
"second_component": true,
|
||||
"lifecycle_probe": true,
|
||||
"autoload": true,
|
||||
"automatic_retry": true,
|
||||
"graphics": true,
|
||||
"retroarch": true
|
||||
}
|
||||
}
|
||||
```
|
||||
<!-- END PHASE09_BACKUP_CREATION_TEMPLATE -->
|
||||
|
||||
The exact current live identity and separate backup destination must be filled
|
||||
from later admissible evidence. A stock reference hash does not fill this
|
||||
template. The Payload Manager backup hard gate remains open.
|
||||
@@ -0,0 +1,64 @@
|
||||
# Phase 0.9 future observation approval template
|
||||
|
||||
Status: **TEMPLATE ONLY — NOT AUTHORIZED**.
|
||||
|
||||
This template never grants permission. It is bound only to a possible future
|
||||
observation action and cannot authorize backup creation, staging, switch,
|
||||
installation, lifecycle, execution, autoload, retry, graphics or RetroArch.
|
||||
Every request-specific value is deliberately empty.
|
||||
|
||||
<!-- BEGIN PHASE09_OBSERVATION_TEMPLATE -->
|
||||
```json
|
||||
{
|
||||
"template_only": true,
|
||||
"template_action": "observation",
|
||||
"authorized": false,
|
||||
"installation_authorized": false,
|
||||
"execution_authorized": false,
|
||||
"transfer_authorized": false,
|
||||
"lifecycle_authorized": false,
|
||||
"automatic_retry": false,
|
||||
"required_fields": {
|
||||
"exact_user_statement": null,
|
||||
"active_task_id": null,
|
||||
"authorization_issued_at": null,
|
||||
"authorization_expires_at": null,
|
||||
"device_identity": null,
|
||||
"firmware_exact": null,
|
||||
"firmware_source_one": null,
|
||||
"firmware_source_two": null,
|
||||
"component": null,
|
||||
"exact_action": null,
|
||||
"maximum_action_count": null,
|
||||
"maximum_runtime_ms": null,
|
||||
"collector_or_artifact_id": null,
|
||||
"collector_or_artifact_size": null,
|
||||
"collector_or_artifact_sha256": null,
|
||||
"source_commit": null,
|
||||
"allowed_observations": null,
|
||||
"allowed_volatile_effects": null,
|
||||
"forbidden_effects": null,
|
||||
"output_contract": null,
|
||||
"cleanup_contract": null,
|
||||
"stop_conditions": null,
|
||||
"revocation_method": null,
|
||||
"reviewer": null
|
||||
},
|
||||
"fixed_exclusions": {
|
||||
"backup_creation": true,
|
||||
"staging": true,
|
||||
"switch": true,
|
||||
"installation": true,
|
||||
"execution": true,
|
||||
"lifecycle_probe": true,
|
||||
"autoload": true,
|
||||
"automatic_retry": true,
|
||||
"graphics": true,
|
||||
"retroarch": true
|
||||
}
|
||||
}
|
||||
```
|
||||
<!-- END PHASE09_OBSERVATION_TEMPLATE -->
|
||||
|
||||
Empty, ambiguous, expired, mismatched or unreviewed data means `STOP`. A copy,
|
||||
signature, edit or commit of this file is not approval.
|
||||
@@ -0,0 +1,64 @@
|
||||
# Phase 0.9 future one-shot execution approval template
|
||||
|
||||
Status: **TEMPLATE ONLY — NOT AUTHORIZED**.
|
||||
|
||||
This template can be considered only after a separately approved switch,
|
||||
durable post-switch identity verification and human review. It is bound to one
|
||||
component and one manual execution. It does not authorize transfer,
|
||||
installation, lifecycle-probe execution, autoload, retry or another component.
|
||||
|
||||
<!-- BEGIN PHASE09_ONE_SHOT_EXECUTION_TEMPLATE -->
|
||||
```json
|
||||
{
|
||||
"template_only": true,
|
||||
"template_action": "one_shot_execution",
|
||||
"authorized": false,
|
||||
"installation_authorized": false,
|
||||
"execution_authorized": false,
|
||||
"transfer_authorized": false,
|
||||
"lifecycle_authorized": false,
|
||||
"automatic_retry": false,
|
||||
"required_fields": {
|
||||
"exact_user_statement": null,
|
||||
"active_task_id": null,
|
||||
"authorization_issued_at": null,
|
||||
"authorization_expires_at": null,
|
||||
"device_identity": null,
|
||||
"firmware_exact": null,
|
||||
"component": null,
|
||||
"exact_action": null,
|
||||
"maximum_execution_count": null,
|
||||
"maximum_runtime_ms": null,
|
||||
"live_artifact_id": null,
|
||||
"live_source_commit": null,
|
||||
"live_size": null,
|
||||
"live_sha256": null,
|
||||
"live_mount_id": null,
|
||||
"live_object_id": null,
|
||||
"post_switch_verification_evidence": null,
|
||||
"verified_backup_identity": null,
|
||||
"independent_recovery_executor": null,
|
||||
"success_criteria": null,
|
||||
"stop_conditions": null,
|
||||
"cleanup_contract": null,
|
||||
"reporting_contract": null,
|
||||
"revocation_method": null,
|
||||
"reviewer": null
|
||||
},
|
||||
"fixed_exclusions": {
|
||||
"transfer": true,
|
||||
"installation": true,
|
||||
"second_execution": true,
|
||||
"second_component": true,
|
||||
"lifecycle_probe": true,
|
||||
"autoload": true,
|
||||
"automatic_retry": true,
|
||||
"graphics": true,
|
||||
"retroarch": true
|
||||
}
|
||||
}
|
||||
```
|
||||
<!-- END PHASE09_ONE_SHOT_EXECUTION_TEMPLATE -->
|
||||
|
||||
The template itself is not a request and is not permission. Phase 0.9A does
|
||||
not ask for execution approval.
|
||||
@@ -0,0 +1,63 @@
|
||||
# Phase 0.9 future staging approval template
|
||||
|
||||
Status: **TEMPLATE ONLY — NOT AUTHORIZED**.
|
||||
|
||||
This template could bind one future inactive candidate-staging action. It
|
||||
cannot authorize a live switch, installation, execution, lifecycle, autoload,
|
||||
retry or a second component.
|
||||
|
||||
<!-- BEGIN PHASE09_STAGING_TEMPLATE -->
|
||||
```json
|
||||
{
|
||||
"template_only": true,
|
||||
"template_action": "staging",
|
||||
"authorized": false,
|
||||
"installation_authorized": false,
|
||||
"execution_authorized": false,
|
||||
"transfer_authorized": false,
|
||||
"lifecycle_authorized": false,
|
||||
"automatic_retry": false,
|
||||
"required_fields": {
|
||||
"exact_user_statement": null,
|
||||
"active_task_id": null,
|
||||
"authorization_issued_at": null,
|
||||
"authorization_expires_at": null,
|
||||
"device_identity": null,
|
||||
"firmware_exact": null,
|
||||
"component": null,
|
||||
"exact_action": null,
|
||||
"maximum_action_count": null,
|
||||
"maximum_runtime_ms": null,
|
||||
"candidate_artifact_id": null,
|
||||
"candidate_source_commit": null,
|
||||
"candidate_size": null,
|
||||
"candidate_sha256": null,
|
||||
"staging_path": null,
|
||||
"staging_mount_id": null,
|
||||
"staging_inactive_proof": null,
|
||||
"verified_backup_identity": null,
|
||||
"verified_backup_sha256": null,
|
||||
"candidate_reopen_and_rehash_contract": null,
|
||||
"allowed_persistent_effects": null,
|
||||
"forbidden_effects": null,
|
||||
"cleanup_contract": null,
|
||||
"stop_conditions": null,
|
||||
"revocation_method": null,
|
||||
"reviewer": null
|
||||
},
|
||||
"fixed_exclusions": {
|
||||
"live_switch": true,
|
||||
"installation": true,
|
||||
"execution": true,
|
||||
"second_component": true,
|
||||
"lifecycle_probe": true,
|
||||
"autoload": true,
|
||||
"automatic_retry": true,
|
||||
"graphics": true,
|
||||
"retroarch": true
|
||||
}
|
||||
}
|
||||
```
|
||||
<!-- END PHASE09_STAGING_TEMPLATE -->
|
||||
|
||||
A candidate hash or offline build record alone never authorizes staging.
|
||||
@@ -0,0 +1,67 @@
|
||||
# Phase 0.9 future live-switch approval template
|
||||
|
||||
Status: **TEMPLATE ONLY — NOT AUTHORIZED**.
|
||||
|
||||
This template is limited to one future switch of one separately staged
|
||||
component. It cannot authorize staging, execution, lifecycle, rollback,
|
||||
autoload, retry or a second component.
|
||||
|
||||
<!-- BEGIN PHASE09_SWITCH_TEMPLATE -->
|
||||
```json
|
||||
{
|
||||
"template_only": true,
|
||||
"template_action": "live_switch",
|
||||
"authorized": false,
|
||||
"installation_authorized": false,
|
||||
"execution_authorized": false,
|
||||
"transfer_authorized": false,
|
||||
"lifecycle_authorized": false,
|
||||
"automatic_retry": false,
|
||||
"required_fields": {
|
||||
"exact_user_statement": null,
|
||||
"active_task_id": null,
|
||||
"authorization_issued_at": null,
|
||||
"authorization_expires_at": null,
|
||||
"device_identity": null,
|
||||
"firmware_exact": null,
|
||||
"component": null,
|
||||
"exact_action": null,
|
||||
"maximum_action_count": null,
|
||||
"maximum_runtime_ms": null,
|
||||
"live_path_mount_object_size_sha256": null,
|
||||
"backup_path_mount_object_size_sha256": null,
|
||||
"candidate_path_mount_object_size_sha256": null,
|
||||
"target_quiescence_evidence": null,
|
||||
"autoload_and_retry_disabled_evidence": null,
|
||||
"atomic_switch_primitive_identity": null,
|
||||
"atomicity_evidence": null,
|
||||
"file_durability_evidence": null,
|
||||
"directory_durability_evidence": null,
|
||||
"power_loss_evidence": null,
|
||||
"post_switch_verification_contract": null,
|
||||
"independent_recovery_executor": null,
|
||||
"rollback_target_mapping": null,
|
||||
"allowed_persistent_effects": null,
|
||||
"forbidden_effects": null,
|
||||
"stop_conditions": null,
|
||||
"revocation_method": null,
|
||||
"reviewer": null
|
||||
},
|
||||
"fixed_exclusions": {
|
||||
"staging": true,
|
||||
"execution": true,
|
||||
"second_component": true,
|
||||
"lifecycle_probe": true,
|
||||
"autoload": true,
|
||||
"automatic_retry": true,
|
||||
"in_place_overwrite": true,
|
||||
"two_step_rename_gap": true,
|
||||
"graphics": true,
|
||||
"retroarch": true
|
||||
}
|
||||
}
|
||||
```
|
||||
<!-- END PHASE09_SWITCH_TEMPLATE -->
|
||||
|
||||
While atomicity or durability is `UNPROVEN`, this template must remain empty
|
||||
and no switch request may be made.
|
||||
@@ -0,0 +1,76 @@
|
||||
# Phase 0.9B future observer execution template
|
||||
|
||||
Status: **TEMPLATE ONLY — NOT AUTHORIZED — BLOCKED**.
|
||||
|
||||
This file cannot authorize an action. There is no observer artifact to bind,
|
||||
and the startup/exit and output-channel gates are blocked. Every
|
||||
request-specific value is deliberately empty. Editing, signing, copying,
|
||||
committing or pushing this template does not grant permission.
|
||||
|
||||
<!-- BEGIN PHASE09B_OBSERVER_EXECUTION_TEMPLATE -->
|
||||
```json
|
||||
{
|
||||
"template_only": true,
|
||||
"phase": "0.9B",
|
||||
"action": "one_shot_observer_execution",
|
||||
"status": "BLOCKED",
|
||||
"authorized": false,
|
||||
"transfer_authorized": false,
|
||||
"execution_authorized": false,
|
||||
"installation_authorized": false,
|
||||
"lifecycle_authorized": false,
|
||||
"autoload_authorized": false,
|
||||
"backup_creation_authorized": false,
|
||||
"automatic_retry": false,
|
||||
"observer_only": true,
|
||||
"required_fields": {
|
||||
"exact_user_statement": null,
|
||||
"active_task_id": null,
|
||||
"authorization_issued_at": null,
|
||||
"authorization_expires_at": null,
|
||||
"device_identity": null,
|
||||
"firmware_exact": null,
|
||||
"firmware_source_one": null,
|
||||
"firmware_source_two": null,
|
||||
"observer_build_id": null,
|
||||
"observer_source_commit": null,
|
||||
"observer_size": null,
|
||||
"observer_sha256": null,
|
||||
"toolchain_identity": null,
|
||||
"runtime_path": null,
|
||||
"allowed_observations": null,
|
||||
"allowed_read_paths": null,
|
||||
"output_channel": null,
|
||||
"maximum_runtime_ms": null,
|
||||
"maximum_execution_count": null,
|
||||
"stop_criteria": null,
|
||||
"reviewer": null
|
||||
},
|
||||
"fixed_exclusions": {
|
||||
"device_address": true,
|
||||
"installation": true,
|
||||
"lifecycle": true,
|
||||
"autoload": true,
|
||||
"automatic_retry": true,
|
||||
"backup_creation": true,
|
||||
"file_mutation": true,
|
||||
"process_or_service_mutation": true,
|
||||
"listener_creation": true,
|
||||
"kernelwrite": true,
|
||||
"graphics": true,
|
||||
"sdl": true,
|
||||
"retroarch": true
|
||||
},
|
||||
"blocking_facts": [
|
||||
"OBSERVER_STARTUP_OR_EXIT_ABI_UNPROVEN",
|
||||
"NO_PROVEN_NON_PERSISTENT_OUTPUT_CHANNEL",
|
||||
"OBSERVER_ARTIFACT_ABSENT"
|
||||
]
|
||||
}
|
||||
```
|
||||
<!-- END PHASE09B_OBSERVER_EXECUTION_TEMPLATE -->
|
||||
|
||||
A future request would need a new active-task authorization bound to one exact
|
||||
artifact, device, firmware, output channel, observation plan, runtime,
|
||||
one execution and expiration. That later request still could not authorize
|
||||
installation, lifecycle, backup creation, autoload or retry.
|
||||
@@ -0,0 +1,57 @@
|
||||
# Phase 0.9E-R Y2JB deployed-use operator attestation
|
||||
|
||||
Status: `UNATTESTED_TEMPLATE`
|
||||
|
||||
This template records a future operator statement. It is not device evidence,
|
||||
runtime verification, permission, or approval. Do not add secrets, PS5
|
||||
addresses, account identifiers, signed download URLs, or credentials.
|
||||
|
||||
```yaml
|
||||
schema_version: 1
|
||||
phase: PHASE_0_9E_R_Y2JB_DEPLOYED_USE_ATTESTATION
|
||||
attested: false
|
||||
attestation_date: null
|
||||
operator: null
|
||||
|
||||
outer_zip:
|
||||
file_name: null
|
||||
sha256: null
|
||||
size: null
|
||||
obtained_from: null
|
||||
installation_date_exact_or_estimated: null
|
||||
installation_date_is_estimate: null
|
||||
restore_or_install_method: null
|
||||
firmware_at_restore_or_install: null
|
||||
|
||||
subsequent_changes:
|
||||
another_y2jb_backup_applied: null
|
||||
download0_dat_replaced_separately: null
|
||||
youtube_or_appdata_changed: null
|
||||
external_autoloader_used: null
|
||||
external_autoloader_identity: null
|
||||
|
||||
host_sender:
|
||||
tool_name: null
|
||||
path_or_source: null
|
||||
version_or_commit: null
|
||||
sha256: null
|
||||
default_port: null
|
||||
ports_actually_selected: []
|
||||
|
||||
classification_when_completed: OPERATOR_ATTESTED_DEPLOYED_USE
|
||||
runtime_verified: false
|
||||
|
||||
device_action_authorized: false
|
||||
target_build_authorized: false
|
||||
execution_authorized: false
|
||||
installation_authorized: false
|
||||
transfer_authorized: false
|
||||
lifecycle_authorized: false
|
||||
autoload_authorized: false
|
||||
device_write_authorized: false
|
||||
automatic_retry: false
|
||||
```
|
||||
|
||||
An incomplete or completed statement never changes `runtime_verified` and
|
||||
never authorizes a device action. Any later use requires a separate review and
|
||||
artifact-specific authorization.
|
||||
@@ -0,0 +1,25 @@
|
||||
# Phase 1.0AA offline fake-adapter approval record
|
||||
|
||||
This tracked record is deliberately inactive and authorizes no live action.
|
||||
|
||||
- `active=false`
|
||||
- `attested=false`
|
||||
- `run_id=null`
|
||||
- `target_address=null`
|
||||
- `target_port=null`
|
||||
- `window=null`
|
||||
- `ps5_connection_authorized=false`
|
||||
- `device_request_authorized=false`
|
||||
- `result_receive_authorized=false`
|
||||
- `target_build_authorized=false`
|
||||
- `device_transfer_authorized=false`
|
||||
- `device_execution_authorized=false`
|
||||
- `installation_authorized=false`
|
||||
- `autoload_authorized=false`
|
||||
- `device_write_authorized=false`
|
||||
- `automatic_retry=false`
|
||||
- `reconnect_authorized=false`
|
||||
- `resume_authorized=false`
|
||||
|
||||
The fake integration cannot consume a live approval and exposes no live
|
||||
adapter. A later phase and new exact permission would be required first.
|
||||
@@ -0,0 +1,23 @@
|
||||
# Phase 1.0AB live-adapter feasibility approval record
|
||||
|
||||
This tracked record is inactive and grants no network or device authority.
|
||||
|
||||
- `active=false`
|
||||
- `attested=false`
|
||||
- `target_address=null`
|
||||
- `target_port=null`
|
||||
- `run_id=null`
|
||||
- `ps5_connection_authorized=false`
|
||||
- `device_request_authorized=false`
|
||||
- `result_receive_authorized=false`
|
||||
- `target_build_authorized=false`
|
||||
- `device_transfer_authorized=false`
|
||||
- `device_execution_authorized=false`
|
||||
- `installation_authorized=false`
|
||||
- `autoload_authorized=false`
|
||||
- `device_write_authorized=false`
|
||||
- `automatic_retry=false`
|
||||
- `reconnect_authorized=false`
|
||||
- `resume_authorized=false`
|
||||
|
||||
The trace model cannot connect and cannot consume an approval.
|
||||
@@ -0,0 +1,24 @@
|
||||
# Phase 1.0AC inactive record
|
||||
|
||||
This is not a device approval.
|
||||
|
||||
```text
|
||||
active=false
|
||||
target_address=null
|
||||
target_port=null
|
||||
run_id=null
|
||||
ps5_connection_authorized=false
|
||||
device_request_authorized=false
|
||||
result_receive_authorized=false
|
||||
device_transfer_authorized=false
|
||||
device_execution_authorized=false
|
||||
installation_authorized=false
|
||||
autoload_authorized=false
|
||||
device_write_authorized=false
|
||||
automatic_retry=false
|
||||
reconnect_authorized=false
|
||||
resume_authorized=false
|
||||
```
|
||||
|
||||
Phase 1.0AC contains only host-side synthetic tests. No value in this file can
|
||||
activate a transport or authorize a later action.
|
||||
@@ -0,0 +1,50 @@
|
||||
# Phase 1.0B device-smoke approval template
|
||||
|
||||
This template is intentionally empty and non-authorizing.
|
||||
|
||||
```yaml
|
||||
authorized: false
|
||||
transfer_authorized: false
|
||||
execution_authorized: false
|
||||
installation_authorized: false
|
||||
autoload_authorized: false
|
||||
automatic_retry: false
|
||||
|
||||
artifact:
|
||||
label: retroarch_ps5_software_smoke.elf
|
||||
sha256: null
|
||||
size: null
|
||||
chimera_retroarch_source_commit: null
|
||||
build_manifest_sha256: null
|
||||
|
||||
operator_observation:
|
||||
firmware_text: null
|
||||
firmware_expected: "9.60"
|
||||
observed_by: null
|
||||
observed_at: null
|
||||
|
||||
window:
|
||||
maximum_transfers: 1
|
||||
maximum_executions: 1
|
||||
maximum_runtime_ms: 60000
|
||||
live_replacement: false
|
||||
retry: false
|
||||
autoload: false
|
||||
installation: false
|
||||
|
||||
expected_visible_phases:
|
||||
- S07_RUNNING
|
||||
- S08_SHUTDOWN_REQUESTED
|
||||
expected_shutdown:
|
||||
- OPTIONS_HOLD_2000_MS
|
||||
- RUNTIME_LIMIT_60000_MS
|
||||
- FRAME_LIMIT_3600
|
||||
|
||||
accepted_remaining_risks: []
|
||||
operator_stop_criteria_reviewed: false
|
||||
```
|
||||
|
||||
An edited copy is not valid unless every identity is exact and a new active
|
||||
task explicitly grants that artifact-specific transfer and execution. This
|
||||
template is not an execution package and contains no address, sender or
|
||||
device command.
|
||||
@@ -0,0 +1,10 @@
|
||||
# Phase 1.0CZ launch-canary approval template
|
||||
|
||||
This tracked document is intentionally inactive and is not permission.
|
||||
|
||||
An active approval must be supplied separately in the active task by Jens and
|
||||
must name the exact SHA-256
|
||||
`8dadce9d9faaef21ea129a3d216c768eea9a3ca9bf8ecb8d852e376b58a9bf95`,
|
||||
firmware 9.60, the raw-elfldr baseline route, target, port, unique run ID,
|
||||
timeout, one transfer, one execution and one bounded result reception. It must
|
||||
also state no installation, autoload, device write, retry, reconnect or reboot.
|
||||
@@ -0,0 +1 @@
|
||||
{"active":false,"run_id":null,"target":null,"port":9021,"artifact_size":109896,"artifact_sha256":"147b5bede0f0b5b7d2be903bc72ff0d0541a2cdc28eae7d86b6bf95e1978ebdf","snapshot_path":null,"receipt_path":null,"not_before":null,"not_after":null,"one_connection":false,"one_transfer":false,"one_execution":false,"result_receive":false,"target_file_read":false,"device_write":false,"installation":false,"autoload":false,"retry":false,"reconnect":false}
|
||||
@@ -0,0 +1 @@
|
||||
{"active":false,"run_id":null,"target":null,"port":9021,"artifact_size":110032,"artifact_sha256":"914fce06a490ad048fdd0a85ae117858e8904b47c72054bf12fbfebc213a6db8","output_path":null,"receipt_path":null,"not_before":null,"not_after":null,"one_connection":false,"one_transfer":false,"one_execution":false,"result_receive":false,"directory_inventory":false,"possible_atime_effect_acknowledged":false,"device_file_content_read":false,"persistent_device_write":false,"installation":false,"autoload":false,"retry":false,"reconnect":false}
|
||||
@@ -0,0 +1 @@
|
||||
{"active":false,"run_id":null,"target":null,"port":9021,"artifact_size":109928,"artifact_sha256":"077307b98e44f566fa1db82b08cd5e71bd56bd9792826fc7254965fa768c0dc7","output_path":null,"receipt_path":null,"not_before":null,"not_after":null,"one_connection":false,"one_transfer":false,"one_execution":false,"result_receive":false,"four_exact_metadata_reads":false,"possible_atime_effect_acknowledged":false,"app_pkg_read":false,"backup_read":false,"persistent_device_write":false,"installation":false,"autoload":false,"retry":false,"reconnect":false}
|
||||
@@ -0,0 +1,28 @@
|
||||
# Phase 1.0E one-shot result test approval
|
||||
|
||||
Status: **CONSUMED — NO FURTHER DEVICE ACTION AUTHORIZED**.
|
||||
|
||||
On 2026-07-22 the repository owner issued an exact, artifact-bound approval.
|
||||
The immediately preceding proposal bound that confirmation to:
|
||||
|
||||
- `retroarch_ps5_result_diag.elf`;
|
||||
- 1,844,880 bytes;
|
||||
- SHA-256
|
||||
`1049c78099a60b472a3fb0e2999e3393b6ad76337a28532a7e53872e7772dedf`;
|
||||
- exact firmware 9.60 and the separately confirmed current session address;
|
||||
- one connection, one direct in-memory raw-ELF transfer, one execution;
|
||||
- result reception through the same inherited connection; and
|
||||
- no retry, reconnect, installation, autoload or device write.
|
||||
|
||||
The bounded host deadline is 75 seconds. The address is held only in the local
|
||||
ignored approval record and is not committed. The first connection attempt
|
||||
consumes this permission regardless of send, execution or result success.
|
||||
Timeout, EOF, reset, parser failure or any exception stops the run without a
|
||||
second connection.
|
||||
|
||||
This approval does not apply to any other artifact or later device action.
