Publish Chimera GFX source

docs/approvals/phase-0.8-bounded-observation-template.md

@@ -0,0 +1,131 @@
+# Phase 0.8 future bounded-observation permission template
+
+Status: **TEMPLATE ONLY — NOT AUTHORIZED**.
+
+This file is not permission. Empty, `null`, zero, missing, ambiguous, expired,
+or inconsistent input means `STOP`. Copying, editing, signing, or committing
+the template does not itself authorize a connection, transfer, or execution.
+Authorization can exist only through a new exact statement from Jens in the
+active task after the proposed method and its complete effect contract have
+been reviewed.
+
+The template may describe only a separately named bounded-observation phase.
+It cannot authorize installation, rollback creation, lifecycle execution,
+autoload, retry, graphics work, or RetroArch work.
+
+## Machine-readable default state
+
+The validator requires every authority value below to remain `false` in the
+repository template and every request-specific field to remain unfilled.
+
+<!-- BEGIN PHASE08_BOUNDED_OBSERVATION_TEMPLATE -->
+```json
+{
+  "template_only": true,
+  "authorized": false,
+  "execution_authorized": false,
+  "transfer_authorized": false,
+  "installation_authorized": false,
+  "lifecycle_authorized": false,
+  "automatic_retry": false,
+  "required_fields": {
+    "exact_user_statement": null,
+    "authorization_date": null,
+    "expiration_time": null,
+    "device_identity": null,
+    "exact_purpose": null,
+    "exact_observations": null,
+    "method_or_collector_id": null,
+    "source_commit": null,
+    "collector_file_size": null,
+    "collector_sha256": null,
+    "firmware_gate": null,
+    "maximum_runtime_ms": null,
+    "maximum_execution_count": null,
+    "maximum_transfer_count": null,
+    "network_behavior": null,
+    "output_channel": null,
+    "allowed_volatile_effects": null,
+    "prohibited_persistent_effects": null,
+    "stop_criteria": null,
+    "cleanup_requirements": null,
+    "reporting_requirements": null,
+    "explicit_installation_exclusion": null,
+    "explicit_lifecycle_probe_exclusion": null,
+    "explicit_autoload_and_retry_exclusion": null,
+    "explicit_graphics_and_retroarch_exclusion": null,
+    "revocation_method": null,
+    "manual_confirmation_template_does_not_authorize": null
+  },
+  "fixed_exclusions": {
+    "installation": true,
+    "lifecycle_probe": true,
+    "autoload": true,
+    "automatic_retry": true,
+    "gnm": true,
+    "videoout": true,
+    "sdl": true,
+    "retroarch": true
+  }
+}
+```
+<!-- END PHASE08_BOUNDED_OBSERVATION_TEMPLATE -->
+
+## Required human review fields
+
+Every field below must be supplied in a later review package. Do not fill it
+in this repository template.
+
+- Exact user statement:
+- Authorization date and timezone:
+- Expiration time and timezone:
+- Device identity:
+- Exact purpose:
+- Exact observations:
+- Method or collector ID:
+- Source repository and commit:
+- Collector filename:
+- Collector byte size:
+- Collector SHA-256:
+- Exact firmware gate:
+- Maximum runtime:
+- Maximum execution count:
+- Maximum transfer count:
+- Network behavior, addresses, ports, direction, and connection count:
+- Output channel and maximum output:
+- Exhaustive allowed volatile effects:
+- Exhaustive forbidden persistent and functional effects:
+- STOP criteria:
+- Cleanup requirements:
+- Reporting and raw-evidence requirements:
+- Explicit installation exclusion:
+- Explicit lifecycle-probe exclusion:
+- Explicit autoload and retry exclusion:
+- Explicit GNM, VideoOut, SDL, and RetroArch exclusion:
+- Revocation method and immediate-stop behavior:
+- Manual confirmation that this template is not authorization:
+
+No artifact ID, filename, size, SHA-256, path, ABI, syscall, loader contract,
+transport, or execution mechanism is implied by these empty fields.
+
+## Mandatory future effect boundary
+
+A future request must enumerate every allowed category-C volatile effect
+before authorization. All category-A persistent mutations and category-B
+functional mutations remain prohibited unless a different, explicitly
+mutating phase is designed and separately authorized.
+
+Unknown behavior, an unspecified effect, an identity mismatch, a partial
+dataset, a timeout, an expired authorization, a count overrun, an unexpected
+log, or cleanup uncertainty means immediate `STOP` with no automatic retry.
+
+The approved observation count, transfer count, and execution count—if any—
+must be literal bounded integers. No value carries into rollback preparation,
+installation, lifecycle testing, graphics, or RetroArch.
+
+## Revocation
+
+Jens may revoke a later authorization at any time before or during the
+authorized window. Revocation, ambiguity, interruption, or conflicting
+instructions causes fail-closed stop. Revocation never triggers cleanup that
+was not already explicitly reviewed and authorized.

docs/approvals/phase-0.9-backup-creation-template.md

@@ -0,0 +1,69 @@
+# Phase 0.9 future backup-creation approval template
+
+Status: **TEMPLATE ONLY — NOT AUTHORIZED**.
+
+This template is for one possible future backup-creation change window for one
+component. It cannot authorize observation collection, staging, switch,
+installation, execution, lifecycle, autoload, retry or a second component.
+
+<!-- BEGIN PHASE09_BACKUP_CREATION_TEMPLATE -->
+```json
+{
+  "template_only": true,
+  "template_action": "backup_creation",
+  "authorized": false,
+  "installation_authorized": false,
+  "execution_authorized": false,
+  "transfer_authorized": false,
+  "lifecycle_authorized": false,
+  "automatic_retry": false,
+  "required_fields": {
+    "exact_user_statement": null,
+    "active_task_id": null,
+    "authorization_issued_at": null,
+    "authorization_expires_at": null,
+    "device_identity": null,
+    "firmware_exact": null,
+    "component": null,
+    "exact_action": null,
+    "maximum_action_count": null,
+    "maximum_runtime_ms": null,
+    "live_path": null,
+    "live_mount_id": null,
+    "live_object_id": null,
+    "live_type": null,
+    "live_size": null,
+    "live_sha256": null,
+    "backup_path": null,
+    "backup_mount_id": null,
+    "minimum_free_bytes_and_metadata_reserve": null,
+    "reopen_and_rehash_contract": null,
+    "target_mapping": null,
+    "independent_recovery_executor": null,
+    "second_independent_recovery_path": null,
+    "allowed_persistent_effects": null,
+    "forbidden_effects": null,
+    "cleanup_contract": null,
+    "stop_conditions": null,
+    "revocation_method": null,
+    "reviewer": null
+  },
+  "fixed_exclusions": {
+    "staging": true,
+    "switch": true,
+    "installation": true,
+    "execution": true,
+    "second_component": true,
+    "lifecycle_probe": true,
+    "autoload": true,
+    "automatic_retry": true,
+    "graphics": true,
+    "retroarch": true
+  }
+}
+```
+<!-- END PHASE09_BACKUP_CREATION_TEMPLATE -->
+
+The exact current live identity and separate backup destination must be filled
+from later admissible evidence. A stock reference hash does not fill this
+template. The Payload Manager backup hard gate remains open.

