Jens/chimera-gfx-Public
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Publish Chimera GFX source
phase0-ci / build-and-audit (push) Failing after 1m41s
Details

Browse Source
This commit is contained in:
Chimera GFX release export
2026-09-03 02:53:36 +02:00
commit fee37cd9b5
824 changed files with 100072 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.clang-format
+7
View File
@@ -0,0 +1,7 @@
BasedOnStyle: LLVM
IndentWidth: 4
ContinuationIndentWidth: 4
ColumnLimit: 80
DerivePointerAlignment: false
PointerAlignment: Right
SortIncludes: CaseSensitive
.clang-tidy
+13
View File
@@ -0,0 +1,13 @@
Checks: >-
-*,
clang-analyzer-*,
-clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling,
bugprone-sizeof-expression,
bugprone-suspicious-memory-comparison,
bugprone-suspicious-missing-comma,
bugprone-suspicious-realloc-usage,
performance-*,
portability-*
WarningsAsErrors: '*'
HeaderFilterRegex: '(include/chimera|src|samples|tests)/.*'
FormatStyle: file
.dockerignore
+11
View File
@@ -0,0 +1,11 @@
.git
.gitea
build
build-*
work
out
.vs
.vscode
.idea
*.log
*.elf
.editorconfig
+23
View File
@@ -0,0 +1,23 @@
root = true
[*]
charset = utf-8
end_of_line = lf
insert_final_newline = true
trim_trailing_whitespace = true
[*.{c,h}]
indent_style = space
indent_size = 4
[*.{cmake,json,md,yml,yaml}]
indent_style = space
indent_size = 2
[*.{py,ps1}]
indent_style = space
indent_size = 4
[CMakeLists.txt]
indent_style = space
indent_size = 2
.gitattributes
+8
View File
@@ -0,0 +1,8 @@
* text=auto eol=lf
*.png binary
*.jpg binary
*.jpeg binary
*.zip binary
*.elf binary
*.patch -whitespace
.gitea/workflows/ci.yml
+60
View File
@@ -0,0 +1,60 @@
name: phase0-ci
on:
push:
branches: [main]
pull_request:
workflow_dispatch:
concurrency:
group: phase0-ci-${{ gitea.repository }}-${{ gitea.ref }}
cancel-in-progress: true
jobs:
build-and-audit:
if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
runs-on: ubuntu-latest
container:
image: ubuntu:26.04@sha256:651ba3fe3a830441e3deaf70fafac40d808a6bd2800a6f2c43130055159f23e6
steps:
- name: Install build tools
run: >-
apt-get update && apt-get install -y --no-install-recommends
ca-certificates
bsdextrautils
clang-18
clang-format-18
clang-tidy-18
cmake
curl
git
lld-18
llvm-18-dev
ninja-build
nodejs
python3
unzip
- name: Check out repository
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with:
fetch-depth: 0
- name: Host build and policy tests
run: |
cmake -S . -B build/host -G Ninja -DCMAKE_C_COMPILER=clang-18 -DCHIMERA_GFX_ENABLE_CLANG_TIDY=ON -DCHIMERA_GFX_REGISTER_EXTERNAL_EVIDENCE_VALIDATORS=OFF -DBUILD_TESTING=ON
cmake --build build/host
ctest --test-dir build/host --output-on-failure
- name: Fetch and verify locked public PS5 SDK
run: |
curl -fL --retry 3 --output /tmp/ps5-payload-sdk.zip https://github.com/ps5-payload-dev/sdk/releases/download/v0.41/ps5-payload-sdk.zip
echo "ebfb0acb5260511951a80e17db41650c62d20a8caf8659a230b928dc85005984 /tmp/ps5-payload-sdk.zip" | sha256sum --check --strict
unzip -q /tmp/ps5-payload-sdk.zip -d /opt
- name: Compile all safe Phase-0 PS5 targets
env:
LLVM_CONFIG: /usr/bin/llvm-config-18
run: |
cmake -S . -B build/ps5 -G Ninja -DCMAKE_TOOLCHAIN_FILE=/opt/ps5-payload-sdk/toolchain/prospero.cmake -DCHIMERA_GFX_BUILD_PS5_PROBE=ON -DCHIMERA_GFX_PS5_ALLOWED_FIRMWARE=NONE -DBUILD_TESTING=OFF
cmake --build build/ps5
.gitea/workflows/managed-validation.yml
+117
View File
@@ -0,0 +1,117 @@
name: Managed validation
on:
workflow_dispatch:
inputs:
profile:
description: Allowlisted validation profile
required: true
default: full
type: choice
options: [test, lint, typecheck, build, security, full]
permissions:
contents: read
concurrency:
group: managed-validation-${{ gitea.repository }}-${{ gitea.ref }}
cancel-in-progress: true
jobs:
full:
name: full
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Validate repository with a bounded profile
shell: bash
env:
REQUESTED_PROFILE: ${{ inputs.profile }}
run: |
set -euo pipefail
profile="${REQUESTED_PROFILE:-full}"
case "${profile}" in
test|lint|typecheck|build|security|full) ;;
*) echo "Profile is not allowlisted" >&2; exit 2 ;;
esac
git diff --check
if git grep -nE '^(<<<<<<< |=======$|>>>>>>> )' -- . ':!*.lock' ':!*.patch'; then
echo "Unresolved merge markers detected" >&2
exit 1
fi
if [[ -f pyproject.toml || -f requirements.txt ]]; then
# Compile only tracked Python sources. Running compileall after a
# Node install would otherwise traverse node_modules and turn a
# lightweight baseline into a large runner workload.
git ls-files -z '*.py' | xargs -0 -r python -m py_compile
if [[ -f uv.lock ]]; then
python -m venv "${RUNNER_TEMP}/managed-uv"
uv_python="${RUNNER_TEMP}/managed-uv/bin/python"
"${uv_python}" -m pip install --disable-pip-version-check uv==0.10.0
managed_uv="${RUNNER_TEMP}/managed-uv/bin/uv"
export UV_PROJECT_ENVIRONMENT="${RUNNER_TEMP}/managed-project-venv"
"${managed_uv}" sync --locked
export PATH="${UV_PROJECT_ENVIRONMENT}/bin:${PATH}"
if [[ "${profile}" == test || "${profile}" == full ]]; then
if "${managed_uv}" run python -c 'import pytest' 2>/dev/null; then
"${managed_uv}" run python -m pytest
fi
fi
if [[ "${profile}" == lint || "${profile}" == full ]]; then
if "${managed_uv}" run python -c 'import ruff' 2>/dev/null; then
"${managed_uv}" run python -m ruff check .
fi
fi
elif [[ -f requirements.txt ]]; then
python -m venv "${RUNNER_TEMP}/managed-python"
managed_python="${RUNNER_TEMP}/managed-python/bin/python"
"${managed_python}" -m pip install --disable-pip-version-check -r requirements.txt
export PATH="${RUNNER_TEMP}/managed-python/bin:${PATH}"
if [[ "${profile}" == test || "${profile}" == full ]]; then
if "${managed_python}" -c 'import pytest' 2>/dev/null; then
"${managed_python}" -m pytest
fi
fi
fi
fi
# Prepare Python before invoking Node scripts. Polyglot repositories
# commonly delegate their test script to Python and need the managed
# virtual environment to be active first.
if [[ -f package.json ]]; then
corepack enable
if [[ -f pnpm-lock.yaml ]]; then
pnpm install --frozen-lockfile
[[ "${profile}" == test || "${profile}" == full ]] && pnpm --if-present test
[[ "${profile}" == lint || "${profile}" == full ]] && pnpm --if-present lint
[[ "${profile}" == typecheck || "${profile}" == full ]] && pnpm --if-present typecheck
[[ "${profile}" == build || "${profile}" == full ]] && pnpm --if-present build
elif [[ -f package-lock.json ]]; then
npm ci
[[ "${profile}" == test || "${profile}" == full ]] && npm run --if-present test
[[ "${profile}" == lint || "${profile}" == full ]] && npm run --if-present lint
if [[ "${profile}" == typecheck || "${profile}" == full ]]; then
npm run --if-present typecheck
fi
[[ "${profile}" == build || "${profile}" == full ]] && npm run --if-present build
fi
fi
if [[ -f go.mod ]]; then
if [[ "${profile}" == test || "${profile}" == build || "${profile}" == full ]]; then
go test ./...
fi
fi
if [[ -f Cargo.toml ]]; then
if [[ "${profile}" == test || "${profile}" == build || "${profile}" == full ]]; then
cargo test --locked
fi
fi
if compgen -G '*.sln' >/dev/null; then
if [[ "${profile}" == test || "${profile}" == build || "${profile}" == full ]]; then
dotnet test --configuration Release
fi
fi
.gitignore
+60
View File
@@ -0,0 +1,60 @@
# Build products
/build/
/build-*/
/out/
/outputs/
/CMakeFiles/
CMakeCache.txt
cmake_install.cmake
CTestTestfile.cmake
compile_commands.json
.ninja_*
build.ninja
*.elf
*.o
*.obj
*.a
*.lib
*.pdb
*.dSYM/
__pycache__/
*.py[cod]
# Test, coverage and diagnostic output
/Testing/
/coverage/
*.gcda
*.gcno
*.profraw
*.profdata
core
core.*
crash-*.json
*.log
# Local tools, downloads and upstream research clones
/work/
/tmp/
/temp/
/artifacts/
# Local AI/editor workspace state
.codex/
.claude/
.agents/
.idea/
.vscode/
.vs/
.DS_Store
Thumbs.db
# Credentials and local configuration
.env
.env.*
!.env.example
*.key
*.pem
*.p12
*.pfx
credentials*
secrets*
.gitleaks.toml
+13
View File
@@ -0,0 +1,13 @@
[extend]
useDefault = true
# These files contain published SHA-256 provenance values. Gitleaks' generic
# key rule mistakes the JSON field names for credentials; the values are
# one-way digests, not authentication material. Keep the allowlist path-bound.
[[allowlists]]
description = "Published provenance SHA-256 values"
paths = [
'''^manifests/runtime/phase-0\.9e-r-release-correlation\.json$''',
'''^manifests/retroarch/phase-1\.0bz-exact-sdl-stage-cleanup-gate\.json$''',
'''^manifests/retroarch/phase-1\.0ca-cleanup-result-and-hash-verifier-correction-gate\.json$'''
]
ARCHITECTURE.md
+438
View File
@@ -0,0 +1,438 @@
# Architecture
## Scope and trust boundaries
`libchimera-gfx` is split so that host-testable policy and state validation do
not depend on PS5 headers or undocumented ABI assumptions.
```text
RetroArch adapter (Phase 3) ----+
+--> public C API --> validated core
SDL2 renderer (Phase 4) --------+ |
+--> mock backend
+--> PS5 backend (refuses)
Phase-0 capability sample --> probe logic --> symbol resolver --> system loader
^ |
| +-- no resolved pointer escapes
+-- generated read-only symbol table
```
The capability probe is intentionally separate from the normal context API.
Discovering exports does not make the PS5 backend usable and cannot set a
rendering capability flag.
## Public API contract
The public API is C11 and uses opaque handles, explicit structure sizes, and an
API version. This supports compatible growth without copying upstream or
proprietary structures into the interface.
Phase-0 guarantees:
1. `chimera_gfx_create()` creates only the mock backend; the separately
compiled PS5 backend always returns `SAFETY_POLICY`.
2. Any rendering-request flag fails with `CHIMERA_GFX_STATUS_SAFETY_POLICY`.
3. Mock capabilities claim only a host-memory lifecycle and present model,
always together with `NON_RENDERING` and `HOST_TEST_ONLY`.
4. Context destruction accepts `NULL` and otherwise returns `RESOURCE_BUSY`
until every child surface and texture is destroyed.
5. Unknown backend IDs, API versions, flags, or undersized structures fail
before backend code is entered.
The contract includes opaque surface and texture handles, validated RGBA8
upload, a deterministic mock present serial, and cleanup status. It does not
yet include buffers, queues, shaders, fences, swapchains, display ownership,
hardware contexts, or hardware presentation.
## Backend contract
Backends receive only validated inputs. A backend must populate capability
flags from evidence, never from platform names or compile-time assumptions.
Future mutating operations must include bounded lifetimes, timeout behavior,
idempotent cleanup, and a safe fallback before entering the public API.
The mock backend is deterministic and advertises only:
- backend availability;
- non-rendering operation;
- host-test support;
- bounded surface and texture lifecycle;
- packed host-memory upload and non-graphical present-state tracking.
It allocates no display or GPU resource. A present validates ownership,
dimensions, format, and upload state, then records a serial and FNV-1a content
hash for test inspection.
## PS5 discovery boundary
The PS5 probe has two layers:
- portable logic that iterates an immutable symbol-name table and records only
`resolved: true|false`;
- a PS5 loader shim limited to `dlopen`, `dlsym`, and `dlclose`.
Resolved addresses are compared with `NULL`, then discarded. They are never
logged, returned, cast to a function type, or invoked. The probe does not call
even apparently read-only exports because their signatures and ABI remain
unverified.
