Publish Chimera GFX source

docs/approvals/probe-9.60-transfer-execution.md

@@ -0,0 +1,94 @@
+# Firmware 9.60 probe transfer and one-time execution package
+
+Status: **BLOCKED — do not transfer and do not execute**.
+
+This is the separate review package requested after the offline build. It is
+not an authorization request because the current artifact cannot satisfy the
+project's no-kernel-change boundary.
+
+## Bound artifact
+
+- Filename:
+  `chimera-gfx-capability-probe-0.1.0-fw-9.60-offline-audit-only.elf`
+- SHA-256:
+  `4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63`
+- Size: 110424 bytes
+- Source commit: `ba8f6a40cf37dff628254caa9b11d83a73957cf8`
+- Firmware build gate: exact `9.60`
+- Manifest: `manifests/artifacts/chimera-gfx-capability-probe-0.1.0-fw-9.60.json`
+- Offline evidence: `docs/evidence/probe-9.60-offline-2026-07-17.md`
+- Transfer / execution recorded: false / false
+- Execution eligible: false
+- Permanent denylist: `manifests/artifact-denylist.json`
+
+## Intended one-time project action
+
+If a future replacement artifact closes every blocker, the first action would
+be a single manual, foreground capability probe with application arguments:
+
+```text
+--firmware 9.60 --acknowledge-read-only-probe
+```
+
+Project code would open the candidate GNM module, perform exactly 21 `dlsym`
+lookups, log names plus booleans, call none of the returned addresses, and
+attempt `dlclose`. It would request no VideoOut, framebuffer, GNM command,
+draw, dispatch, submit, flip, GPU-memory mutation, MMIO, or register operation.
+There would be no retry or automatic boot path.
+
+## APIs and side effects under review
+
+Project path: `strcmp`, `chimera_gfx_firmware_gate_allows`,
+`chimera_gfx_ps5_make_loader_ops`, `chimera_gfx_ps5_probe_symbols`, `dlopen`,
+`open_module`, `dlerror`, `resolve_symbol`, `dlsym`, `log_line`, `snprintf`,
+`write_log`, `fprintf`/`fwrite`, `close_module`, `dlclose`, and
+`chimera_gfx_status_string`.
+
+Pinned SDK transitive path includes `__patch_init`, kernel credential and
+syscall-permission writes, rtld initialization, possible
+`sceKernelLoadStartModule` calls, SDK kernel reads while inspecting module
+metadata, and possible `sceKernelStopUnloadModule` during cleanup. The complete
+audited path is in the evidence document.
+
+## Blocking findings
+
+1. SDK v0.41 performs kernel process-state writes before `main`. The firmware
+   gate cannot prevent them.
+2. No bounded/cancellable loader API or safe external supervisor has been
+   proven. A hang can prevent cleanup.
+3. Module start/stop internals on firmware 9.60 are unknown.
+4. The gate trusts a supplied string and does not attest firmware.
+5. Runtime delivery of the required four arguments has not been observed.
+
+Likely failure outcomes range from a clean refusal or loader error to a payload
+crash, persistent loaded-module/process state, or a console restart. GPU/display
+effects are not requested, but driver-internal effects cannot be ruled out.
+
+## Timeout, cleanup, and recovery status
+
+No safe timeout or forced-cancellation procedure exists for this artifact.
+Normal cleanup attempts `dlclose`; crash/hang cleanup and CRT kernel-state
+restoration are not guaranteed. Therefore no transfer, launch, kill, retry, or
+recovery procedure is approved.
+
+## Approval checklist
+
+- [x] Offline artifact hash and source commit recorded
+- [x] Full imports and call chain audited
+- [x] VideoOut/Phase-1 excluded from the build
+- [ ] Public, kernelwrite-free startup/loader path proven
+- [ ] Replacement artifact built and newly hashed
+- [ ] Firmware attestation and argument delivery proven
+- [ ] Bounded timeout and cleanup/recovery proven
+- [ ] New artifact-specific transfer approval
+- [ ] New artifact-specific one-time execution approval
+
+## Permission text
+
+There is deliberately **no valid permission text for this hash**. Generic or
+future approval must not be interpreted as authorization for it. After the
+blockers are closed, a newly named and newly hashed replacement needs a new
+package and an exact permission sentence that names that replacement hash.
+
+ADR-0009 makes this hash permanently ineligible; closing future startup
+blockers cannot rehabilitate these bytes.