docs/approvals/phase-0.9-observation-template.md

@@ -0,0 +1,64 @@
+# Phase 0.9 future observation approval template
+
+Status: **TEMPLATE ONLY — NOT AUTHORIZED**.
+
+This template never grants permission. It is bound only to a possible future
+observation action and cannot authorize backup creation, staging, switch,
+installation, lifecycle, execution, autoload, retry, graphics or RetroArch.
+Every request-specific value is deliberately empty.
+
+<!-- BEGIN PHASE09_OBSERVATION_TEMPLATE -->
+```json
+{
+  "template_only": true,
+  "template_action": "observation",
+  "authorized": false,
+  "installation_authorized": false,
+  "execution_authorized": false,
+  "transfer_authorized": false,
+  "lifecycle_authorized": false,
+  "automatic_retry": false,
+  "required_fields": {
+    "exact_user_statement": null,
+    "active_task_id": null,
+    "authorization_issued_at": null,
+    "authorization_expires_at": null,
+    "device_identity": null,
+    "firmware_exact": null,
+    "firmware_source_one": null,
+    "firmware_source_two": null,
+    "component": null,
+    "exact_action": null,
+    "maximum_action_count": null,
+    "maximum_runtime_ms": null,
+    "collector_or_artifact_id": null,
+    "collector_or_artifact_size": null,
+    "collector_or_artifact_sha256": null,
+    "source_commit": null,
+    "allowed_observations": null,
+    "allowed_volatile_effects": null,
+    "forbidden_effects": null,
+    "output_contract": null,
+    "cleanup_contract": null,
+    "stop_conditions": null,
+    "revocation_method": null,
+    "reviewer": null
+  },
+  "fixed_exclusions": {
+    "backup_creation": true,
+    "staging": true,
+    "switch": true,
+    "installation": true,
+    "execution": true,
+    "lifecycle_probe": true,
+    "autoload": true,
+    "automatic_retry": true,
+    "graphics": true,
+    "retroarch": true
+  }
+}
+```
+<!-- END PHASE09_OBSERVATION_TEMPLATE -->
+
+Empty, ambiguous, expired, mismatched or unreviewed data means `STOP`. A copy,
+signature, edit or commit of this file is not approval.

docs/approvals/phase-0.9-one-shot-execution-template.md

@@ -0,0 +1,64 @@
+# Phase 0.9 future one-shot execution approval template
+
+Status: **TEMPLATE ONLY — NOT AUTHORIZED**.
+
+This template can be considered only after a separately approved switch,
+durable post-switch identity verification and human review. It is bound to one
+component and one manual execution. It does not authorize transfer,
+installation, lifecycle-probe execution, autoload, retry or another component.
+
+<!-- BEGIN PHASE09_ONE_SHOT_EXECUTION_TEMPLATE -->
+```json
+{
+  "template_only": true,
+  "template_action": "one_shot_execution",
+  "authorized": false,
+  "installation_authorized": false,
+  "execution_authorized": false,
+  "transfer_authorized": false,
+  "lifecycle_authorized": false,
+  "automatic_retry": false,
+  "required_fields": {
+    "exact_user_statement": null,
+    "active_task_id": null,
+    "authorization_issued_at": null,
+    "authorization_expires_at": null,
+    "device_identity": null,
+    "firmware_exact": null,
+    "component": null,
+    "exact_action": null,
+    "maximum_execution_count": null,
+    "maximum_runtime_ms": null,
+    "live_artifact_id": null,
+    "live_source_commit": null,
+    "live_size": null,
+    "live_sha256": null,
+    "live_mount_id": null,
+    "live_object_id": null,
+    "post_switch_verification_evidence": null,
+    "verified_backup_identity": null,
+    "independent_recovery_executor": null,
+    "success_criteria": null,
+    "stop_conditions": null,
+    "cleanup_contract": null,
+    "reporting_contract": null,
+    "revocation_method": null,
+    "reviewer": null
+  },
+  "fixed_exclusions": {
+    "transfer": true,
+    "installation": true,
+    "second_execution": true,
+    "second_component": true,
+    "lifecycle_probe": true,
+    "autoload": true,
+    "automatic_retry": true,
+    "graphics": true,
+    "retroarch": true
+  }
+}
+```
+<!-- END PHASE09_ONE_SHOT_EXECUTION_TEMPLATE -->
+
+The template itself is not a request and is not permission. Phase 0.9A does
+not ask for execution approval.