|
||||
|
||||
The attempt used one connection, transfer and execution and received validated
|
||||
D00-D02 frames before remote EOF. No retry or reconnect occurred. All device,
|
||||
transfer, execution and result-receive authorization fields were reset to
|
||||
`false`; the artifact is no longer transfer- or execution-eligible.
|
||||
@@ -0,0 +1,24 @@
|
||||
# Phase 1.0F device-test template — inactive
|
||||
|
||||
This is a non-authorizing review template for the offline Phase-1.0F artifact.
|
||||
It is not permission to connect, transfer, receive results or execute.
|
||||
|
||||
```text
|
||||
artifact=retroarch_ps5_interval_diag.elf
|
||||
size=1845152
|
||||
sha256=e8bfc01c61bfb14b5814280a6e5442f1a5ad05ace5439d1c09e7e5ee00cd0055
|
||||
firmware=9.60
|
||||
ps5_connection_authorized=false
|
||||
device_transfer_authorized=false
|
||||
device_execution_authorized=false
|
||||
result_receive_authorized=false
|
||||
installation_authorized=false
|
||||
autoload_authorized=false
|
||||
device_write_authorized=false
|
||||
automatic_retry=false
|
||||
```
|
||||
|
||||
Any future authorization must be a new explicit statement in the active task,
|
||||
repeat the exact name, size and SHA-256, set the intended actions explicitly,
|
||||
and bound connection, transfer, execution, reception and observation counts.
|
||||
No authority carries from RUN A, RUN B or RUN C.
|
||||
@@ -0,0 +1,34 @@
|
||||
# Phase 1.0G one-shot approval template — inactive
|
||||
|
||||
This is a review checklist, not an authorization. The tracked JSON template is
|
||||
intentionally inactive and must never be edited into a reusable project-wide
|
||||
permission.
|
||||
|
||||
Current values:
|
||||
|
||||
```text
|
||||
authorized=false
|
||||
consumed=false
|
||||
ps5_connection_authorized=false
|
||||
device_transfer_authorized=false
|
||||
device_execution_authorized=false
|
||||
result_receive_authorized=false
|
||||
installation_authorized=false
|
||||
autoload_authorized=false
|
||||
device_write_authorized=false
|
||||
automatic_retry=false
|
||||
protocol_activation_authorized=false
|
||||
run_id=null
|
||||
target=null
|
||||
port=null
|
||||
```
|
||||
|
||||
A future approval, if Jens chooses to issue one, must name the exact artifact
|
||||
name, size and SHA-256; firmware; one target; protocol `CHD10F01`; timeout;
|
||||
unique run identifier; result reception; and one connection, transfer,
|
||||
execution and receive. It must separately keep installation, autoload, device
|
||||
write, retry, reconnect, resume and automatic reboot false.
|
||||
|
||||
The active record must stay outside tracked repository paths, carry an exact
|
||||
approval reference, and be reviewed together with the active execution
|
||||
manifest. No prior RUN A, B or C permission carries forward.
|
||||
@@ -0,0 +1,23 @@
|
||||
# Phase 1.0H device-test template — inactive
|
||||
|
||||
This non-authorizing template identifies the offline Phase-1.0H artifact. It
|
||||
is not permission to connect, transfer, receive results or execute.
|
||||
|
||||
```text
|
||||
artifact=retroarch_ps5_startup_args_diag.elf
|
||||
size=1845152
|
||||
sha256=822f2cf1f4d33a514d2bdd88fde40ad580dda5d85f537362ef6dff2eafcb56b6
|
||||
firmware=9.60
|
||||
ps5_connection_authorized=false
|
||||
device_transfer_authorized=false
|
||||
device_execution_authorized=false
|
||||
result_receive_authorized=false
|
||||
installation_authorized=false
|
||||
autoload_authorized=false
|
||||
device_write_authorized=false
|
||||
automatic_retry=false
|
||||
```
|
||||
|
||||
Any possible device test requires a new active-task statement naming this
|
||||
exact artifact, size and hash and separately bounding connection, transfer,
|
||||
execution, receive and observation. This template grants nothing.
|
||||
@@ -0,0 +1,38 @@
|
||||
# Phase 1.0K one-shot approval template — inactive
|
||||
|
||||
This is a review checklist, not authorization. Its tracked JSON companion is
|
||||
permanently inactive and contains no device address, port or run ID.
|
||||
|
||||
Current state:
|
||||
|
||||
```text
|
||||
authorized=false
|
||||
consumed=false
|
||||
ps5_connection_authorized=false
|
||||
device_transfer_authorized=false
|
||||
device_execution_authorized=false
|
||||
result_receive_authorized=false
|
||||
installation_authorized=false
|
||||
autoload_authorized=false
|
||||
device_write_authorized=false
|
||||
automatic_retry=false
|
||||
protocol_activation_authorized=false
|
||||
run_id=null
|
||||
target=null
|
||||
port=null
|
||||
```
|
||||
|
||||
Any later approval must be newly issued by Jens and bind exactly:
|
||||
|
||||
- `retroarch_ps5_write_diag.elf`;
|
||||
- size `1845208`;
|
||||
- SHA-256 `6ff0f7ea391da5f15ea43512a871078133e896a6900ae9f8f3fa75711abb8009`;
|
||||
- firmware `9.60`;
|
||||
- protocol `CHD10J01`, version 1, 64-byte frames;
|
||||
- one explicit target, port, timeout and unique run ID;
|
||||
- exactly one connection, transfer, execution and result reception.
|
||||
|
||||
It must keep installation, autoload, device write, retry, reconnect, resume and
|
||||
automatic reboot false. The active approval must remain outside tracked
|
||||
repository paths and agree byte-for-byte with a separately reviewed active
|
||||
manifest. This template grants nothing and prior permissions do not carry.
|
||||
@@ -0,0 +1,39 @@
|
||||
# Phase 1.0N one-shot approval template — inactive
|
||||
|
||||
This is a review checklist, not authorization. Its tracked JSON companion is
|
||||
permanently inactive and contains no device address, port or run ID.
|
||||
|
||||
Current state:
|
||||
|
||||
```text
|
||||
authorized=false
|
||||
consumed=false
|
||||
ps5_connection_authorized=false
|
||||
device_transfer_authorized=false
|
||||
device_execution_authorized=false
|
||||
result_receive_authorized=false
|
||||
installation_authorized=false
|
||||
autoload_authorized=false
|
||||
device_write_authorized=false
|
||||
automatic_retry=false
|
||||
protocol_activation_authorized=false
|
||||
run_id=null
|
||||
target=null
|
||||
port=null
|
||||
```
|
||||
|
||||
Any later approval must be newly issued by Jens and bind exactly:
|
||||
|
||||
- `retroarch_ps5_write_diag.elf`;
|
||||
- size `1845208`;
|
||||
- SHA-256 `c99a0856309a357ad2667d89b4924e4063ad214cae09c8a419457b0732f583cd`;
|
||||
- firmware `9.60`;
|
||||
- protocol `CHD10J01`, version 1, 64-byte frames;
|
||||
- scope `EXACT_ONE_SHOT_PHASE_1_0N`;
|
||||
- one explicit target, port, timeout and unique run ID;
|
||||
- exactly one connection, transfer, execution and result reception.
|
||||
|
||||
It must keep installation, autoload, device write, retry, reconnect, resume and
|
||||
automatic reboot false. The approval must remain outside tracked repository
|
||||
paths and agree with a separately reviewed active manifest. This template
|
||||
grants nothing; consumed Phase-1.0K and all earlier permissions do not carry.
|
||||
@@ -0,0 +1,32 @@
|
||||
# Phase 1.0T shsrv metadata collection approval
|
||||
|
||||
Status: `INACTIVE_TEMPLATE`
|
||||
|
||||
This document is deliberately unapproved. It is not a command list, device
|
||||
client, or permission to connect.
|
||||
|
||||
```text
|
||||
attested=false
|
||||
active=false
|
||||
ps5_connection_authorized=false
|
||||
device_request_authorized=false
|
||||
result_receive_authorized=false
|
||||
process_side_effects_accepted=false
|
||||
automatic_serial_query_accepted=false
|
||||
automatic_telemetry_query_accepted=false
|
||||
serial_redaction_contract_accepted=false
|
||||
automatic_retry=false
|
||||
reconnect_authorized=false
|
||||
target_address=null
|
||||
listener_already_running_attested=false
|
||||
window=null
|
||||
exact_literal_path=null
|
||||
commands=[]
|
||||
expires_at=null
|
||||
```
|
||||
|
||||
Any future approval must name exactly one window, one connection, the exact
|
||||
commands, a short deadline, and whether the unavoidable spawned shell and
|
||||
automatic serial/telemetry reads are accepted. Acceptance does not authorize
|
||||
hbldr, target staging, file writes, app termination, remount, execution,
|
||||
autoload, retry or any other device action.
|
||||
@@ -0,0 +1,35 @@
|
||||
# Phase 1.0V shsrv collector approval
|
||||
|
||||
Status: `INACTIVE_TEMPLATE`
|
||||
|
||||
This template grants no authority and cannot activate the offline model.
|
||||
|
||||
```text
|
||||
attested=false
|
||||
active=false
|
||||
collector_source_sha256=null
|
||||
ps5_connection_authorized=false
|
||||
device_request_authorized=false
|
||||
result_receive_authorized=false
|
||||
automatic_serial_query_accepted=false
|
||||
automatic_telemetry_query_accepted=false
|
||||
spawned_shell_effects_accepted=false
|
||||
sanitized_output_only_accepted=false
|
||||
physical_memory_erasure_unproven_accepted=false
|
||||
automatic_retry=false
|
||||
reconnect_authorized=false
|
||||
target_address=null
|
||||
target_port=null
|
||||
listener_already_running_attested=false
|
||||
window=null
|
||||
exact_literal_path=null
|
||||
commands=[]
|
||||
deadline_seconds=null
|
||||
run_id=null
|
||||
expires_at=null
|
||||
```
|
||||
|
||||
Any future live collector requires a new phase because Phase 1.0V contains no
|
||||
network transport. Filling this template does not add one and does not
|
||||
authorize hbldr, file content reads, writes, execution, transfer, installation,
|
||||
autoload, path discovery, retry or reconnect.
|
||||
@@ -0,0 +1,43 @@
|
||||
# Phase 1.0W shsrv client approval
|
||||
|
||||
Status: `INACTIVE_TEMPLATE`
|
||||
|
||||
There is no live client in Phase 1.0W. This template cannot activate the
|
||||
policy model or create network capability.
|
||||
|
||||
```text
|
||||
attested=false
|
||||
active=false
|
||||
policy_sha256=null
|
||||
collector_sha256=null
|
||||
run_id=null
|
||||
target_address=null
|
||||
target_port=null
|
||||
window=null
|
||||
exact_literal_path=null
|
||||
commands=[]
|
||||
deadline_seconds=null
|
||||
expires_at=null
|
||||
listener_already_running_attested=false
|
||||
ps5_connection_authorized=false
|
||||
device_request_authorized=false
|
||||
result_receive_authorized=false
|
||||
spawned_shell_effects_accepted=false
|
||||
automatic_serial_query_accepted=false
|
||||
automatic_telemetry_query_accepted=false
|
||||
sanitized_output_only_accepted=false
|
||||
physical_memory_erasure_unproven_accepted=false
|
||||
target_build_authorized=false
|
||||
device_transfer_authorized=false
|
||||
device_execution_authorized=false
|
||||
installation_authorized=false
|
||||
autoload_authorized=false
|
||||
device_write_authorized=false
|
||||
automatic_retry=false
|
||||
reconnect_authorized=false
|
||||
resume_authorized=false
|
||||
fallback_authorized=false
|
||||
```
|
||||
|
||||
A later phase must create and audit a separate inactive transport before any
|
||||
approval can be considered. No field in this template authorizes a connection.
|
||||
@@ -0,0 +1,47 @@
|
||||
# Phase 1.0X inactive transport approval
|
||||
|
||||
Status: `INACTIVE_TEMPLATE`
|
||||
|
||||
Phase 1.0X has no live network adapter. This record is deliberately inert and
|
||||
cannot authorize or activate a connection.
|
||||
|
||||
```text
|
||||
attested=false
|
||||
active=false
|
||||
policy_sha256=null
|
||||
collector_sha256=null
|
||||
transport_sha256=null
|
||||
run_id=null
|
||||
target_address=null
|
||||
target_port=null
|
||||
window=null
|
||||
exact_literal_path=null
|
||||
commands=[]
|
||||
deadline_seconds=null
|
||||
expires_at=null
|
||||
listener_already_running_attested=false
|
||||
ps5_connection_authorized=false
|
||||
device_request_authorized=false
|
||||
result_receive_authorized=false
|
||||
spawned_shell_effects_accepted=false
|
||||
automatic_serial_query_accepted=false
|
||||
automatic_telemetry_query_accepted=false
|
||||
sanitized_output_only_accepted=false
|
||||
physical_memory_erasure_unproven_accepted=false
|
||||
directory_entry_durability_unproven_accepted=false
|
||||
blocking_call_preemption_unproven_accepted=false
|
||||
target_build_authorized=false
|
||||
device_transfer_authorized=false
|
||||
device_execution_authorized=false
|
||||
installation_authorized=false
|
||||
autoload_authorized=false
|
||||
device_write_authorized=false
|
||||
automatic_retry=false
|
||||
reconnect_authorized=false
|
||||
resume_authorized=false
|
||||
fallback_authorized=false
|
||||
```
|
||||
|
||||
No value may be filled under Phase 1.0X. A later phase must first prove exact
|
||||
prompt/Telnet framing and implement an independently reviewed inactive network
|
||||
adapter. That work still would not inherit authority from this template.
|
||||
@@ -0,0 +1,33 @@
|
||||
# Phase 1.0Y shsrv framing approval
|
||||
|
||||
Status: `INACTIVE_TEMPLATE`
|
||||
|
||||
This phase is source audit and synthetic modeling only. It contains no live
|
||||
transport to activate.
|
||||
|
||||
```text
|
||||
attested=false
|
||||
active=false
|
||||
framing_model_sha256=null
|
||||
source_family=null
|
||||
run_id=null
|
||||
target_address=null
|
||||
target_port=null
|
||||
commands=[]
|
||||
ps5_connection_authorized=false
|
||||
device_request_authorized=false
|
||||
result_receive_authorized=false
|
||||
target_build_authorized=false
|
||||
device_transfer_authorized=false
|
||||
device_execution_authorized=false
|
||||
installation_authorized=false
|
||||
autoload_authorized=false
|
||||
device_write_authorized=false
|
||||
automatic_retry=false
|
||||
reconnect_authorized=false
|
||||
resume_authorized=false
|
||||
fallback_authorized=false
|
||||
```
|
||||
|
||||
No field may be filled under Phase 1.0Y. Official-source framing is not proof
|
||||
of the deployed shsrv family, live prompt boundaries or firmware behavior.
|
||||
@@ -0,0 +1,27 @@
|
||||
# Phase 1.0Z passive-batch approval record
|
||||
|
||||
This tracked record is deliberately inactive. It is not permission to connect,
|
||||
send, receive or execute anything.
|
||||
|
||||
- `active=false`
|
||||
- `attested=false`
|
||||
- `run_id=null`
|
||||
- `target_address=null`
|
||||
- `target_port=null`
|
||||
- `window=null`
|
||||
- `exact_literal_path=null`
|
||||
- `ps5_connection_authorized=false`
|
||||
- `device_request_authorized=false`
|
||||
- `result_receive_authorized=false`
|
||||
- `target_build_authorized=false`
|
||||
- `device_transfer_authorized=false`
|
||||
- `device_execution_authorized=false`
|
||||
- `installation_authorized=false`
|
||||
- `autoload_authorized=false`
|
||||
- `device_write_authorized=false`
|
||||
- `automatic_retry=false`
|
||||
- `reconnect_authorized=false`
|
||||
- `resume_authorized=false`
|
||||
|
||||
Any later action requires a new exact artifact/session-specific approval and a
|
||||
separate reviewed live-adapter phase. Nothing in this template activates one.
|
||||
@@ -0,0 +1,39 @@
|
||||
# Phase-0.7 installation authorization packet
|
||||
|
||||
Status: **NOT AUTHORIZED**. This file prepares a later installation request;
|
||||
it grants no authority and contains no transfer or execution command.
|
||||
|
||||
## Hash-bound installation set
|
||||
|
||||
- elfldr:
|
||||
`63e810982471eb40cae3a20aa9df9a0a02892f420e429874fae4e99aa400b561`
|
||||
(397000 bytes)
|
||||
- controlled Payload Manager:
|
||||
`8fecf8241a46246eddbd21e8bb4d875f5d76f1f4f4c6a11384df1f131aa5e5b1`
|
||||
(99560 bytes)
|
||||
- lifecycle probe:
|
||||
`bfb4a5cc768e162fe4c2fddf41c3978e152722918a39085277fd172cb95a7182`
|
||||
(112680 bytes)
|
||||
- firmware: exact `9.60`
|
||||
- automatic retry: `false`
|
||||
- lifecycle timeout: `2000 ms`
|
||||
|
||||
The permanent blocked hash
|
||||
`4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63`
|
||||
is excluded and must still be rejected.
|
||||
|
||||
## Exact later permission sentence
|
||||
|
||||
> Ik geef toestemming om uitsluitend op mijn PS5 met exact firmware 9.60 de
|
||||
> geharde elfldr met SHA-256
|
||||
> 63e810982471eb40cae3a20aa9df9a0a02892f420e429874fae4e99aa400b561
|
||||
> en de controlled Payload Manager met SHA-256
|
||||
> 8fecf8241a46246eddbd21e8bb4d875f5d76f1f4f4c6a11384df1f131aa5e5b1
|
||||
> éénmalig te installeren, nadat de bestaande bestanden hashgebonden zijn
|
||||
> geback-upt. Deze toestemming omvat geen overdracht of uitvoering van de
|
||||
> lifecycle-probe en geen automatische start.
|
||||
|
||||
After that separate installation is verified, a second, artifact-specific
|
||||
authorization would still be required to transfer and execute the lifecycle
|
||||
probe. Installation permission must not be interpreted as execution
|
||||
permission.
|
||||
@@ -0,0 +1,41 @@
|
||||
# Phase-0.7 lifecycle transfer and one-time execution request
|
||||
|
||||
Status: **NOT AUTHORIZED**. Do not use this request until the hardened elfldr
|
||||
and controlled Payload Manager have been separately authorized, installed,
|
||||
hash-verified on-device, and recorded in a new active task.
|
||||
|
||||
## Exact later execution subject
|
||||
|
||||
- lifecycle probe SHA-256:
|
||||
`bfb4a5cc768e162fe4c2fddf41c3978e152722918a39085277fd172cb95a7182`
|
||||
- size: 112680 bytes
|
||||
- artifact ID: `chimera-gfx-lifecycle-phase07-fw960-v1`
|
||||
- firmware: exact `9.60`
|
||||
- maximum runtime: 2000 ms
|
||||
- automatic retry: `false`
|
||||
- requested action count: one transfer and one execution
|
||||
|
||||
## Preconditions
|
||||
|
||||
- on-device hardened elfldr hash equals
|
||||
`63e810982471eb40cae3a20aa9df9a0a02892f420e429874fae4e99aa400b561`;
|
||||
- on-device controlled Payload Manager hash equals
|
||||
`8fecf8241a46246eddbd21e8bb4d875f5d76f1f4f4c6a11384df1f131aa5e5b1`;
|
||||
- the original installed components have hash-bound backups;
|
||||
- the permanent blocked hash is rejected by both installed consumers;
|
||||
- the static policy gate is rerun against the exact transferred bytes;
|
||||
- no autoload or automatic retry is enabled.
|
||||
|
||||
## Exact later permission sentence
|
||||
|
||||
> Ik geef toestemming om uitsluitend op mijn PS5 met exact firmware 9.60 de
|
||||
> lifecycle-probe met SHA-256
|
||||
> bfb4a5cc768e162fe4c2fddf41c3978e152722918a39085277fd172cb95a7182,
|
||||
> 112680 bytes en artifact-ID
|
||||
> chimera-gfx-lifecycle-phase07-fw960-v1 eenmalig over te dragen en eenmaal uit
|
||||
> te voeren via de reeds geinstalleerde en exact geverifieerde geharde runtime,
|
||||
> met een harde limiet van 2000 ms, zonder retry, autoload, VideoOut, GNM, SDL
|
||||
> of netwerkgebruik door de probe.
|
||||
|
||||
This text is a future request template only. Its presence in the repository is
|
||||
not approval.
|
||||
@@ -0,0 +1,94 @@
|
||||
# Firmware 9.60 probe transfer and one-time execution package
|
||||
|
||||
Status: **BLOCKED — do not transfer and do not execute**.
|
||||
|
||||
This is the separate review package requested after the offline build. It is
|
||||
not an authorization request because the current artifact cannot satisfy the
|
||||
project's no-kernel-change boundary.
|
||||
|
||||
## Bound artifact
|
||||
|
||||
- Filename:
|
||||
`chimera-gfx-capability-probe-0.1.0-fw-9.60-offline-audit-only.elf`
|
||||
- SHA-256:
|
||||
`4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63`
|
||||
- Size: 110424 bytes
|
||||
- Source commit: `ba8f6a40cf37dff628254caa9b11d83a73957cf8`
|
||||
- Firmware build gate: exact `9.60`
|
||||
- Manifest: `manifests/artifacts/chimera-gfx-capability-probe-0.1.0-fw-9.60.json`
|
||||
- Offline evidence: `docs/evidence/probe-9.60-offline-2026-07-17.md`
|
||||
- Transfer / execution recorded: false / false
|
||||
- Execution eligible: false
|
||||
- Permanent denylist: `manifests/artifact-denylist.json`
|
||||
|
||||
## Intended one-time project action
|
||||
|
||||
If a future replacement artifact closes every blocker, the first action would
|
||||
be a single manual, foreground capability probe with application arguments:
|
||||
|
||||
```text
|
||||
--firmware 9.60 --acknowledge-read-only-probe
|
||||
```
|
||||
|
||||
Project code would open the candidate GNM module, perform exactly 21 `dlsym`
|
||||
lookups, log names plus booleans, call none of the returned addresses, and
|
||||
attempt `dlclose`. It would request no VideoOut, framebuffer, GNM command,
|
||||
draw, dispatch, submit, flip, GPU-memory mutation, MMIO, or register operation.
|
||||
There would be no retry or automatic boot path.
|
||||
|
||||
## APIs and side effects under review
|
||||
|
||||
Project path: `strcmp`, `chimera_gfx_firmware_gate_allows`,
|
||||
`chimera_gfx_ps5_make_loader_ops`, `chimera_gfx_ps5_probe_symbols`, `dlopen`,
|
||||
`open_module`, `dlerror`, `resolve_symbol`, `dlsym`, `log_line`, `snprintf`,
|
||||
`write_log`, `fprintf`/`fwrite`, `close_module`, `dlclose`, and
|
||||
`chimera_gfx_status_string`.
|
||||
|
||||
Pinned SDK transitive path includes `__patch_init`, kernel credential and
|
||||
syscall-permission writes, rtld initialization, possible
|
||||
`sceKernelLoadStartModule` calls, SDK kernel reads while inspecting module
|
||||
metadata, and possible `sceKernelStopUnloadModule` during cleanup. The complete
|
||||
audited path is in the evidence document.
|
||||
|
||||
## Blocking findings
|
||||
|
||||
1. SDK v0.41 performs kernel process-state writes before `main`. The firmware
|
||||
gate cannot prevent them.
|
||||
2. No bounded/cancellable loader API or safe external supervisor has been
|
||||
proven. A hang can prevent cleanup.
|
||||
3. Module start/stop internals on firmware 9.60 are unknown.
|
||||
4. The gate trusts a supplied string and does not attest firmware.
|
||||
5. Runtime delivery of the required four arguments has not been observed.
|
||||
|
||||
Likely failure outcomes range from a clean refusal or loader error to a payload
|
||||
crash, persistent loaded-module/process state, or a console restart. GPU/display
|
||||
effects are not requested, but driver-internal effects cannot be ruled out.
|
||||
|
||||
## Timeout, cleanup, and recovery status
|
||||
|
||||
No safe timeout or forced-cancellation procedure exists for this artifact.
|
||||
Normal cleanup attempts `dlclose`; crash/hang cleanup and CRT kernel-state
|
||||
restoration are not guaranteed. Therefore no transfer, launch, kill, retry, or
|
||||
recovery procedure is approved.
|
||||
|
||||
## Approval checklist
|
||||
|
||||
- [x] Offline artifact hash and source commit recorded
|
||||
- [x] Full imports and call chain audited
|
||||
- [x] VideoOut/Phase-1 excluded from the build
|
||||
- [ ] Public, kernelwrite-free startup/loader path proven
|
||||
- [ ] Replacement artifact built and newly hashed
|
||||
- [ ] Firmware attestation and argument delivery proven
|
||||
- [ ] Bounded timeout and cleanup/recovery proven
|
||||
- [ ] New artifact-specific transfer approval
|
||||
- [ ] New artifact-specific one-time execution approval
|
||||
|
||||
## Permission text
|
||||
|
||||
There is deliberately **no valid permission text for this hash**. Generic or
|
||||
future approval must not be interpreted as authorization for it. After the
|
||||
blockers are closed, a newly named and newly hashed replacement needs a new
|
||||
package and an exact permission sentence that names that replacement hash.
