Publish Chimera GFX source

2026-09-03 03:27:14 +02:00
commit a6037502d7
828 changed files with 100454 additions and 0 deletions
@@ -0,0 +1,105 @@
+# Phase 1.0V: inactive one-shot shsrv collector model
+
+Status: `INACTIVE_OFFLINE_COLLECTOR_MODEL_COMPLETE_NO_LIVE_CLIENT`
+
+Date: 2026-07-22
+
+Phase 1.0V implements and tests only an offline input model. It has no socket,
+address, port, DNS, connection, command sender, timeout loop, retry or device
+transport. No PS5 action was performed and no live action is authorized.
+
+## Purpose
+
+Phase 1.0T proved that a shsrv greeting automatically exposes serial and
+telemetry and that existing metadata cannot establish an exact binary
+identity. Phase 1.0U found no original host target to hash. This phase models
+the minimum safe receive-and-sanitize boundary before deciding whether a later
+separately approved live collector is justified.
+
+The model accepts only synthetic or already-supplied bytes through stdin or a
+host unit test. It cannot initiate collection.
+
+## State and bounds
+
+The state sequence is:
+
+`READY -> RECEIVING -> SEALED`
+
+Failure produces `INVALID`; an operator abort produces `ABORTED`. Input after
+sealing/abort and a second finalize are rejected. Limits are:
+
+- 65,536 total input bytes;
+- 65,536 post-Telnet bytes;
+- 256 chunks;
+- strict UTF-8 after Telnet filtering;
+- one finalize and one sanitized result only.
+
+There is no automatic retry, reconnect, resume or fallback.
+
+## Telnet handling
+
+The incremental filter removes `WILL`, `WONT`, `DO`, `DONT` option exchanges
+and bounded subnegotiation sequences. It supports control sequences split
+across chunks. An incomplete control sequence at EOF fails closed. The model
+does not send the negotiation replies a live Telnet client may require; that
+is deliberately outside this phase.
+
+## Sanitization
+
+After filtering, Phase 1.0T parsing:
+
+- discards serial, model, temperature and CPU-frequency values;
+- retains compile metadata and firmware only;
+- retains file metadata only for an exact pre-approved literal path;
+- labels `sum` as a non-cryptographic 16-bit checksum;
+- never returns raw transcript data;
+- always returns `exact_identity=false`.
+
+The internal bytearray is overwritten and cleared before return or invalidation.
+Python and the operating system may have made copies outside that bytearray,
+so `physical_memory_erasure_proven=false`. The guarantee is limited to no raw
+transcript in the model's persistent output.
+
+## CLI boundary
+
+The only supported CLI input mode is:
+
+```text
+--offline-transcript [--expected-path LITERAL_PATH]
+```
+
+There is no target, host, address, port, command, connect or send option. The
+CLI reads stdin in 4 KiB chunks and prints sanitized JSON. It is an offline
+analysis tool, not a deviceclient.
+
+## Future live requirements
+
+A later live implementation would require a separate phase and review of:
+
+- an exact inactive manifest and untracked approval;
+- one pre-attested listener and literal address;
+- one connection and one command window;
+- an absolute monotonic deadline;
+- no raw stdout/log/file persistence;
+- explicit acceptance of automatic serial/telemetry reads;
+- Telnet reply behavior and prompt framing;
+- exclusive sanitized output creation;
+- no retry, reconnect, resume, path discovery or fallback;
+- a consumed-attempt receipt before opening a socket.
+
+None of those live capabilities or approvals exists in Phase 1.0V.
+
+## Phase 1.0W self-review remediation
+
+Before using this model as an architecture dependency, self-review corrected
+the doubled-`IAC` subnegotiation state, stopped empty chunks consuming the
+chunk budget, added absolute normalized path allowlisting, gated firmware
+metadata to exact `9.60`, validated compile date/time formats and normalized
+numeric parser failures to a generic fail-closed result. The model was rehashed
+after these changes. Physical memory erasure remains unproven.
+
+## Decision
+
+The offline sanitization model is ready for human review. Exact deployed shsrv
+identity remains unproven. No launch-context experiment, target build,
+connection, command, transfer or execution is enabled.