docs/approvals/phase-0.9-staging-template.md

@@ -0,0 +1,63 @@
+# Phase 0.9 future staging approval template
+
+Status: **TEMPLATE ONLY — NOT AUTHORIZED**.
+
+This template could bind one future inactive candidate-staging action. It
+cannot authorize a live switch, installation, execution, lifecycle, autoload,
+retry or a second component.
+
+<!-- BEGIN PHASE09_STAGING_TEMPLATE -->
+```json
+{
+  "template_only": true,
+  "template_action": "staging",
+  "authorized": false,
+  "installation_authorized": false,
+  "execution_authorized": false,
+  "transfer_authorized": false,
+  "lifecycle_authorized": false,
+  "automatic_retry": false,
+  "required_fields": {
+    "exact_user_statement": null,
+    "active_task_id": null,
+    "authorization_issued_at": null,
+    "authorization_expires_at": null,
+    "device_identity": null,
+    "firmware_exact": null,
+    "component": null,
+    "exact_action": null,
+    "maximum_action_count": null,
+    "maximum_runtime_ms": null,
+    "candidate_artifact_id": null,
+    "candidate_source_commit": null,
+    "candidate_size": null,
+    "candidate_sha256": null,
+    "staging_path": null,
+    "staging_mount_id": null,
+    "staging_inactive_proof": null,
+    "verified_backup_identity": null,
+    "verified_backup_sha256": null,
+    "candidate_reopen_and_rehash_contract": null,
+    "allowed_persistent_effects": null,
+    "forbidden_effects": null,
+    "cleanup_contract": null,
+    "stop_conditions": null,
+    "revocation_method": null,
+    "reviewer": null
+  },
+  "fixed_exclusions": {
+    "live_switch": true,
+    "installation": true,
+    "execution": true,
+    "second_component": true,
+    "lifecycle_probe": true,
+    "autoload": true,
+    "automatic_retry": true,
+    "graphics": true,
+    "retroarch": true
+  }
+}
+```
+<!-- END PHASE09_STAGING_TEMPLATE -->
+
+A candidate hash or offline build record alone never authorizes staging.

docs/approvals/phase-0.9-switch-template.md

@@ -0,0 +1,67 @@
+# Phase 0.9 future live-switch approval template
+
+Status: **TEMPLATE ONLY — NOT AUTHORIZED**.
+
+This template is limited to one future switch of one separately staged
+component. It cannot authorize staging, execution, lifecycle, rollback,
+autoload, retry or a second component.
+
+<!-- BEGIN PHASE09_SWITCH_TEMPLATE -->
+```json
+{
+  "template_only": true,
+  "template_action": "live_switch",
+  "authorized": false,
+  "installation_authorized": false,
+  "execution_authorized": false,
+  "transfer_authorized": false,
+  "lifecycle_authorized": false,
+  "automatic_retry": false,
+  "required_fields": {
+    "exact_user_statement": null,
+    "active_task_id": null,
+    "authorization_issued_at": null,
+    "authorization_expires_at": null,
+    "device_identity": null,
+    "firmware_exact": null,
+    "component": null,
+    "exact_action": null,
+    "maximum_action_count": null,
+    "maximum_runtime_ms": null,
+    "live_path_mount_object_size_sha256": null,
+    "backup_path_mount_object_size_sha256": null,
+    "candidate_path_mount_object_size_sha256": null,
+    "target_quiescence_evidence": null,
+    "autoload_and_retry_disabled_evidence": null,
+    "atomic_switch_primitive_identity": null,
+    "atomicity_evidence": null,
+    "file_durability_evidence": null,
+    "directory_durability_evidence": null,
+    "power_loss_evidence": null,
+    "post_switch_verification_contract": null,
+    "independent_recovery_executor": null,
+    "rollback_target_mapping": null,
+    "allowed_persistent_effects": null,
+    "forbidden_effects": null,
+    "stop_conditions": null,
+    "revocation_method": null,
+    "reviewer": null
+  },
+  "fixed_exclusions": {
+    "staging": true,
+    "execution": true,
+    "second_component": true,
+    "lifecycle_probe": true,
+    "autoload": true,
+    "automatic_retry": true,
+    "in_place_overwrite": true,
+    "two_step_rename_gap": true,
+    "graphics": true,
+    "retroarch": true
+  }
+}
+```
+<!-- END PHASE09_SWITCH_TEMPLATE -->
+
+While atomicity or durability is `UNPROVEN`, this template must remain empty
+and no switch request may be made.

docs/approvals/phase-0.9b-observer-execution-template.md

@@ -0,0 +1,76 @@
+# Phase 0.9B future observer execution template
+
+Status: **TEMPLATE ONLY — NOT AUTHORIZED — BLOCKED**.
+
+This file cannot authorize an action. There is no observer artifact to bind,
+and the startup/exit and output-channel gates are blocked. Every
+request-specific value is deliberately empty. Editing, signing, copying,
+committing or pushing this template does not grant permission.
+
+<!-- BEGIN PHASE09B_OBSERVER_EXECUTION_TEMPLATE -->
+```json
+{
+  "template_only": true,
+  "phase": "0.9B",
+  "action": "one_shot_observer_execution",
+  "status": "BLOCKED",
+  "authorized": false,
+  "transfer_authorized": false,
+  "execution_authorized": false,
+  "installation_authorized": false,
+  "lifecycle_authorized": false,
+  "autoload_authorized": false,
+  "backup_creation_authorized": false,
+  "automatic_retry": false,
+  "observer_only": true,
+  "required_fields": {
+    "exact_user_statement": null,
+    "active_task_id": null,
+    "authorization_issued_at": null,
+    "authorization_expires_at": null,
+    "device_identity": null,
+    "firmware_exact": null,
+    "firmware_source_one": null,
+    "firmware_source_two": null,
+    "observer_build_id": null,
+    "observer_source_commit": null,
+    "observer_size": null,
+    "observer_sha256": null,
+    "toolchain_identity": null,
+    "runtime_path": null,
+    "allowed_observations": null,
+    "allowed_read_paths": null,
+    "output_channel": null,
+    "maximum_runtime_ms": null,
+    "maximum_execution_count": null,
+    "stop_criteria": null,
+    "reviewer": null
+  },
+  "fixed_exclusions": {
+    "device_address": true,
+    "installation": true,
+    "lifecycle": true,
+    "autoload": true,
+    "automatic_retry": true,
+    "backup_creation": true,
+    "file_mutation": true,
+    "process_or_service_mutation": true,
+    "listener_creation": true,
+    "kernelwrite": true,
+    "graphics": true,
+    "sdl": true,
+    "retroarch": true
+  },
+  "blocking_facts": [
+    "OBSERVER_STARTUP_OR_EXIT_ABI_UNPROVEN",
+    "NO_PROVEN_NON_PERSISTENT_OUTPUT_CHANNEL",
+    "OBSERVER_ARTIFACT_ABSENT"
+  ]
+}
+```
+<!-- END PHASE09B_OBSERVER_EXECUTION_TEMPLATE -->
+
+A future request would need a new active-task authorization bound to one exact
+artifact, device, firmware, output channel, observation plan, runtime,
+one execution and expiration. That later request still could not authorize
+installation, lifecycle, backup creation, autoload or retry.

