Publish Chimera GFX source

2026-09-03 03:27:14 +02:00
commit a6037502d7
828 changed files with 100454 additions and 0 deletions
@@ -0,0 +1,45 @@
+# ADR-0010: Controlled runtime effects and Phase-0.6 gate
+
+Status: accepted on 2026-07-17.
+
+## Context
+
+ADR-0009 asked whether a fully kernelwrite-free startup could be proven while
+the exact loader was absent. The current task corrects the safety model:
+documented, bounded, volatile runtime changes may be acceptable. Persistent
+writes and unbounded or unknown effects remain hard blockers.
+
+The installed Payload Manager and elfldr were subsequently identified exactly.
+Their public source exposes both acceptable volatile effects and unresolved
+unbounded paths.
+
+## Decision
+
+Classify each lifecycle effect as exactly one of:
+
+- `EXPECTED_VOLATILE_RUNTIME_EFFECT`;
+- `RESTORED_BY_LOADER`;
+- `PAYLOAD_PROCESS_LOCAL`;
+- `PERSISTENT_WRITE`;
+- `UNBOUNDED_OR_UNKNOWN`.
+
+Only the final two are categorical blockers. `__patch_init` is classified as
+payload-process-local and is no longer an automatic blocker.
+
+Every potentially eligible artifact must also have a profile named exactly
+`controlled-ps5-runtime`, with exact firmware/loader/SDK/artifact identity,
+an explicit list of expected volatile effects, zero persistent and filesystem
+writes, no payload network, a maximum 2000 ms runtime, no retry, no hard
+effects, and no hard blockers. Both the profile and static gate explicitly set
+`execution_authorized=false`; static eligibility never grants execution
+authority.
+
+## Consequences
+
+Phase 0.6 remains blocked because the exact chain has unbounded ptrace loops,
+no payload watchdog, unresolved termination/cleanup, incomplete credential
+restoration, no launch-time hash enforcement, and a persistent manager upload
+path. No lifecycle source or ELF is built.
+
+ADR-0009 and its Phase-0.5 evidence remain historical records. The permanent
+artifact denylist is unchanged.