This commit is contained in:
Chimera GFX release export
@@ -0,0 +1,103 @@
|
||||
# Phase 0.9C capability closure
|
||||
|
||||
Status: **NO TARGET CAPABILITY CLOSED**.
|
||||
|
||||
“Host evidence” below means a deterministic model or source validator. It is
|
||||
not PS5 evidence. `implementation allowed` and `execution allowed` are false
|
||||
for every capability because the startup/exit, output, firmware-source, and
|
||||
side-effect gates fail before target implementation.
|
||||
|
||||
## Closure matrix
|
||||
|
||||
| Capability | Source evidence | Host evidence | Target evidence | Implement allowed | Execute allowed | Remaining blocker |
|
||||
|---|---|---|---|---:|---:|---|
|
||||
| runtime self-identity | future protocol binds observer version and artifact SHA-256 | framing validates both | absent | false | false | no target artifact or runtime self-binding |
|
||||
| firmware source 1 | SDK `kernel_get_fw_version`, `crt/kernel.c:148-170` | protocol binds raw value | absent | false | false | depends on prohibited runtime and is not independent system identity |
|
||||
| firmware source 2 | export-stub name only, no accepted signature/semantics | missing/conflict tests fail closed | absent | false | false | independent accepted source absent |
|
||||
| mount query | SDK `samples/mntinfo` and libc wrapper | unsupported can be represented | absent | false | false | ABI, completeness, runtime behavior and effects unproven |
|
||||
| metadata | controlled manager no-follow pattern | result framing can represent error | absent | false | false | target metadata/no-follow semantics and effects unproven |
|
||||
| object ID | manager compares `st_dev/st_ino` | completeness rules modeled | absent | false | false | stable target identity and race contract unproven |
|
||||
| size | manager compares exact `st_size` | checked result length modeled | absent | false | false | current object and stable-read evidence absent |
|
||||
| SHA-256 | bounded same-FD manager implementation | checksum corruption is rejected | absent | false | false | target read effects, current paths and stable object absent |
|
||||
| processes | SDK `samples/ps` partial snapshot | unsupported result modeled | absent | false | false | complete ABI, bounds and semantics absent |
|
||||
| services | no complete source/API mapping | unsupported result modeled | absent | false | false | service inventory and ownership semantics absent |
|
||||
| listeners | no accepted snapshot/owner API | unsupported result modeled | absent | false | false | listener API, ownership and side effects absent |
|
||||
| autoload/startup/retry | stock manager readers/HTTP are incomplete or side-effecting | missing source remains blocked | absent | false | false | complete authoritative sources and safe collector absent |
|
||||
| rollback objects | Phase 0.8R/0.9A evidence contract only | no false promotion in validators | absent | false | false | current exact backups absent; manager backup is hard blocker |
|
||||
| monotonic time | hardened loader uses `CLOCK_MONOTONIC` | deadline expiry is rejected | absent in observer ABI | false | false | loader exposes no clock callback; freestanding callable ABI absent |
|
||||
| startup | SDK and hardened loader callgraphs | startup classifications validated | absent | false | false | normal CRT writes; freestanding dependency closure incomplete |
|
||||
| output | current route proven send-only; D1 host contract defined | 4096-byte framing and negative tests | absent | false | false | no caller-owned target buffer/copy-out/manager delivery |
|
||||
| normal exit | loader has wait/reap; status discarded | no safe exit terminal modeled | absent | false | false | return/exit semantics and teardown unproven |
|
||||
| error exit | CRT error/longjmp/trap and loader reap reviewed | observer error cannot equal empty success | absent | false | false | partial unwind, status and cleanup unproven |
|
||||
| timeout | loader SIGTERM/SIGKILL watchdog reviewed | timeout record is rejected | absent | false | false | kill/timeout is not an admissible safe exit |
|
||||
| cleanup | pre-detach cleanup state exists; post-detach relies on process lifetime | failed/incomplete cleanup rejected | absent | false | false | mappings, FDs, buffers, loader and manager cleanup not jointly proven |
|
||||
| recovery independence | Phase 0.9A contract | blocker preserved | absent | false | false | recovery executor and exact rollback objects unproven |
|
||||
|
||||
## Firmware-source closure
|
||||
|
||||
Current source 1 reads a process-parameter field associated with
|
||||
`libSceLibcInternal`; its own comment says it is chosen because some payloads
|
||||
modify the kernel-reported value. That makes it useful source evidence, but
|
||||
not an independent second current device identity.
|
||||
|
||||
The SDK stubs contain
|
||||
`sceKernelGetProsperoSystemSwVersion`, but a stub exports only a name/NID
|
||||
surface. The repository has no reviewed public prototype, result layout,
|
||||
return semantics, side-effect contract, or firmware-9.60 observation. It is
|
||||
not callable evidence and is not source 2.
|
||||
|
||||
A future source 2 must:
|
||||
|
||||
1. be official/reproducible public platform evidence or a separately reviewed
|
||||
locally obtained runtime value;
|
||||
2. have exact function/data ABI and side-effect evidence;
|
||||
3. identify the current system, not the observer's compiled SDK requirement;
|
||||
4. produce an exact raw value under the same deadline;
|
||||
5. be independent of source 1's data origin;
|
||||
6. bind source identity, raw result, nonce, request ID, observer artifact hash
|
||||
and deadline into the result record; and
|
||||
7. fail closed if absent, ambiguous, stale, or conflicting.
|
||||
|
||||
The host protocol returns
|
||||
`BLOCKED_FIRMWARE_SOURCE_2_ABSENT` for absence and
|
||||
`BLOCKED_FIRMWARE_CONFLICT` for disagreement. It never normalizes a conflict
|
||||
away or prefers one source.
|
||||
|
||||
## Cross-gate closure
|
||||
|
||||
The following dependencies form one conjunctive gate:
|
||||
|
||||
```text
|
||||
kernelwrite-free usable startup
|
||||
+ proven stack/relocation/BSS/TLS closure
|
||||
+ callable bounded observation primitives
|
||||
+ two bound firmware sources
|
||||
+ bounded transient output
|
||||
+ normal/error/deadline exit without kill
|
||||
+ complete cleanup and unambiguous status
|
||||
+ bounded accepted observation effects
|
||||
= target implementation may be reconsidered
|
||||
```
|
||||
|
||||
Every term is required. A passing host protocol cannot compensate for a
|
||||
missing exit ABI. A proven read algorithm cannot compensate for an absent
|
||||
output channel. Two firmware strings cannot compensate for an unreviewed ABI
|
||||
or stale execution binding.
|
||||
|
||||
## Decision
|
||||
|
||||
Closed for host design:
|
||||
|
||||
- startup graph classifications are explicit;
|
||||
- the freestanding missing dependencies are explicit;
|
||||
- D1 framing is fixed at 4096 bytes and fails closed;
|
||||
- stale, duplicate, incomplete, corrupt, timed-out and conflicting records
|
||||
are rejected; and
|
||||
- every capability has an explicit blocker.
|
||||
|
||||
Not closed for target implementation:
|
||||
|
||||
- all 21 capabilities in the matrix.
|
||||
|
||||
The capability result contributes to
|
||||
`BLOCKED_MULTIPLE_FOUNDATIONAL_CONTRACTS`.
|
||||
Reference in New Issue
Block a user