docs/approvals/phase-0.9e-r-y2jb-deployed-use-attestation.md

@@ -0,0 +1,57 @@
+# Phase 0.9E-R Y2JB deployed-use operator attestation
+
+Status: `UNATTESTED_TEMPLATE`
+
+This template records a future operator statement. It is not device evidence,
+runtime verification, permission, or approval. Do not add secrets, PS5
+addresses, account identifiers, signed download URLs, or credentials.
+
+```yaml
+schema_version: 1
+phase: PHASE_0_9E_R_Y2JB_DEPLOYED_USE_ATTESTATION
+attested: false
+attestation_date: null
+operator: null
+
+outer_zip:
+  file_name: null
+  sha256: null
+  size: null
+  obtained_from: null
+  installation_date_exact_or_estimated: null
+  installation_date_is_estimate: null
+  restore_or_install_method: null
+  firmware_at_restore_or_install: null
+
+subsequent_changes:
+  another_y2jb_backup_applied: null
+  download0_dat_replaced_separately: null
+  youtube_or_appdata_changed: null
+  external_autoloader_used: null
+  external_autoloader_identity: null
+
+host_sender:
+  tool_name: null
+  path_or_source: null
+  version_or_commit: null
+  sha256: null
+  default_port: null
+  ports_actually_selected: []
+
+classification_when_completed: OPERATOR_ATTESTED_DEPLOYED_USE
+runtime_verified: false
+
+device_action_authorized: false
+target_build_authorized: false
+execution_authorized: false
+installation_authorized: false
+transfer_authorized: false
+lifecycle_authorized: false
+autoload_authorized: false
+device_write_authorized: false
+automatic_retry: false
+```
+
+An incomplete or completed statement never changes `runtime_verified` and
+never authorizes a device action. Any later use requires a separate review and
+artifact-specific authorization.

docs/approvals/phase-1.0aa-offline-fake-adapter.md

@@ -0,0 +1,25 @@
+# Phase 1.0AA offline fake-adapter approval record
+
+This tracked record is deliberately inactive and authorizes no live action.
+
+- `active=false`
+- `attested=false`
+- `run_id=null`
+- `target_address=null`
+- `target_port=null`
+- `window=null`
+- `ps5_connection_authorized=false`
+- `device_request_authorized=false`
+- `result_receive_authorized=false`
+- `target_build_authorized=false`
+- `device_transfer_authorized=false`
+- `device_execution_authorized=false`
+- `installation_authorized=false`
+- `autoload_authorized=false`
+- `device_write_authorized=false`
+- `automatic_retry=false`
+- `reconnect_authorized=false`
+- `resume_authorized=false`
+
+The fake integration cannot consume a live approval and exposes no live
+adapter. A later phase and new exact permission would be required first.

docs/approvals/phase-1.0ab-live-adapter-feasibility.md

@@ -0,0 +1,23 @@
+# Phase 1.0AB live-adapter feasibility approval record
+
+This tracked record is inactive and grants no network or device authority.
+
+- `active=false`
+- `attested=false`
+- `target_address=null`
+- `target_port=null`
+- `run_id=null`
+- `ps5_connection_authorized=false`
+- `device_request_authorized=false`
+- `result_receive_authorized=false`
+- `target_build_authorized=false`
+- `device_transfer_authorized=false`
+- `device_execution_authorized=false`
+- `installation_authorized=false`
+- `autoload_authorized=false`
+- `device_write_authorized=false`
+- `automatic_retry=false`
+- `reconnect_authorized=false`
+- `resume_authorized=false`
+
+The trace model cannot connect and cannot consume an approval.

docs/approvals/phase-1.0ac-dormant-adapter.md

@@ -0,0 +1,24 @@
+# Phase 1.0AC inactive record
+
+This is not a device approval.
+
+```text
+active=false
+target_address=null
+target_port=null
+run_id=null
+ps5_connection_authorized=false
+device_request_authorized=false
+result_receive_authorized=false
+device_transfer_authorized=false
+device_execution_authorized=false
+installation_authorized=false
+autoload_authorized=false
+device_write_authorized=false
+automatic_retry=false
+reconnect_authorized=false
+resume_authorized=false
+```
+
+Phase 1.0AC contains only host-side synthetic tests. No value in this file can
+activate a transport or authorize a later action.

docs/approvals/phase-1.0b-device-smoke-template.md

@@ -0,0 +1,50 @@
+# Phase 1.0B device-smoke approval template
+
+This template is intentionally empty and non-authorizing.
+
+```yaml
+authorized: false
+transfer_authorized: false
+execution_authorized: false
+installation_authorized: false
+autoload_authorized: false
+automatic_retry: false
+
+artifact:
+  label: retroarch_ps5_software_smoke.elf
+  sha256: null
+  size: null
+  chimera_retroarch_source_commit: null
+  build_manifest_sha256: null
+
+operator_observation:
+  firmware_text: null
+  firmware_expected: "9.60"
+  observed_by: null
+  observed_at: null
+
+window:
+  maximum_transfers: 1
+  maximum_executions: 1
+  maximum_runtime_ms: 60000
+  live_replacement: false
+  retry: false
+  autoload: false
+  installation: false
+
+expected_visible_phases:
+  - S07_RUNNING
+  - S08_SHUTDOWN_REQUESTED
+expected_shutdown:
+  - OPTIONS_HOLD_2000_MS
+  - RUNTIME_LIMIT_60000_MS
+  - FRAME_LIMIT_3600
+
+accepted_remaining_risks: []
+operator_stop_criteria_reviewed: false
+```
+
+An edited copy is not valid unless every identity is exact and a new active
+task explicitly grants that artifact-specific transfer and execution. This
+template is not an execution package and contains no address, sender or
+device command.

docs/approvals/phase-1.0cz-launch-canary-template.md

@@ -0,0 +1,10 @@
+# Phase 1.0CZ launch-canary approval template
+
+This tracked document is intentionally inactive and is not permission.
+
+An active approval must be supplied separately in the active task by Jens and
+must name the exact SHA-256
+`8dadce9d9faaef21ea129a3d216c768eea9a3ca9bf8ecb8d852e376b58a9bf95`,
+firmware 9.60, the raw-elfldr baseline route, target, port, unique run ID,
+timeout, one transfer, one execution and one bounded result reception. It must
+also state no installation, autoload, device write, retry, reconnect or reboot.