## Phase-0.5 startup boundary
The stock SDK v0.41 `crt1.o` is outside the trusted runtime boundary: its
reachable `_start` graph performs kernel credential and syscall-bound writes
and initializes a module-capable rtld. A compiler trace proves that
`-nostartfiles -nodefaultlibs` can omit that object, but the exact public loader
caller needed to prove entry stack, argument ownership, safe return, cleanup,
and crash behavior is absent from the pinned local evidence.
Accordingly, `CHIMERA_GFX_BUILD_PS5_MINIMAL_STARTUP=ON` always fails
configuration. There is no candidate source or artifact. The design may be
reopened only after the evidence listed in
`docs/runtime/minimal-crt-feasibility.md` is available and reviewed.
Artifact execution policy is a separate, fail-closed boundary. Static
eligibility requires `execution_eligible=true` and a SHA-256 absent from the
permanent denylist. Passing that layer never grants execution authority.
## Phase-0.6 controlled runtime boundary
Phase 0.6 identified the exact installed Payload Manager v0.3.1 and
`ps5-payload-dev/elfldr` v0.23. The normal SDK CRT is acceptable for design
only when every temporary effect is documented and bounded; `__patch_init`
alone is no longer an automatic blocker.
The exact chain is not bounded: ptrace single-step loops and detached payload
runtime have no deadline, cleanup and credential failure paths are unresolved,
Payload Manager launch is not SHA-256-bound, and manager upload writes
persistent storage. The historical Phase-0.6 profile therefore remained
`execution_eligible=false` and no Phase-0.6 lifecycle artifact exists.
Future consumers must validate the artifact manifest, permanent denylist,
controlled runtime profile, exact device firmware, exact local bytes, and
budgets together. The static gate always returns
`execution_authorized=false`. See ADR-0010.
## Phase-0.7 hardened deployment boundary
Phase 0.7 preserves the Phase-0.6 record and creates new private hardened
runtime artifacts. elfldr now bounds ptrace and child lifetime, restores and
checks all credential fields, centralizes cleanup, reaps every controlled
child, and rehashes received payload bytes. The controlled Payload Manager
hashes and streams one no-follow file descriptor and is compiled for one exact
firmware/artifact identity.
The lifecycle payload uses normal SDK v0.41 startup, sends one notification,
and calls `_exit`. It contains no GNM, VideoOut, SDL, payload-network, retry,
or autoload path. Complete source/map/disassembly callgraphs remain part of the
audit because static linkage means imports alone are insufficient evidence.
The current architecture state is
`READY_FOR_HARDENED_RUNTIME_DEPLOYMENT` offline only. It permits packaging and
review; it does not permit connection, installation, transfer, or execution.
See ADR-0011.
The candidate runtime module name `libSceGnmDriver.sprx` is an inference from
the public stub filename and the SDK's documented dynamic-loading convention;
it is not treated as proven on any firmware.
## Phase-0.9A anti-brick design boundary
Phase 0.9A adds only an offline transaction contract and a virtual host
simulator. It does not add an installer, PS5 path, device transport, target
artifact or production runtime code. The simulator holds logical objects,
mounts, hashes and writes in memory and marks every result as non-hardware
evidence.
Hardened elfldr and controlled Payload Manager have independent transactions,
backups, target mappings, approvals, switches and rollbacks. No combined action
or component order is inferred. The lifecycle probe is excluded. In-place
overwrite and a two-rename interval with a missing live name are forbidden.
All fourteen PS5 power-loss boundaries and all filesystem atomicity and
durability properties remain `UNPROVEN`; any one blocks installation. See
`docs/runtime/phase-0.9-installation-transaction-design.md`.
## Phase-0.9B bounded observer boundary
Phase 0.9B stops before target implementation. The normal SDK v0.41 `_start`
graph reaches `__patch_init()` before `main` and therefore violates this
phase's kernelwrite-free requirement. `-nostartfiles -nodefaultlibs` can omit
that graph, but the bare-entry return/exit, crash and loader-cleanup contract
is still unproven.
The hardened controlled route also passes `stdio=-1` to the payload. The
controlled manager provides connect, send and close operations but no receive
operation; the loader's fixed exit response carries no payload data. Therefore
there is no proven non-persistent observer output channel. No observer source,
target, ELF, map or artifact package exists. Host-only mocks validate the
result contract and fail-closed BLOCKED record, not PS5 behavior. See
`docs/runtime/phase-0.9b-bounded-observer-design.md`.
## Phase-0.9C observer execution-feasibility boundary
Phase 0.9C closes the offline design question with
`BLOCKED_MULTIPLE_FOUNDATIONAL_CONTRACTS`. The loader sets `RIP`, `RDI`, and a
synthetic return address, but it does not prove entry stack alignment or a
safe post-return continuation. Normal SDK startup reaches `__patch_init`;
omitting that runtime also removes the only reviewed syscall, import, time,
heap, and libc initialization path. No safe normal/error/deadline exit and
joint cleanup contract remains.
The host-only D1 model defines a fixed 4096-byte caller-owned record with
nonce/request binding, two firmware fields, capability bitmaps, checksums,
deadline, cleanup status, and a final completion marker. Hardened elfldr does
not own such a buffer: its current `payloadout` lives in the child mapping.
The controlled manager connects, sends, and closes without receiving; the
loader discards wait status. The protocol is therefore a future contract, not
a target implementation or output channel. No observer source, target,
artifact, map, package, device operation, or authorization exists.
## Phase-0.9D existing-stack readback boundary
Phase 0.9D does not revisit target startup or create an observer. It audits the
already present elfldr and Payload Manager request surfaces. Their file reads
feed listing, metadata, hash-before-launch, or host-to-elfldr transmission; no
route frames and returns an arbitrary file to the host. The result is
`BLOCKED_NO_READBACK_PATH`.
The host backup state machine therefore remains a contract only: two separate
exclusive local files, exact byte counts, close/reopen/hash, and full
size/hash/byte comparison. Matching copies could establish
`OFF_DEVICE_BACKUP_VALID`, never `RECOVERY_PROVEN`. Current live component
paths, external exploit repeatability, durable restoration, and power-loss
recovery remain unproven. See
`docs/runtime/phase-0.9d-readback-feasibility.md`.
## Phase-0.9E external bootstrap boundary
The architecture before hardened elfldr is not locally source-bound. The
bounded inventory found an exact Y2JB-named ZIP and byte-exact opaque `SIECAF`
member, but no acceptable parser, exact-used deployment evidence, port-9020
listener source/binary, or exact sender implementation. The port-9020 material
in the elfldr README describes only a host stream into a pre-existing
rudimentary loader; it is not that loader's protocol or implementation.
Consequently host-to-memory, filesystem staging, entrypoint selection,
duplex output, crash cleanup, post-reboot restart, and independence from
elfldr and Payload Manager remain `UNPROVEN`. Phase 0.9E adds no parser,
emulator, target code, client, rescue payload, or artifact. Its fail-closed
classification is `BOOTSTRAP_IMPLEMENTATION_MISSING`.
## Phase-0.9E-R official-release correlation boundary
The local outer Y2JB ZIP is not byte-identical to any current official
`Gezine/Y2JB` release asset: all official sizes and GitHub SHA-256 digests
differ. Official tag source establishes a dynamic Remote JS Loader that seeks
port 50000 and evaluates bounded JavaScript, while 9020 appears only in sender
examples. The embedded port-9021 elfldr has no source or generator in release
1.6. These source facts do not bind the local opaque `SIECAF` backup or prove
deployed behavior. Classification remains `LOCAL_BACKUP_NOT_CORRELATED`; no
Phase-0.9F design gate opens.
## Phase-0.9E-R2 inner-correlation boundary
The local MediaFire URL and object page are now metadata-bound, but their
maker/source is not. A read-only host parser, bound to the public fixed-width
SIECAF header layout, fingerprints header, metadata, and hash tables without
decrypting or extracting content. The local inner differs from both the
mandatory official Y2JB 1.6 4.03 inner and one date/size-motivated community
autoloader inner in complete bytes and normalized structure. Classification is
`LOCAL_BACKUP_UNCORRELATED`; the parser and fingerprints create no bootstrap,
target, recovery, deployment, or runtime evidence.
## Adapter boundaries
### RetroArch
Phase 1.0A is implemented in a separate private `chimera-retroarch` fork. It
links the real RetroArch frontend/runloop, a PS5 platform frontend and a
deterministic static software smoke core. The headless profile uses null
drivers; the second profile links RGUI and RetroArch's SDL2 video, input and
audio drivers to the public PS5 SDL fork. Neither profile uses
`libchimera-gfx`, GNM, a hardware-rendered libretro context or dynamic cores.
Target artifacts remain ignored local outputs with execution eligibility
disabled. Later hardware-rendered cores still require proven context,
synchronization, memory-ownership and shader contracts.
Phase 1.0E adds a narrowly scoped result path to the Phase-1.0D diagnostic
profile. Hardened elfldr's legacy raw-ELF route duplicates the accepted socket
to payload stdout, so the payload can emit fixed 64-byte checksummed D-stage
frames without creating a target-side socket or connection. The host performs
one send and a write-half-close, then bounded receive on that same connection.
This contract does not apply to the controlled route (`stdio=-1`), grants no
device authority, and leaves the SDK CRT, SDL/VideoOut path and GNM boundary
unchanged.
Phase 1.0I adds no runtime component. It binds the consumed H trace to the
existing RetroArch/SDL source, linker map and disassembly. The architecture
boundary remains at the failed first VideoOut submit: the exact call tuple is
known, while errno, argument semantics, visible presentation and cleanup are
not. The write-firewall status contains more state than the transmitted D12
frame, so future observability must expose the exact operation before another
artifact can be reviewed.
Phase 1.0P similarly adds no runtime component. It binds the consumed O result
to the exact M source, map, dynamic relocations and disassembly. The submit
failure site and D12-before-D04 source order are proven, while VideoOut
argument/layout semantics and the root cause remain unresolved. A future
protocol needs a distinct post-D04 terminal; accepting the earlier D12 would
confuse a shutdown request with lifecycle completion.
Phase 1.0Q adds only public-source provenance. The PS5 submit declarations,
opaque records and constants all trace to one SDL commit lineage; the SDK has
export names only and the relevant official ports consume that same SDL fork.
PS4's similar API is retained as analogue evidence, never promoted to a PS5
contract. The architecture therefore remains blocked before any argument or
ownership-state experiment.
Phase 1.0R adds no runtime path. It proves that the pinned PS5 SDL2main does
not create an application or display context: its only pre-entry action is
splash hiding and its exit action occurs after `SDL_main` returns. SDL's video
backend already performs the splash action before VideoOut open in the tested
artifact. Direct and Payload Manager transfers converge on the same hardened
elfldr spawn routine. PacBrew is packaging metadata, and the distinct
`hbldr`/shsrv launcher implementation remains unbound; it cannot be promoted
to a target fix.
Phase 1.0S binds that official implementation and proves an architectural
difference: hbldr substitutes an ELF into a SystemService-launched BigApp,
whereas raw elfldr substitutes it into SceSpZeroConf. It does not prove that
the BigApp supplies usable VideoOut ownership on firmware 9.60. The available
hbldr path is also outside the Chimera execution model because it requires a
device file and includes BigApp termination, runtime kernel/ptrace mutation,
unbounded waits and, in current releases, possible persistent fake-app setup
under `/system_ex`. It remains research evidence, never a runtime dependency.
Phase 1.0T adds only an offline sanitization and classification boundary for
text that an operator might supply later. It has no socket implementation.
The model drops serial, model, temperature, frequency, raw transcript and
unknown paths; it fingerprints `help` command names and labels `sum` as a
non-cryptographic 16-bit checksum. Its output schema hard-codes
`exact_identity=false`. Any future collector remains a separately reviewed,
inactive design problem because merely connecting already spawns shsrv's
shell and emits sensitive greeting data.
Phase 1.0U adds no runtime component. It records a bounded local artifact
inventory and distinguishes official source, a host telnet wrapper and an
unpinned package recipe from a deployed target binary. No candidate was found
inside the declared scope. That negative result cannot be generalized to the
whole host or device and cannot satisfy the launch-context identity gate.
Phase 1.0V adds a host-only byte-stream model, not a transport. An incremental
Telnet filter feeds the existing Phase-1.0T sanitizer under fixed byte/chunk
limits and a one-shot state machine. The CLI exposes only an explicit offline
stdin mode and literal metadata paths. Logical buffer clearing limits retained
application state but does not prove physical memory erasure. No network or
device boundary is crossed.
Phase 1.0W hardens the collector's Telnet, chunk, path and metadata edges and
places an immutable policy object above it. The policy consumes two synthetic
matching records and produces a frozen session-plan value. A test-only fake
transport models one open/command/receive/close sequence. Neither component
contains a live transport, persistence path or executable CLI, so the network
boundary remains a separately blocked implementation concern.
Phase 1.0X places exclusive host evidence and one-shot orchestration around
that immutable plan. The adapter and monotonic clock are dependency-injected;
the repository provides only fakes. Receipt creation precedes adapter open,
and sanitized output follows collector completion. Both files use exclusive
leaf creation, file flush, close and reopen verification. There is deliberately
no command-byte layer or live prompt boundary: those contracts remain blocked
until exact source framing is established. File flush does not prove containing
directory durability, and pre/post deadline checks cannot preempt a blocking
adapter implementation.
