Publish Chimera GFX source

2026-09-03 03:27:14 +02:00
commit a6037502d7
828 changed files with 100454 additions and 0 deletions
@@ -0,0 +1,75 @@
+# Phase 1.0Z: offline passive batch contract
+
+Status: `PASSIVE_LF_BATCH_CONTRACT_COMPLETE_LIVE_TRANSPORT_BLOCKED`
+
+Date: 2026-07-22
+
+Phase 1.0Z defines and tests a target-free host model only. It creates no
+socket, address, sender CLI, target code or artifact. No PS5 action occurred.
+
+## Contract
+
+An already validated Phase-1.0W `SessionPlan` can produce exactly one immutable
+outbound batch:
+
+| Window | Exact byte shape | Bound |
+|---|---|---|
+| `T2_GREETING_AND_HELP` | `help` followed by LF | 5 bytes |
+| `T3_ONE_EXACT_PATH` | `stat PATH` LF, then `sum PATH` LF | 1,035 bytes |
+
+The path is the existing normalized absolute-path alphabet, ASCII-encoded and
+at most 512 bytes. NUL, CR, IAC (`0xff`), whitespace inside the path and shell
+metacharacters cannot enter the batch. The contract retains no target address.
+It permits one outbound batch, no retry, no reconnect and no resume.
+
+Plain LF is accepted by both audited official source families. The legacy
+v0.7-v0.8 server passes it through; v0.9-v0.19 `libtelnet` also passes plain LF
+to `sh_readline`. The model does not select a deployed family.
+
+## Passive receive and completion
+
+The accumulator accepts only bytes already supplied by a synthetic caller. It
+does not own a transport or clock. Any incoming IAC is rejected because this
+passive contract emits no negotiation and both audited families send none
+proactively. That fail-closed rule avoids silently adding Telnet replies or
+signal semantics.
+
+Prompt text and remote EOF are never completion events. Only the explicit
+`seal_at_hard_deadline(true)` model event can request sealing. This is a
+synthetic boundary, not a working timer or proof that a future blocking receive
+can be preempted.
+
+Sealing is successful only when:
+
+- T2 contains a complete help listing matching the known v0.7 or v0.19 source
+  family fingerprint;
+- T3 contains `stat` metadata including size and a non-cryptographic BSD
+  rotate-16 `sum` for the one exact allowed path.
+
+Partial output, unknown help, missing stat, missing sum, invalid UTF-8,
+unexpected firmware metadata, IAC and a missing deadline event all fail closed.
+The sanitized result never proves an exact binary or device behavior.
+
+## Effects and limitations
+
+The offline model has no side effects. A future real T2/T3 session would still
+need explicit acceptance of the automatic model/serial/firmware/temperature/
+frequency greeting, shell process and connection state. T3 reads one file;
+that may cause low-level effects such as atime, cache, accounting and scheduler
+activity. Those effects are not claimed absent.
+
+Unresolved blockers remain:
+
+- exact deployed shsrv identity and family;
+- a real bounded adapter and preemptible hard deadline;
+- single-write/short-write behavior in current shsrv;
+- live chunking, disconnect, cleanup and restart behavior on firmware 9.60;
+- physical erasure of sensitive bytes from host memory;
+- directory durability for exclusive evidence inherited from Phase 1.0X.
+
+## Decision
+
+The offline passive batch contract is complete. Live transport remains blocked
+and unauthorized. The next permitted step is an offline fake-adapter
+integration that injects the exact batch and synthetic deadline without adding
+a socket, address, device client or device action.