docs/approvals/phase-1.0do-snapshot-runner-template.json

@@ -0,0 +1 @@
+{"active":false,"run_id":null,"target":null,"port":9021,"artifact_size":109896,"artifact_sha256":"147b5bede0f0b5b7d2be903bc72ff0d0541a2cdc28eae7d86b6bf95e1978ebdf","snapshot_path":null,"receipt_path":null,"not_before":null,"not_after":null,"one_connection":false,"one_transfer":false,"one_execution":false,"result_receive":false,"target_file_read":false,"device_write":false,"installation":false,"autoload":false,"retry":false,"reconnect":false}

docs/approvals/phase-1.0dr-inventory-runner-template.json

@@ -0,0 +1 @@
+{"active":false,"run_id":null,"target":null,"port":9021,"artifact_size":110032,"artifact_sha256":"914fce06a490ad048fdd0a85ae117858e8904b47c72054bf12fbfebc213a6db8","output_path":null,"receipt_path":null,"not_before":null,"not_after":null,"one_connection":false,"one_transfer":false,"one_execution":false,"result_receive":false,"directory_inventory":false,"possible_atime_effect_acknowledged":false,"device_file_content_read":false,"persistent_device_write":false,"installation":false,"autoload":false,"retry":false,"reconnect":false}

docs/approvals/phase-1.0dt-metadata-runner-template.json

@@ -0,0 +1 @@
+{"active":false,"run_id":null,"target":null,"port":9021,"artifact_size":109928,"artifact_sha256":"077307b98e44f566fa1db82b08cd5e71bd56bd9792826fc7254965fa768c0dc7","output_path":null,"receipt_path":null,"not_before":null,"not_after":null,"one_connection":false,"one_transfer":false,"one_execution":false,"result_receive":false,"four_exact_metadata_reads":false,"possible_atime_effect_acknowledged":false,"app_pkg_read":false,"backup_read":false,"persistent_device_write":false,"installation":false,"autoload":false,"retry":false,"reconnect":false}

docs/approvals/phase-1.0e-one-shot-result-test.md

@@ -0,0 +1,28 @@
+# Phase 1.0E one-shot result test approval
+
+Status: **CONSUMED — NO FURTHER DEVICE ACTION AUTHORIZED**.
+
+On 2026-07-22 the repository owner issued an exact, artifact-bound approval.
+The immediately preceding proposal bound that confirmation to:
+
+- `retroarch_ps5_result_diag.elf`;
+- 1,844,880 bytes;
+- SHA-256
+  `1049c78099a60b472a3fb0e2999e3393b6ad76337a28532a7e53872e7772dedf`;
+- exact firmware 9.60 and the separately confirmed current session address;
+- one connection, one direct in-memory raw-ELF transfer, one execution;
+- result reception through the same inherited connection; and
+- no retry, reconnect, installation, autoload or device write.
+
+The bounded host deadline is 75 seconds. The address is held only in the local
+ignored approval record and is not committed. The first connection attempt
+consumes this permission regardless of send, execution or result success.
+Timeout, EOF, reset, parser failure or any exception stops the run without a
+second connection.
+
+This approval does not apply to any other artifact or later device action.
+
+The attempt used one connection, transfer and execution and received validated
+D00-D02 frames before remote EOF. No retry or reconnect occurred. All device,
+transfer, execution and result-receive authorization fields were reset to
+`false`; the artifact is no longer transfer- or execution-eligible.

docs/approvals/phase-1.0f-device-test-template.md

@@ -0,0 +1,24 @@
+# Phase 1.0F device-test template — inactive
+
+This is a non-authorizing review template for the offline Phase-1.0F artifact.
+It is not permission to connect, transfer, receive results or execute.
+
+```text
+artifact=retroarch_ps5_interval_diag.elf
+size=1845152
+sha256=e8bfc01c61bfb14b5814280a6e5442f1a5ad05ace5439d1c09e7e5ee00cd0055
+firmware=9.60
+ps5_connection_authorized=false
+device_transfer_authorized=false
+device_execution_authorized=false
+result_receive_authorized=false
+installation_authorized=false
+autoload_authorized=false
+device_write_authorized=false
+automatic_retry=false
+```
+
+Any future authorization must be a new explicit statement in the active task,
+repeat the exact name, size and SHA-256, set the intended actions explicitly,
+and bound connection, transfer, execution, reception and observation counts.
+No authority carries from RUN A, RUN B or RUN C.

docs/approvals/phase-1.0g-one-shot-runner-template.md

@@ -0,0 +1,34 @@
+# Phase 1.0G one-shot approval template — inactive
+
+This is a review checklist, not an authorization. The tracked JSON template is
+intentionally inactive and must never be edited into a reusable project-wide
+permission.
+
+Current values:
+
+```text
+authorized=false
+consumed=false
+ps5_connection_authorized=false
+device_transfer_authorized=false
+device_execution_authorized=false
+result_receive_authorized=false
+installation_authorized=false
+autoload_authorized=false
+device_write_authorized=false
+automatic_retry=false
+protocol_activation_authorized=false
+run_id=null
+target=null
+port=null
+```
+
+A future approval, if Jens chooses to issue one, must name the exact artifact
+name, size and SHA-256; firmware; one target; protocol `CHD10F01`; timeout;
+unique run identifier; result reception; and one connection, transfer,
+execution and receive. It must separately keep installation, autoload, device
+write, retry, reconnect, resume and automatic reboot false.
+
+The active record must stay outside tracked repository paths, carry an exact
+approval reference, and be reviewed together with the active execution
+manifest. No prior RUN A, B or C permission carries forward.