Phase 1.0Y separates protocol evidence into legacy raw and current
`libtelnet`/NVT source families. The framing model is deliberately independent
of X orchestration: it transforms only supplied synthetic bytes and reports
prompt candidates without creating boundaries for a live adapter. This avoids
silently binding current-source CRLF and negotiation behavior to an unknown
deployed version. A later passive contract can use plain LF, which both audited
families accept, while treating all received negotiation and incomplete output
as bounded failure.
Phase 1.0Z implements that later layer as a pure data contract. An immutable,
target-free object contains one ASCII/LF batch and its exact completion policy.
The receive accumulator consumes supplied chunks, rejects IAC and delegates
sanitization to V, but it cannot seal on prompt or EOF. An externally injected
synthetic hard-deadline event is the only sealing boundary. This separation
keeps byte formatting and completeness checks independently testable without
quietly introducing a network adapter, clock or live completion claim.
Phase 1.0AA composes X evidence and Z framing behind a closed fake boundary.
Unlike X's abstract injected adapter, AA accepts only exact built-in fake types;
there is no protocol a live implementation can satisfy. A synthetic event
advances an explicit fake clock, while receipt, one-batch send, deadline seal,
close and sanitized output form a testable order. This proves model composition
only, not socket preemption, deployment identity or firmware behavior.
Phase 1.0AB separates OS feasibility from implementation. It binds the local
Python `_socket`, `select`, `socket.py`, `selectors.py` and monotonic-clock
identities, then validates only synthetic syscall ordering. The required future
architecture is one nonblocking descriptor, readiness before every I/O call,
an explicit partial-send offset, a single absolute deadline and `finally`-based
local cleanup. Runtime source makes that sequence feasible but cannot turn
selector timeouts into a hard scheduling guarantee or attest remote cleanup.
Phase 1.0AC realizes that ordering behind a dormant, target-free component.
Only the exact built-in fake facade and fake clock are accepted, so no live
implementation can satisfy an injected protocol. The adapter composes the Z
batch/result contract with synthetic create, readiness, partial progress,
deadline and close outcomes. This is integration-test infrastructure only: it
adds no socket factory, address model, activation path or firmware evidence.
Phase 1.0AU closes the subsequent result-channel source-feasibility question.
The official SDK exposes every primitive signature needed by the AT ownership
model, but official shsrv composes none of them into a bounded channel. Its
worker closes inherited descriptors and its service restarts automatically.
The architecture therefore permits only a target-free canary contract next;
live channel code, a target build and every device action remain outside the
boundary.
Phase 1.0AV turns the unresolved launch-context claim into a causal offline
contract. It holds payload and protocol identity constant while varying only
the launcher identity, and requires independent one-shot approvals. Results
are comparable only after submit, D04 and a distinct cleanup terminal. The
contract deliberately cannot interpret a zero submit return as presentation;
it contains no target implementation or activation surface.
Phase 1.0AW maps that contract onto exact historical source. A future single
ELF needs a new magic and a D14 terminal guarded by completed RetroArch teardown,
an empty initialized mask, valid cleanup order and an independent cleanup-error
counter. Official v0.7 can duplicate raw stdout into its BigApp, but that source
candidate does not make its unbounded and mutating launcher admissible.
Phase 1.0AX freezes the proposed wire and cleanup semantics independently of
target code. D14 reuses the 64-byte frame's raw/result/auxiliary fields to bind
initialized, cleaned, cleanup-error and `rarch_main` state. Only canonical D14
after D07 and D04 is terminal. This host reference cannot establish that a
future RetroArch build or firmware implements the same behavior.
Phase 1.0AY fixes repository lineage as another trust boundary. The selected N
tip is an exact descendant of M with unchanged diagnostic target sources and an
inactive runner. Future source work must occur in a separate worktree so the
historical loader checkout and consumed-run records are not rewritten.
### SDL2
The future SDL2 integration will be a renderer backend that can satisfy
`SDL_RENDERER_ACCELERATED`; it will not replace the existing PS5 window,
VideoOut, audio, input, IME, or filesystem backends. This separation avoids
forking unrelated platform support. The compiled scaffold reports acceleration
unavailable and requires the existing software fallback.
## Offline Phase-1 boundary
The VideoOut candidate is a separate CMake option that is off by default and
valid only under the PS5 toolchain. Project code calls public SDL2 APIs; a
staged Zlib-licensed overlay removes upstream keyboard/IME initialization.
SDL retains ownership of its public-source VideoOut declarations and layouts.
The target does not link SDL2main, so the firmware gate runs before SDL or
system-service initialization. See ADR-0006 and `docs/phase1/`.
## Failure model
All unknown firmware, missing exports, version mismatches, partial
initialization, or unsupported requests fail closed. Later hardware phases must
add bounded waits, watchdog-visible progress, crash logs without secrets or
addresses, and cleanup that can be audited independently of the success path.
CMakeLists.txt
+1293
View File
File diff suppressed because it is too large Load Diff
CMakePresets.json
+49
View File
@@ -0,0 +1,49 @@
{
"version": 6,
"cmakeMinimumRequired": {
"major": 3,
"minor": 21,
"patch": 0
},
"configurePresets": [
{
"name": "host-debug",
"displayName": "Host debug build",
"generator": "Ninja",
"binaryDir": "${sourceDir}/build/host-debug",
"cacheVariables": {
"BUILD_TESTING": "ON",
"CHIMERA_GFX_REGISTER_EXTERNAL_EVIDENCE_VALIDATORS": "OFF",
"CMAKE_BUILD_TYPE": "Debug",
"CMAKE_EXPORT_COMPILE_COMMANDS": "ON"
}
},
{
"name": "host-release",
"displayName": "Host release build",
"generator": "Ninja",
"binaryDir": "${sourceDir}/build/host-release",
"cacheVariables": {
"BUILD_TESTING": "ON",
"CHIMERA_GFX_REGISTER_EXTERNAL_EVIDENCE_VALIDATORS": "OFF",
"CMAKE_BUILD_TYPE": "Release"
}
}
],
"buildPresets": [
{"name": "host-debug", "configurePreset": "host-debug"},
{"name": "host-release", "configurePreset": "host-release"}
],
"testPresets": [
{
"name": "host-debug",
"configurePreset": "host-debug",
"output": {"outputOnFailure": true}
},
{
"name": "host-release",
"configurePreset": "host-release",
"output": {"outputOnFailure": true}
}
]
}
CONTRIBUTING.md
+46
View File
@@ -0,0 +1,46 @@
# Contributing
All contributions must preserve the safety boundary in `SAFETY.md`.
## Workflow
1. Start from an issue or ADR-sized question.
2. Update `RESEARCH.md` when a claim or source changes; label facts,
inferences, and unknowns.
3. Add or update host tests before adding a backend behavior.
4. Keep commits small: documentation/evidence, portable logic, and platform
behavior should be independently reviewable.
5. Run the host build, full CTest suite, generated-file and manifest checks,
safety audit, format/static analysis, and secret scan.
6. Do not add deployment commands or hardware execution to CI.
7. Never weaken `execution_eligible`, remove a permanent denylist entry, or
bypass the Phase-0.5 minimal-startup configure failure.
## Source requirements
Use primary, public, open-source technical sources. Do not contribute
proprietary SDK content, leaked or decrypted headers/binaries, exploit code,
DRM bypass, direct register/MMIO access, firmware patches, or clock/SMU/fan
control. ROMs, BIOS images, and copyrighted game content are outside scope.
Guessed ABI declarations are not accepted. A symbol name is not a function
signature. When evidence is incomplete, record an unknown instead of adding a
plausible-looking definition.
## Style and compatibility
- C11, four-space indentation, no compiler extensions in the public API.
- Public structures begin with `struct_size`; API changes require tests.
- Destroy child handles before their context; cleanup failures must be visible.
- Use SPDX identifiers in new source files.
- Keep logs deterministic and free of addresses, credentials, user paths, and
content filenames.
- Warnings are errors in project-owned code.
## Hardware changes
A pull request can prepare a disabled experiment, but review or merge does not
authorize console execution. Each hardware test requires explicit approval in
the active task and must follow the template in `TEST_PLAN.md`.
Startup changes additionally require the exact loader-caller evidence listed
in `docs/runtime/minimal-crt-feasibility.md` before an ELF may be built.
FIRMWARE_COMPATIBILITY.md
+271
View File
@@ -0,0 +1,271 @@
# Firmware compatibility
Firmware `9.60` remains the only exact firmware in scope. Separately approved
Phase-1.0D runs have proven SDK CRT/main/notification execution on that device,
but they do not prove the Phase-0 capability probe, GNM, general VideoOut,
rendering, cleanup or compatibility of any other artifact. On 2026-07-22 the
exact Phase-1.0E result artifact received and consumed one single-use
authorization; all authorization fields are again false.
| Firmware | Discovery build | Probe executed | Result | Evidence | Rendering |
|---|---:|---:|---|---|---:|
| _none_ | no | no | unknown | no hardware authorization | prohibited |
| `9.60` | yes, offline only | no | unknown; SDK CRT execution blocker | `docs/evidence/probe-9.60-offline-2026-07-17.md` | prohibited |
| `9.60` Phase 0.6 lifecycle | no artifact built | no | blocked: exact loader has unbounded/unknown effects | `docs/runtime/phase-0.6-loader-audit.md` | prohibited |
| `9.60` Phase 0.7 lifecycle | yes, offline only | no | hardened runtime ready for a separately approved installation; hardware behavior unproven | `docs/runtime/phase-0.7-hardening.md` | prohibited |
| `9.60` Phase 0.8 preflight | no new artifact | no | read-only on-device preflight blocked: collector side-effect freedom and current rollback state unproven | `docs/runtime/phase-0.8-read-only-preflight.md` | prohibited |
| `9.60` Phase 0.9A anti-brick | no target artifact | no | offline design only; filesystem atomicity, durability and independent recovery unproven | `docs/runtime/phase-0.9-installation-transaction-design.md` | prohibited |
| `9.60` Phase 0.9B observer | no target artifact | no | blocked before build: startup/exit ABI and non-persistent output channel unproven | `docs/runtime/phase-0.9b-bounded-observer-design.md` | prohibited |
| `9.60` Phase 0.9C feasibility | no target artifact | no | blocked: startup/exit/cleanup, current bounded output, firmware source two, and observation effects remain unproven | `docs/runtime/phase-0.9c-static-audit.md` | prohibited |
| `9.60` Phase 0.9D readback | no target artifact | no | blocked: existing stack has no PS5-to-host file response; live paths and recovery remain unproven | `docs/runtime/phase-0.9d-readback-feasibility.md` | prohibited |
| `9.60` Phase 0.9E-R provenance | no target artifact | no | local outer Y2JB backup does not match any current official asset; official source has no 9020 listener implementation | `docs/runtime/phase-0.9e-r-official-release-correlation.md` | prohibited |
| `9.60` Phase 0.9E-R2 inner provenance | no target artifact | no | local inner differs from the mandatory official and selected community inners; MediaFire maker/source and deployment remain unbound | `docs/runtime/phase-0.9e-r2-final-provenance-decision.md` | prohibited |
| `9.60` Phase 1.0D RUN A/B | yes, exact one-shot artifacts | yes, two separately authorized runs | C1 proves SDK CRT/main/notification; RUN-B stage remains unclassified because its notification was unreadable | `docs/retroarch/phase-1.0e-device-observations.md` | unproven |
| `9.60` Phase 1.0E result channel | yes, exact one-shot artifact | yes, one authorized run | inherited stdout returned valid D00-D02 with platform result `0`; remote EOF before D03; permission consumed | `docs/retroarch/phase-1.0e-inherited-result-channel.md` | unproven beyond D02 |
| `9.60` Phase 1.0F interval diagnostic | yes, offline exact artifact | no | I00-I14 source interval prepared and statically audited; no device authorization | `docs/retroarch/phase-1.0f-startup-interval.md` | unproven beyond D02 |
| `9.60` Phase 1.0G interval run | exact one-shot artifact | yes, consumed | valid through I03; deterministic no-argument/no-menu help exit before I04 | `docs/retroarch/phase-1.0g-device-result.md` | SDL/VideoOut unproven |
| `9.60` Phase 1.0H startup args | yes, offline exact artifact | no | scoped argc-2 correction built and statically audited; no device authorization | `docs/retroarch/phase-1.0h-startup-args.md` | unproven beyond I03 |
| `9.60` Phase 1.0H one-shot run | exact one-shot artifact | yes, consumed | I04 and SDL/VideoOut reached; buffers registered; first flip submit and SDL init returned `-1` | `docs/retroarch/phase-1.0h-device-result.md` | visible flip unproven |
| `9.60` Phase 1.0I postmortem | no new artifact | no new run | offline source/map/disassembly binds submit `(handle,0,1,0)`; exact E118 operation, submit errno and root cause remain unproven | `docs/retroarch/phase-1.0i-flip-and-write-analysis.md` | no new rendering evidence |
| `9.60` Phase 1.0J-1.0O diagnostics/results | exact offline artifacts and consumed one-shot runs where recorded | only separately authorized J/K/O attempts | first blocked write was `MKDIR`; write-free M reached VideoOut but first flip still returned `-1`; all permissions consumed | `docs/retroarch/` Phase-1.0J through O records | visible presentation and cleanup unproven |
| `9.60` Phase 1.0P-1.0S analysis | no new target artifact | no new run | public VideoOut semantics and a source-proven launch-context fix remain unavailable; hbldr/shsrv is only a source candidate | `docs/retroarch/` Phase-1.0P through S records | parameter or launcher change blocked |
| `9.60` Phase 1.0T-1.0AY offline route design | host-only models and source audits | no device request | deployed shsrv identity remains unknown; result-channel, launch-context, protocol and exact source-base work are offline only | `docs/retroarch/` Phase-1.0T through AY records | no firmware/rendering evidence |
## Rules
- A firmware row is added only for an exact, reproducible identifier.
