Publish Chimera GFX source

2026-09-03 03:27:14 +02:00
commit a6037502d7
828 changed files with 100454 additions and 0 deletions
@@ -0,0 +1,152 @@
+# Phase 0.9B observer static audit
+
+Status: **NOT PERFORMED — BLOCKED BEFORE SOURCE AND BUILD**.
+
+This is a truthful negative audit record. No observer artifact exists, so no
+ELF property can be reported as passing. Absence of imports or strings is not
+used as a substitute for a reachable-code proof.
+
+## Build decision
+
+The source audit stopped the target build because:
+
+- normal SDK startup reaches `__patch_init()` and performs prohibited writes;
+- a freestanding observer return/exit and cleanup contract remains unproven;
+- the hash-bound controlled route suppresses payload stdout/stderr; and
+- the controlled manager sends the ELF and closes without receiving observer
+  output.
+
+No observer source path or CMake target was added. The existing
+`CHIMERA_GFX_BUILD_PS5_MINIMAL_STARTUP` configure-time blocker remains intact.
+
+## Required artifact audit status
+
+| Audit | Status | Reason |
+|---|---|---|
+| SHA-256 and size | `NOT_APPLICABLE_NO_ARTIFACT` | no binary |
+| source commit binding | `NOT_APPLICABLE_NO_ARTIFACT` | no target source |
+| toolchain identity | `PARTIAL_OFFLINE_REFERENCE_ONLY` | SDK v0.41 pinned; no observer link |
+| double clean build | `NOT_PERFORMED_BLOCKED_BEFORE_BUILD` | hard gates failed |
+| ELF header | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
+| program headers | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
+| section headers | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
+| dynamic dependencies | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
+| imported/undefined symbols | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
+| exported symbols | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
+| relocations | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
+| linker map | `NOT_CREATED` | no link |
+| reachable callgraph | `NOT_CREATED` | no code |
+| disassembly | `NOT_CREATED` | no code |
+| strings | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
+| denied capabilities | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
+| filesystem open flags | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
+| network functions | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
+| threads/loops | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
+| kernelwrites | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
+
+The validator fails if a Phase-0.9B ELF, map, observer target, observer source
+directory, installation package or lifecycle package appears while the
+manifest remains blocked.
+
+## Transitive startup audit
+
+### Normal SDK link
+
+The SDK compiler wrapper at commit
+`d2e2e585740362976a39fdd5ccf390f199a7bc37` selects
+`target/lib/crt1.o` unless `-nostartfiles` is present. The CRT Makefile links:
+
+`crt.o`, `syscall.o`, `klog.o`, `nid.o`, `kernel.o`, `rtld.o`, `rtld_so.o`,
+`rtld_sprx.o`, `rtld_payload.o`, `rtld_dlfcn.o`, `mdbg.o`, and `patch.o`.
+
+The installed `crt1.o` is 112256 bytes with SHA-256
+`0e4c1e5e38f22026580e856238a53e75d9e112f99a34bfe5495a3a0ffac15238`.
+It was inspected as source-bound evidence and was not linked into a new
+artifact.
+
+Reachable sequence from normal `_start`:
+
+```text
+_start
+  -> clear BSS
+  -> payload_init
+     -> __crt_syscall_init
+     -> __kernel_init
+     -> __klog_init
+     -> write __isthreaded
+     -> __patch_init
+        -> patch_kernel_ucred
+           -> kernel_set_ucred_caps
+           -> kernel_set_ucred_attrs
+        -> patch_syscall_permissions
+           -> kernel_copyin syscall low bound
+           -> kernel_copyin syscall high bound
+     -> __rtld_init
+  -> payload_run
+     -> constructors
+     -> main
+     -> destructors
+  -> payload_terminate
+```
+
+Result: **UNSAFE** for the Phase-0.9B kernelwrite-free contract.
+
+### Custom entry
+
+`-nostartfiles -nodefaultlibs` can remove `crt1.o` and default libraries.
+However, compile/link capability alone does not establish safe behavior.
+elfldr `elfldr_prepare_exec()` shows `RDI=args`, `RIP=entry`, and the old RIP
+stored on the adjusted stack. No source establishes the complete observer
+post-return cleanup, process-exit, crash, or resource-lifetime contract for a
+new bare entry. Result: **UNPROVEN**.
+
+## Output audit
+
+Controlled elfldr call path:
+
+```text
+controlled manager
+  -> connect_loopback
+  -> send_all(control header)
+  -> send_all(ELF bytes)
+  -> close_socket
+
+elfldr controlled route
+  -> payload_read_controlled
+  -> payload_spawn
+  -> elfldr_spawn(stdio = -1)
+  -> no stdio duplication
+  -> watchdog/reap
+  -> fixed "Controlled payload exited" loader response
+```
+
+There is no manager receive callback and no payload-provided response body.
+Result: **NO PROVEN NON-PERSISTENT OUTPUT CHANNEL**.
+
+## Existing loader effects versus observer effects
+
+The hardened loader performs ptrace, credential, mapping, socket-overlap,
+breakpoint, protection and cleanup operations before and around entry. Those
+are existing loader effects, not code introduced by an observer artifact.
+They are still relevant to the risk of a later execution and do not make the
+observer’s own startup kernelwrite-free.
+
+Because no observer was built:
+
+- observer imports: none to report;
+- observer filesystem reads: none implemented;
+- observer network functions: none implemented;
+- observer threads or loops: none implemented;
+- observer prohibited capabilities: none implemented; and
+- absence of an artifact is not hardware-safety proof.
+
+## Reproducibility
+
+Build 1 hash: `null`.
+
+Build 2 hash: `null`.
+
+Final artifact hash/size: `null` / `null`.
+
+Result: `NOT_PERFORMED_BLOCKED_BEFORE_BUILD`, not
+`REPRODUCIBILITY_PASSED`.