|
||||
|
||||
ADR-0009 makes this hash permanently ineligible; closing future startup
|
||||
blockers cannot rehabilitate these bytes.
|
||||
@@ -0,0 +1,54 @@
|
||||
# External evidence integrity check — 2026-07-29
|
||||
|
||||
## Decision
|
||||
|
||||
`EXTERNAL_EVIDENCE_WORKSPACE_NOT_REPRODUCIBLE`
|
||||
|
||||
This is a host-only integrity record. No PS5, network, transfer, target build,
|
||||
installation, execution, result reception, autoload, or device write was used.
|
||||
Every authorization remains false and automatic retry remains false.
|
||||
|
||||
## Findings
|
||||
|
||||
The standalone tracked-input suite passes, but the currently available sibling
|
||||
workspace cannot reproduce every historical cross-repository validator:
|
||||
|
||||
- Phase-0.9B and Phase-0.9C source digests do not match several committed
|
||||
blobs at the commits named by their historical manifests;
|
||||
- the expected historical bytes are not present in any local commit of the
|
||||
affected sibling repositories;
|
||||
- Phase-1.0L and Phase-1.0M require ignored sibling audit documents that are
|
||||
absent from the current RetroArch checkout;
|
||||
- Phase-1.0P and Phase-1.0R bind older RetroArch revisions and Phase-1.0R also
|
||||
requires ignored Phase-1.0M ELF/map evidence that is absent;
|
||||
- a single sibling worktree cannot simultaneously represent all historical
|
||||
revisions.
|
||||
|
||||
Worktree CRLF conversion is a separate source of false mismatches on Windows.
|
||||
The historical validators and their checksum inventories are immutable and
|
||||
were not rewritten. A future source-evidence contract should bind committed
|
||||
Git blobs or explicitly normalized text, but that change must use a new schema
|
||||
and record rather than altering the historical evidence package. Comparison
|
||||
against committed blobs confirmed that several remaining mismatches are
|
||||
genuine evidence-availability failures, not line-ending conversion.
|
||||
|
||||
## Test boundary
|
||||
|
||||
The default CTest suite uses tracked files only. Historical validators needing
|
||||
sibling repositories, upstream trees, or ignored artifacts are registered only
|
||||
with `CHIMERA_GFX_REGISTER_EXTERNAL_EVIDENCE_VALIDATORS=ON` and must be run one
|
||||
at a time against the exact phase-specific workspace described in
|
||||
`TEST_PLAN.md`.
|
||||
|
||||
Unregistered does not mean passed. Missing or mismatched external evidence
|
||||
remains fail-closed and cannot support a compatibility, hardware-safety,
|
||||
execution, cleanup, or recovery claim. The historical records are preserved;
|
||||
their missing bytes are not reconstructed or replaced by current source.
|
||||
|
||||
## Recovery requirement
|
||||
|
||||
To re-establish a historical external validation, supply the original exact
|
||||
ignored evidence and source bytes, verify their SHA-256 values independently,
|
||||
and bind them to a clean phase-specific checkout. If those bytes cannot be
|
||||
recovered, the affected source-binding claim remains unavailable permanently;
|
||||
no manifest hash may be rewritten merely to make a validator pass.
|
||||
@@ -0,0 +1,41 @@
|
||||
# Phase-0 build evidence — 2026-07-16
|
||||
|
||||
This record captures local compile evidence only. No PS5 connection, transfer,
|
||||
or execution occurred.
|
||||
|
||||
## Inputs
|
||||
|
||||
- source workspace: standalone `chimera-gfx`
|
||||
- PS5 Payload SDK: v0.41 / commit `d2e2e585740362976a39fdd5ccf390f199a7bc37`
|
||||
- SDK ZIP SHA-256:
|
||||
`ebfb0acb5260511951a80e17db41650c62d20a8caf8659a230b928dc85005984`
|
||||
- host compiler: MSVC 19.42.34436.0
|
||||
- cross compiler: Ubuntu clang 18.1.8 (`20ubuntu8`)
|
||||
- CMake: host 3.29.5-msvc4; cross 4.2.3
|
||||
- Ninja: 1.13.2
|
||||
|
||||
## Host result
|
||||
|
||||
The Debug host library and test executables compiled with warnings as errors.
|
||||
Clang-tidy completed during the WSL/Clang build. All 7 unit, manifest,
|
||||
generated-file, safety, secret, and format checks passed.
|
||||
|
||||
## PS5 compile result
|
||||
|
||||
`chimera-gfx-capability-probe.elf` compiled as a 64-bit x86-64 PIE using the
|
||||
public SDK toolchain, with `CHIMERA_GFX_PS5_ALLOWED_FIRMWARE=NONE` and warnings
|
||||
as errors. Initial artifact SHA-256 before the final source split was
|
||||
`618eadc14975eb3f20942ee2228007b2457c0f6c1b0e4daa72d17ae9feb64c5c`.
|
||||
After splitting unused host allocation code out of the linked probe surface and
|
||||
performing the final rebuild, the artifact SHA-256 is
|
||||
`bc09865f6d26ba4fa86a5167b99841ad3ebee3629421a2cb4bae678bde63227f`.
|
||||
|
||||
Read-only symbol inspection found:
|
||||
|
||||
- GNM imports: 0
|
||||
- VideoOut imports: 0
|
||||
- loader entry points present: `dlopen`, `dlsym`, `dlclose`
|
||||
- undefined allocation imports (`calloc`, `free`): 0
|
||||
- representative GNM names present only as embedded lookup strings
|
||||
|
||||
This evidence does not claim runtime compatibility with any firmware.
|
||||
@@ -0,0 +1,76 @@
|
||||
# Phase-0 and offline Phase-1 build evidence
|
||||
|
||||
- Date: 2026-07-17
|
||||
- Source commit: `72292f2d5788ad643e9d1816ce28ab754ef739b5`
|
||||
- Branch: `main`
|
||||
- Firmware gate: `NONE`
|
||||
- Hardware transfer/execution: **not performed**
|
||||
|
||||
The source tree was clean when the two artifacts below were rebuilt. Generated
|
||||
build directories and ELFs are ignored; only their machine-readable manifests
|
||||
are tracked.
|
||||
|
||||
## Host verification
|
||||
|
||||
| Environment | Result |
|
||||
|---|---|
|
||||
| Windows, Visual Studio 2022 x64 Debug | 11/11 CTest tests passed |
|
||||
| Windows, Visual Studio 2022 x64 Release | 11/11 CTest tests passed |
|
||||
| WSL, Clang 18.1.8, clang-tidy 18, warnings as errors | 12/12 CTest tests passed |
|
||||
| WSL, GCC 15.2.0, ASan + UBSan | 12/12 CTest tests passed |
|
||||
| Installed core library consumer | compiled and exited 0 |
|
||||
| Installed RetroArch/SDL2 scaffold consumer | compiled and exited 0 |
|
||||
|
||||
The tests include API/error/lifecycle validation, cross-context ownership,
|
||||
resource limits, deterministic mock upload/present state, adapter refusal,
|
||||
firmware-gate negative cases, symbol-manifest generation, artifact-manifest
|
||||
tamper rejection, format, safety policy, and secret scanning.
|
||||
|
||||
The Clang ASan/UBSan variant was attempted but could not link because this WSL
|
||||
installation lacks Clang 18's `compiler-rt` ASan archives. That attempt is not
|
||||
counted as a passed test. The available GCC sanitizer runtime completed the
|
||||
same 12-test suite successfully.
|
||||
|
||||
Docker was not installed in the local environment, so the pinned Dockerfile
|
||||
was reviewed but not built. Its host and Phase-0 cross-build commands were run
|
||||
directly with the same pinned compiler/SDK inputs. No Gitea job is claimed as
|
||||
passed merely from being queued.
|
||||
|
||||
## Cross-build verification
|
||||
|
||||
The clean PS5 compile used:
|
||||
|
||||
- PS5 Payload SDK `v0.41`, commit
|
||||
`d2e2e585740362976a39fdd5ccf390f199a7bc37`;
|
||||
- PS5 SDL2 commit `0baf4ac49382b537ba449901b5b6d0d189bb1fbb`;
|
||||
- the single reviewed keyboard/IME-removal overlay;
|
||||
- SDL2main, audio, joystick, haptic, sensor, power, file, filesystem, locale,
|
||||
misc, OpenGL, LoadSO, render, Vulkan, dummy/offscreen video, and HIDAPI
|
||||
disabled for the Phase-1 candidate;
|
||||
- warnings as errors and firmware identifier `NONE`.
|
||||
|
||||
All core, adapter, firmware-gate, probe, and disabled Phase-1 targets compiled
|
||||
and linked. Static `prospero-nm` inspection then passed the strict import audit.
|
||||
|
||||
| Artifact | Size | SHA-256 | Static result |
|
||||
|---|---:|---|---|
|
||||
| `chimera-gfx-capability-probe.elf` | 110424 | `f0f74978ac62490ff2482386e9c4efa3ad6d6cc46e10d54c41cb8669b4449f36` | 0 direct Sce imports; 0 GNM imports |
|
||||
| `chimera-gfx-phase1-videoout-clear.elf` | 1566368 | `2e826ac4ea2bffb626d82e370f98909bb508417d92b1ac3796e9f5a902e975c9` | exact reviewed 15-name Sce set; 0 GNM/keyboard/IME/UserService imports |
|
||||
|
||||
The 15 Phase-1 imports are six direct-memory/equeue functions, one
|
||||
SystemService function, and eight VideoOut functions listed in
|
||||
`docs/phase1/VIDEOOUT_CLEAR_EXPERIMENT.md`.
|
||||
|
||||
`llvm-objdump-18` confirmed the retained control-flow order in the Phase-1
|
||||
`main`: firmware gate at offset `0x78`, `SDL_SetMainReady` at `0xa9`,
|
||||
`SDL_Init` at `0xb4`, and the sole `SDL_UpdateWindowSurface` at `0x1fc`. The
|
||||
probe likewise reaches its firmware gate before loader construction and probe
|
||||
logic. With embedded identifier `NONE`, both return before the later calls.
|
||||
|
||||
The corresponding tracked manifests are:
|
||||
|
||||
- `manifests/artifacts/chimera-gfx-capability-probe-0.1.0-none.json`;
|
||||
- `manifests/artifacts/chimera-gfx-phase1-videoout-clear-0.1.0-none.json`.
|
||||
|
||||
Both manifests verify against the local bytes and state `authorized: false`,
|
||||
`transferred: false`, and `executed: false`.
|
||||
@@ -0,0 +1,67 @@
|
||||
# Phase 0.5 startup offline evidence — 2026-07-17
|
||||
|
||||
## Outcome
|
||||
|
||||
Decision: **BLOCKED**. The stock SDK v0.41 startup is `UNSAFE`, and the exact
|
||||
loader caller needed to prove safe return from a replacement is absent. No
|
||||
custom `_start` source and no PS5 ELF were created.
|
||||
|
||||
No PS5 connection, transfer, execution, VideoOut open, module load, network
|
||||
initialization, GNM operation, framebuffer mutation, credential change,
|
||||
syscall-bound change, MMIO access, or firmware change occurred.
|
||||
|
||||
## Offline startup audit
|
||||
|
||||
`tools/audit_ps5_startup_feasibility.py` was run twice independently against
|
||||
the pinned SDK source and install. Both JSON outputs were byte-identical:
|
||||
|
||||
- startup audit SHA-256:
|
||||
`d0e8202c1a07e4104476cadf6c14a1dea2d724b1d97495dddcdf05858f6c8d4a`;
|
||||
- 12 transitive stock CRT sources enumerated;
|
||||
- six other CRT-named installed files confirmed as empty archives;
|
||||
- 31 functions and 182 call/tail-call edges reachable from stock `_start`;
|
||||
- reachable prohibited set: `__patch_init`, `kernel_copyin`, `kernel_copyout`,
|
||||
`kernel_set_ucred_caps`, and `kernel_set_ucred_attrs`;
|
||||
- compiler `-###` trace confirmed that `-nostartfiles -nodefaultlibs` adds no
|
||||
stock CRT or default library and produced no ELF;
|
||||
- non-SDK local loader-contract hits: zero.
|
||||
|
||||
## Policy verification
|
||||
|
||||
The real legacy artifact, its updated manifest, and the permanent denylist were
|
||||
evaluated together. The policy tool returned exit 2 with both
|
||||
`ARTIFACT_PERMANENTLY_DENYLISTED` and
|
||||
`MANIFEST_EXECUTION_INELIGIBLE`.
|
||||
|
||||
JSON Schema validation passed for all three tracked artifact manifests and the
|
||||
permanent denylist.
|
||||
|
||||
## Host and static tests
|
||||
|
||||
- Windows MSVC warnings-as-errors build: passed.
|
||||
- Windows CTest: 14/14 passed.
|
||||
- WSL Clang 18 plus clang-tidy build: passed.
|
||||
- WSL Clang CTest including formatting: 15/15 passed.
|
||||
- WSL GCC 15 ASan+UBSan build: passed.
|
||||
- WSL GCC ASan+UBSan CTest: 15/15 passed.
|
||||
- Python syntax compilation for every changed tool/test: passed.
|
||||
- `git diff --check`: passed at review time.
|
||||
|
||||
An initial Clang ASan configure did not compile a project source because the
|
||||
local Clang install lacks `libclang_rt.asan*`. GCC's available ASan/UBSan
|
||||
runtime was used successfully instead. The failed configure is an environment
|
||||
toolchain limitation and was not reported as a passed test.
|
||||
|
||||
## Bound hashes
|
||||
|
||||
| Record | SHA-256 |
|
||||
|---|---|
|
||||
| permanent denylist | `e9603b0e3792781ad5b511afb22ef61e3d4fd4c5a16bf928f8609193bcd97783` |
|
||||
| denylist schema | `78d0d28da552550e4b7dabc5b9c25347fb2618c4664b7a554b87c6de69cd6c96` |
|
||||
| startup audit JSON | `d0e8202c1a07e4104476cadf6c14a1dea2d724b1d97495dddcdf05858f6c8d4a` |
|
||||
| non-build decision | `b04dd224c00af0c7228c582f6ba3ca55ef03e9453287f233a0c4ff2e545092fc` |
|
||||
| machine proof matrix | `aefd1d1e663be617ed1042c6a1d68b9f21dd0c137f0c601d15cdcbfdf03dadb7` |
|
||||
| permanently blocked legacy ELF | `4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63` |
|
||||
|
||||
The last hash names pre-existing bytes only. It is not a Phase-0.5 artifact and
|
||||
must not be transferred or executed.
|
||||
@@ -0,0 +1,61 @@
|
||||
# Phase-0.7 offline build evidence — 2026-07-17
|
||||
|
||||
- Public SDK: v0.41,
|
||||
`d2e2e585740362976a39fdd5ccf390f199a7bc37`
|
||||
- Firmware build gate: exact `9.60`
|
||||
- Host validation: MSVC 19.50 `/W4 /WX`; Clang 18
|
||||
warnings-as-errors/clang-tidy/format; GCC 15 ASan/UBSan
|
||||
- Fuzz fallback: 100,000 deterministic ASan/UBSan inputs for both controlled
|
||||
header and verified metadata
|
||||
- Cross-build: all three targets with warnings-as-errors
|
||||
- Reproducibility: two clean byte-identical builds per ELF
|
||||
- Console actions: none
|
||||
|
||||
The complete machine evidence is
|
||||
`manifests/runtime/phase-0.7-offline-audit.json`. Full ignored reports and
|
||||
artifacts are packaged below `outputs/phase07/`.
|
||||
|
||||
## Exact outputs
|
||||
|
||||
| Artifact | SHA-256 | Size | Undefined imports | `DT_NEEDED` |
|
||||
|---|---|---:|---|---|
|
||||
| hardened elfldr | `63e810982471eb40cae3a20aa9df9a0a02892f420e429874fae4e99aa400b561` | 397000 | none | `libSceLibcInternal.sprx`, `libSceNet.sprx`, `libkernel_web.sprx` |
|
||||
| controlled Payload Manager | `8fecf8241a46246eddbd21e8bb4d875f5d76f1f4f4c6a11384df1f131aa5e5b1` | 99560 | none | `libSceLibcInternal.sprx`, `libSceNet.sprx`, `libkernel_web.sprx` |
|
||||
| lifecycle probe | `bfb4a5cc768e162fe4c2fddf41c3978e152722918a39085277fd172cb95a7182` | 112680 | `_exit`, `sceKernelSendNotificationRequest` | `libSceLibcInternal.sprx`, `libkernel_web.sprx` |
|
||||
|
||||
The lifecycle project's called functions are exactly one
|
||||
`sceKernelSendNotificationRequest` followed by `_exit`. The normal SDK startup
|
||||
is statically included and reaches `__patch_init` before `main`; that fact is
|
||||
proven from source, linker map, disassembly, and the 499-edge lifecycle
|
||||
callgraph rather than inferred from imports. The hardened loader audit records
|
||||
1032 call edges and the controlled manager records 478.
|
||||
|
||||
The lifecycle linker map also contains stock-SDK `__dlopen`, `__dlsym`,
|
||||
`sceKernelLoadStartModule`, and `sceKernelStopUnloadModule` symbols. Direct
|
||||
static reachability proves the rtld initialization path but cannot resolve all
|
||||
116 indirect lifecycle edges. The audit therefore records linked symbols,
|
||||
direct `_start` reachability where symbolization permits it, and every
|
||||
unresolved indirect edge separately. No graphics/display-sensitive symbol is
|
||||
linked in any of the three audited ELFs.
|
||||
|
||||
## Final offline tests
|
||||
|
||||
- Chimera GFX Windows host build: MSVC `/W4 /WX`, 16/16 CTest passed.
|
||||
- Hardened elfldr: MSVC 1/1; Clang 18 plus clang-tidy 1/1; GCC 15
|
||||
ASan/UBSan 1/1; 100,000-input sanitizer fuzz pass.
|
||||
- Controlled Payload Manager: MSVC 1/1; Clang 18 plus clang-tidy 2/2; GCC 15
|
||||
ASan/UBSan 2/2; 100,000-input sanitizer fuzz pass.
|
||||
- All three PS5 cross-builds passed warnings-as-errors and reproduced the
|
||||
exact hashes and sizes above.
|
||||
- Negative lifecycle firmware `9.50` configure failed before creating a build
|
||||
graph.
|
||||
- Controlled-manager build without exact hash/size/artifact ID failed.
|
||||
- Static execution-policy refusal suite, manifest schemas, Phase-0.5/0.6
|
||||
historical gates, Phase-0.7 proof matrix, safety audit, and secret scans
|
||||
passed.
|
||||
|
||||
The local Clang installation does not contain the optional
|
||||
`libclang_rt.asan`/libFuzzer runtime archives. Clang warnings and clang-tidy
|
||||
therefore run without sanitizers; GCC supplies the ASan/UBSan and deterministic
|
||||
fuzz coverage. This is a host-tool packaging limitation, not a target
|
||||
compiler, linker, or ABI blocker.
|
||||
@@ -0,0 +1,147 @@
|
||||
# Firmware 9.60 capability-probe offline evidence
|
||||
|
||||
Date: 2026-07-17. No PS5 connection, transfer, deployment, or execution was
|
||||
performed.
|
||||
|
||||
## Artifact identity
|
||||
|
||||
| Field | Value |
|
||||
|---|---|
|
||||
| Artifact | `chimera-gfx-capability-probe-0.1.0-fw-9.60-offline-audit-only.elf` |
|
||||
| Size | 110424 bytes |
|
||||
| SHA-256 | `4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63` |
|
||||
| Source commit | `ba8f6a40cf37dff628254caa9b11d83a73957cf8` |
|
||||
| SDK | PS5 Payload SDK v0.41, commit `d2e2e585740362976a39fdd5ccf390f199a7bc37` |
|
||||
| Build type | Release, C11, warnings as errors |
|
||||
| Phase-1 VideoOut | explicitly `OFF`; target not built or linked |
|
||||
| Transfer / execution | false / false |
|
||||
| Execution eligibility | **false** |
|
||||
|
||||
Two clean builds around an audit-tool-only commit produced the same size and
|
||||
SHA-256. The tracked manifest is
|
||||
`manifests/artifacts/chimera-gfx-capability-probe-0.1.0-fw-9.60.json`.
|
||||
|
||||
## Firmware gate
|
||||
|
||||
The checked-in discovery allowlist is exactly `["9.60"]`; CMake still defaults
|
||||
to `NONE`. Configure rejects `9.61`. The Phase-1 target rejects `9.60` and every
|
||||
other non-`NONE` value.
|
||||
|
||||
The ELF embeds `9.60` and requires exactly these application arguments:
|
||||
|
||||
```text
|
||||
--firmware 9.60 --acknowledge-read-only-probe
|
||||
```
|
||||
|
||||
Disassembly places `chimera_gfx_firmware_gate_allows` at `main+0x7f`, before
|
||||
`chimera_gfx_ps5_make_loader_ops` at `main+0xa5` and the probe call at
|
||||
`main+0xb2`. This is only a comparison against an operator-supplied string; it
|
||||
does not independently attest the console firmware. SDK startup occurs before
|
||||
`main` and therefore before this gate.
|
||||
|
||||
## Complete dynamic import inventory
|
||||
|
||||
Undefined symbols (`prospero-nm -u`), exact set:
|
||||
|
||||
- `__stderrp`
|
||||
- `__stdoutp`
|
||||
- `fprintf`
|
||||
- `fwrite`
|
||||
- `snprintf`
|
||||
- `strcmp`
|
||||
|
||||
`DT_NEEDED` modules (`llvm-readelf-18 --dynamic-table`), exact set:
|
||||
|
||||
- `libkernel_web.sprx`
|
||||
- `libSceLibcInternal.sprx`
|
||||
- `libSceNet.sprx`
|
||||
|
||||
There are zero direct `sce*`, GNM, VideoOut, SDL, draw, dispatch, submit, or
|
||||
flip imports. `libSceVideoOut.sprx` text is present only because the SDK rtld
|
||||
statically includes a general sysmodule-name table; there is no corresponding
|
||||
import or call. `INIT_ARRAYSZ` and `FINI_ARRAYSZ` are both zero.
|
||||
|
||||
## Project-requested functions
|
||||
|
||||
Before the firmware gate, project `main` uses only argument checks, `strcmp`,
|
||||
and a refusal log on error. After the gate, the complete project path is:
|
||||
|
||||
1. `chimera_gfx_ps5_make_loader_ops`;
|
||||
2. `chimera_gfx_ps5_probe_symbols`;
|
||||
3. internal `log_line`/`write_log` callbacks for boolean JSON events;
|
||||
4. loader callback `open_module`, which calls
|
||||
`dlopen("libSceGnmDriver.sprx", RTLD_LAZY | RTLD_LOCAL)`;
|
||||
5. loader callback `resolve_symbol` 21 times; it calls `dlerror`, `dlsym`, then
|
||||
`dlerror`; every returned address is reduced to a boolean and discarded;
|
||||
6. `snprintf` plus `fprintf`/compiler-selected `fwrite` for boolean JSON lines;
|
||||
7. loader callback `close_module`, which calls `dlclose`;
|
||||
8. `chimera_gfx_status_string` and a final summary log.
|
||||
|
||||
No resolved GNM pointer is cast to a callable type or invoked. The 21 exact
|
||||
names are machine-checked against `manifests/ps5_gnm_symbols.json`.
|
||||
|
||||
## SDK startup and loader side effects
|
||||
|
||||
Pinned-source review plus disassembly proves this pre-`main` success path:
|
||||
|
||||
1. `_start` clears payload BSS.
|
||||
2. `__crt_syscall_init`, `__kernel_init`, and `__klog_init` initialize SDK
|
||||
state from loader-supplied arguments.
|
||||
3. libc `__isthreaded` is set to one.
|
||||
4. `__patch_init` reads current process credentials, calls
|
||||
`kernel_set_ucred_caps` and `kernel_set_ucred_attrs`, and performs two
|
||||
`kernel_copyin` writes that change the process syscall-address bounds.
|
||||
5. `__rtld_init` initializes SPRX/SO/payload/dlfcn support and may call
|
||||
`sceKernelLoadStartModule` for `libSceSysmodule.sprx` if it is absent.
|
||||
6. payload dependencies are opened and relocations modify payload memory;
|
||||
payload init/fini arrays themselves are empty.
|
||||
|
||||
After the project gate, SDK `dlopen` first checks loaded modules through SDK
|
||||
kernel reads. If GNM is absent it can call `sceKernelLoadStartModule`. It then
|
||||
uses `kernel_copyout` to copy module metadata, symbol tables, and string tables
|
||||
into allocated user memory. The pinned SPRX-specific `init` callback is empty,
|
||||
but the internal behavior of the system load/start call is unknown.
