Publish Chimera GFX source

docs/runtime/payload-manager-policy.md

@@ -0,0 +1,72 @@
+# Chimera Payload Manager artifact policy contract
+
+The controlled Phase-0.7 Payload Manager is maintained in the separate private
+`chimera-ps5-payload-manager` repository. This repository supplies the
+hash-bound artifact and runtime profile that the manager must enforce.
+
+## Same-file-descriptor launch boundary
+
+The controlled manager:
+
+1. opens the selected artifact once with read-only, no-follow, close-on-exec
+   flags;
+2. requires a regular file and exact compiled byte size;
+3. hashes that same file descriptor;
+4. rejects the permanent denylist and every metadata mismatch;
+5. rewinds and streams that same descriptor;
+6. checks descriptor identity and path identity after streaming;
+7. sends an exact versioned header over loopback only;
+8. uses a compiled exact artifact ID, SHA-256, size, firmware 9.60, 2000 ms
+   timeout, and `retry=false`.
+
+There is no path reopen between hash and stream. A symlink, truncation,
+replacement, digest mismatch, denylist match, wrong route, wrong firmware,
+non-loopback destination, or post-stream identity change fails closed.
+
+## Controlled upload boundary
+
+The upload route accepts only the controlled directory, creates an exclusive
+no-follow temporary file, writes and synchronizes it, verifies exact content,
+then atomically renames it. Upload never autoloads or executes the artifact.
+The removable application write is explicit in the Phase-0.7 budget; it is not
+a firmware write.
+
+## Receiver enforcement
+
+The hardened elfldr independently hashes the received bytes, validates the
+exact artifact ID/size/firmware/digest/timeout/no-retry header, and enforces the
+permanent denylist. Sender metadata alone is therefore insufficient.
+
+The legacy route is classified `UNVERIFIED_LEGACY` and is not a controlled
+Chimera launch path.
+
+## Repository static gate
+
+Before preparing a later action, the exact lifecycle bytes must also pass:
+
+```text
+python3 tools/check_artifact_execution_policy.py \
+  --manifest <artifact-manifest.json> \
+  --denylist manifests/artifact-denylist.json \
+  --artifact <exact-local-artifact> \
+  --runtime-profile manifests/runtime/controlled-ps5-runtime-profile.json \
+  --firmware 9.60
+```
+
+Only `PASS_STATIC_DEPLOYMENT_ELIGIBILITY_GATE` is accepted. The result always
+contains `execution_authorized=false`; it is preparation evidence, not
+permission.
+
+## Permanent denial
+
+SHA-256 `4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63`
+must always return `ARTIFACT_PERMANENTLY_DENYLISTED`, regardless of metadata,
+runtime profile, or later generic approval. The entry is also copied into both
+hardened consumers.
+
+## Current action state
+
+No hardened binary is installed. No lifecycle artifact has been transferred
+or executed. A separate exact-hash installation approval is required first;
+after successful installation verification, lifecycle transfer and one-time
+execution require another artifact-specific approval.