- Build allowlisting is not runtime compatibility evidence or execution
permission.
- `symbol present` means only that lookup returned non-null on that observation.
- Presence does not establish signature, semantics, or rendering compatibility.
- Failure on an unlisted firmware is the expected fail-closed behavior.
- Compatibility does not transfer between firmware revisions.
- Every observation must reference the source commit, manifest hash, SDK lock,
approval, and redacted crash/probe log.
The build cache variable `CHIMERA_GFX_PS5_ALLOWED_FIRMWARE` defaults to `NONE`.
Changing it is a deliberate build action, not a repository compatibility claim
and not permission to execute the artifact.
The default capability-probe and every VideoOut review artifact embed `NONE`.
The 9.60 capability artifact has its own digest, manifest, and offline review.
It remains execution-blocked because the pinned SDK payload CRT writes kernel
process state before `main`. VideoOut is not allowlisted for 9.60 and also
remains blocked by the unproven bounded-wait requirement in
`docs/phase1/HARDWARE_TEST_PLAN.md`.
Phase 0.5 did not create a firmware-9.60 startup artifact: the exact loader
caller, return, cleanup, crash, and pre-entry contract is unproven. The older
9.60 probe hash `4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63`
is permanently denylisted independent of future firmware or approval records.
Phase 0.6 exactly matched the installed Payload Manager v0.3.1 and elfldr
v0.23, but the firmware identifier is still user-attested rather than
device-attested. The lifecycle remains blocked by unbounded ptrace/payload
runtime, unproven return and cleanup, incomplete restoration, absent
launch-time hash enforcement, and the manager's persistent upload path.
`__patch_init` is now a documented payload-process-local effect and is not by
itself the blocker.
Phase 0.7 uses new private hardened elfldr and controlled Payload Manager
artifacts rather than reclassifying the old binaries. Exact firmware 9.60 is
explicitly confirmed by Jens but has not been queried from the device in this
task. Offline compiler, linker, test, disassembly, callgraph, and
reproducibility evidence supports
`READY_FOR_HARDENED_RUNTIME_DEPLOYMENT`. This is not an installed, transferred,
executed, or compatibility-tested state, and it authorizes no console action.
Phase 0.8 preserves that static Phase-0.7 decision but blocks the operational
read-only preflight before any connection. The stock Payload Manager HTTP
interface mutates in-process state, and no alternative collector currently
proves freedom from atime, audit, cache, metadata, service, or logging side
effects. Firmware 9.60 remains user-attested rather than confirmed by two
current device sources.
Phase 0.9A does not add firmware evidence. Its virtual host model cannot prove
PS5 filesystem identity, atomic switch, file or directory durability,
power-loss behavior, quiescence or independent recovery. Every such property
remains `UNPROVEN`, all device authorizations remain false, and no target
artifact is built.
Phase 0.9B also adds no firmware evidence. The normal SDK startup path violates
the phase's kernelwrite-free rule, a freestanding return/exit cleanup contract
is unproven, and the hash-bound controlled loader route does not return payload
output. The observer build stops before source or artifact creation. Firmware
9.60 remains user-attested and runtime-unproven.
Phase 0.9C identifies SDK `kernel_get_fw_version()` as source 1, but that
function reads a `libSceLibcInternal` process-parameter SDK field and has no
runtime observation in this phase. The SDK stub name
`sceKernelGetProsperoSystemSwVersion` has no accepted public signature,
semantics, side-effect contract, or firmware-9.60 evidence and is not source
2. The host result record can bind two exact values to a nonce, request ID and
artifact hash, but no target output implementation exists. Firmware agreement
therefore remains `BLOCKED_FIRMWARE_SOURCE_INCOMPLETE`.
Phase 0.9D adds no firmware evidence and performs no device request. Its local
source audit finds only host-to-PS5 upload/launch and internal read paths, not a
binary-safe PS5-to-host component download. Configured, packaged, and
historical reference paths are not current live-path evidence. Firmware 9.60
therefore remains user-attested and runtime behavior remains `UNPROVEN`.
Phase 0.9E also adds no firmware evidence. The local Y2JB-named backup
candidate covers firmware 4.03 through 12.40 only by filename claim; its opaque
`SIECAF` content cannot be tied to the exact firmware-9.60 deployment or to an
auditable port-9020 listener. No bootstrap, restart, host-to-memory, output,
filesystem, autoload, crash, or reboot property was tested on hardware.
Firmware 9.60 remains user-attested and runtime behavior remains `UNPROVEN`.
Phase 0.9E-R confirms only that official release 1.6 source permits Lapse's
version-selection path through firmware 10.01. Because the local outer backup
matches no current official asset, that source logic is not bound to the
deployed bytes and is not runtime compatibility evidence for firmware 9.60.
Phase 0.9E-R2 adds no firmware evidence. Full host-side inner and SIECAF
comparisons are negative, and the MediaFire page exposes no source binding.
Even a positive structural or byte match would not prove current deployment.
Firmware 9.60 remains user-attested and runtime behavior remains `UNPROVEN`.
Phase-1.0D RUN A changes one narrow firmware statement: the operator visibly
observed the exact C1 marker, proving that hardened elfldr reached the normal
SDK CRT, `main` and the notification ABI on the firmware-9.60 console for that
exact canary hash. RUN B produced one unreadable notification and therefore
does not identify a D-stage. Phase-1.0E RUN C adds exact artifact-bound evidence
for D00-D02 and the inherited result channel. D02 reported platform result `0`;
remote EOF occurred before D03. It proves neither SDL/VideoOut nor rendering,
terminal status, cleanup or safe exit. Every authorization is false.
Phase 1.0F adds no firmware evidence: its I00-I14 artifact exists only as an
offline build and has never been transferred, received from or executed on a
device.
Phase 1.0G adds exact artifact-bound firmware evidence through I03. Captured
ordinary stdout proves the build took RetroArch's no-argument/no-menu help path
and exited before I04. It adds no SDL, VideoOut, rendering, terminal cleanup or
safe-exit evidence. Its one-shot permission is consumed.
Phase 1.0H adds no firmware evidence. It is an offline, reproducible correction
for that source-bound argument defect and remains transfer- and
execution-ineligible. Its modeled I04 boundary and all later stages are
unproven on firmware 9.60.
The later exact H permission was consumed once. It proves I04, I13/I14, D03,
a positive D05 VideoOut handle and D06 buffer-registration result `0`. D07 and
D04 both returned `-1`; no successful visible flip, runloop, full cleanup or
safe exit is proven. No retry occurred.
Phase 1.0M adds no firmware evidence. It removes the source-bound playlist
directory probe/`mkdir` from write-free builds and produces a reproducible,
statically audited artifact, but that new hash has never been transferred or
executed. I04, SDL, VideoOut, flip behavior, visible output and cleanup remain
unproven on firmware 9.60.
Phase 1.0N adds no firmware evidence. It prepares only an inactive,
manifest-selected host runner for the unchanged Phase-1.0M hash. Fake-socket
tests and static hash binding do not prove runtime behavior on firmware 9.60;
all target, transfer, execution and reception authorizations remain false.
The separately authorized Phase-1.0O attempt adds exact firmware-9.60 evidence
for the M hash: I04 and SDL video entry were reached, VideoOut opened, buffer
registration returned `0`, and the first flip submit returned `-1` with saved
errno `0`. No D13/write-firewall frame occurred. D12 reported runtime
failure/E104 and D04 reported SDL init `-1`. Visible presentation, successful
termination and cleanup remain unproven; the permission is consumed.
Phase 1.0P adds no firmware evidence. Its offline source/map/disassembly audit
proves the exact first-submit tuple and failure site, but the local public
sources do not prove the argument semantics, opaque attributes, flip-master
or active-app requirements, return-code meaning, visible output or cleanup.
The VideoOut root cause remains unresolved and no new device action is
authorized.
Phase 1.0Q adds no firmware evidence. Its public-source search establishes
that the current PS5 VideoOut declarations have one SDL lineage and no
independent public PS5 corroboration. PS4 analogues and host source scans do
not establish firmware-9.60 argument, layout, ownership or error semantics.
Phase 1.0R adds no firmware evidence. Source proves only that SDL2main is a
lifecycle wrapper and that the tested artifact already hides the splash before
VideoOut open. It does not prove the firmware-9.60 active-app, flip-owner,
launcher, process, visibility or cleanup contract. The observed LNC log remains
a non-unique correlation, not a firmware interpretation or root cause.
Phase 1.0S adds no firmware evidence. Official shsrv source proves that hbldr
creates a BigApp-based process context, but source cannot prove that the route
works on this firmware-9.60 device, grants flip ownership, or fixes the exact
submit failure. The deployed shsrv version, target fake-app state, visibility,
crash and cleanup behavior remain unobserved.
Phase 1.0T adds no firmware evidence. It statically proves that the audited
shsrv source emits firmware, serial and telemetry on connection and that its
existing identity-related commands cannot return an exact deployed SHA-256.
No port-2323 connection occurred, so the deployed shsrv family, compile
metadata, device paths and all firmware-9.60 runtime effects remain unobserved.
Phase 1.0U adds no firmware evidence. Its bounded host inventory found no
original shsrv target binary or receipt to hash. Official source and packaging
metadata do not establish what runs on firmware 9.60, and no device identity,
path, version, greeting or behavior was observed.
Phase 1.0V adds no firmware evidence. Its Telnet and sanitization behavior is a
synthetic host model fed from stdin. It neither connects to nor observes the
firmware-9.60 device, and it does not prove the live greeting, prompt,
negotiation, timeout, disconnect, shell cleanup or deployed shsrv identity.
Phase 1.0W adds no firmware evidence. Its remediated collector, session policy
and fake transport use synthetic host input and an explicit synthetic clock.
Source-bound port 2323 and exact firmware text `9.60` are policy constraints,
not proof of a listener, negotiation, device identity, deployed bytes or
runtime behavior.
Phase 1.0X also adds no firmware evidence. Its receipt/output operations and
deadline/cleanup state are exercised only against injected fake adapters. The
official shsrv source describes a dynamic `PWD` prompt and automatic greeting,
but does not bind the deployed bytes or live Telnet stream on firmware 9.60.
Phase 1.0Y adds source-history evidence only. Official tags v0.7-v0.8 use raw
framing and v0.9-v0.19 use `libtelnet`/NVT, but no evidence selects which
family, revision or modified binary runs on firmware 9.60. Synthetic framing
tests therefore do not establish live line endings, prompt completion, echo,
short-write behavior or disconnect cleanup.
Phase 1.0Z adds no firmware evidence. Its one-batch formatter and deadline-only
accumulator run exclusively on synthetic host inputs. The tests show that the
contract tolerates modeled LF/CRLF output and rejects incomplete data; they do
not prove a listener, exact deployed shsrv bytes, live deadline behavior,
filesystem effects, cleanup or restart on firmware 9.60.
Phase 1.0AA adds no firmware evidence. Its exact fake adapter, synthetic clock,
exclusive temporary host files and scripted events exercise only local model
composition. Passing receipt/send/deadline/close tests cannot establish a live
listener, OS timeout behavior, target identity, shell cleanup or any behavior
on firmware 9.60.
Phase 1.0AB adds no firmware evidence. Local Windows Python runtime identities
and synthetic nonblocking traces describe only a possible host implementation.
They do not observe port state, packet delivery, shsrv cleanup or any behavior
on firmware 9.60.
Phase 1.0AC adds no firmware evidence. Its dormant adapter accepts only exact
built-in fake syscall steps and a synthetic clock. Passing its lifecycle and
cleanup cases does not establish a listener, deployed shsrv identity, network
timing, remote cleanup, launch context or any firmware-9.60 behavior.
Phase 1.0AU adds no firmware evidence. Exact official headers establish source
signatures for pipe, descriptor inheritance, nonblocking reads, monotonic time,
termination and reap. They do not establish their runtime behavior on firmware
9.60, and current official shsrv does not contain the bounded composition.
Phase 1.0AV adds no firmware evidence. Its two synthetic arms define how a
future exact-payload comparison would isolate launcher identity, but neither
arm has target source, an artifact, approval or device result. A modeled return
difference cannot prove a visible flip or firmware behavior.