|
||||
|
||||
These facts mean the ELF is non-rendering at project level but is not globally
|
||||
non-mutating. The pre-`main` kernel writes violate the project's userland-only
|
||||
execution boundary.
|
||||
|
||||
## Cleanup audit
|
||||
|
||||
The bounded project loop attempts `dlclose` after all lookups and on lookup or
|
||||
format failures. SDK `dlclose` calls rtld fini, close, and destroy. The pinned
|
||||
SPRX `fini` callback is empty. If this open loaded the module, `sprx_close`
|
||||
calls `sceKernelStopUnloadModule`, then frees copied tables and clears local
|
||||
state.
|
||||
|
||||
Cleanup is not guaranteed:
|
||||
|
||||
- there is no documented cancellation or bounded timeout around loader calls;
|
||||
- a crash or hang can bypass `dlclose`;
|
||||
- a stop/unload failure can leave the module loaded while SDK bookkeeping is
|
||||
destroyed;
|
||||
- the CRT's credential/syscall-permission changes have no matching restoration
|
||||
path in the pinned source;
|
||||
- a `libSceSysmodule.sprx` load during rtld initialization has no observed
|
||||
matching unload in this call chain.
|
||||
|
||||
## Offline verification results
|
||||
|
||||
- Windows MSVC Debug: 11/11 tests passed.
|
||||
- WSL Clang 18 with clang-tidy and formatting: 12/12 tests passed.
|
||||
- Strict artifact audit: six exact undefined symbols, three exact
|
||||
`DT_NEEDED` modules, empty init/fini arrays, all 21 manifest names, zero
|
||||
direct Sce/GNM imports.
|
||||
- SDK runtime source audit: passed and concluded execution eligibility false.
|
||||
- Negative configure tests: firmware `9.61` rejected; Phase-1 with `9.60`
|
||||
rejected.
|
||||
- Artifact-manifest digest/size verification: passed.
|
||||
- Secret scan and `git diff --check`: passed.
|
||||
|
||||
## Remaining blockers
|
||||
|
||||
The exact system-module initialization effects, runtime argument delivery,
|
||||
firmware attestation, loader timeout behavior, and partial-failure recovery are
|
||||
unproven. More decisively, the SDK v0.41 CRT performs prohibited kernel writes
|
||||
before the project firmware gate. This exact artifact must not be transferred
|
||||
or executed.
|
||||
@@ -0,0 +1,53 @@
|
||||
# Hardware approval package
|
||||
|
||||
Status: **not authorized; offline review artifacts only**.
|
||||
|
||||
## Current offline review artifacts
|
||||
|
||||
| Artifact | Firmware | SHA-256 | Transfer/execution |
|
||||
|---|---|---|---|
|
||||
| `chimera-gfx-capability-probe.elf` | `NONE` | `f0f74978ac62490ff2482386e9c4efa3ad6d6cc46e10d54c41cb8669b4449f36` | false / false |
|
||||
| `chimera-gfx-phase1-videoout-clear.elf` | `NONE` | `2e826ac4ea2bffb626d82e370f98909bb508417d92b1ac3796e9f5a902e975c9` | false / false |
|
||||
| `chimera-gfx-capability-probe-0.1.0-fw-9.60-offline-audit-only.elf` | `9.60` | `4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63` | false / false; permanently denylisted |
|
||||
|
||||
The two `NONE` artifacts are tied to source commit
|
||||
`72292f2d5788ad643e9d1816ce28ab754ef739b5`. The offline test and import
|
||||
evidence is in `docs/evidence/phase0-build-2026-07-17.md`. These exact artifacts
|
||||
cannot enter the project-requested GNM module open or SDL initialization because
|
||||
their firmware gate is `NONE`. The SDK payload CRT still initializes before
|
||||
`main`.
|
||||
|
||||
## First hardware gate
|
||||
|
||||
The first console action, if it ever becomes safe and receives new permission,
|
||||
must be the non-rendering capability probe, not the VideoOut experiment.
|
||||
Project code would call only `dlopen`, `dlsym`, `dlclose`, and standard output
|
||||
functions. It would resolve the 21 manifest names, record only booleans, invoke
|
||||
no resolved pointer, and request no submit, draw, dispatch, flip, or GPU-memory
|
||||
operation.
|
||||
|
||||
Jens reported exact firmware `9.60` and authorized only its offline build and
|
||||
audit. The pinned SDK v0.41 payload CRT performs prohibited kernel process-state
|
||||
writes before `main`, so the resulting ELF is not execution-eligible even
|
||||
though the project gate precedes `dlopen`. A kernelwrite-free startup route and
|
||||
a newly built digest are required before execution can be considered.
|
||||
|
||||
## VideoOut gate after successful discovery
|
||||
|
||||
The later experiment would execute the exact SDL sequence and indirect API
|
||||
inventory in `VIDEOOUT_CLEAR_EXPERIMENT.md`. Likely failures are a clean error,
|
||||
payload crash, stuck payload, lost display ownership, or required controlled
|
||||
console restart. Automatic retry is prohibited. The unbounded SDL flip wait is
|
||||
an unresolved blocker even after symbol discovery.
|
||||
|
||||
## Authorization state
|
||||
|
||||
The 9.60 offline build authorization has been received. No transfer or execution
|
||||
authorization has been received. No execution-permission wording is offered
|
||||
while the SDK CRT blocker remains. The firmware-specific evidence and blocked
|
||||
approval package must record the filename, SHA-256, exact source commit, all
|
||||
imports, startup/loader/cleanup call chain, and offline tests. Approval never
|
||||
carries forward to the VideoOut test.
|
||||
|
||||
The completed firmware-specific package is
|
||||
`docs/approvals/probe-9.60-transfer-execution.md`.
|
||||
@@ -0,0 +1,39 @@
|
||||
# Firmware and ABI checklist
|
||||
|
||||
## Firmware identity
|
||||
|
||||
- [ ] Exact user-visible firmware identifier supplied by Jens
|
||||
- [ ] Reproducible identification method documented without kernel access
|
||||
- [ ] Identifier added to one candidate build only
|
||||
- [ ] `FIRMWARE_COMPATIBILITY.md` row created as untested
|
||||
- [ ] No compatibility inferred from another revision
|
||||
|
||||
## Discovery gate
|
||||
|
||||
- [ ] Capability-probe artifact manifest and SHA-256 reviewed
|
||||
- [ ] Explicit artifact-specific execution permission recorded
|
||||
- [ ] Probe resolves names only and invokes no resolved pointer
|
||||
- [ ] Redacted result log archived
|
||||
- [ ] Runtime module candidate confirmed or rejected for this firmware
|
||||
|
||||
## SDL/VideoOut evidence
|
||||
|
||||
- [x] SDL source commit pinned
|
||||
- [x] Zlib license and overlay notice recorded
|
||||
- [x] Project code uses public SDL2 APIs only
|
||||
- [x] Keyboard/IME initialization removed from the staged build
|
||||
- [x] Direct GNM imports forbidden
|
||||
- [ ] Bounded flip-wait or safe supervisor proven
|
||||
- [ ] Cleanup behavior observed on this exact firmware
|
||||
|
||||
## Artifact review
|
||||
|
||||
- [ ] Clean source commit matches manifest
|
||||
- [ ] SDK and SDL commits match locks
|
||||
- [ ] Firmware is not `NONE`
|
||||
- [ ] ELF filename, size, and SHA-256 match
|
||||
- [ ] Imports match the API inventory
|
||||
- [ ] Offline host, static-analysis, cross-compile, and secret tests pass
|
||||
- [ ] Transfer and execution remain false until separately approved
|
||||
|
||||
Any unchecked runtime item blocks execution.
|
||||
@@ -0,0 +1,58 @@
|
||||
# Phase-1 hardware test plan
|
||||
|
||||
## Preconditions
|
||||
|
||||
Every item must be complete before transfer:
|
||||
|
||||
- exact firmware is recorded and allowlisted for one artifact;
|
||||
- the discovery-only capability probe has already completed on that firmware;
|
||||
- source commit, SDK/SDL commits, artifact SHA-256, and static imports match the
|
||||
reviewed manifest;
|
||||
- the console has no unsaved work and automatic retry/boot integration is off;
|
||||
- an operator and observer have the redacted JSON-stage log visible;
|
||||
- the bounded-wait blocker below has an accepted resolution.
|
||||
|
||||
## Proposed timeline
|
||||
|
||||
1. Verify digest again immediately before transfer.
|
||||
2. Transfer manually using an existing approved userland loader workflow.
|
||||
3. Start once, manually. No boot hook or retry.
|
||||
4. Require `firmware_gate`, `video_init`, `window_create`, `surface_acquire`,
|
||||
and `cpu_fill` within five seconds total.
|
||||
5. Permit exactly one `single_present` and a one-second hold.
|
||||
6. Require `cleanup` and process exit within five seconds after present.
|
||||
7. Preserve logs and mark the firmware row pass, fail, or anomalous.
|
||||
|
||||
## Watchdog and timeout
|
||||
|
||||
The application stages are bounded except the pinned SDL call
|
||||
`SDL_UpdateWindowSurface`, whose backend waits for a flip event without a
|
||||
publicly proven finite timeout. A cooperative application thread cannot safely
|
||||
cancel it. Force-killing a thread while it owns VideoOut or direct-memory state
|
||||
is prohibited.
|
||||
|
||||
Before authorization, one of these must be proven and separately reviewed:
|
||||
|
||||
1. a public, licensed SDL/VideoOut change that supplies a bounded wait and
|
||||
returns control for cleanup; or
|
||||
2. a userland process supervisor whose termination semantics guarantee OS
|
||||
cleanup of VideoOut, equeue, and direct-memory ownership.
|
||||
|
||||
Until then, the operator wall-clock limit is a detection mechanism only, not a
|
||||
safe watchdog, and the hardware test remains blocked.
|
||||
|
||||
## Cleanup, rollback, and emergency stop
|
||||
|
||||
Normal cleanup is `SDL_DestroyWindow` followed by `SDL_Quit`; the pinned
|
||||
backend then closes VideoOut, releases direct memory, and deletes its equeue.
|
||||
No second flip is attempted during cleanup.
|
||||
|
||||
On any error, missing stage, display anomaly, or deadline:
|
||||
|
||||
- do not retry;
|
||||
- request normal userland process termination only if responsive;
|
||||
- do not kill an individual worker thread;
|
||||
- if display ownership does not return, use the console's normal controlled
|
||||
restart procedure; never patch firmware, registers, clocks, or fans;
|
||||
- after restart, use the existing SDL software path and mark the artifact and
|
||||
firmware combination failed/unknown pending review.
|
||||
@@ -0,0 +1,13 @@
|
||||
# Offline Phase-1 preparation
|
||||
|
||||
No Phase-1 artifact has been transferred or executed. This directory contains
|
||||
the review package for the first CPU-framebuffer/VideoOut experiment:
|
||||
|
||||
- `VIDEOOUT_CLEAR_EXPERIMENT.md`: exact design and API inventory;
|
||||
- `HARDWARE_TEST_PLAN.md`: staging, timeout, cleanup, rollback, and stop rules;
|
||||
- `FIRMWARE_ABI_CHECKLIST.md`: evidence that must be completed per firmware;
|
||||
- `APPROVAL_PACKAGE.md`: artifact-specific authorization gate.
|
||||
|
||||
The compile target is off by default and the produced review artifact embeds
|
||||
firmware `NONE`, so it refuses before `SDL_Init`. This preparation does not
|
||||
authorize a hardware test.
|
||||
@@ -0,0 +1,62 @@
|
||||
# Minimal VideoOut clear-frame experiment
|
||||
|
||||
## Goal and non-goals
|
||||
|
||||
Display exactly one fixed 1920x1080 solid frame through the existing pinned
|
||||
PS5 SDL2 CPU-framebuffer backend, hold it for one second, and cleanly release
|
||||
SDL. This experiment does not use `libchimera-gfx` hardware contexts, GNM,
|
||||
shaders, command buffers, compute, custom tiling code, input, audio, OpenGL,
|
||||
OSMesa, or a render loop.
|
||||
|
||||
## Application sequence
|
||||
|
||||
Project code performs the following calls only after exact compile-time and
|
||||
runtime firmware identifiers match and the literal acknowledgement is present:
|
||||
|
||||
1. `SDL_SetMainReady`
|
||||
2. `SDL_Init(SDL_INIT_VIDEO)`
|
||||
3. `SDL_CreateWindow`
|
||||
4. `SDL_GetWindowSurface`
|
||||
5. `SDL_MapRGBA`
|
||||
6. `SDL_FillRect`
|
||||
7. `SDL_UpdateWindowSurface` exactly once
|
||||
8. `SDL_Delay(1000)`
|
||||
9. `SDL_DestroyWindow`
|
||||
10. `SDL_Quit`
|
||||
|
||||
The fixed color is RGBA `(0x18, 0x2a, 0x41, 0xff)`. Logs contain stage names
|
||||
and booleans only.
|
||||
|
||||
## Indirect pinned-SDL behavior
|
||||
|
||||
At commit `0baf4ac49382b537ba449901b5b6d0d189bb1fbb`, the reviewed PS5 video
|
||||
backend indirectly uses these public export names:
|
||||
|
||||
- initialization: `sceSystemServiceHideSplashScreen`, `sceVideoOutOpen`,
|
||||
`sceKernelAllocateMainDirectMemory`, `sceKernelMapDirectMemory`,
|
||||
`sceKernelCreateEqueue`, `sceVideoOutAddFlipEvent`,
|
||||
`sceVideoOutSetFlipRate`, `sceVideoOutSetBufferAttribute2`, and
|
||||
`sceVideoOutRegisterBuffers2`;
|
||||
- single present: `sceVideoOutSubmitFlip` and `sceKernelWaitEqueue`;
|
||||
- cleanup: `sceVideoOutDeleteFlipEvent`, `sceVideoOutClose`,
|
||||
`sceKernelReleaseDirectMemory`, and `sceKernelDeleteEqueue`.
|
||||
|
||||
These are indirect implementation observations, not independently proven
|
||||
`chimera-gfx` ABI declarations. The overlay removes keyboard and IME setup.
|
||||
|
||||
## Build boundary
|
||||
|
||||
`tools/build-phase1-videoout.sh` verifies both upstream commits, stages the
|
||||
reviewed SDL overlay, disables SDL2main plus unrelated SDL subsystems, and
|
||||
cross-compiles the probe and candidate. It then statically requires the exact
|
||||
15-name Sce import inventory above and zero GNM, keyboard, IME, or UserService
|
||||
imports. It contains no upload, run, host, port, or boot command. The default
|
||||
firmware identifier is `NONE`.
|
||||
|
||||
## Known blocker
|
||||
|
||||
The pinned SDL backend waits inside `sceKernelWaitEqueue` with no publicly
|
||||
proven bounded timeout in this call path. Project code cannot safely cancel
|
||||
that wait. The artifact is suitable for offline inspection, but not yet for
|
||||
hardware authorization until `HARDWARE_TEST_PLAN.md` records an accepted
|
||||
supervisor/recovery mechanism and an exact firmware.
|
||||
@@ -0,0 +1,169 @@
|
||||
# Phase 1.0A build and artifact results
|
||||
|
||||
## Result
|
||||
|
||||
`RETROARCH_PS5_SOFTWARE_PORT_BUILT`
|
||||
|
||||
Both outputs are real RetroArch v1.22.2 frontends built from fork commit
|
||||
`ca1b45680577befc743e1c92fa40687e1b1745e7`. They link the upstream
|
||||
frontend/runloop and the static `chimera_smokecore`; the software target also
|
||||
links RGUI and the reviewed PS5 SDL2 software backends. They were not run.
|
||||
|
||||
| Profile | Local output | Size | SHA-256 | Map SHA-256 |
|
||||
| --- | --- | ---: | --- | --- |
|
||||
| headless | `build/phase10a/final/retroarch_ps5_headless.elf` | 722392 | `fd595a826f64d18598be0b55e539bb524b33bd469b98f62c958ee50acb544628` | `fb935f7a768c91408a87290f03bad8ed59f5061de75232d5660957eff8ec017f` |
|
||||
| software/RGUI | `build/phase10a/final/retroarch_ps5_software.elf` | 3318432 | `7beb09592404b5c1fb4161c632171d2901f3715db26e59458998690e8c49f3fc` | `1573a9951fa53bfa1bf304e0038e6f049f859fbfbe92f6a895196dc283c27597` |
|
||||
|
||||
The paths are relative to the separate `chimera-retroarch` repository. The
|
||||
ELFs and maps are ignored local build outputs, not files in `chimera-gfx` and
|
||||
not transfer, execution or installation packages.
|
||||
|
||||
## Builds and reproducibility
|
||||
|
||||
Every target comparison used fork commit
|
||||
`ca1b45680577befc743e1c92fa40687e1b1745e7`, SDK commit
|
||||
`d2e2e585740362976a39fdd5ccf390f199a7bc37`,
|
||||
`SOURCE_DATE_EPOCH=1763597828`, `TZ=UTC` and `LC_ALL=C`.
|
||||
Each repetition invoked `make ... clean` to completion before a separate
|
||||
`make ... -j4 all`. An earlier concurrent `make clean all` experiment was
|
||||
rejected as a race and is not evidence.
|
||||
|
||||
| Comparison | ELF | Linker map |
|
||||
| --- | --- | --- |
|
||||
| headless A versus B | byte-identical | byte-identical |
|
||||
| software A versus B | byte-identical | byte-identical |
|
||||
|
||||
Compiler flags include warnings-as-errors, `-O2`, no debug data, source-prefix
|
||||
maps, section garbage collection, `--as-needed` and `--build-id=none`. The
|
||||
cross compiler reports Clang 18.1.8 for `x86_64-sie-ps5`; GNU Make 4.4.1 was
|
||||
used under WSL2.
|
||||
|
||||
The static SDL2 archive is 3120572 bytes with SHA-256
|
||||
`353065505f54e71fa8f7fff41e090dce52f39fe2aaafab85c4653648fc5f1b56`.
|
||||
It was built from commit `0baf4ac49382b537ba449901b5b6d0d189bb1fbb`
|
||||
plus the 5195-byte reviewed overlay whose SHA-256 is
|
||||
`b547260d8af40ce2360575ab7831c009036c1f35f8b525cad6fd376dc5ca9d6b`.
|
||||
|
||||
## Host integration result
|
||||
|
||||
The host harness compiled with GCC 15.2.0, `-Werror`, AddressSanitizer and
|
||||
UndefinedBehaviorSanitizer, with leak detection enabled. It completed:
|
||||
|
||||
- 600 frames;
|
||||
- video FNV-1a-64 `43f920496eb5f435`;
|
||||
- audio FNV-1a-64 `a48f47dc08c56625`;
|
||||
- digital and analog input mapping: pass;
|
||||
- Start-driven libretro shutdown callback: pass;
|
||||
- init/deinit and ASan/UBSan/leak checks: pass;
|
||||
- PS5 port structural validator: pass.
|
||||
|
||||
This is host evidence for the core and source contracts, not PS5 runtime
|
||||
evidence.
|
||||
|
||||
## ELF audit
|
||||
|
||||
Both files are ELF64 little-endian x86-64 System V PIE/DYN binaries, dynamically
|
||||
linked and not stripped. Neither has an interpreter, build ID, GNU-stack
|
||||
program header, ELF TLS segment, `.tdata` or `.tbss`. Both have 20 section
|
||||
headers; `.init_array` and `.fini_array` exist with zero size. The full section
|
||||
set is `.text`, unwind tables, dynamic symbol/hash/string/relocation tables,
|
||||
`.data.rel.ro`, `.got`, `.rodata`, empty init/fini arrays, `.dynamic`, `.data`,
|
||||
`.bss`, `.comment` and static symbol/string tables.
|
||||
|
||||
| Field | Headless | Software/RGUI |
|
||||
| --- | ---: | ---: |
|
||||
| Entry point | `0x47d10` | `0x1c29c0` |
|
||||
| Program headers | 4 | 4 |
|
||||
| First LOAD | offset `0x4000`, size `0x4e570`, RWE | offset `0x4000`, size `0x1c93e0`, RWE |
|
||||
| Other LOADs | two RW | two RW |
|
||||
| `.rela.dyn` entries | 610 | 3373 |
|
||||
| Dynamic symbols | 79 | 220 |
|
||||
| Full symbols | 1387 | 7256 |
|
||||
| Defined global symbols | 719 | 2403 |
|
||||
| Undefined symbols/imports | 73 | 210 |
|
||||
|
||||
The executable first LOAD segment is also writable because the pinned SDK
|
||||
linker script co-locates text that way. This is a material W^X weakness and a
|
||||
future execution risk; offline build success does not waive it.
|
||||
|
||||
The linker maps prove inclusion of `frontend/drivers/platform_ps5.o` and
|
||||
`cores/chimera_smokecore/chimera_smokecore.o` in both targets. The software
|
||||
map additionally proves inclusion of `SDL_ps5video.c.o`, `SDL_ps5audio.c.o`
|
||||
and `SDL_ps5joystick.c.o`, while PS5 keyboard and IME objects are absent from
|
||||
the final link.
|
||||
|
||||
## Dynamic dependencies and imports
|
||||
|
||||
Headless `DT_NEEDED`:
|
||||
|
||||
- `libkernel_web.sprx`;
|
||||
- `libSceLibcInternal.sprx`.
|
||||
|
||||
Software/RGUI additionally needs:
|
||||
|
||||
- `libSceVideoOut.sprx`;
|
||||
- `libScePad.sprx`;
|
||||
- `libSceUserService.sprx`;
|
||||
- `libSceSystemService.sprx`;
|
||||
- `libSceAudioOut.sprx`.
|
||||
|
||||
`--as-needed` removes the SDK's otherwise unconditional SceNet dependency.
|
||||
There are no undefined socket/network, `dlopen`/`dlsym`, module-loader, GNM,
|
||||
mount, reboot or console-shutdown symbols. The software target's complete Sce
|
||||
API import set is AudioOut init/open/output/close; direct-memory and equeue
|
||||
allocation/wait/release; Pad init/open/read/close plus linked-but-not-required
|
||||
lightbar/vibration calls; UserService initialization/user queries;
|
||||
`sceSystemServiceHideSplashScreen`; and VideoOut open/register/flip/event/
|
||||
close operations. Full ordered import lists are in
|
||||
`manifests/retroarch/phase-1.0a-artifacts.json`.
|
||||
|
||||
Generic RetroArch code keeps write-capable libc imports. Headless includes
|
||||
`fopen`, `ftruncate`, `fwrite`, `mkdir`, `open`, `remove`, `rename` and
|
||||
`write`; software also includes `setenv`. The fixed PS5 startup path blocks
|
||||
configuration reads, supplies no content/config/SRAM/state/core/data path and
|
||||
compiles the normal shutdown-save paths out. The claim is therefore
|
||||
control-flow-specific, not global absence of write-capable code.
|
||||
|
||||
## Entry, shutdown and static reachability
|
||||
|
||||
Source and disassembly agree on this entry sequence:
|
||||
|
||||
`_start` clears BSS, performs the inlined SDK `payload_init` sequence
|
||||
(`__crt_syscall_init`, `__kernel_init`, `__klog_init`, `__isthreaded`,
|
||||
`__patch_init`, `__rtld_init`), constructs the SDK payload runtime, calls
|
||||
`main`, which tail-jumps to `rarch_main`, then runs SDK fini/close/destroy and
|
||||
termination handling. RetroArch selects `frontend_ctx_ps5`, performs a
|
||||
contentless static-core launch, enters `runloop_iterate`, and reaches the
|
||||
linked `retro_run`. Start requests the normal RetroArch/core shutdown path;
|
||||
`retro_deinit` and the PS5 frontend deinit/shutdown callbacks are linked.
|
||||
|
||||
The SDK source and linked disassembly also prove that startup is not
|
||||
kernelwrite-free: `__patch_init` reaches credential-capability/attribute
|
||||
changes and syscall-bound writes through `kernel_copyin/out`. Those effects
|
||||
are accepted for this authorized offline link milestone under the existing
|
||||
ADR boundary, but remain unexecuted and hardware-unproven.
|
||||
|
||||
## String and policy audit
|
||||
|
||||
No personal absolute host path, credential, PS5/device address, install route,
|
||||
Payload Manager modification, elfldr modification, lifecycle probe, deploy
|
||||
client or execution helper was found. The generic RetroArch string pool keeps
|
||||
`udp://127.0.0.1:`, an RTMP template, overlay “autoload” labels and downloader
|
||||
localization even though networking, updater, dynamic cores and autoload
|
||||
routes are compiled out. The software pool also yields byte-pattern false
|
||||
positives `0.1.2.3` and `4.5.6.7`. SDK RTLD name tables contain module/dlsym
|
||||
strings, but none is an undefined application import.