docs/approvals/phase-1.0h-device-test-template.md

@@ -0,0 +1,23 @@
+# Phase 1.0H device-test template — inactive
+
+This non-authorizing template identifies the offline Phase-1.0H artifact. It
+is not permission to connect, transfer, receive results or execute.
+
+```text
+artifact=retroarch_ps5_startup_args_diag.elf
+size=1845152
+sha256=822f2cf1f4d33a514d2bdd88fde40ad580dda5d85f537362ef6dff2eafcb56b6
+firmware=9.60
+ps5_connection_authorized=false
+device_transfer_authorized=false
+device_execution_authorized=false
+result_receive_authorized=false
+installation_authorized=false
+autoload_authorized=false
+device_write_authorized=false
+automatic_retry=false
+```
+
+Any possible device test requires a new active-task statement naming this
+exact artifact, size and hash and separately bounding connection, transfer,
+execution, receive and observation. This template grants nothing.

docs/approvals/phase-1.0k-write-diag-one-shot-template.md

@@ -0,0 +1,38 @@
+# Phase 1.0K one-shot approval template — inactive
+
+This is a review checklist, not authorization. Its tracked JSON companion is
+permanently inactive and contains no device address, port or run ID.
+
+Current state:
+
+```text
+authorized=false
+consumed=false
+ps5_connection_authorized=false
+device_transfer_authorized=false
+device_execution_authorized=false
+result_receive_authorized=false
+installation_authorized=false
+autoload_authorized=false
+device_write_authorized=false
+automatic_retry=false
+protocol_activation_authorized=false
+run_id=null
+target=null
+port=null
+```
+
+Any later approval must be newly issued by Jens and bind exactly:
+
+- `retroarch_ps5_write_diag.elf`;
+- size `1845208`;
+- SHA-256 `6ff0f7ea391da5f15ea43512a871078133e896a6900ae9f8f3fa75711abb8009`;
+- firmware `9.60`;
+- protocol `CHD10J01`, version 1, 64-byte frames;
+- one explicit target, port, timeout and unique run ID;
+- exactly one connection, transfer, execution and result reception.
+
+It must keep installation, autoload, device write, retry, reconnect, resume and
+automatic reboot false. The active approval must remain outside tracked
+repository paths and agree byte-for-byte with a separately reviewed active
+manifest. This template grants nothing and prior permissions do not carry.

docs/approvals/phase-1.0n-write-free-one-shot-template.md

@@ -0,0 +1,39 @@
+# Phase 1.0N one-shot approval template — inactive
+
+This is a review checklist, not authorization. Its tracked JSON companion is
+permanently inactive and contains no device address, port or run ID.
+
+Current state:
+
+```text
+authorized=false
+consumed=false
+ps5_connection_authorized=false
+device_transfer_authorized=false
+device_execution_authorized=false
+result_receive_authorized=false
+installation_authorized=false
+autoload_authorized=false
+device_write_authorized=false
+automatic_retry=false
+protocol_activation_authorized=false
+run_id=null
+target=null
+port=null
+```
+
+Any later approval must be newly issued by Jens and bind exactly:
+
+- `retroarch_ps5_write_diag.elf`;
+- size `1845208`;
+- SHA-256 `c99a0856309a357ad2667d89b4924e4063ad214cae09c8a419457b0732f583cd`;
+- firmware `9.60`;
+- protocol `CHD10J01`, version 1, 64-byte frames;
+- scope `EXACT_ONE_SHOT_PHASE_1_0N`;
+- one explicit target, port, timeout and unique run ID;
+- exactly one connection, transfer, execution and result reception.
+
+It must keep installation, autoload, device write, retry, reconnect, resume and
+automatic reboot false. The approval must remain outside tracked repository
+paths and agree with a separately reviewed active manifest. This template
+grants nothing; consumed Phase-1.0K and all earlier permissions do not carry.

docs/approvals/phase-1.0t-shsrv-metadata-collection.md

@@ -0,0 +1,32 @@
+# Phase 1.0T shsrv metadata collection approval
+
+Status: `INACTIVE_TEMPLATE`
+
+This document is deliberately unapproved. It is not a command list, device
+client, or permission to connect.
+
+```text
+attested=false
+active=false
+ps5_connection_authorized=false
+device_request_authorized=false
+result_receive_authorized=false
+process_side_effects_accepted=false
+automatic_serial_query_accepted=false
+automatic_telemetry_query_accepted=false
+serial_redaction_contract_accepted=false
+automatic_retry=false
+reconnect_authorized=false
+target_address=null
+listener_already_running_attested=false
+window=null
+exact_literal_path=null
+commands=[]
+expires_at=null
+```
+
+Any future approval must name exactly one window, one connection, the exact
+commands, a short deadline, and whether the unavoidable spawned shell and
+automatic serial/telemetry reads are accepted. Acceptance does not authorize
+hbldr, target staging, file writes, app termination, remount, execution,
+autoload, retry or any other device action.

docs/approvals/phase-1.0v-shsrv-collector.md

@@ -0,0 +1,35 @@
+# Phase 1.0V shsrv collector approval
+
+Status: `INACTIVE_TEMPLATE`
+
+This template grants no authority and cannot activate the offline model.
+
+```text
+attested=false
+active=false
+collector_source_sha256=null
+ps5_connection_authorized=false
+device_request_authorized=false
+result_receive_authorized=false
+automatic_serial_query_accepted=false
+automatic_telemetry_query_accepted=false
+spawned_shell_effects_accepted=false
+sanitized_output_only_accepted=false
+physical_memory_erasure_unproven_accepted=false
+automatic_retry=false
+reconnect_authorized=false
+target_address=null
+target_port=null
+listener_already_running_attested=false
+window=null
+exact_literal_path=null
+commands=[]
+deadline_seconds=null
+run_id=null
+expires_at=null
+```
+
+Any future live collector requires a new phase because Phase 1.0V contains no
+network transport. Filling this template does not add one and does not
+authorize hbldr, file content reads, writes, execution, transfer, installation,
+autoload, path discovery, retry or reconnect.