Phase 1.0AW adds no firmware evidence. It proves only that official v0.7 source
passes raw stdout into the replaced BigApp and identifies the source changes a
future canary would need. No deployed identity, bounded launcher, target bytes
or firmware-9.60 result exists.
Phase 1.0AX adds no firmware evidence. Its valid D07/D04/D14 traces are
synthetic bytes and its cleanup predicate is a host reference. No target source,
artifact, device result or visible output implements that reference.
Phase 1.0AY adds no firmware evidence. Selecting an exact private Git commit
establishes only source lineage; it creates no target source delta, artifact or
firmware-9.60 observation.
LICENSE
+676
View File
@@ -0,0 +1,676 @@
GNU GENERAL PUBLIC LICENSE
Version 3, 29 June 2007
Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
Preamble
The GNU General Public License is a free, copyleft license for
software and other kinds of works.
The licenses for most software and other practical works are designed
to take away your freedom to share and change the works. By contrast,
the GNU General Public License is intended to guarantee your freedom to
share and change all versions of a program--to make sure it remains free
software for all its users. We, the Free Software Foundation, use the
GNU General Public License for most of our software; it applies also to
any other work released this way by its authors. You can apply it to
your programs, too.
When we speak of free software, we are referring to freedom, not
price. Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
them if you wish), that you receive source code or can get it if you
want it, that you can change the software or use pieces of it in new
free programs, and that you know you can do these things.
To protect your rights, we need to prevent others from denying you
these rights or asking you to surrender the rights. Therefore, you have
certain responsibilities if you distribute copies of the software, or if
you modify it: responsibilities to respect the freedom of others.
For example, if you distribute copies of such a program, whether
gratis or for a fee, you must pass on to the recipients the same
freedoms that you received. You must make sure that they, too, receive
or can get the source code. And you must show them these terms so they
know their rights.
Developers that use the GNU GPL protect your rights with two steps:
(1) assert copyright on the software, and (2) offer you this License
giving you legal permission to copy, distribute and/or modify it.
For the developers' and authors' protection, the GPL clearly explains
that there is no warranty for this free software. For both users' and
authors' sake, the GPL requires that modified versions be marked as
changed, so that their problems will not be attributed erroneously to
authors of previous versions.
Some devices are designed to deny users access to install or run
modified versions of the software inside them, although the manufacturer
can do so. This is fundamentally incompatible with the aim of
protecting users' freedom to change the software. The systematic
pattern of such abuse occurs in the area of products for individuals to
use, which is precisely where it is most unacceptable. Therefore, we
have designed this version of the GPL to prohibit the practice for those
products. If such problems arise substantially in other domains, we
stand ready to extend this provision to those domains in future versions
of the GPL, as needed to protect the freedom of users.
Finally, every program is threatened constantly by software patents.
States should not allow patents to restrict development and use of
software on general-purpose computers, but in those that do, we wish to
avoid the special danger that patents applied to a free program could
make it effectively proprietary. To prevent this, the GPL assures that
patents cannot be used to render the program non-free.
The precise terms and conditions for copying, distribution and
modification follow.
TERMS AND CONDITIONS
0. Definitions.
"This License" refers to version 3 of the GNU General Public License.
"Copyright" also means copyright-like laws that apply to other kinds of
works, such as semiconductor masks.
"The Program" refers to any copyrightable work licensed under this
License. Each licensee is addressed as "you". "Licensees" and
"recipients" may be individuals or organizations.
To "modify" a work means to copy from or adapt all or part of the work
in a fashion requiring copyright permission, other than the making of an
exact copy. The resulting work is called a "modified version" of the
earlier work or a work "based on" the earlier work.
A "covered work" means either the unmodified Program or a work based
on the Program.
To "propagate" a work means to do anything with it that, without
permission, would make you directly or secondarily liable for
infringement under applicable copyright law, except executing it on a
computer or modifying a private copy. Propagation includes copying,
distribution (with or without modification), making available to the
public, and in some countries other activities as well.
To "convey" a work means any kind of propagation that enables other
parties to make or receive copies. Mere interaction with a user through
a computer network, with no transfer of a copy, is not conveying.
An interactive user interface displays "Appropriate Legal Notices"
to the extent that it includes a convenient and prominently visible
feature that (1) displays an appropriate copyright notice, and (2)
tells the user that there is no warranty for the work (except to the
extent that warranties are provided), that licensees may convey the
work under this License, and how to view a copy of this License. If
the interface presents a list of user commands or options, such as a
menu, a prominent item in the list meets this criterion.
1. Source Code.
The "source code" for a work means the preferred form of the work
for making modifications to it. "Object code" means any non-source
form of a work.
A "Standard Interface" means an interface that either is an official
standard defined by a recognized standards body, or, in the case of
interfaces specified for a particular programming language, one that
is widely used among developers working in that language.
The "System Libraries" of an executable work include anything, other
than the work as a whole, that (a) is included in the normal form of
packaging a Major Component, but which is not part of that Major
Component, and (b) serves only to enable use of the work with that
Major Component, or to implement a Standard Interface for which an
implementation is available to the public in source code form. A
"Major Component", in this context, means a major essential component
(kernel, window system, and so on) of the specific operating system
(if any) on which the executable work runs, or a compiler used to
produce the work, or an object code interpreter used to run it.
The "Corresponding Source" for a work in object code form means all
the source code needed to generate, install, and (for an executable
work) run the object code and to modify the work, including scripts to
control those activities. However, it does not include the work's
System Libraries, or general-purpose tools or generally available free
programs which are used unmodified in performing those activities but
which are not part of the work. For example, Corresponding Source
includes interface definition files associated with source files for
the work, and the source code for shared libraries and dynamically
linked subprograms that the work is specifically designed to require,
such as by intimate data communication or control flow between those
subprograms and other parts of the work.
The Corresponding Source need not include anything that users
can regenerate automatically from other parts of the Corresponding
Source.
The Corresponding Source for a work in source code form is that
same work.
2. Basic Permissions.
All rights granted under this License are granted for the term of
copyright on the Program, and are irrevocable provided the stated
conditions are met. This License explicitly affirms your unlimited
permission to run the unmodified Program. The output from running a
covered work is covered by this License only if the output, given its
content, constitutes a covered work. This License acknowledges your
rights of fair use or other equivalent, as provided by copyright law.
You may make, run and propagate covered works that you do not
convey, without conditions so long as your license otherwise remains
in force. You may convey covered works to others for the sole purpose
of having them make modifications exclusively for you, or provide you
with facilities for running those works, provided that you comply with
the terms of this License in conveying all material for which you do
not control copyright. Those thus making or running the covered works
for you must do so exclusively on your behalf, under your direction
and control, on terms that prohibit them from making any copies of
your copyrighted material outside their relationship with you.
Conveying under any other circumstances is permitted solely under
the conditions stated below. Sublicensing is not allowed; section 10
makes it unnecessary.
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
No covered work shall be deemed part of an effective technological
measure under any applicable law fulfilling obligations under article
11 of the WIPO copyright treaty adopted on 20 December 1996, or
similar laws prohibiting or restricting circumvention of such
measures.
When you convey a covered work, you waive any legal power to forbid
circumvention of technological measures to the extent such circumvention
is effected by exercising rights under this License with respect to
the covered work, and you disclaim any intention to limit operation or
modification of the work as a means of enforcing, against the work's
users, your or third parties' legal rights to forbid circumvention of
technological measures.
4. Conveying Verbatim Copies.
You may convey verbatim copies of the Program's source code as you
receive it, in any medium, provided that you conspicuously and
appropriately publish on each copy an appropriate copyright notice;
keep intact all notices stating that this License and any
non-permissive terms added in accord with section 7 apply to the code;
keep intact all notices of the absence of any warranty; and give all
recipients a copy of this License along with the Program.
You may charge any price or no price for each copy that you convey,
and you may offer support or warranty protection for a fee.
5. Conveying Modified Source Versions.
You may convey a work based on the Program, or the modifications to
produce it from the Program, in the form of source code under the
terms of section 4, provided that you also meet all of these conditions:
a) The work must carry prominent notices stating that you modified
it, and giving a relevant date.
b) The work must carry prominent notices stating that it is
released under this License and any conditions added under section
7. This requirement modifies the requirement in section 4 to
"keep intact all notices".
c) You must license the entire work, as a whole, under this
License to anyone who comes into possession of a copy. This
License will therefore apply, along with any applicable section 7
additional terms, to the whole of the work, and all its parts,
regardless of how they are packaged. This License gives no
permission to license the work in any other way, but it does not
invalidate such permission if you have separately received it.
d) If the work has interactive user interfaces, each must display
Appropriate Legal Notices; however, if the Program has interactive
interfaces that do not display Appropriate Legal Notices, your
work need not make them do so.
A compilation of a covered work with other separate and independent
works, which are not by their nature extensions of the covered work,
and which are not combined with it such as to form a larger program,
in or on a volume of a storage or distribution medium, is called an
"aggregate" if the compilation and its resulting copyright are not
used to limit the access or legal rights of the compilation's users
beyond what the individual works permit. Inclusion of a covered work
in an aggregate does not cause this License to apply to the other
parts of the aggregate.
6. Conveying Non-Source Forms.
You may convey a covered work in object code form under the terms
of sections 4 and 5, provided that you also convey the
machine-readable Corresponding Source under the terms of this License,
in one of these ways:
a) Convey the object code in, or embodied in, a physical product
(including a physical distribution medium), accompanied by the
Corresponding Source fixed on a durable physical medium
customarily used for software interchange.
b) Convey the object code in, or embodied in, a physical product
(including a physical distribution medium), accompanied by a
written offer, valid for at least three years and valid for as
long as you offer spare parts or customer support for that product
model, to give anyone who possesses the object code either (1) a
copy of the Corresponding Source for all the software in the
product that is covered by this License, on a durable physical
medium customarily used for software interchange, for a price no
more than your reasonable cost of physically performing this
conveying of source, or (2) access to copy the
Corresponding Source from a network server at no charge.
c) Convey individual copies of the object code with a copy of the
written offer to provide the Corresponding Source. This
alternative is allowed only occasionally and noncommercially, and
only if you received the object code with such an offer, in accord
with subsection 6b.
d) Convey the object code by offering access from a designated
place (gratis or for a charge), and offer equivalent access to the
Corresponding Source in the same way through the same place at no
further charge. You need not require recipients to copy the
Corresponding Source along with the object code. If the place to
copy the object code is a network server, the Corresponding Source
may be on a different server (operated by you or a third party)
that supports equivalent copying facilities, provided you maintain
clear directions next to the object code saying where to find the
Corresponding Source. Regardless of what server hosts the
Corresponding Source, you remain obligated to ensure that it is
available for as long as needed to satisfy these requirements.
e) Convey the object code using peer-to-peer transmission, provided
you inform other peers where the object code and Corresponding
Source of the work are being offered to the general public at no
charge under subsection 6d.
A separable portion of the object code, whose source code is excluded
from the Corresponding Source as a System Library, need not be
included in conveying the object code work.
A "User Product" is either (1) a "consumer product", which means any
tangible personal property which is normally used for personal, family,
or household purposes, or (2) anything designed or sold for incorporation
into a dwelling. In determining whether a product is a consumer product,
doubtful cases shall be resolved in favor of coverage. For a particular
product received by a particular user, "normally used" refers to a
typical or common use of that class of product, regardless of the status
of the particular user or of the way in which the particular user
actually uses, or expects or is expected to use, the product. A product
is a consumer product regardless of whether the product has substantial
commercial, industrial or non-consumer uses, unless such uses represent
the only significant mode of use of the product.
"Installation Information" for a User Product means any methods,
procedures, authorization keys, or other information required to install
and execute modified versions of a covered work in that User Product from
a modified version of its Corresponding Source. The information must
suffice to ensure that the continued functioning of the modified object
code is in no case prevented or interfered with solely because
modification has been made.
If you convey an object code work under this section in, or with, or
specifically for use in, a User Product, and the conveying occurs as
part of a transaction in which the right of possession and use of the
User Product is transferred to the recipient in perpetuity or for a
fixed term (regardless of how the transaction is characterized), the
Corresponding Source conveyed under this section must be accompanied
by the Installation Information. But this requirement does not apply
if neither you nor any third party retains the ability to install
modified object code on the User Product (for example, the work has
been installed in ROM).
The requirement to provide Installation Information does not include a
requirement to continue to provide support service, warranty, or updates
for a work that has been modified or installed by the recipient, or for
the User Product in which it has been modified or installed. Access to a
network may be denied when the modification itself materially and
adversely affects the operation of the network or violates the rules and
protocols for communication across the network.
Corresponding Source conveyed, and Installation Information provided,
in accord with this section must be in a format that is publicly
documented (and with an implementation available to the public in
source code form), and must require no special password or key for
unpacking, reading or copying.
7. Additional Terms.
"Additional permissions" are terms that supplement the terms of this
License by making exceptions from one or more of its conditions.