|
||||
|
||||
Full local audit output for each target contains the file classification,
|
||||
ELF/readobj dump, complete symbols and undefined symbols, relocations,
|
||||
disassembly, startup/shutdown slices and strings under
|
||||
`build/phase10a/audit/{headless,software}` in `chimera-retroarch`.
|
||||
|
||||
The Chimera GFX secretscan passed across 658 text files and a clean archive of
|
||||
all 21 fork-delta files passed separately. A whole-upstream RetroArch scan
|
||||
also identified the pre-existing BearSSL sample private-key fixtures and
|
||||
mbedTLS parser/writer source literals; these are official baseline dependency
|
||||
test/source material, not additions or credentials introduced by this port.
|
||||
|
||||
No PS5 connection, request, transfer, execution, installation, autoload or
|
||||
device write occurred.
|
||||
@@ -0,0 +1,55 @@
|
||||
# Phase 1.0A driver status
|
||||
|
||||
| Component | Headless | Software/RGUI | Runtime classification |
|
||||
| --- | --- | --- | --- |
|
||||
| RetroArch frontend/runloop | Real linked code | Real linked code | Built offline |
|
||||
| Platform frontend | `frontend_ctx_ps5` | `frontend_ctx_ps5` | Startup/return on device unproven |
|
||||
| Video | `video_null` | RetroArch `sdl2` + SDL software + PS5 VideoOut | Linked, firmware runtime unproven |
|
||||
| Menu | none | RGUI | Linked, display unproven |
|
||||
| Input | `input_null` | RetroArch SDL + SDL PS5 Pad | Linked, one-controller runtime unproven |
|
||||
| Joypad | null | SDL joypad over PS5 Pad | Buttons/axes source present; runtime unproven |
|
||||
| Audio | `audio_null` | RetroArch SDL + PS5 AudioOut | 48 kHz stereo source present; runtime unproven |
|
||||
| Core | static `chimera_smokecore` | static `chimera_smokecore` | Host-verified |
|
||||
| Dynamic core | disabled | disabled | Not implemented |
|
||||
| Config/VFS persistence | disabled default path | disabled default path | Generic write-capable code remains |
|
||||
| Networking/updater | disabled | disabled | No network API imports expected |
|
||||
| GNM/hardware context | absent | absent | Out of scope |
|
||||
|
||||
## Platform services
|
||||
|
||||
- lifecycle, contentless arguments and blocked config reads:
|
||||
`frontend_ctx_ps5`;
|
||||
- monotonic time and bounded sleeps: RetroArch/libretro-common POSIX paths
|
||||
backed by the pinned SDK libc; no invented PS5 ABI;
|
||||
- RetroArch worker threads: compiled out; the software profile may use SDL's
|
||||
public pthread-backed audio primitives;
|
||||
- logging: existing RetroArch stderr/stdout path only, with file logging off;
|
||||
- VFS: generic code is linkable but the fixed PS5 wrapper supplies no content,
|
||||
config, SRAM, state, core or data path;
|
||||
- dynamic core loading and executable-memory policy: explicitly unsupported.
|
||||
|
||||
## Smoke core contract
|
||||
|
||||
- no content;
|
||||
- 320x240 XRGB8888 at 60 Hz;
|
||||
- 48 kHz deterministic stereo, 800 sample frames per video frame;
|
||||
- D-pad and left analog stick offset the pattern;
|
||||
- A toggles the background;
|
||||
- Start requests clean libretro shutdown;
|
||||
- no input means unbounded deterministic operation;
|
||||
- no filesystem, networking, threads, JIT or frame-hot-path allocation.
|
||||
|
||||
Host result for 600 no-input frames:
|
||||
|
||||
- video FNV-1a-64: `43f920496eb5f435`;
|
||||
- audio FNV-1a-64: `a48f47dc08c56625`;
|
||||
- ASan/UBSan: pass;
|
||||
- digital- and analog-input-dependent video change: pass;
|
||||
- Start shutdown callback: pass.
|
||||
|
||||
## Explicitly unsupported
|
||||
|
||||
Persistent configuration, history, playlists, screenshots, saves, states,
|
||||
content loading, dynamic cores, multiple controllers, haptics, touchpad,
|
||||
gyro, lightbar, overlays, shaders and hardware-rendered cores are not silently
|
||||
reported as working.
|
||||
@@ -0,0 +1,65 @@
|
||||
# Proposed first PS5 smoke test (not authorized)
|
||||
|
||||
This is a review package only. It is not a sender, execution package or device
|
||||
instruction and it grants no authority.
|
||||
|
||||
## Candidate
|
||||
|
||||
The first useful device test would use the exact audited
|
||||
`retroarch_ps5_software.elf`, not the headless ELF. The headless static core
|
||||
has no observable result channel and intentionally runs indefinitely with null
|
||||
input. The software candidate can provide visible, audible and controller
|
||||
evidence and can request a clean shutdown.
|
||||
|
||||
Before any action, a later task must bind:
|
||||
|
||||
- source commit `ca1b45680577befc743e1c92fa40687e1b1745e7`;
|
||||
- the 3318432-byte ELF with SHA-256
|
||||
`7beb09592404b5c1fb4161c632171d2901f3715db26e59458998690e8c49f3fc`;
|
||||
- firmware text `9.60`;
|
||||
- a manual, non-autoload, non-installing one-shot loader route;
|
||||
- an independently reviewed recovery path;
|
||||
- a 100 ms flip timeout in the linked SDL object;
|
||||
- no automatic retry;
|
||||
- one explicit artifact-specific transfer authorization and one explicit
|
||||
execution authorization.
|
||||
|
||||
## Exact proposed one-shot scope
|
||||
|
||||
1. Verify the local ELF hash against the reviewed manifest.
|
||||
2. Verify autoload remains off and no live component will be replaced.
|
||||
3. Transfer only that one ELF to a non-persistent one-shot loader path.
|
||||
4. Execute once with no content and no arguments.
|
||||
5. Observe whether a 320x240 moving pattern is presented through RGUI/SDL.
|
||||
6. Observe bounded 48 kHz stereo test audio.
|
||||
7. Check one controller: D-pad and left stick change pattern position and A
|
||||
changes its background.
|
||||
8. Press Start once and observe whether RetroArch returns cleanly.
|
||||
9. Do not retry automatically. On crash, hang, missing output, timeout or
|
||||
unexpected filesystem/service behaviour, stop and use the separately
|
||||
reviewed recovery action.
|
||||
10. Hash and preserve host-side logs/transcript; do not infer success for
|
||||
unobserved subsystems.
|
||||
|
||||
## Explicit technical effects to accept later
|
||||
|
||||
The SDK CRT performs its previously documented bounded runtime initialization.
|
||||
The software profile opens user/system service, VideoOut, Pad and AudioOut,
|
||||
allocates heap/direct-memory buffers, creates SDL audio/thread primitives,
|
||||
submits VideoOut flips, waits on an equeue with a 100 ms timeout, polls input
|
||||
and writes audio. Logs, scheduler activity, process accounting and caches may
|
||||
change. These are functional runtime effects, not a side-effect-free probe.
|
||||
|
||||
## Remaining risks
|
||||
|
||||
- loader entry/return and firmware-9.60 lifecycle remain hardware-unproven;
|
||||
- VideoOut ownership or direct-memory assumptions may fail;
|
||||
- the public SDL backend's partial-init cleanup has not been observed;
|
||||
- a timeout may return an error but higher-level shutdown still needs proof;
|
||||
- audio output is blocking and underrun/overrun statistics are absent;
|
||||
- controller mappings/deadzone need device validation;
|
||||
- generic RetroArch write-capable code remains in the ELF even though the
|
||||
fixed first-run path blocks persistent writes;
|
||||
- a crash or hang may require a reboot/new jailbreak session.
|
||||
|
||||
No transfer or execution may occur on the basis of this document alone.
|
||||
@@ -0,0 +1,56 @@
|
||||
# Phase 1.0A PacBrew and PS5 SDL analysis
|
||||
|
||||
## Identities
|
||||
|
||||
| Source | Identity |
|
||||
| --- | --- |
|
||||
| PacBrew repository | `c2abcfcb60f569128abd0e8e70ad03a67bee5ea7` |
|
||||
| PS5 SDL fork | `0baf4ac49382b537ba449901b5b6d0d189bb1fbb` |
|
||||
| SDL reported revision | `SDL-2.30.12-g0baf4ac4` |
|
||||
| SDL license | Zlib |
|
||||
|
||||
The PacBrew SDL2 recipe builds the PS5 fork and enables OpenGL and LOADSO.
|
||||
Those two options are intentionally disabled here. PacBrew recipes were also
|
||||
reviewed for SDL2_image, SDL2_mixer, SDL2_ttf, freetype, zlib, libpng, OpenAL,
|
||||
elfldr and representative emulator ports. None is needed by the two Phase
|
||||
1.0A binaries beyond SDL2 itself.
|
||||
|
||||
## Native backend inventory
|
||||
|
||||
| Area | PS5 SDL implementation | APIs/dependencies | Phase 1.0A use |
|
||||
| --- | --- | --- | --- |
|
||||
| Video | Software surface, tiled direct-memory buffers, double buffer, VideoOut flip/equeue | `SceVideoOut`, kernel equeue/direct memory, user/system service | Enabled |
|
||||
| Render | SDL software renderer targeting the window framebuffer | SDL core software renderer | Enabled |
|
||||
| Input | Up to four PS5 Pad users, buttons, axes, connect/disconnect polling | `ScePad`, `SceUserService` | Enabled for one controller |
|
||||
| Audio | 48 kHz, mono/stereo, S16 or F32, bounded 256-2048 sample buffers | `SceAudioOut` | Enabled, RetroArch requests stereo |
|
||||
| Keyboard/IME | PS5 keyboard and IME dialog | `SceKeyboard`, `SceImeDialog` | Removed by reviewed overlay |
|
||||
| Filesystem | PS5 implementation exists | user service/filesystem | Disabled |
|
||||
| OpenGL/OSMesa | Optional source exists | Mesa/OSMesa | Disabled |
|
||||
| LoadSO | Optional | dynamic loader | Disabled |
|
||||
|
||||
## Reviewed overlay
|
||||
|
||||
The fork carries only a patch, not SDL source. The patch:
|
||||
|
||||
- removes keyboard/IME initialization and event pumping;
|
||||
- replaces twelve freshly created worker threads per frame with a checked
|
||||
single-thread tile copy;
|
||||
- rejects non-positive or non-tile-aligned framebuffer dimensions;
|
||||
- passes a 100,000 microsecond timeout to `sceKernelWaitEqueue`;
|
||||
- propagates copy and timeout errors to SDL.
|
||||
|
||||
SDL is configured with video, render, events, joystick, threads, timers and
|
||||
audio on; filesystem, file, loadso, OpenGL, Vulkan, haptic, sensor, locale,
|
||||
misc, libsamplerate, disk audio and dummy audio are off.
|
||||
|
||||
## Classification
|
||||
|
||||
`PS5_SDL_PARTIAL_CANDIDATE`
|
||||
|
||||
The source contains real PS5 video, controller and audio backends and the
|
||||
software RetroArch profile links them. It is not `FULL` because firmware-9.60
|
||||
runtime behaviour, VideoOut ownership, error cleanup, disconnect recovery,
|
||||
audio underrun/overrun reporting, exact flip timeout semantics and shutdown
|
||||
after partial initialization have not been verified on hardware.
|
||||
|
||||
Static build and host audits are not runtime evidence.
|
||||
@@ -0,0 +1,70 @@
|
||||
# Phase 1.0A native RetroArch PS5 port plan
|
||||
|
||||
Date: 2026-07-19
|
||||
|
||||
## Outcome and boundary
|
||||
|
||||
Phase 1.0A creates a real native RetroArch target in the separate
|
||||
`chimera-retroarch` repository. It does not add RetroArch source to
|
||||
`chimera-gfx`. The implementation has three profiles:
|
||||
|
||||
| Profile | Purpose | Target result |
|
||||
| --- | --- | --- |
|
||||
| `ps5-headless-smokecore` | Real RetroArch frontend/runloop with null drivers | `retroarch_ps5_headless.elf` |
|
||||
| `ps5-software-rgui-smokecore` | RGUI and SDL2 software video, Pad input and 48 kHz AudioOut | `retroarch_ps5_software.elf` |
|
||||
| `host-smokecore-integration` | 600 deterministic libretro frames under ASan/UBSan | Host executable, removed after test |
|
||||
|
||||
The target outputs are offline research artifacts. They are not installation
|
||||
or execution packages and carry no device authority.
|
||||
|
||||
## Layering
|
||||
|
||||
1. Upstream RetroArch remains the generic frontend, runloop, menu and driver
|
||||
registry.
|
||||
2. The PS5 layer adds the platform frontend, compile-time profiles and static
|
||||
smoke core. The software profile selects existing RetroArch SDL2 drivers.
|
||||
3. Chimera owns dependency locks, reproducible builds, artifact audits,
|
||||
manifests, guardrails and a later human-reviewed smoke-test proposal.
|
||||
|
||||
## Work sequence
|
||||
|
||||
1. Pin the official stable RetroArch release and source archive.
|
||||
2. Add the PS5 frontend and a warnings-as-errors headless build.
|
||||
3. Add and host-test a deterministic, contentless static libretro core.
|
||||
4. Cross-link the real headless RetroArch ELF.
|
||||
5. Build the pinned PS5 SDL fork with a reviewed overlay.
|
||||
6. Cross-link RGUI plus software video, input and audio.
|
||||
7. Perform two clean builds of every successful profile and compare bytes.
|
||||
8. Audit ELF headers, dynamic dependencies, symbols, relocations, executable
|
||||
segments, map files, startup/shutdown disassembly, strings and policy
|
||||
markers.
|
||||
9. Commit the port to its separate private branch and record only identities,
|
||||
results and safety evidence here.
|
||||
|
||||
## Compile-time safety policy
|
||||
|
||||
- networking, achievements, updater, core download and dynamic cores are off;
|
||||
- no GNM, OpenGL, Vulkan, shaders or hardware libretro context is present;
|
||||
- configuration reads are blocked by the PS5 frontend;
|
||||
- no content, core, SRAM, state, config or data path is supplied;
|
||||
- Salamander config and the normal shutdown save event are compiled out;
|
||||
- the static smoke core has no filesystem, network, JIT, thread or hot-path
|
||||
allocation code;
|
||||
- build rules contain no sender, deploy, install or run action.
|
||||
|
||||
Generic RetroArch filesystem functions remain linkable and some libc write
|
||||
imports remain in the ELFs. The safety claim is limited to the fixed default
|
||||
launch control flow, not global absence of all write-capable library code.
|
||||
Hardware behaviour on firmware 9.60 remains unproven.
|
||||
|
||||
## Non-goals
|
||||
|
||||
Dynamic libretro cores, persistent VFS paths, savestates, SRAM, playlists,
|
||||
history, screenshots, multiple controllers, rumble, touchpad, gyro, shaders,
|
||||
GNM acceleration, OpenGL/Vulkan contexts, packaging, installation and device
|
||||
execution are outside Phase 1.0A.
|
||||
|
||||
The five explicit offline source/build/audit/private-push authorizations are
|
||||
recorded as true for this phase. PS5 connection, device transfer, device
|
||||
execution, installation, lifecycle, autoload and device writes remain false;
|
||||
`automatic_retry=false`.
|
||||
@@ -0,0 +1,29 @@
|
||||
# Phase 1.0A PS4 reference delta
|
||||
|
||||
The official RetroArch Orbis port is a structural reference only.
|
||||
|
||||
| Orbis concept | PS5 Phase 1.0A decision | Evidence/status |
|
||||
| --- | --- | --- |
|
||||
| `Makefile.orbis` platform build | New `Makefile.ps5` using the open PS5 Payload SDK | Implemented |
|
||||
| Orbis frontend registry | New `frontend_ctx_ps5`, first for `__PS5__` | Implemented |
|
||||
| Orbis platform paths | No device paths at all | Safer default; future VFS work |
|
||||
| PS4 native input | RetroArch SDL2 input over the PS5 SDL Pad backend | Linked; runtime unproven |
|
||||
| PS4 native audio | RetroArch SDL audio over PS5 SDL AudioOut | Linked; runtime unproven |
|
||||
| PS4 video/context | PS5 SDL software framebuffer and VideoOut only | Linked; no GNM/context |
|
||||
| Static core support | Global libretro symbols provided by `chimera_smokecore` | Implemented and audited |
|
||||
| Console definitions | `__PS5__`, `__PROSPERO__`, `PS5`, `RARCH_CONSOLE` | Compile-time only |
|
||||
| Packaging/SELF | No conversion or packaging | Explicitly excluded |
|
||||
|
||||
Not reused from PS4:
|
||||
|
||||
- ABI declarations or structure layouts;
|
||||
- Orbis library or stub names;
|
||||
- PS4 paths, title identifiers or package logic;
|
||||
- PS4 controller/audio/video calls;
|
||||
- Auth info, SELF generation or installation;
|
||||
- PS4 runtime or cleanup assumptions.
|
||||
|
||||
The PS5 ELF uses the public SDK v0.41 CRT and linker contract already audited
|
||||
by Chimera. That startup has documented userland/kernel runtime effects and
|
||||
adds SDK dynamic dependencies; it is not a PS4 ABI and is not claimed to be
|
||||
side-effect free. Offline linking is authorized, device execution is not.
|
||||
@@ -0,0 +1,67 @@
|
||||
# Phase 1.0A upstream analysis
|
||||
|
||||
## Selected RetroArch base
|
||||
|
||||
| Field | Value |
|
||||
| --- | --- |
|
||||
| Official repository | `https://github.com/libretro/RetroArch` |
|
||||
| Stable tag | `v1.22.2` |
|
||||
| Commit | `69a4f0ea1e8aaf442ae4858f2e7f2b31a1776576` |
|
||||
| Tree | `33babf9eb7699b5d571a3063ea21c3e488c159fe` |
|
||||
| Commit date | `2025-11-20T00:17:08Z` |
|
||||
| Source archive | official GitHub tag archive |
|
||||
| Archive size | `71629881` bytes |
|
||||
| Archive SHA-256 | `245ef18c8fa8fbd9fbb5eb25cf43e17c6aace2f95c1ed99873cbd794012bb232` |
|
||||
| License | GPL-3.0-or-later (`COPYING` and source notices) |
|
||||
| Acquisition date | `2026-07-19` |
|
||||
|
||||
The local fork starts at that exact commit. Its `upstream` fetch remote names
|
||||
the official repository and its push URL is disabled. Project pushes are
|
||||
restricted to the private Gitea `origin`.
|
||||
|
||||
## Areas inspected
|
||||
|
||||
The analysis covered `Makefile.common`, `Makefile.griffin`,
|
||||
`Makefile.orbis`, frontend and driver registries, null/dummy drivers, RGUI,
|
||||
static core glue, config/path startup, task queues, time/sleep, threads,
|
||||
dynamic loading, VFS and logging. Reference platform implementations included
|
||||
Orbis, Vita, Switch, PSP and null.
|
||||
|
||||
Relevant upstream mechanisms:
|
||||
|
||||
- `frontend_ctx_drivers[]` selects the first compiled platform frontend;
|
||||
- video, audio and input arrays fall back to their null drivers;
|
||||
- `Makefile.common` conditionally adds SDL2 video, input/joypad and audio;
|
||||
- a static build resolves the global libretro API symbols at link time;
|
||||
- configuration defaults derive driver names from compiled feature macros;
|
||||
- RGUI is the smallest software-oriented menu driver;
|
||||
- generic file/VFS/task code is widely shared even when persistent features
|
||||
are disabled.
|
||||
|
||||
## Fork delta
|
||||
|
||||
The port adds:
|
||||
|
||||
- `Makefile.ps5` with explicit headless and software profiles;
|
||||
- `frontend/drivers/platform_ps5.c`;
|
||||
- `cores/chimera_smokecore/`;
|
||||
- host tests and PS5 build validation;
|
||||
- `pkg/ps5/` for the pinned SDL build and reviewed overlay;
|
||||
- PS5 port documentation.
|
||||
|
||||
Small generic-source changes register the platform, block static Salamander
|
||||
config I/O and normal shutdown saves for this profile, and add headers or
|
||||
fallback locals required by the unusually small feature matrix. No proprietary
|
||||
header, NID, syscall, firmware offset or device path is introduced.
|
||||
|
||||
## Static and dynamic core decisions
|
||||
|
||||
The static smoke core is linked into both ELFs and exports the real libretro
|
||||
entrypoints consumed by RetroArch. Dynamic loading is deliberately disabled:
|
||||
there is no proven native PS5 shared-core file/relocation/unload contract yet.
|
||||
A later milestone must separately specify format, symbol binding, executable
|
||||
memory, directory/VFS policy, ABI compatibility, error cleanup and unload.
|
||||
|
||||
No additional `libretro-samples` acquisition was needed because the required
|
||||
deterministic input, video, audio and no-content behaviour was implemented in
|
||||
the small GPL-compatible Chimera core and verified by a host harness.
|
||||
@@ -0,0 +1,70 @@
|
||||
# Phase 1.0AA: offline fake-adapter integration
|
||||
|
||||
Status: `OFFLINE_FAKE_BATCH_INTEGRATION_COMPLETE_LIVE_ADAPTER_BLOCKED`
|
||||
|
||||
Date: 2026-07-22
|
||||
|
||||
Phase 1.0AA connects the Phase-1.0Z passive batch contract to the Phase-1.0X
|
||||
exclusive evidence model using only an exact built-in fake adapter and exact
|
||||
synthetic clock. It creates no live adapter, socket, address, CLI, target code
|
||||
or target artifact. No PS5 action occurred.
|
||||
|
||||
## Closed fake boundary
|
||||
|
||||
`run_offline_fake_batch` rejects subclasses and arbitrary adapter objects. The
|
||||
only accepted components are:
|
||||
|
||||
- `OfflineFakeClock`, whose value changes only through explicit fake events;
|
||||
- `OfflineFakeBatchAdapter`, which allows one fake open, one complete Z batch,
|
||||
a bounded scripted event sequence and one fake close;
|
||||
- `OfflineFakeEvidenceStore`, which exclusively creates local test evidence.
|
||||
|
||||
There is deliberately no adapter protocol that a network implementation could
|
||||
quietly satisfy. The fake adapter records only the SHA-256 of sent bytes, not a
|
||||
target. Scripted event buffers are logically discarded during close; physical
|
||||
memory erasure remains unproven because caller-owned immutable bytes may still
|
||||
exist.
|
||||
|
||||
## State and ordering
|
||||
|
||||
```text
|
||||
validate W plan -> build and revalidate Z batch
|
||||
-> exclusive consumed receipt
|
||||
-> fake open exactly once
|
||||
-> fake send exactly one complete batch
|
||||
-> zero or more bounded DATA events before deadline
|
||||
-> HARD_DEADLINE at or after the synthetic deadline
|
||||
-> Z completeness validation and sanitization
|
||||
-> fake close exactly once
|
||||
-> exclusive receipt-bound sanitized output
|
||||
```
|
||||
|
||||
The consumed receipt includes run ID, window, batch size, batch SHA-256,
|
||||
deadline and the exact Z contract hash. It does not include a target or raw
|
||||
transcript. A failure after receipt creation leaves the receipt intact and
|
||||
creates no sanitized output; no cleanup deletes it.
|
||||
|
||||
Remote EOF, a blocked receive event, missing deadline, early deadline, data at
|
||||
or after the deadline, IAC, partial output, a second fake send, a second fake
|
||||
close and evidence collisions all fail closed. Prompt bytes remain ordinary
|
||||
data and cannot seal a result.
|
||||
|
||||
## What the tests prove
|
||||
|
||||
The host tests prove internal ordering and rejection behavior of this exact
|
||||
Python model. They do not prove:
|
||||
|
||||
- a live listener or exact deployed shsrv binary;
|
||||
- OS socket timeouts or preemption of a blocking call;
|
||||
- live fragmentation, short sends/writes, disconnect or cleanup;
|
||||
- firmware-9.60 behavior;
|
||||
- absence of atime, cache, accounting, scheduler or shell-process effects;
|
||||
- physical erasure or containing-directory durability.
|
||||
|
||||
## Decision
|
||||
|
||||
The fake integration is complete and remains host-only. A live adapter is
|
||||
blocked and unauthorized. The next permitted step is an offline feasibility
|
||||
review for a future bounded live adapter: OS timeout/preemption semantics,
|
||||
short-send handling, exclusive evidence ordering and failure cleanup must be
|
||||
specified without adding a socket, address or device action.
|
||||
@@ -0,0 +1,79 @@
|
||||
# Phase 1.0AB: offline live-adapter feasibility
|
||||
|
||||
Status: `PARTIAL_FEASIBILITY_LIVE_IMPLEMENTATION_BLOCKED`
|
||||
|
||||
Date: 2026-07-22
|
||||
|
||||
This phase audits the local Windows host runtime and models lifecycle ordering
|
||||
with synthetic traces only. It adds no socket import, address, DNS, live
|
||||
adapter, CLI or device action.