docs/approvals/phase-1.0w-shsrv-client.md

@@ -0,0 +1,43 @@
+# Phase 1.0W shsrv client approval
+
+Status: `INACTIVE_TEMPLATE`
+
+There is no live client in Phase 1.0W. This template cannot activate the
+policy model or create network capability.
+
+```text
+attested=false
+active=false
+policy_sha256=null
+collector_sha256=null
+run_id=null
+target_address=null
+target_port=null
+window=null
+exact_literal_path=null
+commands=[]
+deadline_seconds=null
+expires_at=null
+listener_already_running_attested=false
+ps5_connection_authorized=false
+device_request_authorized=false
+result_receive_authorized=false
+spawned_shell_effects_accepted=false
+automatic_serial_query_accepted=false
+automatic_telemetry_query_accepted=false
+sanitized_output_only_accepted=false
+physical_memory_erasure_unproven_accepted=false
+target_build_authorized=false
+device_transfer_authorized=false
+device_execution_authorized=false
+installation_authorized=false
+autoload_authorized=false
+device_write_authorized=false
+automatic_retry=false
+reconnect_authorized=false
+resume_authorized=false
+fallback_authorized=false
+```
+
+A later phase must create and audit a separate inactive transport before any
+approval can be considered. No field in this template authorizes a connection.

docs/approvals/phase-1.0x-inactive-transport.md

@@ -0,0 +1,47 @@
+# Phase 1.0X inactive transport approval
+
+Status: `INACTIVE_TEMPLATE`
+
+Phase 1.0X has no live network adapter. This record is deliberately inert and
+cannot authorize or activate a connection.
+
+```text
+attested=false
+active=false
+policy_sha256=null
+collector_sha256=null
+transport_sha256=null
+run_id=null
+target_address=null
+target_port=null
+window=null
+exact_literal_path=null
+commands=[]
+deadline_seconds=null
+expires_at=null
+listener_already_running_attested=false
+ps5_connection_authorized=false
+device_request_authorized=false
+result_receive_authorized=false
+spawned_shell_effects_accepted=false
+automatic_serial_query_accepted=false
+automatic_telemetry_query_accepted=false
+sanitized_output_only_accepted=false
+physical_memory_erasure_unproven_accepted=false
+directory_entry_durability_unproven_accepted=false
+blocking_call_preemption_unproven_accepted=false
+target_build_authorized=false
+device_transfer_authorized=false
+device_execution_authorized=false
+installation_authorized=false
+autoload_authorized=false
+device_write_authorized=false
+automatic_retry=false
+reconnect_authorized=false
+resume_authorized=false
+fallback_authorized=false
+```
+
+No value may be filled under Phase 1.0X. A later phase must first prove exact
+prompt/Telnet framing and implement an independently reviewed inactive network
+adapter. That work still would not inherit authority from this template.

docs/approvals/phase-1.0y-shsrv-framing.md

@@ -0,0 +1,33 @@
+# Phase 1.0Y shsrv framing approval
+
+Status: `INACTIVE_TEMPLATE`
+
+This phase is source audit and synthetic modeling only. It contains no live
+transport to activate.
+
+```text
+attested=false
+active=false
+framing_model_sha256=null
+source_family=null
+run_id=null
+target_address=null
+target_port=null
+commands=[]
+ps5_connection_authorized=false
+device_request_authorized=false
+result_receive_authorized=false
+target_build_authorized=false
+device_transfer_authorized=false
+device_execution_authorized=false
+installation_authorized=false
+autoload_authorized=false
+device_write_authorized=false
+automatic_retry=false
+reconnect_authorized=false
+resume_authorized=false
+fallback_authorized=false
+```
+
+No field may be filled under Phase 1.0Y. Official-source framing is not proof
+of the deployed shsrv family, live prompt boundaries or firmware behavior.

docs/approvals/phase-1.0z-passive-batch.md

@@ -0,0 +1,27 @@
+# Phase 1.0Z passive-batch approval record
+
+This tracked record is deliberately inactive. It is not permission to connect,
+send, receive or execute anything.
+
+- `active=false`
+- `attested=false`
+- `run_id=null`
+- `target_address=null`
+- `target_port=null`
+- `window=null`
+- `exact_literal_path=null`
+- `ps5_connection_authorized=false`
+- `device_request_authorized=false`
+- `result_receive_authorized=false`
+- `target_build_authorized=false`
+- `device_transfer_authorized=false`
+- `device_execution_authorized=false`
+- `installation_authorized=false`
+- `autoload_authorized=false`
+- `device_write_authorized=false`
+- `automatic_retry=false`
+- `reconnect_authorized=false`
+- `resume_authorized=false`
+
+Any later action requires a new exact artifact/session-specific approval and a
+separate reviewed live-adapter phase. Nothing in this template activates one.

docs/approvals/phase07-hardened-installation-request.md

@@ -0,0 +1,39 @@
+# Phase-0.7 installation authorization packet
+
+Status: **NOT AUTHORIZED**. This file prepares a later installation request;
+it grants no authority and contains no transfer or execution command.
+
+## Hash-bound installation set
+
+- elfldr:
+  `63e810982471eb40cae3a20aa9df9a0a02892f420e429874fae4e99aa400b561`
+  (397000 bytes)
+- controlled Payload Manager:
+  `8fecf8241a46246eddbd21e8bb4d875f5d76f1f4f4c6a11384df1f131aa5e5b1`
+  (99560 bytes)
+- lifecycle probe:
+  `bfb4a5cc768e162fe4c2fddf41c3978e152722918a39085277fd172cb95a7182`
+  (112680 bytes)
+- firmware: exact `9.60`
+- automatic retry: `false`
+- lifecycle timeout: `2000 ms`
+
+The permanent blocked hash
+`4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63`
+is excluded and must still be rejected.
+
+## Exact later permission sentence
+
+> Ik geef toestemming om uitsluitend op mijn PS5 met exact firmware 9.60 de
+> geharde elfldr met SHA-256
+> 63e810982471eb40cae3a20aa9df9a0a02892f420e429874fae4e99aa400b561
+> en de controlled Payload Manager met SHA-256
+> 8fecf8241a46246eddbd21e8bb4d875f5d76f1f4f4c6a11384df1f131aa5e5b1
+> éénmalig te installeren, nadat de bestaande bestanden hashgebonden zijn
+> geback-upt. Deze toestemming omvat geen overdracht of uitvoering van de
+> lifecycle-probe en geen automatische start.
+
+After that separate installation is verified, a second, artifact-specific
+authorization would still be required to transfer and execute the lifecycle
+probe. Installation permission must not be interpreted as execution
+permission.