Additional permissions that are applicable to the entire Program shall
be treated as though they were included in this License, to the extent
that they are valid under applicable law. If additional permissions
apply only to part of the Program, that part may be used separately
under those permissions, but the entire Program remains governed by
this License without regard to the additional permissions.
When you convey a copy of a covered work, you may at your option
remove any additional permissions from that copy, or from any part of
it. (Additional permissions may be written to require their own
removal in certain cases when you modify the work.) You may place
additional permissions on material, added by you to a covered work,
for which you have or can give appropriate copyright permission.
Notwithstanding any other provision of this License, for material you
add to a covered work, you may (if authorized by the copyright holders of
that material) supplement the terms of this License with terms:
a) Disclaiming warranty or limiting liability differently from the
terms of sections 15 and 16 of this License; or
b) Requiring preservation of specified reasonable legal notices or
author attributions in that material or in the Appropriate Legal
Notices displayed by works containing it; or
c) Prohibiting misrepresentation of the origin of that material, or
requiring that modified versions of such material be marked in
reasonable ways as different from the original version; or
d) Limiting the use for publicity purposes of names of licensors or
authors of the material; or
e) Declining to grant rights under trademark law for use of some
trade names, trademarks, or service marks; or
f) Requiring indemnification of licensors and authors of that
material by anyone who conveys the material (or modified versions of
it) with contractual assumptions of liability to the recipient, for
any liability that these contractual assumptions directly impose on
those licensors and authors.
All other non-permissive additional terms are considered "further
restrictions" within the meaning of section 10. If the Program as you
received it, or any part of it, contains a notice stating that it is
governed by this License along with a term that is a further
restriction, you may remove that term. If a license document contains
a further restriction but permits relicensing or conveying under this
License, you may add to a covered work material governed by the terms
of that license document, provided that the further restriction does
not survive such relicensing or conveying.
If you add terms to a covered work in accord with this section, you
must place, in the relevant source files, a statement of the
additional terms that apply to those files, or a notice indicating
where to find the applicable terms.
Additional terms, permissive or non-permissive, may be stated in the
form of a separately written license, or stated as exceptions;
the above requirements apply either way.
8. Termination.
You may not propagate or modify a covered work except as expressly
provided under this License. Any attempt otherwise to propagate or
modify it is void, and will automatically terminate your rights under
this License (including any patent licenses granted under the third
paragraph of section 11).
However, if you cease all violation of this License, then your
license from a particular copyright holder is reinstated (a)
provisionally, unless and until the copyright holder explicitly and
finally terminates your license, and (b) permanently, if the copyright
holder fails to notify you of the violation by some reasonable means
prior to 60 days after the cessation.
Moreover, your license from a particular copyright holder is
reinstated permanently if the copyright holder notifies you of the
violation by some reasonable means, this is the first time you have
received notice of violation of this License (for any work) from that
copyright holder, and you cure the violation prior to 30 days after
your receipt of the notice.
Termination of your rights under this section does not terminate the
licenses of parties who have received copies or rights from you under
this License. If your rights have been terminated and not permanently
reinstated, you do not qualify to receive new licenses for the same
material under section 10.
9. Acceptance Not Required for Having Copies.
You are not required to accept this License in order to receive or
run a copy of the Program. Ancillary propagation of a covered work
occurring solely as a consequence of using peer-to-peer transmission
to receive a copy likewise does not require acceptance. However,
nothing other than this License grants you permission to propagate or
modify any covered work. These actions infringe copyright if you do
not accept this License. Therefore, by modifying or propagating a
covered work, you indicate your acceptance of this License to do so.
10. Automatic Licensing of Downstream Recipients.
Each time you convey a covered work, the recipient automatically
receives a license from the original licensors, to run, modify and
propagate that work, subject to this License. You are not responsible
for enforcing compliance by third parties with this License.
An "entity transaction" is a transaction transferring control of an
organization, or substantially all assets of one, or subdividing an
organization, or merging organizations. If propagation of a covered
work results from an entity transaction, each party to that
transaction who receives a copy of the work also receives whatever
licenses to the work the party's predecessor in interest had or could
give under the previous paragraph, plus a right to possession of the
Corresponding Source of the work from the predecessor in interest, if
the predecessor has it or can get it with reasonable efforts.
You may not impose any further restrictions on the exercise of the
rights granted or affirmed under this License. For example, you may
not impose a license fee, royalty, or other charge for exercise of
rights granted under this License, and you may not initiate litigation
(including a cross-claim or counterclaim in a lawsuit) alleging that
any patent claim is infringed by making, using, selling, offering for
sale, or importing the Program or any portion of it.
11. Patents.
A "contributor" is a copyright holder who authorizes use under this
License of the Program or a work on which the Program is based. The
work thus licensed is called the contributor's "contributor version".
A contributor's "essential patent claims" are all patent claims
owned or controlled by the contributor, whether already acquired or
hereafter acquired, that would be infringed by some manner, permitted
by this License, of making, using, or selling its contributor version,
but do not include claims that would be infringed only as a
consequence of further modification of the contributor version. For
purposes of this definition, "control" includes the right to grant
patent sublicenses in a manner consistent with the requirements of
this License.
Each contributor grants you a non-exclusive, worldwide, royalty-free
patent license under the contributor's essential patent claims, to
make, use, sell, offer for sale, import and otherwise run, modify and
propagate the contents of its contributor version.
In the following three paragraphs, a "patent license" is any express
agreement or commitment, however denominated, not to enforce a patent
(such as an express permission to practice a patent or covenant not to
sue for patent infringement). To "grant" such a patent license to a
party means to make such an agreement or commitment not to enforce a
patent against the party.
If you convey a covered work, knowingly relying on a patent license,
and the Corresponding Source of the work is not available for anyone
to copy, free of charge and under the terms of this License, through a
publicly available network server or other readily accessible means,
then you must either (1) cause the Corresponding Source to be so
available, or (2) arrange to deprive yourself of the benefit of the
patent license for this particular work, or (3) arrange, in a manner
consistent with the requirements of this License, to extend the patent
license to downstream recipients. "Knowingly relying" means you have
actual knowledge that, but for the patent license, your conveying the
covered work in a country, or your recipient's use of the covered work
in a country, would infringe one or more identifiable patents in that
country that you have reason to believe are valid.
If, pursuant to or in connection with a single transaction or
arrangement, you convey, or propagate by procuring conveyance of, a
covered work, and grant a patent license to some of the parties
receiving the covered work authorizing them to use, propagate, modify
or convey a specific copy of the covered work, then the patent license
you grant is automatically extended to all recipients of the covered
work and works based on it.
A patent license is "discriminatory" if it does not include within
the scope of its coverage, prohibits the exercise of, or is
conditioned on the non-exercise of one or more of the rights that are
specifically granted under this License. You may not convey a covered
work if you are a party to an arrangement with a third party that is
in the business of distributing software, under which you make payment
to the third party based on the extent of your activity of conveying
the work, and under which the third party grants, to any of the
parties who would receive the covered work from you, a discriminatory
patent license (a) in connection with copies of the covered work
conveyed by you (or copies made from those copies), or (b) primarily
for and in connection with specific products or compilations that
contain the covered work, unless you entered into that arrangement,
or that patent license was granted, prior to 28 March 2007.
Nothing in this License shall be construed as excluding or limiting
any implied license or other defenses to infringement that may
otherwise be available to you under applicable patent law.
12. No Surrender of Others' Freedom.
If conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License. If you cannot convey a
covered work so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you may
not convey it at all. For example, if you agree to terms that obligate you
to collect a royalty for further conveying from those to whom you convey
the Program, the only way you could satisfy both those terms and this
License would be to refrain entirely from conveying the Program.
13. Use with the GNU Affero General Public License.
Notwithstanding any other provision of this License, you have
permission to link or combine any covered work with a work licensed
under version 3 of the GNU Affero General Public License into a single
combined work, and to convey the resulting work. The terms of this
License will continue to apply to the part which is the covered work,
but the special requirements of the GNU Affero General Public License,
section 13, concerning interaction through a network will apply to the
combination as such.
14. Revised Versions of this License.
The Free Software Foundation may publish revised and/or new versions of
the GNU General Public License from time to time. Such new versions will
be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.
Each version is given a distinguishing version number. If the
Program specifies that a certain numbered version of the GNU General
Public License "or any later version" applies to it, you have the
option of following the terms and conditions either of that numbered
version or of any later version published by the Free Software
Foundation. If the Program does not specify a version number of the
GNU General Public License, you may choose any version ever published
by the Free Software Foundation.
If the Program specifies that a proxy can decide which future
versions of the GNU General Public License can be used, that proxy's
public statement of acceptance of a version permanently authorizes you
to choose that version for the Program.
Later license versions may give you additional or different
permissions. However, no additional obligations are imposed on any
author or copyright holder as a result of your choosing to follow a
later version.
15. Disclaimer of Warranty.
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
16. Limitation of Liability.
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
SUCH DAMAGES.
17. Interpretation of Sections 15 and 16.
If the disclaimer of warranty and limitation of liability provided
above cannot be given local legal effect according to their terms,
reviewing courts shall apply local law that most closely approximates
an absolute waiver of all civil liability in connection with the
Program, unless a warranty or assumption of liability accompanies a
copy of the Program in return for a fee.
END OF TERMS AND CONDITIONS
How to Apply These Terms to Your New Programs
If you develop a new program, and you want it to be of the greatest
possible use to the public, the best way to achieve this is to make it
free software which everyone can redistribute and change under these terms.
To do so, attach the following notices to the program. It is safest
to attach them to the start of each source file to most effectively
state the exclusion of warranty; and each file should have at least
the "copyright" line and a pointer to where the full notice is found.
<one line to give the program's name and a brief idea of what it does.>
Copyright (C) <year> <name of author>
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
Also add information on how to contact you by electronic and paper mail.
If the program does terminal interaction, make it output a short
notice like this when it starts in an interactive mode:
<program> Copyright (C) <year> <name of author>
This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
This is free software, and you are welcome to redistribute it
under certain conditions; type `show c' for details.
The hypothetical commands `show w' and `show c' should show the appropriate
parts of the General Public License. Of course, your program's commands
might be different; for a GUI interface, you would use an "about box".
You should also get your employer (if you work as a programmer) or school,
if any, to sign a "copyright disclaimer" for the program, if necessary.
For more information on this, and how to apply and follow the GNU GPL, see
<https://www.gnu.org/licenses/>.
The GNU General Public License does not permit incorporating your program
into proprietary programs. If your program is a subroutine library, you
may consider it more useful to permit linking proprietary applications with
the library. If this is what you want to do, use the GNU Lesser General
Public License instead of this License. But first, please read
<https://www.gnu.org/licenses/why-not-lgpl.html>.