|
||||
|
||||
## Bound local runtime
|
||||
|
||||
| Object | Identity |
|
||||
|---|---|
|
||||
| Python | 3.13.2, MSC v.1942, 64-bit AMD64 |
|
||||
| `socket.py` | 38,741 bytes; SHA-256 `523695ac3383799547b421b4fe18004de1e80181e97181b6d7a10533b47f4c49` |
|
||||
| `selectors.py` | 20,060 bytes; SHA-256 `b3d6cebd4a3a03b4a614f12f171622ce4e4ba3295b9e8b89e2bde051003106eb` |
|
||||
| `_socket.pyd` | 84,984 bytes; SHA-256 `8daefaff53e6956f5aea5279a7c71f17d8c63e2b0d54031c3b9e82fcb0fb84db` |
|
||||
| `select.pyd` | 32,248 bytes; SHA-256 `baee284995b22d495fd12fa8378077e470978db1522c61bfb9af37fb827f33d1` |
|
||||
| monotonic clock | `QueryPerformanceCounter()`, monotonic, non-adjustable, reported resolution `1e-07` seconds |
|
||||
| default selector | `SelectSelector` on this runtime |
|
||||
|
||||
These identities are local host evidence only. They are not portable to a
|
||||
different Python build and say nothing about the PS5.
|
||||
|
||||
## Source-bound findings
|
||||
|
||||
The local `_socket` interface states that:
|
||||
|
||||
- `setblocking(False)` is equivalent to timeout `0.0`;
|
||||
- `connect_ex` returns an error number instead of raising for connection
|
||||
results;
|
||||
- `send` returns a byte count that may be smaller than the supplied buffer;
|
||||
- `recv` returns at most the requested bytes and returns empty bytes after
|
||||
remote close and drained data;
|
||||
- `close` makes the local socket object unusable.
|
||||
|
||||
The local `selectors.py` documents a maximum wait parameter. On Windows its
|
||||
`SelectSelector` passes readers, writers and exceptional writers to
|
||||
`select.select`, merges exceptional sockets into writable results, and returns
|
||||
an empty readiness set after `InterruptedError`. Therefore a pending connect
|
||||
must inspect `SO_ERROR` after writability, and every empty/interrupted return
|
||||
must recompute the remaining monotonic budget.
|
||||
|
||||
## Feasibility matrix
|
||||
|
||||
| Part | Classification | Reason |
|
||||
|---|---|---|
|
||||
| receipt before socket creation | `FEASIBLE_FROM_EXISTING_HOST_MODEL` | X/AA exclusive evidence already models this order |
|
||||
| numeric-address-only input | `DESIGN_REQUIRED` | DNS must be excluded; no address parser is added here |
|
||||
| nonblocking mode before connect | `FEASIBLE_FROM_LOCAL_RUNTIME` | exact local `_socket` contract exists |
|
||||
| pending connect completion | `PARTIAL` | readiness plus `SO_ERROR` is source-bound; exact accepted Windows error set still needs implementation review |
|
||||
| complete batch send | `FEASIBLE_FROM_LOCAL_RUNTIME` | repeated readiness and explicit partial-send loop are available |
|
||||
| bounded receive memory | `FEASIBLE_FROM_EXISTING_MODEL` | 65,536-byte collector bound already exists |
|
||||
| hard wall-clock deadline | `PARTIAL` | monotonic remaining budgets are feasible; selector/scheduler overshoot cannot be proven impossible |
|
||||
| prompt-independent completion | `FEASIBLE_FROM_Z` | only deadline sealing is accepted |
|
||||
| EOF behavior | `FEASIBLE_FAIL_CLOSED` | empty receive must be failure, never completion |
|
||||
| local descriptor cleanup | `FEASIBLE_BY_DESIGN` | unregister/selector close/socket close can run in `finally` |
|
||||
| remote shell cleanup | `UNPROVEN` | local close does not attest remote exit or firmware behavior |
|
||||
| retry/reconnect/resume | `EXCLUDED` | forbidden by contract |
|
||||
|
||||
Overall classification: `PARTIAL_FEASIBILITY_LIVE_IMPLEMENTATION_BLOCKED`.
|
||||
|
||||
## Existing-client comparison
|
||||
|
||||
Earlier one-shot ELF runners used blocking `sendall`, write-half-close and
|
||||
bounded receive for a different raw-ELF protocol. Their result manifests prove
|
||||
those consumed runs only. They are not reusable for shsrv: Z sends a tiny shell
|
||||
batch, must keep the write direction open while receiving, ignores prompts and
|
||||
seals only at deadline. `sendall` also hides individual partial-send progress;
|
||||
the future contract requires an explicit nonblocking send loop.
|
||||
|
||||
## Decision
|
||||
|
||||
The required sequence is implementable in principle on the exact local host,
|
||||
but a hard scheduling bound and remote cleanup cannot be proven offline. A live
|
||||
adapter remains blocked. The next permitted phase may build only a dormant,
|
||||
target-free adapter around an injected syscall facade and fake OS results. It
|
||||
must not import or instantiate a real socket until a later dedicated review.
|
||||
@@ -0,0 +1,50 @@
|
||||
# Phase 1.0AB timeout and cleanup contract
|
||||
|
||||
This is a design contract, not live network code.
|
||||
|
||||
## Future required algorithm
|
||||
|
||||
1. Rehash policy, Z batch and approval before any capability creation.
|
||||
2. Exclusively create, flush, close and reopen the consumed receipt.
|
||||
3. Acquire one absolute monotonic deadline.
|
||||
4. Create at most one stream socket and immediately set it nonblocking.
|
||||
5. Start one numeric-address connect; never perform DNS.
|
||||
6. For pending connect, wait for write/exception readiness using only the
|
||||
recomputed remaining budget, then require `SO_ERROR == 0`.
|
||||
7. Send the exact batch with an offset loop. Each call requires prior write
|
||||
readiness; zero progress, excess count or error fails the attempt.
|
||||
8. Switch to read readiness. Each read is bounded by both remaining collector
|
||||
capacity and a small fixed chunk size.
|
||||
9. Treat empty receive as remote EOF and fail immediately.
|
||||
10. After every wait or operation, read monotonic time again. At or beyond the
|
||||
deadline perform no further send or receive.
|
||||
11. Ask Z to seal only because the hard deadline was reached. Partial or
|
||||
malformed data remains invalid.
|
||||
12. In `finally`, unregister if registered, close the selector and close the
|
||||
local socket exactly once. Never retry, reconnect, resume or delete the
|
||||
consumed receipt.
|
||||
13. Create sanitized output only after successful Z sealing and local cleanup.
|
||||
|
||||
## Conservative race rule
|
||||
|
||||
When readiness and deadline coincide, the deadline wins. No additional bytes
|
||||
are read or sent at `now >= deadline`. This can reject data already queued by
|
||||
the OS, but it cannot silently extend the approved window.
|
||||
|
||||
## Failure classifications
|
||||
|
||||
| Event | Required result |
|
||||
|---|---|
|
||||
| connect error or nonzero `SO_ERROR` | fail, local cleanup |
|
||||
| selector interruption | recompute remaining budget; no retry counter |
|
||||
| selector timeout before absolute deadline | recompute; never seal early |
|
||||
| partial send | advance offset only by reported positive count |
|
||||
| zero send | fail |
|
||||
| receive over 65,536 bytes | fail |
|
||||
| remote EOF | fail |
|
||||
| deadline without complete Z result | fail |
|
||||
| cleanup exception | fail and retain receipt |
|
||||
| output collision or short host write | fail and retain existing evidence |
|
||||
|
||||
`close()` proves only local object closure. It does not prove TCP packet
|
||||
delivery, remote shsrv exit, process cleanup or reboot recovery.
|
||||
@@ -0,0 +1,24 @@
|
||||
# Phase 1.0AC fake-syscall contract
|
||||
|
||||
This contract is executable only against the exact built-in fake facade.
|
||||
|
||||
| Synthetic operation | Accepted result | Rule |
|
||||
|---|---|---|
|
||||
| `CREATE_STREAM` | `OK`, `ERROR` | exactly once after a precommitted receipt |
|
||||
| `SET_NONBLOCKING` | `OK`, `ERROR` | immediately after create |
|
||||
| `START_CONNECT` | `IMMEDIATE`, `PENDING`, `ERROR` | contains no target or address |
|
||||
| `WAIT_WRITE` | `READY`, `INTERRUPTED`, `TIMEOUT`, `ERROR` | remaining fake budget is rechecked |
|
||||
| `GET_SO_ERROR` | `ZERO`, `NONZERO`, `ERROR` | mandatory after pending readiness |
|
||||
| `WRITE_BYTES` | `PROGRESS`, `ZERO`, `ERROR` | positive progress cannot exceed remainder |
|
||||
| `WAIT_READ` | `READY`, `INTERRUPTED`, `TIMEOUT`, `ERROR` | deadline wins a simultaneous readiness event |
|
||||
| `READ_BYTES` | `PROGRESS`, `EOF`, `ERROR` | EOF is failure; total input is bounded |
|
||||
| local close | `OK`, `ERROR` | one call after ownership; none if create failed |
|
||||
|
||||
The facade accepts at most 1,024 scripted steps. One step may advance the fake
|
||||
clock by at most 60 seconds. These are model bounds, not proposed live values.
|
||||
Unused synthetic steps are logically discarded at close; physical memory
|
||||
erasure is not proven.
|
||||
|
||||
There is deliberately no adapter protocol, inheritance hook, address field,
|
||||
network import or live factory. A later phase cannot reinterpret this fake as
|
||||
device authorization.
|
||||
@@ -0,0 +1,55 @@
|
||||
# Phase 1.0AC: offline dormant adapter
|
||||
|
||||
Status: `OFFLINE_DORMANT_FAKE_SYSCALL_ADAPTER_COMPLETE_LIVE_ADAPTER_BLOCKED`
|
||||
|
||||
Date: 2026-07-22
|
||||
|
||||
Chimera GFX is a graphics/homebrew project. This phase adds host-side test
|
||||
infrastructure for a possible future one-shot launcher observation; it is not
|
||||
a security feature and it changes no RetroArch, SDL, VideoOut or target code.
|
||||
|
||||
## Closed capability boundary
|
||||
|
||||
`phase10ac_dormant_adapter.py` composes the Phase-1.0Z passive batch parser
|
||||
with an exact built-in fake syscall facade. The facade consumes caller-created
|
||||
synthetic outcomes. It cannot accept a live implementation and stores no
|
||||
target. The module imports no socket, selector, DNS, real clock or filesystem
|
||||
output interface and exposes no CLI.
|
||||
|
||||
The adapter requires a precommitted-receipt marker before the first synthetic
|
||||
create step. It then models:
|
||||
|
||||
1. one create and immediate nonblocking setup;
|
||||
2. immediate or pending connect completion;
|
||||
3. readiness plus `SO_ERROR == 0` for a pending result;
|
||||
4. an explicit partial-write loop for exactly one Phase-1.0Z batch;
|
||||
5. bounded read readiness and at most 65,536 supplied bytes;
|
||||
6. deadline-only result sealing;
|
||||
7. one local close on success or any failure after successful create.
|
||||
|
||||
Timeout and interrupted-wait events stay inside the same synthetic attempt.
|
||||
They never create a retry, reconnect or resume. When readiness coincides with
|
||||
the deadline, the deadline wins and no subsequent fake read or write occurs.
|
||||
EOF, zero progress, excess progress, malformed data and cleanup failure all
|
||||
invalidate the run.
|
||||
|
||||
## Evidence boundary
|
||||
|
||||
The 32 host tests cover immediate and pending connect paths, partial writes,
|
||||
interrupted and timeout waits, exact deadline races, EOF, receive limits,
|
||||
malformed results, cleanup and closed fake types. They prove only the Python
|
||||
model's behavior. They do not prove:
|
||||
|
||||
- a deployed shsrv identity or port-2323 behavior;
|
||||
- Windows scheduler or real socket timing;
|
||||
- a live connect, send, receive or remote-process cleanup;
|
||||
- firmware-9.60 behavior;
|
||||
- RetroArch launch context, SDL, VideoOut or rendering.
|
||||
|
||||
## Decision
|
||||
|
||||
The dormant fake-syscall adapter is complete. A live adapter remains blocked
|
||||
and absent. The next permissible step is an offline-only Phase 1.0AD design
|
||||
for numeric target validation and an inactive activation record. That phase
|
||||
must still contain no socket creation, connection, device request or enabled
|
||||
authorization.
|
||||
@@ -0,0 +1,24 @@
|
||||
# Phase 1.0AD: inactive activation contract
|
||||
|
||||
Status: `INACTIVE_NUMERIC_TARGET_CONTRACT_COMPLETE_NO_LIVE_CAPABILITY`
|
||||
|
||||
Date: 2026-07-29
|
||||
|
||||
This phase closes the data boundary left by Phase 1.0AC. It does not add a
|
||||
network adapter, target source, launcher, socket, DNS lookup, clock, CLI or
|
||||
device action.
|
||||
|
||||
The tracked activation is entirely inactive and target-free. The host-only
|
||||
contract can validate hypothetical future records, but validation neither
|
||||
activates nor persists them. A candidate must use canonical private IPv4 text,
|
||||
source-bound port 2323, a unique run ID, a window of at most five minutes and
|
||||
separate SHA-256 identities for launcher, payload and untracked approval.
|
||||
|
||||
Retry, reconnect, resume, device writes, app termination and system remounts
|
||||
are rejected. The contract deliberately cannot express authorization for
|
||||
those effects.
|
||||
|
||||
The next useful phase is a separate offline architecture review of a minimal
|
||||
BigApp launcher derived from official GPLv3 shsrv source. That review must
|
||||
remove the general shell, persistent fake-app creation, remount behavior,
|
||||
unbounded waits and arbitrary payload selection before target code is allowed.
|
||||
@@ -0,0 +1,79 @@
|
||||
# Phase 1.0AE: minimal BigApp launcher architecture
|
||||
|
||||
Status: `V07_NONPERSISTENT_LINEAGE_SELECTED_TARGET_IMPLEMENTATION_BLOCKED`
|
||||
|
||||
Date: 2026-07-29
|
||||
|
||||
## Objective
|
||||
|
||||
Identify the shortest public-source route from the proven raw-ELF VideoOut
|
||||
failure to one bounded launch-context experiment. This is an offline source
|
||||
review. It adds no target source, artifact, socket, transfer or execution.
|
||||
|
||||
## Source decision
|
||||
|
||||
Official shsrv v0.19 is not an acceptable base. Its hbldr path can remount
|
||||
`/system_ex`, persistently create `FAKE00000`, copy an executable, kill the
|
||||
running BigApp and enter unbounded ptrace/wait loops.
|
||||
|
||||
Official shsrv v0.7 is the selected reference lineage because it launches the
|
||||
existing VideoPlayer WebApp title `PPSA01659` and contains no fake-app creation
|
||||
or system-ex remount in its hbldr bundle. Selection is not authorization and
|
||||
does not prove that the title exists, launches, owns VideoOut or behaves the
|
||||
same way on firmware 9.60.
|
||||
|
||||
## Required minimal callgraph
|
||||
|
||||
The future design may model only this sequence:
|
||||
|
||||
1. validate one exact payload hash and fixed argument vector;
|
||||
2. query the foreground user;
|
||||
3. require that no BigApp is currently running;
|
||||
4. attach to the source-proven SystemService parent;
|
||||
5. arm bounded fork and exec observation before launch;
|
||||
6. request launch of the fixed existing `PPSA01659` title;
|
||||
7. detach the parent on every path;
|
||||
8. replace only the newly observed child with the exact payload;
|
||||
9. restore every temporary instruction and credential mutation;
|
||||
10. detach the child or terminate only that newly created child on failure;
|
||||
11. emit a bounded inherited result and stop.
|
||||
|
||||
The architecture must fail closed when a BigApp already exists. It must never
|
||||
call `sceSystemServiceKillApp` as part of the experiment.
|
||||
|
||||
## Removed upstream behavior
|
||||
|
||||
- general Telnet shell and arbitrary command parsing;
|
||||
- PATH search, arbitrary filesystem path and target-side ELF read;
|
||||
- `FAKE00000`, `fakeapp_create_if_missing` and `remount_system_ex`;
|
||||
- package installation, autoload and persistent writes;
|
||||
- `hbdbg`, GDB wait and free-form arguments;
|
||||
- arbitrary root/jail broadening unless separately proven indispensable and
|
||||
exactly restored;
|
||||
- unbounded `waitpid`, `pt_await_child`, `pt_await_exec`, `pt_call` and
|
||||
`pt_syscall` loops;
|
||||
- killing or replacing any pre-existing process;
|
||||
- retry, reconnect and fallback title selection.
|
||||
|
||||
## Unclosed contracts
|
||||
|
||||
Target implementation remains blocked until an offline design proves:
|
||||
|
||||
- a deadline-capable wait primitive for every wait/step boundary;
|
||||
- unique child correlation without acting on an unrelated process;
|
||||
- complete parent detach and child cleanup for every failure edge;
|
||||
- exact restoration of breakpoint bytes, page protections, credentials,
|
||||
environment, root and jail changes;
|
||||
- bounded ELF size, headers, segments, relocations and allocation;
|
||||
- exact firmware-9.60 availability and role of `PPSA01659`, or a fail-closed
|
||||
observation that does not install or mutate it;
|
||||
- accepted public evidence for every SystemService/UserService declaration;
|
||||
- an explicit policy for the unavoidable kernel/ptrace effects.
|
||||
|
||||
## Decision
|
||||
|
||||
The persistent v0.19 route is rejected. v0.7 is the preferred public-source
|
||||
reference for a nonpersistent BigApp experiment, but copying or compiling it
|
||||
is still blocked. The next phase may implement only a host lifecycle model
|
||||
with injected fake operations and exhaustive failure cleanup. It may not add
|
||||
PS5 headers, target source, syscall numbers, a target build or device action.
|
||||
@@ -0,0 +1,25 @@
|
||||
# Phase 1.0AF: offline BigApp lifecycle model
|
||||
|
||||
Status: `HOST_LIFECYCLE_MODEL_COMPLETE_TARGET_IMPLEMENTATION_BLOCKED`
|
||||
|
||||
Date: 2026-07-29
|
||||
|
||||
The host-only state machine implements the lifecycle selected in Phase 1.0AE
|
||||
using exact built-in fake events. It contains no PS5 headers, process calls,
|
||||
syscalls, socket, real clock, CLI or filesystem output.
|
||||
|
||||
The model refuses launch when a BigApp already exists. A successful synthetic
|
||||
attempt must attach and arm the parent, request only fixed title `PPSA01659`,
|
||||
observe one positive unique child identity, detach the parent, observe child
|
||||
exec, replace one exact payload, restore temporary mutations, detach the child
|
||||
and emit one result within 64 supplied ticks.
|
||||
|
||||
Failure injection proves the modeled unwind order. An acquired parent is
|
||||
detached. A newly observed child is the only process eligible for termination.
|
||||
If replacement began, restoration precedes termination. Cleanup failure is a
|
||||
hard error rather than a clean result. These are properties of the model, not
|
||||
firmware or runtime evidence.
|
||||
|
||||
Target implementation remains blocked. The next permitted work is a host-only
|
||||
bounded ELF contract and validator so malformed or oversized payloads can be
|
||||
rejected before any future launcher boundary.
|
||||
@@ -0,0 +1,26 @@
|
||||
# Phase 1.0AG: bounded ELF admission
|
||||
|
||||
Status: `BOUNDED_ELF_ADMISSION_IMPLEMENTED_HISTORICAL_ARTIFACT_BYTES_MISSING`
|
||||
|
||||
Date: 2026-07-29
|
||||
|
||||
The bytes-only validator admits only an exact SHA-256-bound, little-endian
|
||||
x86-64 `ET_DYN` payload of at most 2 MiB. All ELF, program-header, optional
|
||||
section-header and load-segment ranges must be contained in the supplied
|
||||
immutable byte string.
|
||||
|
||||
At most 32 program headers, 256 section headers and eight load segments are
|
||||
accepted. Load memory is limited to 64 MiB across a 128 MiB virtual span.
|
||||
Segments must have power-of-two alignment no greater than 2 MiB, must not
|
||||
overlap, and may never be both writable and executable. `PT_INTERP` is
|
||||
forbidden and the entry must fall inside an executable load segment.
|
||||
|
||||
The parser has no path or file interface and performs no mapping, relocation
|
||||
or execution. Synthetic tests cover identity, hash, type, machine, bounds,
|
||||
alignment, overlap, permissions, interpreter, entry and header-count failures.
|
||||
|
||||
The consumed Phase-1.0M artifact is a size/hash reference only. Its exact bytes
|
||||
are absent from the scanned workspace, so Phase 1.0AG does not claim to have
|
||||
admitted it. A future canary must be rebuilt and validated from its exact bytes.
|
||||
Before target mapping can be designed, the supported dynamic table and
|
||||
relocation subset must be specified with the same bounds.
|
||||
@@ -0,0 +1,28 @@
|
||||
# Phase 1.0AH: dynamic and relocation contract
|
||||
|
||||
Status: `LOADER_CRT_RELOCATION_SPLIT_BOUNDED_TARGET_MAPPING_BLOCKED`
|
||||
|
||||
Date: 2026-07-29
|
||||
|
||||
This bytes-only phase extends Phase 1.0AG with one bounded dynamic table and
|
||||
up to four `SHT_RELA` sections containing at most 4,096 entries. It has no
|
||||
file, mapping, module-loading or execution interface.
|
||||
|
||||
The future launcher subset applies only `R_X86_64_RELATIVE`. Each target must
|
||||
be eight-byte aligned and wholly inside an admitted RW load segment; the symbol
|
||||
index must be zero and the addend must identify admitted image memory.
|
||||
|
||||
`R_X86_64_GLOB_DAT` is admitted only as SDK-CRT work, with a nonzero symbol
|
||||
index, zero addend and an RW target. Every other relocation type fails closed.
|
||||
The exact ordered `DT_NEEDED` inventory must be supplied per artifact and may
|
||||
contain only the seven modules already evidenced for Phase 1.0M.
|
||||
|
||||
This distinction matters: official shsrv v0.7 applies RELATIVE relocations
|
||||
while the pinned SDK v0.41 CRT loads `DT_NEEDED` modules and resolves dynamic
|
||||
symbols. The latter is side-effecting runtime behavior, not a property proven
|
||||
safe by this parser.
|
||||
|
||||
The historical M counts (913 RELATIVE, 142 GLOB_DAT, seven modules) remain
|
||||
reference metadata because the bytes are absent. Target mapping remains
|
||||
blocked until allocation, copy, BSS zeroing, final page permissions and full
|
||||
failure restoration are modeled with bounded fake operations.
|
||||
@@ -0,0 +1,25 @@
|
||||
# Phase 1.0AI: offline mapping transaction
|
||||
|
||||
Status: `HOST_MAPPING_ROLLBACK_MODEL_COMPLETE_TARGET_MAPPING_BLOCKED`
|
||||
|
||||
Date: 2026-07-29
|
||||
|
||||
The host-only model consumes already admitted load metadata. It models one
|
||||
new child region and one host mirror, exact file-byte copy and BSS zeroing per
|
||||
segment, the admitted RELATIVE count, one mirror-to-child copy, final segment
|
||||
protections, image sync and mirror release.
|
||||
|
||||
Success retains the new synthetic child region only after every protection,
|
||||
sync and mirror-release step succeeds. Failure releases an acquired mirror and
|
||||
unmaps the complete newly reserved child region. A partial image is never a
|
||||
valid outcome. Cleanup failure is a hard error.
|
||||
|
||||
The supplied tick deadline is atomic: an operation that would cross the bound
|
||||
is classified as not executed. This prevents ambiguous ownership when a
|
||||
resource-creating operation meets the deadline.
|
||||
|
||||
The model rejects W+X segments and overlapping page-rounded protection ranges.
|
||||
It contains no allocator, memory mapping, process, ptrace or target interface.
|
||||
The next phase must bind every required primitive to official source and prove
|
||||
how new mappings and any temporary protection changes are undone on every
|
||||
failure path before target code is considered.
|
||||
@@ -0,0 +1,30 @@
|
||||
# Phase 1.0AJ: offline primitive source audit
|
||||
|
||||
Status: `HYBRID_PRIMITIVE_REUSE_CANDIDATE_GAPS_REMAIN_TARGET_CODE_BLOCKED`
|
||||
|
||||
Date: 2026-07-29
|
||||
|
||||
Official shsrv v0.7 remains useful only for the BigApp creation and replacement
|
||||
lineage. Its loader implementation is not reusable: remote calls are unbounded,
|
||||
and several alias-unmap, descriptor-close, host-unmap and rollback results are
|
||||
discarded.
|
||||
|
||||
The hash-bound hardened `chimera-elfldr` fork supplies better candidates for
|
||||
remote execution and cleanup. Its ptrace calls have monotonic deadlines and a
|
||||
step ceiling, registers are restored, credential restoration attempts every
|
||||
field, and acquired breakpoints, descriptors, mappings and children are handled
|
||||
by centralized cleanup with reported failure bits.