docs/approvals/phase07-lifecycle-transfer-execution-request.md

@@ -0,0 +1,41 @@
+# Phase-0.7 lifecycle transfer and one-time execution request
+
+Status: **NOT AUTHORIZED**. Do not use this request until the hardened elfldr
+and controlled Payload Manager have been separately authorized, installed,
+hash-verified on-device, and recorded in a new active task.
+
+## Exact later execution subject
+
+- lifecycle probe SHA-256:
+  `bfb4a5cc768e162fe4c2fddf41c3978e152722918a39085277fd172cb95a7182`
+- size: 112680 bytes
+- artifact ID: `chimera-gfx-lifecycle-phase07-fw960-v1`
+- firmware: exact `9.60`
+- maximum runtime: 2000 ms
+- automatic retry: `false`
+- requested action count: one transfer and one execution
+
+## Preconditions
+
+- on-device hardened elfldr hash equals
+  `63e810982471eb40cae3a20aa9df9a0a02892f420e429874fae4e99aa400b561`;
+- on-device controlled Payload Manager hash equals
+  `8fecf8241a46246eddbd21e8bb4d875f5d76f1f4f4c6a11384df1f131aa5e5b1`;
+- the original installed components have hash-bound backups;
+- the permanent blocked hash is rejected by both installed consumers;
+- the static policy gate is rerun against the exact transferred bytes;
+- no autoload or automatic retry is enabled.
+
+## Exact later permission sentence
+
+> Ik geef toestemming om uitsluitend op mijn PS5 met exact firmware 9.60 de
+> lifecycle-probe met SHA-256
+> bfb4a5cc768e162fe4c2fddf41c3978e152722918a39085277fd172cb95a7182,
+> 112680 bytes en artifact-ID
+> chimera-gfx-lifecycle-phase07-fw960-v1 eenmalig over te dragen en eenmaal uit
+> te voeren via de reeds geinstalleerde en exact geverifieerde geharde runtime,
+> met een harde limiet van 2000 ms, zonder retry, autoload, VideoOut, GNM, SDL
+> of netwerkgebruik door de probe.
+
+This text is a future request template only. Its presence in the repository is
+not approval.

docs/approvals/probe-9.60-transfer-execution.md

@@ -0,0 +1,94 @@
+# Firmware 9.60 probe transfer and one-time execution package
+
+Status: **BLOCKED — do not transfer and do not execute**.
+
+This is the separate review package requested after the offline build. It is
+not an authorization request because the current artifact cannot satisfy the
+project's no-kernel-change boundary.
+
+## Bound artifact
+
+- Filename:
+  `chimera-gfx-capability-probe-0.1.0-fw-9.60-offline-audit-only.elf`
+- SHA-256:
+  `4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63`
+- Size: 110424 bytes
+- Source commit: `ba8f6a40cf37dff628254caa9b11d83a73957cf8`
+- Firmware build gate: exact `9.60`
+- Manifest: `manifests/artifacts/chimera-gfx-capability-probe-0.1.0-fw-9.60.json`
+- Offline evidence: `docs/evidence/probe-9.60-offline-2026-07-17.md`
+- Transfer / execution recorded: false / false
+- Execution eligible: false
+- Permanent denylist: `manifests/artifact-denylist.json`
+
+## Intended one-time project action
+
+If a future replacement artifact closes every blocker, the first action would
+be a single manual, foreground capability probe with application arguments:
+
+```text
+--firmware 9.60 --acknowledge-read-only-probe
+```
+
+Project code would open the candidate GNM module, perform exactly 21 `dlsym`
+lookups, log names plus booleans, call none of the returned addresses, and
+attempt `dlclose`. It would request no VideoOut, framebuffer, GNM command,
+draw, dispatch, submit, flip, GPU-memory mutation, MMIO, or register operation.
+There would be no retry or automatic boot path.
+
+## APIs and side effects under review
+
+Project path: `strcmp`, `chimera_gfx_firmware_gate_allows`,
+`chimera_gfx_ps5_make_loader_ops`, `chimera_gfx_ps5_probe_symbols`, `dlopen`,
+`open_module`, `dlerror`, `resolve_symbol`, `dlsym`, `log_line`, `snprintf`,
+`write_log`, `fprintf`/`fwrite`, `close_module`, `dlclose`, and
+`chimera_gfx_status_string`.
+
+Pinned SDK transitive path includes `__patch_init`, kernel credential and
+syscall-permission writes, rtld initialization, possible
+`sceKernelLoadStartModule` calls, SDK kernel reads while inspecting module
+metadata, and possible `sceKernelStopUnloadModule` during cleanup. The complete
+audited path is in the evidence document.
+
+## Blocking findings
+
+1. SDK v0.41 performs kernel process-state writes before `main`. The firmware
+   gate cannot prevent them.
+2. No bounded/cancellable loader API or safe external supervisor has been
+   proven. A hang can prevent cleanup.
+3. Module start/stop internals on firmware 9.60 are unknown.
+4. The gate trusts a supplied string and does not attest firmware.
+5. Runtime delivery of the required four arguments has not been observed.
+
+Likely failure outcomes range from a clean refusal or loader error to a payload
+crash, persistent loaded-module/process state, or a console restart. GPU/display
+effects are not requested, but driver-internal effects cannot be ruled out.
+
+## Timeout, cleanup, and recovery status
+
+No safe timeout or forced-cancellation procedure exists for this artifact.
+Normal cleanup attempts `dlclose`; crash/hang cleanup and CRT kernel-state
+restoration are not guaranteed. Therefore no transfer, launch, kill, retry, or
+recovery procedure is approved.
+
+## Approval checklist
+
+- [x] Offline artifact hash and source commit recorded
+- [x] Full imports and call chain audited
+- [x] VideoOut/Phase-1 excluded from the build
+- [ ] Public, kernelwrite-free startup/loader path proven
+- [ ] Replacement artifact built and newly hashed
+- [ ] Firmware attestation and argument delivery proven
+- [ ] Bounded timeout and cleanup/recovery proven
+- [ ] New artifact-specific transfer approval
+- [ ] New artifact-specific one-time execution approval
+
+## Permission text
+
+There is deliberately **no valid permission text for this hash**. Generic or
+future approval must not be interpreted as authorization for it. After the
+blockers are closed, a newly named and newly hashed replacement needs a new
+package and an exact permission sentence that names that replacement hash.
+
+ADR-0009 makes this hash permanently ineligible; closing future startup
+blockers cannot rehabilitate these bytes.