PUBLIC-SOURCE-MANIFEST.sha256
+823
View File
@@ -0,0 +1,823 @@
e5581d3995f5b65624acc550d0af4a76b6dca6d12e5d3dc7765346ba9adc26e5 .clang-format
703c1765cfa88b9ae775aea2218a05beba963f2cfb9f134717c18a4230dbf703 .clang-tidy
984d4bba9c66a83e3ea9fa671d889781de0c9964f0a94e803909c9288b90be46 .dockerignore
18ed8d2c4f47423be504385dc162054e9982364fcd25d6e8cb32a63b417dcbe0 .editorconfig
40b049570098cbfa24b48c5f69436f250ee25a08370153104c8c2527763f84a2 .gitattributes
02b95d59e72562ea17409a0e3644cb76ea47662ccdc8f5ac284574654945accd .gitea/workflows/ci.yml
5019f29fe156ad1e1672198bcc2bb83a86947778a172a80d229b7dd6f092b976 .gitea/workflows/managed-validation.yml
1c1d1dbd105b9ee07e1d64d5a31f7ab905a2b9ff06acde2d3fb35bf78af4e95a .gitignore
ea0dfd53e693b39df4588542f03733db05d95cb34222922dddf6bd7612a726cf .gitleaks.toml
7b479cff9b881cb7989450869e96b6b746c6049b9eac1a1c4ae1f0afac45ad69 ARCHITECTURE.md
82bdaa28bba2f2053b768c8e2737c1cb93947c9c4bf28a3e96c06c9d321d9789 CMakeLists.txt
93b4eab27651241c4b5ffddac717dc151339955e7b5d2c736e7ac0c1ed1e0a9a CMakePresets.json
aa426f28c3d3db8991b51c16e36c804daa0fe10038d38dd034bbc8ac5608b799 CONTRIBUTING.md
9e008af5f21e61aeb05635f4bad8816c0c5f571324e7751c686ae1436c83f3de FIRMWARE_COMPATIBILITY.md
7fe14716ed31cc71fc3bf9af293c368d464a853a70ea86e9995388f6b9e929e5 LICENSE
af26a708c6905da54d831f76f3c8006340fe8d4fd616ae7848954211169c4768 README.md
81e505bff73602c7b5b9cbb4bf9946591277a5896bb2fd68e4b27a8bc787afc9 RESEARCH.md
99374945ca60263212a1b5669cc7e229882a2980a076a5708273a66358c57de9 ROADMAP.md
7446e0bad0ade04fbb2e2fa71909aaab77f895866d3c1dfa6185ccb3c64efe86 SAFETY.md
40d67873455d191ae0d1f9805dabedf20622d100ecfc06ca84aa987c3e2afa92 SECURITY.md
3d2dfc653e341b4b512a89dbb38231631c51872add4cb027f0aeee7d2b4ab06b TEST_PLAN.md
7a7e8823edd5d7f7ded8c162fea18e47aa8a06696a7cfb8290fa08a5570abb07 THIRD_PARTY_NOTICES.md
a70eae3c717b69ecd2a1014c99432faafd81600616fc09c02608d5af849205f7 adapters/retroarch/README.md
de15249d0bc354d843d4ad7f59a6cb122230b8fe128cd6d9e74b81a7141427d6 adapters/retroarch/retroarch_adapter.c
5ed138d0506c85973f9c8d56d8822b93de839a39deecd7fc45e35df4ab747862 adapters/sdl2/README.md
e2a540bb61bfed8665bd7dd7a2bf2c39ff539ecc95d496eb6a9295fd662d987a adapters/sdl2/sdl2_adapter.c
a5ca7ad5adaa14b3fc808da1909a4318320ac9dbe113eb8bd30b7cce9f4fdf4f cmake/README.md
61bf26f2631737849491e48f818febc0fe2a7a3e756dc3d7dbcd1e1b4d60eac5 cmake/chimera-gfx-config.cmake.in
adf50105994b1d95ac1030d23ead8a20952818f703fe5216587f78e6871b9aab docs/DECISIONS.md
1d4a884fca5da62429fbd95a44414c830ec48a35c30a1416ee339e214431d131 docs/PUBLICATION_READINESS.md
a92e6eed8e7ccd73dfdd26a258377a76c52f32b2cbd4d64fbc506395c3b333b6 docs/adr/0001-standalone-repository.md
111c1890d8570d3ea64e4c716aabcf0a5e5d2745228955744bffce47c253068c docs/adr/0002-export-names-are-not-abi.md
f97ba38da2c4bfd3cf19853195110ac48ad59728e241bac47d8c21e00d1d3c26 docs/adr/0003-fail-closed-probe.md
46a9971ce8378172ad2d0beb8e8571f46f0c282052c242ee55fc072dfe177088 docs/adr/0004-license.md
8ec477bd10e5f6c72fa417087d891b5666917f9a6873397313e7a880d4de040b docs/adr/0005-versioned-resource-lifecycle.md
3722750cb3899dcda3589008b94449b12bfd4d4232200e366da779b4f5560e86 docs/adr/0006-phase1-sdl-videoout-boundary.md
585c14113274608d6ab578a6fd5a775bd750c4e8a947ec0174f17d75399bf20c docs/adr/0007-artifact-provenance.md
b3494b872144b9c636bb665be84e8dc3d7c1819ffd597b79c72a5c931cd5656e docs/adr/0008-firmware-9.60-probe-build.md
f7b61c292e51af9632fff385f7ebcc75a5384cf16e7b44fb24066b7cb97b59cb docs/adr/0009-block-unproven-minimal-startup.md
06e2248addc9d66ef5d4705ec518e6f1faa40b4633a51468cce7edd740ca4ccd docs/adr/0010-controlled-runtime-effects.md
299ce9147cab884c50038372fc913b9c603bc5cb99ca0ad52b9ca3e4745f5ed7 docs/adr/0011-phase07-hardened-controlled-runtime.md
aec275591d56a564cd77b022c73246456b42be3aef2def6c1fa702dd89111a97 docs/adr/0012-phase10j-first-frame-identity.md
e18abf9b7cec2d17c9716092e63dac235579b4bd8c80c04ca77b0588981b9f72 docs/approvals/phase-0.8-bounded-observation-template.md
cad136ac07edeac7cf85a7c48e1b6558683ea1b9a9110ebeb8dd79cc8dc419c3 docs/approvals/phase-0.9-backup-creation-template.md
9793af46530f33a3b1fc6f713ddd06a0f4f8b913a442a4a22df2fe1dc4d45f3f docs/approvals/phase-0.9-observation-template.md
b9376da3d539226930785c2ff5412fdce591e809e6d710dd4177f62c44e5ec76 docs/approvals/phase-0.9-one-shot-execution-template.md
b4987f172b56241495577119d38a5c69b7a38a715f61a9973fbcf2beb8b5fc62 docs/approvals/phase-0.9-staging-template.md
ea4e41d138952780160271eba814c7c4ba9b4bfe4c5d15982d4fe582304655bb docs/approvals/phase-0.9-switch-template.md
65b781814e501aea5a78276db658b820d130f643d84e38aee1792c56ef9c52ea docs/approvals/phase-0.9b-observer-execution-template.md
530cd9c8c62bff167c942d4195cedc12d81f948c8e72885bbe8e50105ff76fd9 docs/approvals/phase-0.9e-r-y2jb-deployed-use-attestation.md
5504229082cbe743fcc09a028a36fd28efc4a5e7aeb56a77c79a5ba34244ee9c docs/approvals/phase-1.0aa-offline-fake-adapter.md
dc1b8f657bd949f3d072e00e715229332438ad142f73d4f55da5f02402e3fa8e docs/approvals/phase-1.0ab-live-adapter-feasibility.md
2d4b79b11fa0c1cd4fde39fc82f4ee8ceb99daadab95a2f9dd2f98e8f704fb0a docs/approvals/phase-1.0ac-dormant-adapter.md
104beb0f59d4130e0faddd43c8ecce01509936839df2d891aa992266eba7b1e0 docs/approvals/phase-1.0b-device-smoke-template.md
d825666a600c0462f27cdaf558c5bce8080aba0c8e0bd8d18b54e5b8dab4fb72 docs/approvals/phase-1.0cz-launch-canary-template.md
4961884183ca8ff1ace22d61ab65e831fcb4127d1655a6178f936d83ff7bfc19 docs/approvals/phase-1.0do-snapshot-runner-template.json
15551279dfc71a9dbdce555d999f7370cb9f401869acdcd752a60787b092ed1a docs/approvals/phase-1.0dr-inventory-runner-template.json
1f5655faf888a1ababc5a5eb0e46e7fb13b21993f8d68b151114c482ee01ebf8 docs/approvals/phase-1.0dt-metadata-runner-template.json
1f085ed324802901cf5cb6663bc6d3b4a2a6f65dd350d694e9a525d1c2b7e30b docs/approvals/phase-1.0e-one-shot-result-test.md
66bbe6c71133bd050a3d87ef59e0e452a6c580e9986fe121043844e751940304 docs/approvals/phase-1.0f-device-test-template.md
c83f17317532a07e077f0e4fe81356252d0e84e73367abbd9699125f2c558b13 docs/approvals/phase-1.0g-one-shot-runner-template.md
b4d5306ac2630fa893135ccbf3990e30df219cbec6f6a47c4579c8e1a1790a7a docs/approvals/phase-1.0h-device-test-template.md
b53d609fc2d3ae3bf87c466b585416600d5b264dc98afabafb398d0e766f8638 docs/approvals/phase-1.0k-write-diag-one-shot-template.md
a149dbff78367bab20f3c7dd78a18ad922742ffb5d6e1d7285362052c2d325cd docs/approvals/phase-1.0n-write-free-one-shot-template.md
16a8757bbd396d0b03b6e1c898c0a74f9fae795da9a1fc622e01d1dd2f849ed5 docs/approvals/phase-1.0t-shsrv-metadata-collection.md
f750e8732a785f707b23b47f93664a4994aae48ca091f7e037f36fb788971266 docs/approvals/phase-1.0v-shsrv-collector.md
d5abc3eaf0391d1999396f90962b6e7847eed9b56ac37c6bd7ff5b0be92c8716 docs/approvals/phase-1.0w-shsrv-client.md
03df44f177c5291aff622c89f2ee771ec53377e9b021d3e79b0d33efdc52cf91 docs/approvals/phase-1.0x-inactive-transport.md
5c035120900fe234a2fb53bf291cb9788e2a1de033a2ac33acb2b5e882f6bdef docs/approvals/phase-1.0y-shsrv-framing.md
c0643ffb2f24f0ce43ab0df4556e1a7704bf60c8141f789101d9561bbacbce5d docs/approvals/phase-1.0z-passive-batch.md
5ad3d388f71f9ac2aeb2f39e4600d692f922c9c85700862931c0ad46ee29c3ee docs/approvals/phase07-hardened-installation-request.md
b74189c8abaf9ca200e9b67329ecac55040af2779b433c4680d555c6aea48d69 docs/approvals/phase07-lifecycle-transfer-execution-request.md
232016be1ce7d582b5249b4506e004199539602226bd0015521c6463efa2ae57 docs/approvals/probe-9.60-transfer-execution.md
f300406bfe357f0e5cbf852d46248a1e7a54ece4cdff484b078191ae9fe15a9d docs/evidence/external-evidence-integrity-2026-07-29.md
daa95cec45040afdb6a0c69bf04574f7ded0f76894e506d7d54355ca3773439f docs/evidence/phase0-build-2026-07-16.md
9304cc107fe5423d72fc2615174d0a8d8ff1106c3d52b527d81b732ad6edd51d docs/evidence/phase0-build-2026-07-17.md
fa4a80353b19c6be947e98c2143fed05779fa47f2f70d1599bb82901e17e1204 docs/evidence/phase0.5-startup-offline-2026-07-17.md
5d4c821491c12d717237c97b99c582251e2ecce80b629aa30c88344bb31d6445 docs/evidence/phase07-offline-build-2026-07-17.md
2bc642945a4cda8cf4f782f94afd49849e27f5785327ae37aa010cd4d4180ed5 docs/evidence/probe-9.60-offline-2026-07-17.md
bd043f7e480f7c83a60bc73e2a58cb03a760fa2e543bba7d99c340661aa7d2f4 docs/phase1/APPROVAL_PACKAGE.md
e23066ddab4fef7d682c374b9639dfd1f1cf241f7b45f100cc7fbde21c0fef75 docs/phase1/FIRMWARE_ABI_CHECKLIST.md
baa8142ff42009966a0ce7f4ca77f819c680a51a9b3083346abedc5892bf63af docs/phase1/HARDWARE_TEST_PLAN.md
3501dbdddbfc9f1818f95f00b92275aed21cab8b56aee5e65daa3e71405eb1f7 docs/phase1/README.md
7aa7f5637d5594a7bc23fb92dfba17185f4269fc8ecf34d0691829a6f476cb33 docs/phase1/VIDEOOUT_CLEAR_EXPERIMENT.md
ef2c2a2356dce0409ee2a3b78c683e57f0c064e3f6de10ec271ae44f92682077 docs/retroarch/phase-1.0a-build-results.md
c6ba1b2db5397234d1fe0dcaf74a19a8d62db75f811e61cda3e0d876bdd89553 docs/retroarch/phase-1.0a-driver-status.md
0acb3a025bb10bae6da75be6150d3c7547792e5d83fd8544a73e5a1d5ab68b0d docs/retroarch/phase-1.0a-next-device-smoke-test.md
069b60eb414e144b1e4ca03ca814656afc94e85afe87163710b874e6df88aedc docs/retroarch/phase-1.0a-pacbrew-sdl-analysis.md
e95686b41616bab34cccfd37969385c14ab36ccff17fae17b604a48d8a5e8193 docs/retroarch/phase-1.0a-port-plan.md
15ebed8c48c1919cce4a7ede061a6a5bf696bf2f6ff765fcbf04f0b32e4b8803 docs/retroarch/phase-1.0a-ps4-reference-delta.md
9ba81f2eb4b43d51606b33af55f523fb28b791d157c88a0efb4bac127bebb97e docs/retroarch/phase-1.0a-upstream-analysis.md
12290c7062134e524f19d1666505e95ff13ace7000b3fe22e52be54af5eb9e1b docs/retroarch/phase-1.0aa-offline-fake-adapter-integration.md
39f0bab00fb7055ac0e5f7fb0ca59c33e2b028db04c11ed38dbfe7675fd37c37 docs/retroarch/phase-1.0ab-offline-live-adapter-feasibility.md