|
||||
|
||||
This is not yet a complete BigApp loader. The hardened cleanup state does not
|
||||
model every temporary JIT descriptor, alias and host mirror needed by the v0.7
|
||||
mapping lineage. It also clears ownership bits after failed cleanup, so a
|
||||
composition must make child termination the fail-closed terminal owner rather
|
||||
than treating failed release as successful release. BigApp identity/correlation,
|
||||
partial remote copy, final protection, sync and full rollback remain unbound as
|
||||
one transaction.
|
||||
|
||||
The decision is therefore hybrid reuse by composition, not source copying:
|
||||
retain v0.7 as provenance for BigApp creation, reuse only reviewed hardened
|
||||
primitives, and first extend the Phase-1.0AI host model with every temporary
|
||||
resource and cleanup failure. No target source, build or device action is
|
||||
allowed by this audit.
|
||||
@@ -0,0 +1,23 @@
|
||||
# Phase 1.0AK: offline hybrid primitive composition
|
||||
|
||||
Status: `HOST_HYBRID_RESOURCE_OWNERSHIP_MODEL_COMPLETE_TARGET_CODE_BLOCKED`
|
||||
|
||||
Date: 2026-07-29
|
||||
|
||||
This host-only model composes the lifecycle and mapping ownership needed by a
|
||||
future BigApp route. It explicitly tracks the child, whole image region, host
|
||||
mirror and every per-executable-segment JIT master descriptor, alias descriptor,
|
||||
host alias and remote alias.
|
||||
|
||||
Every forward operation is failure-injected. Acquired temporary resources are
|
||||
released in reverse groups. A failed release is never treated as successful
|
||||
release: once a child exists, bounded kill-and-reap is the terminal owner and
|
||||
models operating-system reclamation. Failure of that terminal operation is a
|
||||
hard error. A successful outcome retains only the child and committed image;
|
||||
all temporary resources are closed.
|
||||
|
||||
The model contains no process, mapping, target, clock, socket or device
|
||||
interface. It does not prove that the source primitives compose on firmware
|
||||
9.60. In particular, partial progress and credential restoration for the SDK
|
||||
`mdbg_copyin` path still require a source-bound audit before target code can be
|
||||
considered.
|
||||
@@ -0,0 +1,24 @@
|
||||
# Phase 1.0AL: offline mdbg copy and restoration audit
|
||||
|
||||
Status: `SDK_MDBG_COPY_NOT_FAIL_CLOSED_DIRECT_REUSE_BLOCKED`
|
||||
|
||||
Date: 2026-07-29
|
||||
|
||||
The exact pinned SDK v0.41 `mdbg_copyin` implementation is unsuitable for
|
||||
direct reuse in the hybrid loader. It changes the service process auth ID
|
||||
before changing capabilities, but a capability-set failure returns without
|
||||
restoring that auth ID. Its normal restoration also returns immediately after
|
||||
an auth-ID restore failure, so capability restoration is not attempted.
|
||||
|
||||
The copy loop neither bounds iterations nor uses a monotonic deadline. It does
|
||||
not reject a reported length larger than the remaining length, check pointer
|
||||
arithmetic, or expose partial progress. A nonzero remote status with zero
|
||||
progress can leave the syscall return value as zero, so return value zero does
|
||||
not prove that the requested copy completed. Any earlier iterations may already
|
||||
have mutated target memory.
|
||||
|
||||
A replacement contract must report exact progress and restoration failures,
|
||||
attempt every required restoration on every exit, and terminate/reap the child
|
||||
after any partial copy or restoration failure. This audit authorizes only a
|
||||
capability-free host model of that contract; it does not authorize target code,
|
||||
a build, connection, transfer or execution.
|
||||
@@ -0,0 +1,22 @@
|
||||
# Phase 1.0AM: offline bounded copy and restore model
|
||||
|
||||
Status: `HOST_EXACT_PROGRESS_AND_RESTORE_MODEL_COMPLETE_TARGET_CODE_BLOCKED`
|
||||
|
||||
Date: 2026-07-29
|
||||
|
||||
The capability-free model replaces the unsafe semantics identified in Phase
|
||||
1.0AL. It validates 64-bit source and destination ranges, bounds total size,
|
||||
chunk count and synthetic ticks, rejects zero or oversized progress, and
|
||||
accepts completion only at the exact requested byte count.
|
||||
|
||||
Auth ID and capabilities are both backed up before modification. Every field
|
||||
that changed is independently restored on every exit, with separate failure
|
||||
bits. A partial copy requires child termination and reap. Any credential
|
||||
restore failure additionally requires termination of the now-untrusted service;
|
||||
failure of either terminal cleanup operation is a hard error.
|
||||
|
||||
Successful exact copy keeps the child alive for subsequent loader stages. This
|
||||
is only host-model behavior. The model imports no credential, process, memory,
|
||||
clock, network or target interface and does not establish the undocumented
|
||||
remote status semantics or firmware-9.60 behavior. Target implementation stays
|
||||
blocked pending service-lifecycle ownership and source review.
|
||||
@@ -0,0 +1,25 @@
|
||||
# Phase 1.0AN: offline service lifecycle and copy audit
|
||||
|
||||
Status: `FAIL_STOP_PRESENT_RESTART_AND_BOUNDED_COPY_UNPROVEN_TARGET_CODE_BLOCKED`
|
||||
|
||||
Date: 2026-07-29
|
||||
|
||||
The hardened elfldr fork has a real fail-stop for its ptrace credential scope.
|
||||
If restoration of the temporary auth ID fails, a process-global latch rejects
|
||||
all later ptrace calls. After the current request and its cleanup attempt, the
|
||||
socket service calls `_exit(125)`.
|
||||
|
||||
That proves process termination, not safe recovery. No reviewed source owns a
|
||||
bounded restart, verifies the identity of a replacement service, or proves
|
||||
cleanup when startup-level credential restoration fails. Automatic restart is
|
||||
therefore forbidden.
|
||||
|
||||
The alternative `pt_copyin` route is also insufficient. It issues one blocking
|
||||
`PT_IO` request and does not validate returned descriptor progress. The source
|
||||
has neither a hard deadline/preemption mechanism for that call nor proof that a
|
||||
successful return means the exact requested byte count. It cannot replace the
|
||||
unsafe SDK `mdbg_copyin` merely because it changes fewer credentials.
|
||||
|
||||
The next work may only design a host-only preemption and service-owner
|
||||
architecture. No target source, build, connection, transfer, restart or device
|
||||
execution is authorized.
|
||||
@@ -0,0 +1,22 @@
|
||||
# Phase 1.0AO: offline worker supervisor model
|
||||
|
||||
Status: `HOST_PREEMPTION_OWNERSHIP_MODEL_COMPLETE_TARGET_FEASIBILITY_UNPROVEN`
|
||||
|
||||
Date: 2026-07-29
|
||||
|
||||
The capability-free architecture isolates the potentially blocking copy and
|
||||
temporary credentials in a one-shot worker. The persistent supervisor changes
|
||||
no credentials. It accepts only a result bound to the exact worker identity,
|
||||
exact requested byte count and zero restoration-failure bits.
|
||||
|
||||
A deadline terminates and reaps the worker. Once copy start is attempted, every
|
||||
deadline, malformed/wrong-identity result, partial copy, restoration failure or
|
||||
ambiguous start additionally terminates and reaps the child. Any terminal
|
||||
cleanup failure is a hard error. The supervisor performs no retry and never
|
||||
automatically restarts a worker or service.
|
||||
|
||||
This model does not prove that PS5 userland can create and uniquely identify
|
||||
such a worker, preempt one blocked inside the relevant syscall, or return a
|
||||
bounded authenticated result. It contains no process, signal, clock, IPC,
|
||||
network or target interface. A source-feasibility audit is required before
|
||||
target code can be considered.
|
||||
@@ -0,0 +1,26 @@
|
||||
# Phase 1.0AP: current-upstream worker feasibility audit
|
||||
|
||||
Status: `WORKER_CREATION_SOURCE_CANDIDATE_PREEMPTION_AND_RESULT_CHANNEL_BLOCKED`
|
||||
|
||||
Date: 2026-07-29
|
||||
|
||||
The current official SDK and shsrv heads were fetched as Git objects without
|
||||
changing either pinned worktree. The SDK declares `rfork_thread`, and current
|
||||
shsrv uses it both for forked shell builtins and its raw ELF process path. A
|
||||
returned PID makes worker creation a strong public-source candidate.
|
||||
|
||||
That PID is not a generation-safe identity. There is no bounded worker-start
|
||||
handshake or birth token. Official source uses `SIGKILL` and `waitpid`, but the
|
||||
relevant waits are blocking and do not prove that a worker stuck in `mdbg` or
|
||||
`PT_IO` can be terminated and reaped within a deadline on firmware 9.60. The
|
||||
state of a separately mutated child after worker termination is also unknown.
|
||||
|
||||
Shell pipes are generic byte streams, not the fixed, identity-bound result
|
||||
record required by Phase 1.0AO. They provide no exact progress/restoration
|
||||
fields, bounded receive or deadline sealing. Current shsrv code must not be
|
||||
copied: its broader persistence and lifecycle effects remain rejected by prior
|
||||
phases.
|
||||
|
||||
The next allowed step is a capability-free fixed-result and PID-generation
|
||||
contract. No target source, build, connection, transfer or execution is
|
||||
authorized.
|
||||
@@ -0,0 +1,23 @@
|
||||
# Phase 1.0AQ: offline fixed worker result record
|
||||
|
||||
Status: `FIXED_RESULT_AND_GENERATION_IDENTITY_COMPLETE_TRANSPORT_BLOCKED`
|
||||
|
||||
Date: 2026-07-29
|
||||
|
||||
The bytes-only protocol is one exact 128-byte little-endian record. It binds an
|
||||
attempt ID, worker nonce, worker and child PID, monotonic generation, requested
|
||||
and copied byte counts, status and credential-restoration failure bits. The
|
||||
first 96 bytes are protected by a trailing SHA-256 digest. Reserved and flag
|
||||
fields must be zero.
|
||||
|
||||
PID alone is explicitly insufficient. A result is accepted only when every
|
||||
identity field equals a precommit. Success additionally requires the exact
|
||||
requested byte count and zero restoration failures. Failure records preserve
|
||||
partial progress. Tests mutate every byte position and also reject rehashed
|
||||
records with semantically invalid fields.
|
||||
|
||||
SHA-256 provides integrity here, not authentication; identity comes from the
|
||||
precommitted attempt and nonce. The model has no random source, pipe, socket,
|
||||
process, clock or target capability. Exclusive writer ownership, partial reads,
|
||||
EOF/deadline behavior and PS5 pipe atomicity remain unproven, so no transport or
|
||||
target implementation is allowed.
|
||||
@@ -0,0 +1,21 @@
|
||||
# Phase 1.0AR: offline exclusive result channel model
|
||||
|
||||
Status: `HOST_PARTIAL_READ_AND_DEADLINE_MODEL_COMPLETE_LIVE_CHANNEL_BLOCKED`
|
||||
|
||||
Date: 2026-07-29
|
||||
|
||||
The transport-free model consumes synthetic chunks from exactly one
|
||||
precommitted writer. It supports every two-part split and byte-at-a-time
|
||||
delivery of the 128-byte Phase-1.0AQ record. Completion of the exact record, not
|
||||
EOF, is the only success boundary.
|
||||
|
||||
EOF or deadline before completion, silent incompleteness, overflow, digest or
|
||||
identity mismatch, and any event after the exact record all fail closed. A read
|
||||
that would cross the synthetic deadline is classified as not executed. Every
|
||||
failed outcome requires the supervisor to contain worker and child.
|
||||
|
||||
The model does not rely on a 128-byte atomic write: partial reads are expected.
|
||||
It contains no pipe, descriptor, real clock, process or target interface. Live
|
||||
descriptor inheritance, close ordering, nonblocking reads and a hard deadline
|
||||
must be bound to reviewed public source before a channel implementation can be
|
||||
considered.
|
||||
@@ -0,0 +1,21 @@
|
||||
# Phase 1.0AS: offline channel primitive and FD ownership audit
|
||||
|
||||
Status: `PIPE_POLL_CANDIDATES_PRESENT_FD_INHERITANCE_AND_HARD_DEADLINE_BLOCKED`
|
||||
|
||||
Date: 2026-07-29
|
||||
|
||||
Current official SDK declarations and shsrv call sites make `pipe` and `poll`
|
||||
public-source candidates. The shsrv telnet loop uses a short relative poll, but
|
||||
does not compose it with an absolute monotonic deadline, EINTR budget
|
||||
recalculation or bounded worker reap.
|
||||
|
||||
The decisive ownership mismatch is in worker creation. The official header
|
||||
defines `RFFDG` as copying the descriptor table and `RFCFDG` as closing every
|
||||
descriptor. Current shsrv workers use `RFCFDG`; a pre-created result pipe would
|
||||
therefore not be inherited. No reviewed worker path uses `RFFDG` with exclusive
|
||||
parent/child pipe-end closure or close-on-exec handling.
|
||||
|
||||
Headers alone do not prove that a new composition is safe on firmware 9.60.
|
||||
The next phase may model FD acquisition, inheritance, close ordering, EINTR and
|
||||
an absolute deadline using fake operations only. No live channel, target source,
|
||||
build or device action is authorized.
|
||||
@@ -0,0 +1,20 @@
|
||||
# Phase 1.0AT: offline RFFDG FD/deadline model
|
||||
|
||||
Status: `OFFLINE_OWNERSHIP_MODEL_COMPLETE_LIVE_COMPOSITION_BLOCKED`
|
||||
|
||||
Date: 2026-07-29
|
||||
|
||||
This phase composes the Phase-1.0AS source candidates in a fake-only ownership
|
||||
transaction. A pipe exists before the modeled `RFFDG` worker copy. The parent
|
||||
closes its write end, the worker closes its read end, and the parent assembles
|
||||
one exact Phase-1.0AQ record through a nonblocking partial-read model.
|
||||
|
||||
One 256-tick absolute budget covers setup, EINTR, would-block and data events.
|
||||
Deadline, early EOF, overflow, a damaged record or any trailing read event
|
||||
contains the worker. Every acquired pipe end is closed and every started worker
|
||||
is terminated and reaped; a cleanup failure is itself a hard model error.
|
||||
|
||||
The facade is scripted and imports no OS, process, clock, network or filesystem
|
||||
capability. It does not establish a real `RFFDG` composition, hard wall-clock
|
||||
preemption, bounded real reap or firmware-9.60 behavior. No target source,
|
||||
cross-build, connection, transfer or execution is authorized.
|
||||
@@ -0,0 +1,21 @@
|
||||
# Phase 1.0AU: offline live result-channel feasibility reassessment
|
||||
|
||||
Status: `PRIMITIVE_SIGNATURES_COMPLETE_COMPOSITION_AND_RUNTIME_BLOCKED`
|
||||
|
||||
Date: 2026-07-29
|
||||
|
||||
The current official SDK headers expose the complete source-level vocabulary
|
||||
needed by the Phase-1.0AT model: `pipe`, `RFFDG`, `fcntl` with `O_NONBLOCK`,
|
||||
`poll`, `CLOCK_MONOTONIC`, `kill`, and `waitpid` with `WNOHANG`.
|
||||
|
||||
No audited official callsite composes that vocabulary into the required
|
||||
channel. Current shsrv builtin workers use `RFCFDG`, which closes pre-created
|
||||
descriptors. Its waits are not bounded by one absolute monotonic deadline and
|
||||
the service has an automatic restart loop. Direct code reuse would violate the
|
||||
one-shot, no-retry and explicit-supervisor boundaries.
|
||||
|
||||
Headers are declarations, not firmware-9.60 runtime evidence. The AT fake
|
||||
model is not proof of hard preemption, real descriptor cleanup, launch context,
|
||||
VideoOut ownership or a visible flip. A live or target implementation remains
|
||||
blocked. The next permitted step is only an offline, target-free canary
|
||||
contract with a distinct post-result terminal state.
|
||||
@@ -0,0 +1,28 @@
|
||||
# Phase 1.0AV: target-free launch-context canary contract
|
||||
|
||||
Status: `OFFLINE_CAUSAL_PAIR_CONTRACT_COMPLETE_NO_ARTIFACT_OR_AUTHORITY`
|
||||
|
||||
Date: 2026-07-29
|
||||
|
||||
AV defines the minimum causal comparison for the launch-context hypothesis.
|
||||
Both arms must use the same exact future payload and `CHD10AV1` protocol. One
|
||||
arm uses raw elfldr and the other a separately identified BigApp candidate.
|
||||
Launcher hashes, run IDs and approval hashes must differ; neither approval can
|
||||
carry to the other arm. Retry, reconnect, resume, installation and autoload are
|
||||
forbidden.
|
||||
|
||||
Each supplied result must prove submit, then D04, then a distinct later cleanup
|
||||
terminal. Missing or early terminal state makes the pair incomparable. Identity
|
||||
drift, a retry, a persistent-write count or an unscoped visible-output claim is
|
||||
a hard contract failure. Graphics operations have a separate closed approval
|
||||
gate and are not conflated with persistent writes.
|
||||
|
||||
A changed submit return is classified only as a launch-context candidate. A
|
||||
zero return is not interpreted as a visible flip, correct VideoOut semantics or
|
||||
root cause. This module processes synthetic immutable values only. There is no
|
||||
target source, artifact, address, transport, activation or device authority.
|
||||
|
||||
Before any implementation can be considered, a separate offline audit must
|
||||
bind the exact source delta, post-D04 terminal, launcher effects and result-path
|
||||
feasibility. BigApp termination requires its own explicit artifact-specific
|
||||
approval and is currently false.
|
||||
@@ -0,0 +1,28 @@
|
||||
# Phase 1.0AW: offline canary source-delta and effect audit
|
||||
|
||||
Status: `SOURCE_DELTA_BOUNDED_RESULT_PATH_CANDIDATE_EFFECTS_BLOCK_ARTIFACT`
|
||||
|
||||
Date: 2026-07-29
|
||||
|
||||
The historical Phase-1.0M bytes are absent and implement `CHD10J01`, where
|
||||
D12 is terminal and D04 can follow it. They cannot satisfy AV and cannot be
|
||||
reused. A new profile must build one ELF for both launch arms; launcher identity
|
||||
must never become a compile define or payload-byte difference.
|
||||
|
||||
The smallest source design adds `CHD10AV1` and D14. Submit-before-D04 ordering
|
||||
is retained. D12 becomes shutdown-request evidence only. D14 may be emitted
|
||||
once, through inherited stdout, only after `rarch_main` returns, S15 is set,
|
||||
the initialized mask is empty, cleanup ordering has no errors and a new cleanup
|
||||
failure counter is zero. The counter is necessary because the current
|
||||
first-error field can retain E106 and mask a later E122 cleanup failure.
|
||||
|
||||
Official shsrv v0.7 supplies a source candidate for the other arm: hbldr passes
|
||||
stdout to `elfldr_exec`, which duplicates it into the replaced BigApp process,
|
||||
and the v0.7 shell framing is raw. This does not prove a live binary channel.
|
||||
The deployed identity is unknown and host completion remains unimplemented.
|
||||
|
||||
The same v0.7 route reads a device-resident ELF, kills the running BigApp,
|
||||
launches PPSA01659, waits indefinitely for child discovery, mutates kernel and
|
||||
ptrace state, and changes root/jail state. Direct reuse is rejected. No source
|
||||
was changed, no artifact was built, and no device action is authorized. Only a
|
||||
host-tested, non-target source design may follow.
|
||||
@@ -0,0 +1,24 @@
|
||||
# Phase 1.0AX: host-only AV protocol and cleanup model
|
||||
|
||||
Status: `HOST_REFERENCE_MODEL_COMPLETE_TARGET_SOURCE_AND_ARTIFACT_BLOCKED`
|
||||
|
||||
Date: 2026-07-29
|
||||
|
||||
AX turns AW's source requirements into an exact bytes-only reference model.
|
||||
Frames remain 64-byte, big-endian and CRC-bound over the first 60 bytes, but
|
||||
use `CHD10AV1`. Historical wire values are preserved and D14 is appended at
|
||||
stage value 30. D12 cannot carry the terminal flag; only a final D14 can.
|
||||
|
||||
D14 records the current initialized mask, cleaned mask, `rarch_main` result,
|
||||
cleanup-order errors and the independent cleanup-failure count. It is generated
|
||||
only when `rarch_main` returned, D04 was emitted, phase S15 was reached, no
|
||||
subsystem remains initialized and both cleanup error counts are zero.
|
||||
|
||||
The trace layer requires exactly one D07, D04 and final D14 in that order,
|
||||
strictly increasing sequence values, at most one D12 and no post-terminal data.
|
||||
All 64 single-byte mutations fail CRC or canonical parsing. Correctly
|
||||
rechecksummed but false cleanup claims also fail.
|
||||
|
||||
This is Python byte processing only. It creates no target profile, source,
|
||||
artifact, socket, process, output file, address or authorization. Passing it
|
||||
proves neither target equivalence nor firmware behavior.
|
||||
@@ -0,0 +1,20 @@
|
||||
# Phase 1.0AY: offline RetroArch target-source base reassessment
|
||||
|
||||
Status: `EXACT_PHASE10N_BASE_SELECTED_HOST_SOURCE_PATCH_ONLY`
|
||||
|
||||
Date: 2026-07-29
|
||||
|
||||
The local primary RetroArch checkout remains on the historical loader-diagnosis
|
||||
branch. It is not switched or rewritten. The exact source base selected for the
|
||||
next isolated worktree is private commit `606909706f91d7213751c245081333f56c2cce89`,
|
||||
the inactive Phase-1.0N runner tip.
|
||||
|
||||
That commit descends from Phase-1.0M, contains its artifact audit and preserves
|
||||
all target-source blobs relevant to AX byte-for-byte. Its Makefile difference
|
||||
adds only inactive N runner validation. This makes it the least-lossy base and
|
||||
avoids replaying the completed M/N history onto the older checkout.
|
||||
|
||||
The next patch is limited to host-tested source structure: cleanup-failure
|
||||
accounting, `CHD10AV1`, D14 and its cleanup predicate. It may not add a target
|
||||
profile, cross-build, artifact, launcher-specific define or runner activation.
|
||||
Every hardware and build authorization remains false.
|
||||
@@ -0,0 +1,30 @@
|
||||
# Phase 1.0AZ: host-tested AV source structure
|
||||
|
||||
Status: `REMOTE_BOUND_HOST_TESTED_SOURCE_TARGET_REASSESSMENT_ONLY`
|
||||
|
||||
Date: 2026-07-29
|
||||
|
||||
An isolated RetroArch worktree was created from the exact Phase-1.0N tip and
|
||||
committed locally as `a3887edd90780426b3762d42b8e3b96f8ca6813d`. The change
|
||||
implements the source structure selected by AY without creating a PS5 build
|
||||
profile or artifact.
|
||||
|
||||
The distinct stream magic is `CHD10AV1`; D14 is appended as stage 30 without
|
||||
renumbering historical stages. Under the AV host define, D11 and D12 are
|
||||
nonterminal. D14 is the sole terminal and is attempted at most once only after
|
||||
a successfully written D04, reported `rarch_main` return, S15, an empty
|
||||
initialized mask, zero cleanup-order errors and zero cleanup failures.
|
||||
Duplicate or failed cleanup is counted independently from the sticky first
|
||||
error, so an earlier runtime error cannot mask cleanup failure.
|
||||
|
||||
The new ASan/UBSan host test passed, as did every C host test and the existing
|
||||
Windows-side Phase-1.0I/J/K/M/N and structural validators. The combined WSL
|
||||
target stopped only when an older validator invoked `git ls-files`: a linked
|
||||
Windows worktree stores a Windows-absolute gitdir that WSL Git cannot resolve.
|
||||
|
||||
The inherited HTTPS remote first failed authentication. The repository was then
|
||||
pushed through the same private Gitea SSH route already configured for Chimera
|
||||
GFX, and `origin/codex/ps5-phase10az-host-av-source` was fetched back as the
|
||||
exact commit above. Remote source binding is therefore complete. Only an
|
||||
offline target-profile reassessment may follow; no target build, ELF,
|
||||
connection, transfer, execution or device action is authorized.
|
||||
@@ -0,0 +1,49 @@
|
||||
# Phase 1.0B device risk assessment
|
||||
|
||||
Overall classification:
|
||||
`RETROARCH_PS5_DEVICE_SMOKE_CANDIDATE_BUILT_WITH_DECLARED_RISKS`.
