Publish Chimera GFX source

2026-09-03 03:27:14 +02:00
commit a6037502d7
828 changed files with 100454 additions and 0 deletions
@@ -0,0 +1,49 @@
+# ADR-0011: Phase-0.7 hardened controlled runtime
+
+- Status: accepted for offline deployment preparation
+- Date: 2026-07-17
+- Decision: `READY_FOR_HARDENED_RUNTIME_DEPLOYMENT`
+
+## Context
+
+Phase 0.6 identified exact upstream loader and Payload Manager versions but
+found unbounded ptrace completion, incomplete credential restoration, missing
+reaping/watchdog behavior, and a path-based unhashed launch route. Those
+findings were implementation inputs, not permanent platform blockers.
+
+Jens explicitly confirmed exact firmware 9.60. Independent device attestation
+is therefore not a Phase-0.7 blocker. The controlled upload below
+`/data/pldmgr/payloads/chimera-controlled` is an allowed, removable
+application write and is not a firmware write.
+
+## Decision
+
+Use private GPL-3.0 hardening forks based on:
+
+- elfldr `699e8bcff03e91e8d6ca6eba281af25c5a58d8c2`;
+- Payload Manager `cfbc70f30f419b09bf2b52283f7409e2d3117ee1`;
+- PS5 Payload SDK `d2e2e585740362976a39fdd5ccf390f199a7bc37`.
+
+The controlled route is a versioned loopback-only protocol with exact
+firmware, artifact ID, size, SHA-256, timeout, and no-retry metadata. elfldr
+rehashes received bytes, enforces the permanent denylist, applies bounded
+ptrace steps and cleanup, and reaps the child through a two-second watchdog.
+The controlled manager is compiled for one exact lifecycle artifact and opens,
+hashes, rewinds, and streams one no-follow file descriptor.
+
+The lifecycle probe uses normal SDK v0.41 startup, performs one
+`sceKernelSendNotificationRequest`, and calls `_exit`; it does not return
+through `payload_terminate`.
+
+## Consequences
+
+The three ELFs are eligible for a later, separately authorized hardened
+runtime installation. This decision does not authorize installation,
+transfer, or execution. The previously blocked SHA-256
+`4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63`
+remains permanently denied.
+
+Normal SDK startup still reaches documented process-local patch and runtime
+initialization. The existing elfldr bootstrap still enables volatile QA flags.
+Both facts are explicit expected runtime effects; neither is silently claimed
+kernelwrite-free.