|
||||
|
||||
## Hard boundaries satisfied offline
|
||||
|
||||
- no PS5 connection, request, transfer or execution occurred;
|
||||
- no installation, autoload, live replacement, sender or retry exists;
|
||||
- no content/config file is required;
|
||||
- persistent write attempts fail closed;
|
||||
- the run requests shutdown at 60 seconds or 3,600 frames;
|
||||
- Options held for two seconds provides an additional shutdown;
|
||||
- the final ELF contains no SceNet, GNM, module-loader, installer, mount,
|
||||
reboot, console-shutdown or other-payload launch import;
|
||||
- SDL's dynamic API and runtime assertion-exit path are disabled, leaving one
|
||||
smoke-owned post-teardown `_Exit` callsite;
|
||||
- the primary ELF contains no permanent W+X load segment.
|
||||
|
||||
The strings audit still sees shared RetroArch localization text for disabled
|
||||
network, autoload and reboot menu entries, plus the generic
|
||||
`udp://127.0.0.1:` template. These are inert data findings, not hidden
|
||||
functionality: the complete undefined-symbol inventory has no networking
|
||||
primitive, and no RetroArch network callgraph is linked. SDK runtime-loader
|
||||
symbol-name strings remain separately because the pinned CRT resolves its
|
||||
own loader at runtime.
|
||||
|
||||
## Declared device-test risks
|
||||
|
||||
| Risk | Class | Bounded mitigation | Residual |
|
||||
|---|---|---|---|
|
||||
| SDK CRT temporary kernel/process patches before `main` | session/integrity | exact SDK v0.41 source and controlled runtime identity | firmware-9.60 effect unobserved |
|
||||
| SDK CRT runtime loader | session/initialization | exact source and DT_NEEDED inventory; no RetroArch dynamic-core path | CRT resolves `sceKernelLoadStartModule` at runtime and can conditionally load `libSceSysmodule`; this is not visible as an ELF import |
|
||||
| `sceAudioOutOutput` is blocking | session hang | SDL worker, error counters, outer 60 s policy | no public timeout ABI; thread/join can still block |
|
||||
| VideoOut/Pad/AudioOut open calls lack an evidenced timeout variant | session hang | single attempt, no retry, partial cleanup | underlying call can outlive outer policy |
|
||||
| direct-memory mapping has no separately evidenced unmap in pinned SDL headers | cleanup | release direct memory and process exit | mapping cleanup before exit is incomplete/unproven |
|
||||
| new RX/R/RW layout | child/session crash | source-bound loader flag handling and relocation audit | device behavior unobserved |
|
||||
| `_Exit` in injected child | session termination | one smoke-owned call after teardown; SDL secondary exit paths compiled out | exact firmware behavior unobserved; SDK init-failure fallback still owns its separate `exit` path |
|
||||
| write firewall relies partly on link wrapping | integrity | VFS guard plus import/disassembly/callgraph audit | libc-internal behavior is not intercepted |
|
||||
| controller mapping differs from label conventions | operability | source-bound Options-to-SDL-Back-to-RetroArch-Select chain | on-device button observation absent |
|
||||
|
||||
These are not brick-safety guarantees. A later operator must explicitly
|
||||
accept possible black screen, missing audio/input, process crash, lost
|
||||
jailbreak/host session, forced manual reboot after a hang, and no diagnostic
|
||||
after video teardown.
|
||||
|
||||
The missing byte-exact Payload Manager backup remains a separate installation
|
||||
blocker. This candidate does not alter that gate because it is not an
|
||||
installation proposal.
|
||||
@@ -0,0 +1,62 @@
|
||||
# Phase 1.0B linker and W^X analysis
|
||||
|
||||
## SDK baseline
|
||||
|
||||
PS5 Payload SDK v0.41 `ldscripts/elf_x86_64.x:20-25` emits three load
|
||||
segments but deliberately marks text `0x7` (RWE), rodata `0x6` (RW) and data
|
||||
`0x6` (RW). The Phase-1.0A software ELF consequently has a permanent RWE
|
||||
text segment.
|
||||
|
||||
## Loader evidence
|
||||
|
||||
Both public elfldr `699e8bcff03e91e8d6ca6eba281af25c5a58d8c2`
|
||||
and hardened elfldr `197623058f509eddde18868dafcb92fdcac66464`:
|
||||
|
||||
- enumerate every `PT_LOAD`;
|
||||
- initially reserve one RW image mapping;
|
||||
- copy all segments and apply `R_X86_64_RELATIVE` relocations in the host
|
||||
mirror;
|
||||
- copy the completed image to the child;
|
||||
- translate every `p_flags` bit through `PFLAGS`;
|
||||
- use `kernel_mprotect` for executable segments and `pt_mprotect` otherwise.
|
||||
|
||||
Relevant hardened source is `elfldr.c:54-56,144-263`. This supports multiple
|
||||
load segments and a temporary relocation-write phase followed by final
|
||||
per-segment protection.
|
||||
|
||||
## Smoke layout
|
||||
|
||||
The smoke-only `pkg/ps5/elf_x86_64_smoke_wx.x` preserves the SDK symbols and
|
||||
0x4000 page alignment while arranging:
|
||||
|
||||
- `.text` and `.plt`: RX;
|
||||
- unwind tables and constant `.rodata`: R;
|
||||
- dynamic symbol/hash/string/relocation tables, `.data.rel.ro`, GOT,
|
||||
init/fini arrays, `.dynamic`, `.data` and `.bss`: RW.
|
||||
|
||||
Runtime-relocated GOT and related metadata deliberately remain writable.
|
||||
The final program-header audit must show no segment with both W and E. All
|
||||
`R_X86_64_RELATIVE` destinations must lie in RW load ranges. The primary
|
||||
candidate is accepted only if both checks pass twice byte-identically.
|
||||
|
||||
## RELRO and self-modification
|
||||
|
||||
The pinned SDK/loader contract does not implement a post-CRT RELRO transition.
|
||||
Marking the GOT read-only before SDK runtime linking would be unsafe, so no
|
||||
RELRO claim is made. No self-modifying RetroArch/smokecore code, JIT or
|
||||
dynamic core loader is enabled or reachable. No production elfldr code was
|
||||
changed.
|
||||
|
||||
## Residual risk
|
||||
|
||||
W^X is statically established, but the exact protected layout has not run on
|
||||
firmware 9.60. Loader protection errors, an SDK runtime write to an
|
||||
unexpected R-only section, or firmware-specific mapping behavior could end
|
||||
the child/session. No persistent installation effect follows from the
|
||||
artifact design, but that claim also remains unobserved.
|
||||
|
||||
The SDK CRT's statically linked runtime loader is present independently of
|
||||
RetroArch's feature set and may conditionally load `libSceSysmodule`.
|
||||
The final import list has no module-loader symbol, but absent imports alone
|
||||
are not used as proof that startup has no module effects; the CRT source and
|
||||
startup disassembly are the controlling evidence.
|
||||
@@ -0,0 +1,47 @@
|
||||
# Phase 1.0B persistent-write audit
|
||||
|
||||
Conclusion: persistent device writes are fail-closed in the selected smoke
|
||||
paths; device execution remains unauthorized.
|
||||
|
||||
## Layers
|
||||
|
||||
1. The PS5 frontend blocks config reads, supplies no content/config/SRAM/state
|
||||
path and selects a static no-content core.
|
||||
2. RetroArch VFS accepts only `RETRO_VFS_FILE_ACCESS_READ`. Write, truncate,
|
||||
remove, rename and mkdir return failure and trip `E118`.
|
||||
3. Link-time wrappers reject write-capable `open/openat`, non-read-only
|
||||
`fopen`, non-stdio `write/fwrite`, and all create, temp, rename, unlink,
|
||||
remove, mkdir, rmdir, chmod, chown and truncate calls.
|
||||
4. A rejected operation returns `EROFS`, stores the first operation in memory,
|
||||
requests shutdown once and never retries.
|
||||
|
||||
`stdout` and `stderr` writes remain allowed because the SDK CRT/RetroArch can
|
||||
already use those process streams. They are not file-output authorization.
|
||||
The ELF imports read-only filesystem primitives (`open`, `fopen`, `read`,
|
||||
`fread`, `stat`, directory iteration); the frontend has no content/config
|
||||
path, but normal runtime/module implementation can still use read primitives.
|
||||
|
||||
## Static reachability result
|
||||
|
||||
Final link garbage collection removes wrapper bodies for operations with no
|
||||
remaining caller. Reachable application calls to `open`, `fopen` and `fwrite`
|
||||
resolve to `__wrap_open`, `__wrap_fopen` and `__wrap_fwrite`; their only
|
||||
forward edges are read-only opens or stdout/stderr. The underlying libc
|
||||
imports remain because accepted paths forward to them.
|
||||
|
||||
No final import is present for `rename`, `unlink`, `remove`, `mkdir`, `chmod`,
|
||||
`chown`, `ftruncate`, `mkstemp`, `tmpfile` or `freopen`. Static absence alone
|
||||
is not the safety claim: the VFS guards, wrappers, linker map and disassembly
|
||||
together provide the offline evidence.
|
||||
|
||||
## Explicit exclusions
|
||||
|
||||
The profile disables or provides no route for config save, playlist/history,
|
||||
SRAM, savestate, screenshot, recording, shader cache, autoconfig, remap,
|
||||
database, temporary file, installation and autoload. It contains no device
|
||||
path, IP address, sender, transfer or installation package.
|
||||
|
||||
Limit: libc internals invoked inside an imported function are not intercepted
|
||||
by linker wrapping. No application path can supply a writable file stream
|
||||
because writable open modes are blocked, but this remains static reasoning,
|
||||
not observed firmware behavior.
|
||||
@@ -0,0 +1,49 @@
|
||||
# Proposed Phase 1.0B one-shot test
|
||||
|
||||
Status: proposal only. Transfer and execution are not authorized.
|
||||
|
||||
## Preconditions for a later review
|
||||
|
||||
- bind approval to the complete ELF SHA-256, size, source commit and manifest
|
||||
SHA-256;
|
||||
- operator independently confirms firmware 9.60 in the PS5 UI;
|
||||
- autoload remains disabled and no live path is selected or replaced;
|
||||
- exactly one transfer and one execution are separately authorized;
|
||||
- no retry, reinstall, backup, recovery, configuration or second payload is
|
||||
combined with the window;
|
||||
- operator accepts all risks in the device-risk assessment.
|
||||
|
||||
## Expected visible sequence
|
||||
|
||||
1. A software framebuffer appears with `CHIMERA RETROARCH PS5 SMOKE TEST`.
|
||||
2. Initialization can pass rapidly through `S01`-`S06`; these phases are not
|
||||
guaranteed to receive their own visible frame.
|
||||
3. `S07` shows increasing monotonic time/frame count, VideoOut/flip index,
|
||||
320 x 240 source with destination pitch/dimensions, XRGB8888 format code,
|
||||
controller buttons/sticks, AudioOut counters, core state and `E000`.
|
||||
4. Holding Options for two seconds shows hold progress and requests `S08`.
|
||||
Without input, 60,000 ms or 3,600 frames requests the same bounded path.
|
||||
5. The final visible frame can show `S08` and its shutdown reason.
|
||||
6. `S09`-`S15` run after the last present; `_Exit` ends the child. No visible
|
||||
completion frame is promised.
|
||||
|
||||
## Operator stop criteria
|
||||
|
||||
Do not retry. Stop the window and record the last visible phase/error when:
|
||||
|
||||
- no image appears;
|
||||
- framebuffer bounds are `FAIL`;
|
||||
- any error other than `E000` appears;
|
||||
- flip count stops advancing;
|
||||
- input state is implausible or Options does not progress;
|
||||
- AudioOut submit time grows unexpectedly or frames stop;
|
||||
- the screen freezes beyond 60 seconds;
|
||||
- RetroArch exits before the expected phase;
|
||||
- the jailbreak/host session disappears;
|
||||
- any write-firewall trip is shown;
|
||||
- any unexpected notification, install, autoload, network or filesystem
|
||||
behavior is observed.
|
||||
|
||||
If the child does not exit, the proposal permits no automated kill, retry or
|
||||
reboot command. The operator may later decide manually whether a console
|
||||
reboot is necessary, outside the authorization window.
|
||||
@@ -0,0 +1,65 @@
|
||||
# Phase 1.0B runtime and exit contract
|
||||
|
||||
Status: source-bound offline contract; firmware-9.60 behavior remains
|
||||
unproven until a separately authorized one-shot run.
|
||||
|
||||
## Stateful lifecycle
|
||||
|
||||
The status record tracks platform, frontend, SDL, video, input, audio, core,
|
||||
threads, buffers, direct memory and device handles. Initialization records
|
||||
each subsystem once in a bounded stack. Cleanup may touch only an initialized
|
||||
bit, runs once, and verifies reverse order. An order violation is sticky
|
||||
`E120`, duplicate init is `E119`, duplicate cleanup is `E121`, and a cleanup
|
||||
failure is `E122`. Host fault injection covers every partial-init boundary,
|
||||
every per-subsystem cleanup failure and an out-of-order cleanup.
|
||||
|
||||
Video cleanup stops future flips, destroys the software surface and event
|
||||
queue, closes VideoOut, releases direct memory, then clears handles. Input
|
||||
cleanup closes Pad before its state is cleared. Audio cleanup stops the SDL
|
||||
worker before AudioOut close and records the elapsed cleanup time. The pinned
|
||||
public SDL source exposes release of direct memory but no separately evidenced
|
||||
direct-memory unmap primitive; this remains a declared cleanup uncertainty.
|
||||
|
||||
## Exit alternatives
|
||||
|
||||
| Option | Exact evidence | Destructors/cleanup | Continuation | Decision |
|
||||
|---|---|---|---|---|
|
||||
| return from `main` | SDK `crt/crt.c:133-146,153-170,196-220` | SDK `.fini` runs | a hijacked process returns through the synthetic address placed by elfldr | rejected |
|
||||
| `payload_exit` | SDK `crt/crt.c:174-180`, `payload.h:45-51` | long-jumps into CRT | still reaches `payload_terminate`; hijacked route returns | rejected |
|
||||
| libc `exit` | imported and used by SDK `payload_terminate` only for a non-hijacked process | libc exit semantics; would bypass the remaining SDK payload path when called directly | process termination expected | not selected |
|
||||
| libc `_Exit` | public libc import in the final ELF; direct call from smoke `main` | all RetroArch/SDL cleanup runs first; no process destructors after call | no synthetic return | selected |
|
||||
|
||||
The selected method is compile-time
|
||||
`CHIMERA_PS5_EXIT_PROCESS_EXIT=1`. After `rarch_main` completes,
|
||||
`main` sets `S15` and reaches one smoke-owned `_Exit(result)` call.
|
||||
The smoke SDL overlay disables the dynamic API and sets
|
||||
`SDL_ASSERT_LEVEL=0`, removing SDL's secondary `SDL_ExitProcess` callsites.
|
||||
Disassembly and the undefined-symbol inventory bind this decision. It does
|
||||
not reboot, launch another process, retry or write a device file. The SDK CRT
|
||||
still imports `exit` for its own pre-`main` initialization-failure
|
||||
termination; that separate startup path is not represented as the selected
|
||||
smoke exit.
|
||||
|
||||
## Loader relationship
|
||||
|
||||
Hardened elfldr commit `197623058f509eddde18868dafcb92fdcac66464`
|
||||
spawns a separate child, writes the pre-injection RIP to `rsp-8`, enters the
|
||||
payload at `_start`, and on the controlled route waits under a bounded
|
||||
watchdog (`elfldr.c:381-410,643-768`;
|
||||
`socksrv.c:128-157`; `ps5_controlled.c:186-215`). `_Exit` terminates that
|
||||
child instead of resuming the synthetic continuation.
|
||||
|
||||
This is stronger source evidence than returning, but it is not device
|
||||
evidence. Remaining exit risks are:
|
||||
|
||||
- SDK CRT initialization and temporary runtime patches occur before `main`;
|
||||
- SDK CRT startup resolves runtime-loader functions and may conditionally
|
||||
load `libSceSysmodule` before entering RetroArch;
|
||||
- firmware-9.60 libc `_Exit` behavior in this exact injected child is
|
||||
unobserved;
|
||||
- a blocked AudioOut call or SDL join can prevent reaching `_Exit`;
|
||||
- the controlled loader route itself is not authorized or exercised here;
|
||||
- ending the child can end the current host/jailbreak session, which is a
|
||||
session risk rather than an installation guarantee.
|
||||
|
||||
No execution-review bundle has been produced.
|
||||
@@ -0,0 +1,81 @@
|
||||
# Phase 1.0B bounded RetroArch smoke candidate
|
||||
|
||||
Status: `BUILT_WITH_DECLARED_RISKS`; offline evidence only. Transfer,
|
||||
installation and execution are not authorized.
|
||||
|
||||
## Scope
|
||||
|
||||
The candidate is the real RetroArch v1.22.2 frontend and runloop from the
|
||||
separate `chimera-retroarch` fork. It statically binds `chimera_smokecore`,
|
||||
uses the pinned PS5 SDL2 software framebuffer, and initializes VideoOut, one
|
||||
Pad device and stereo AudioOut. It requires neither content nor a
|
||||
configuration file. It is not a mini-frontend and contains no dynamic core.
|
||||
The permitted existing smokecore software image is selected, so RGUI/menu
|
||||
and their content browser are compiled out of this bounded variant.
|
||||
|
||||
The logical profile is `ps5-software-rgui-smoke-bounded`; the make selector is
|
||||
`PS5_PROFILE=software-smoke`, and the output label is
|
||||
`retroarch_ps5_software_smoke.elf`.
|
||||
|
||||
## Compile-time closure
|
||||
|
||||
Enabled:
|
||||
|
||||
- real RetroArch frontend and runloop;
|
||||
- static Chimera smokecore, 320 x 240 XRGB8888 at 60 fps;
|
||||
- SDL2 software video with double-buffered PS5 VideoOut;
|
||||
- one SDL2 PS5 Pad and 15% deadzone;
|
||||
- SDL2 PS5 48 kHz stereo AudioOut;
|
||||
- on-screen bounded status record;
|
||||
- 60,000 ms and 3,600-frame shutdown gates;
|
||||
- post-teardown process `_Exit`;
|
||||
- VFS and link-time libc write firewalls.
|
||||
|
||||
Disabled or garbage-collected from the final ELF:
|
||||
|
||||
- dynamic cores, content browser data, playlists/history, databases;
|
||||
- networking, updater, achievements and command interfaces;
|
||||
- screenshots, recording, shaders, filters and compressed content;
|
||||
- SRAM, savestates, remap/autoconfig/config persistence;
|
||||
- keyboard, IME, mouse, sensor, haptic, rumble and lightbar paths;
|
||||
- GNM, OpenGL, Vulkan, RetroArch dynamic-core/module loading, installation,
|
||||
autoload and retry.
|
||||
|
||||
SDL's dynamic API and runtime assertions are disabled in its smoke-specific
|
||||
static build. The pinned SDK CRT remains a necessary startup component: it
|
||||
resolves its own runtime loader primitives and may conditionally load
|
||||
`libSceSysmodule`. This source-bound startup behavior is declared separately
|
||||
and is not confused with a RetroArch dynamic-core path.
|
||||
|
||||
`HAVE_CONFIGFILE=0`, `HAVE_MENU=0` and `HAVE_RGUI=0` remove their read,
|
||||
browser and save paths. Independently, the PS5 frontend sets
|
||||
`RARCH_CTL_SET_BLOCK_CONFIG_READ`, provides no config path, and the smoke
|
||||
firewall rejects every attempted write.
|
||||
|
||||
## Visible record
|
||||
|
||||
The static core draws `CHIMERA RETROARCH PS5 SMOKE TEST`, a build/manifest
|
||||
label, phase, monotonic elapsed time, frame count, VideoOut and framebuffer
|
||||
details, raw button/stick state, AudioOut counters, core state, shutdown
|
||||
reason, first sticky error, write-firewall state and both hard limits.
|
||||
|
||||
Phases are stable `S00` through `S15`; errors are stable `E000` and
|
||||
`E101` through `E123`. `S07 RUNNING` and a final rendered
|
||||
`S08 SHUTDOWN_REQUESTED` are expected on screen. `S09` through `S15` occur
|
||||
during teardown after the final present and therefore remain in the
|
||||
in-memory record rather than being promised as visible frames.
|
||||
|
||||
## Bounded control
|
||||
|
||||
The first condition wins:
|
||||
|
||||
1. Options held for 2,000 ms;
|
||||
2. 60,000 monotonic milliseconds;
|
||||
3. 3,600 core frames;
|
||||
4. a sticky runtime/write-firewall failure.
|
||||
|
||||
The pinned SDL mapping maps the PS5 Options bit to SDL Back, which RetroArch
|
||||
exposes to the core as `RETRO_DEVICE_ID_JOYPAD_SELECT`. Shutdown is requested
|
||||
once. There is no retry, second run or automatic extension.
|
||||
|
||||
No host test or static audit in this phase is hardware evidence.
|
||||
@@ -0,0 +1,24 @@
|
||||
# Phase 1.0BA: offline AV target-profile and callsite audit
|
||||
|
||||
Status: `EXACT_CALLSITE_AND_PROFILE_DELTA_SOURCE_PATCH_ALLOWED_NO_BUILD`
|
||||
|
||||
Date: 2026-07-29
|
||||
|
||||
The remote-bound AZ commit leaves one exact integration point in `main`: after
|
||||
`rarch_main` returns and S15 is set, but before `_Exit`. On the normal PS5 loop
|
||||
return, `rarch_main` has already called `main_exit`; the PS5 frontend deinit
|
||||
then removes its SDL, frontend and platform initialization markers. Early
|
||||
initialization returns that bypass `main_exit` retain initialized bits and the
|
||||
AZ predicate therefore rejects D14.
|
||||
|
||||
The smallest profile is a derivative of `write-diag`: it retains the
|
||||
contentless `-v` startup correction, write firewall, D13 operation evidence,
|
||||
bounded runtime, inherited stdout, SDL diagnostic overlay and frame-zero
|
||||
source. The only new target define is `CHIMERA_PS5_AV_DIAG`; its stream magic
|
||||
takes precedence over the inherited J selection. Launcher identity remains
|
||||
outside the payload so both future launch arms use one byte-exact ELF.
|
||||
|
||||
The next source commit may add the call and a distinct `launch-canary` profile,
|
||||
plus host/static tests. This audit does not permit a cross-build, ELF, runner
|
||||
activation, connection, transfer, execution or PS5 action. A subsequent exact
|
||||
source audit must authorize any artifact build separately.
|
||||
@@ -0,0 +1,21 @@
|
||||
# Phase 1.0BB: source-only launch-canary profile
|
||||
|
||||
Status: `REMOTE_BOUND_SOURCE_PROFILE_COMPLETE_BUILD_PREREQUISITE_AUDIT_ONLY`
|
||||
|
||||
Date: 2026-07-29
|
||||
|
||||
RetroArch commit `b0f5178e5acb59172fb352098d2ba32e5c42831b` adds the
|
||||
BA-authorized post-S15/pre-`_Exit` terminal call and a distinct
|
||||
`launch-canary` profile. The profile inherits write-diag startup, SDL overlay,
|
||||
write firewall, inherited stdout and bounded runtime behavior. No launcher
|
||||
identity enters the payload bytes.
|
||||
|
||||
All host C/sanitizer tests, existing parser/runner tests, historical source
|
||||
validators, the BB mutation tests and PS5 structural validation passed. No
|
||||
launch-canary ELF or map was produced. The source commit was pushed to and
|
||||
read from the private Gitea origin.
|
||||
|
||||
Only an offline prerequisite audit may now determine whether the exact pinned
|
||||
SDK, SDL archive, linker script, write wrappers and expected object graph are
|
||||
present and hashable. This phase does not authorize a cross-build, artifact,
|
||||
runner activation or device action.
|
||||
@@ -0,0 +1,22 @@
|
||||
# Phase 1.0BC: offline launch-canary cross-build prerequisite audit
|
||||
|
||||
Status: `PREREQUISITES_PARTIAL_EXACT_SDL_MATERIALIZATION_REQUIRED`
|
||||
|
||||
Date: 2026-07-29
|
||||
|
||||
The installed public SDK v0.41, clean public SDL commit, reviewed diagnostic
|
||||
patch and W^X linker script are present and hashable. The SDK release remains
|
||||
bound to the upstream lock and the local wrapper resolves to Ubuntu Clang
|
||||
18.1.8.
|
||||
|
||||
The isolated RetroArch worktree has no `build/ps5-sdl2-write-diag/libSDL2.a`.
|
||||
No matching archive exists elsewhere in the declared Chimera project scope.
|
||||
WSL also has no CMake or Ninja command at this observation. Reusing an unknown
|
||||
archive or silently selecting the unpatched SDL tree is forbidden.
|
||||
|
||||
The next phase may add and host-test a target-free materializer that accepts
|
||||
only SDL commit `0baf4ac49382b537ba449901b5b6d0d189bb1fbb`, patch SHA-256
|
||||
`aa1d3ebc...70c193` and the locked SDK. It must create outputs only in ignored
|
||||
build storage and must stop before compiling RetroArch. This phase authorizes
|
||||
neither SDL compilation nor a launch-canary cross-build, artifact or device
|
||||
action.
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user