9c87ff0e5d4dc6ec5961000d7fe60a749d6da8b337fb959a2597041430fdc8f7 docs/retroarch/phase-1.0ab-timeout-and-cleanup-contract.md
d18132c1dcb5f4ec21d5cdd8b2bedf81aefec1edf15877a4b6c9f7de4470b66b docs/retroarch/phase-1.0ac-fake-syscall-contract.md
bb3c1b21c2548f362befc20e09465084041b218151ce1410f1c543fc7b99edd4 docs/retroarch/phase-1.0ac-offline-dormant-adapter.md
6cc0b2dc8140e6860929e543df820d4d9905c8720a366b70cd1a008f7548d93e docs/retroarch/phase-1.0ad-inactive-activation-contract.md
8dd8e89a4f5850ec9fe02e90562066e0e639b78ab74a4b1b7d44947ae1db989b docs/retroarch/phase-1.0ae-minimal-bigapp-launcher-architecture.md
cf78a730c1a9bb41167e5b955d9bffa0bbe6e301cd7f4fd717498e8e294386a7 docs/retroarch/phase-1.0af-offline-bigapp-lifecycle-model.md
8c0a964c0d1343cd62c245d218b0f1dd69c1f723bd803421d019b963063815a7 docs/retroarch/phase-1.0ag-bounded-elf-contract.md
49019682cb278e7d9ed1a7ecf08fcec4863a46afbd49edeb406c6c59de50fc87 docs/retroarch/phase-1.0ah-dynamic-relocation-contract.md
a0547c34101760e07d670ee53ba4fbf022320ca63ab12e428ac1a6d6d3cd3a2e docs/retroarch/phase-1.0ai-offline-mapping-transaction.md
4f7d945127800e985ae775c5ecb2970f174bb92653eb60998179a313b31afe8d docs/retroarch/phase-1.0aj-offline-primitive-audit.md
0057f9dafe295b165b5b3bb5998ffc8310071de1b43ec6d5b3d5ebe007b068a8 docs/retroarch/phase-1.0ak-offline-hybrid-composition.md
ffbc58d32896f80c4de173f5a32d2d7a53086dda74bf8f74b69ff1086bbd2789 docs/retroarch/phase-1.0al-offline-mdbg-copy-audit.md
0ee16aa477b54b3e257bf409a7f89ddd3c416651b151c2b5a571899a446a71f3 docs/retroarch/phase-1.0am-offline-bounded-copy-model.md
fd29ce0799da7c48bbf6a9e1ef9bb94a25b79b7c4e12246029c33fdfe7e90c8b docs/retroarch/phase-1.0an-offline-service-lifecycle-audit.md
847930203f2f7bbc51cd3de5cef6e56ac9c95714a7017c811c2bd8b938540c0b docs/retroarch/phase-1.0ao-offline-worker-supervisor-model.md
2c4d18b6ae3115f25a92603caf9544194b23f50782252cc1313f3479ffe7c0b2 docs/retroarch/phase-1.0ap-offline-worker-feasibility-audit.md
2ec07965bcb32494ea0d4fc8068f2ad2411a683e7470aeec30ed0e0c2dc63fad docs/retroarch/phase-1.0aq-offline-worker-result-record.md
ffa1485f0244ccac112a282b7d40d4fd3d21a67e4782b0bdac34b9eda839c627 docs/retroarch/phase-1.0ar-offline-result-channel-model.md
89ed6e00c2df946ba2beb86f9eab103ae3e79404b8e45772f5c66585def03fb0 docs/retroarch/phase-1.0as-offline-channel-primitive-audit.md
787ffc3825a74ff3b874189a325adf54891bb501d60e6635ea711bf4aba049cf docs/retroarch/phase-1.0at-offline-fd-deadline-model.md
a61d86a2950e16cdddd7211d668e08d684a95cb43c3bbd7a2af9726328c77ab0 docs/retroarch/phase-1.0au-live-channel-feasibility.md
5007989ce1cc715f7541ca6b0c12b45e9c71b2527ad0bba7dfd9654fe5e002b0 docs/retroarch/phase-1.0av-launch-context-canary-contract.md
d26f2157a1998009ae3b0d655432e7e0f641654cf4ca2e0e2a855ddd2bd66323 docs/retroarch/phase-1.0aw-canary-source-delta-audit.md
490f0d4d40f5b041d495fa443b46f80c5393fbb0a635b46cdf5203b8eea92edc docs/retroarch/phase-1.0ax-canary-protocol-model.md
38c7c606ea0eadc4f75162dad2d7e8faf55d21bf6e9056589f71eb0f3f2645c0 docs/retroarch/phase-1.0ay-target-source-base.md
09ec776a2b20c62d1f16b0b9e774d66c86659c774881294a6ef9d28f339fb4d9 docs/retroarch/phase-1.0az-host-av-source.md
5015aca6628dc0b93742fccee9a8173cb8b16718eec8f957e9fe851769b48c29 docs/retroarch/phase-1.0b-device-risk-assessment.md
b74290d32402b8b57896dc3488a4cc8a76d39f4b4cd7e41daf812f8d86aa08c9 docs/retroarch/phase-1.0b-linker-and-wx-analysis.md
34370caa210e18fee5676def8f80dcb2ce56b7d27d747b40d808828327ac825d docs/retroarch/phase-1.0b-persistent-write-audit.md
e31ca5aed239b90e5a295bdae7239405903f779ec75b8160f2efdf94f1f6167c docs/retroarch/phase-1.0b-proposed-one-shot-test.md
b5505b0e076ae6eb643f734dca8b5b0e2a42eef33bdeb4f5c3ad77baa8a80d6e docs/retroarch/phase-1.0b-runtime-and-exit-contract.md
1c64c57d5eea338f0942cb87d80b8ce32babf32d61193c06bca432265b167b37 docs/retroarch/phase-1.0b-smoke-candidate-design.md
529d0179911ab516ca6c339bd8a3537049033666de4083205bf341eddb0c0bf2 docs/retroarch/phase-1.0ba-target-profile-callsite-audit.md
a9f485ff7a17be6147ae306c0f835aaa5e7b3af1ea8016257d1cde163a0292b1 docs/retroarch/phase-1.0bb-source-only-launch-canary-profile.md
d4848c343b801efcef4e559fe4e3bb1d6fa19c3f676d52f08e96b232d4bdd317 docs/retroarch/phase-1.0bc-cross-build-prerequisite-audit.md
937c129f95f2098f80514c3192748da91f7192cb1b32f81abc36d4de88541d74 docs/retroarch/phase-1.0bd-dormant-sdl-materializer-policy.md
0bfd1956813b0762d2cf58de7c60fb8bbd88fc77437ceaac2c10421bf023830c docs/retroarch/phase-1.0be-fake-only-sdl-materializer.md
fb8006ebe45ad37259bd2cfe15448a818dd128c716b1c5b61e4613c4f03825ec docs/retroarch/phase-1.0bf-live-sdl-adapter-boundary-audit.md
cdd878630ed3efa7fdb23127ce82d11f94e8a32bf8cadd092d1fe3f912f47a65 docs/retroarch/phase-1.0bg-dormant-sdl-request-compiler.md
b6b1f6f8fd0a4ce86123e0170b4ff7000a895557c81e2690209b5462c25c1bc5 docs/retroarch/phase-1.0bh-bounded-sdl-executor.md
859304a469d44fa939db56a57e761e4975e27aa0d61960858ebd2b668d17b030 docs/retroarch/phase-1.0bi-real-facade-and-tool-install-audit.md
8c7a101f66e9d56cee4f09a67e3e983a1600bbfcc2d4dc2ee5a7b2357d99dae6 docs/retroarch/phase-1.0bj-exact-host-tool-install-result.md
49bd69bf84aa1404a3fef08c49e0047e675bca2a0727a5308ae6b64596fd6144 docs/retroarch/phase-1.0bk-bounded-real-facade-host-fixture-gate.md
e8c3caf90b02c8fb41074f7af791578e73f83d2090e4ecf67eafc7cfffd1c1ae docs/retroarch/phase-1.0bl-fixture-import-failure-and-new-gate.md
c48641c52dc563d4a5f1a45e3f87d4c6187f8d96ce33c1d9ce894cc9ef5fadd0 docs/retroarch/phase-1.0bm-real-facade-fixture-result.md
7215afaa02718ee0ec81f08110617b4ec921ba9d3a6919569eed471f82113f2b docs/retroarch/phase-1.0bn-materializer-preflight-patch-chain-audit.md
f7eb3bff8eae70b0718d595ea7de32ead6741b856914d757b0b5ae3358e36b9e docs/retroarch/phase-1.0bo-patch-chain-remediation-result.md
6e95488acc2c0e0253ed86179d40cc1cad3aace9ca8093c2022b08d5eb982fa0 docs/retroarch/phase-1.0bp-one-shot-sdl-materialization-gate.md
d12a1eb9dd845157c6f354bb7946b60b99b00d7ae994598c3a0cb6ba752db760 docs/retroarch/phase-1.0bq-inline-invocation-failure.md
2a9bd55f9faf43680b6db3cd59dc73f4468e0e284b19c2661d667ba8fac58fff docs/retroarch/phase-1.0br-script-entrypoint-one-shot-gate.md
dc75f6a87bf09dbda2ba7650818d314e3dce7f04624aa45f4768af44dd0d9157 docs/retroarch/phase-1.0bs-read-only-status-timeout.md
9da8d096f4a3b31ded83faeb7bf8243ff79090b9f72072eebedecc67a15b165d docs/retroarch/phase-1.0bt-corrected-timeout-one-shot-gate.md
01e6f8dbac3944d9f523e9111ac516babd842fd82cf81bf4ce6faf22b81df225 docs/retroarch/phase-1.0bu-wsl-git-status-timeout-and-windows-git-fixture-gate.md
74d7f6bff7dc293b263e06c8e333997d52c51285840c7173892e9cbb6f91593e docs/retroarch/phase-1.0bv-windows-git-fixture-result-and-request-correction-gate.md
6fa0c47c25b70a1c68339244065a5029edff6749363f00438e08ba89b9a4a9ed docs/retroarch/phase-1.0bw-corrected-sdl-materializer-one-shot-gate.md
2f45aa803c78eeaec9659ac732527280071a482c6e527c487d82b5bd9236523f docs/retroarch/phase-1.0bx-changed-files-timeout-and-read-only-fixture-gate.md
9238b84bf6008256759d17521bbb474a5219fd8f147e6c14011eac2479884b90 docs/retroarch/phase-1.0by-windows-git-stage-fixture-failure-and-file-hash-gate.md
84ba9cdaf4399a921f6e99615d830c857d2d6edb7446cd2bb928ac645baa14ec docs/retroarch/phase-1.0bz-exact-sdl-stage-cleanup-gate.md
49ae3623fef1f9d6291141262cfd536c5da6100ee586a365f32b5f2788190e96 docs/retroarch/phase-1.0c-device-smoke-result.md
a65f1c3962e121812786dee0ffbb8075b2e1a4762ec7860f4869fea07be3fdb3 docs/retroarch/phase-1.0ca-cleanup-result-and-hash-verifier-correction-gate.md
de38d557ec8d27d36060c4948e8cdf3a3e5783481fbdbd51d1c9654262d9def7 docs/retroarch/phase-1.0cb-hash-verified-sdl-materializer-one-shot-gate.md
c3906fccc007538c1af16c31cec923c660eb9252bd0bc06cca6622540b089fe9 docs/retroarch/phase-1.0cc-cmake-timeout-and-exact-output-cleanup-gate.md
7bc8e9be7d5bcf0ae86ecc81f3ea44d1b7a381b98e5b51baad6f61e0f12e18ee docs/retroarch/phase-1.0cd-cleanup-result-and-configure-timeout-correction-gate.md
86c4612dac26856eae1e6e7003ea62f73eb5e91b822345c72d688f6c023af801 docs/retroarch/phase-1.0ce-extended-configure-sdl-materializer-one-shot-gate.md
76be79071f727f80598d31991582f4a0f0d452bdc0f61bfbeabea86c8fb8011e docs/retroarch/phase-1.0cf-repeated-configure-timeout-and-cleanup-gate.md
354d81acc6fe933e9173d71003fb3ed3db3b211595c37b91220da4ba29b6051a docs/retroarch/phase-1.0cg-native-wsl-sdl-materializer-design-gate.md
75e84bfe41b6cbfc49bfb0a60e333895575b5939ec3a3ef5251bc8ad9de219c6 docs/retroarch/phase-1.0ch-native-wsl-sdl-materializer-one-shot-gate.md
22494e511d8b3286d494d60b1503c511ef2c7175ca229f7866b05f1a06e773be docs/retroarch/phase-1.0ci-native-sdk-bottleneck-and-cleanup-gate.md
5771c2c19584ea1701625dcfeafa2d0cba72c9dd26a018eebc05fb6f03f91565 docs/retroarch/phase-1.0cj-native-sdk-stage-design-gate.md
f58e9aee796151c1a67e21a472f553eae33c3e72a05a2c7398a56f7e89d1f5a6 docs/retroarch/phase-1.0ck-native-sdk-sdl-materializer-one-shot-gate.md
a0fc6e9c3ca8966f3ac304abc769345d33c1c4aa59b386f70948caf728cd8cf9 docs/retroarch/phase-1.0cl-native-sdk-configure-progress-and-cleanup-gate.md
516ed0355034c58c8bf595e6535fac9a53c6517c1c9458db6ba2a00fbbe2c5af docs/retroarch/phase-1.0cm-measured-configure-timeout-correction-gate.md
bc30af8fa3604448bf46728f72e79301e4ed4583910a64b64d17e3797e800b94 docs/retroarch/phase-1.0cn-measured-native-sdl-materializer-one-shot-gate.md
e6df2ee057620f4629d4ffcf8294a878965582a54b5c3bd547e7fb92b3ea91ad docs/retroarch/phase-1.0co-configure-success-build-output-limit-cleanup-gate.md
d35b77688e0284df00e40a031c64288abdba7ed8c286d004fd7bc20592b8cb99 docs/retroarch/phase-1.0cp-build-output-limit-correction-gate.md
8e4f8d5c0136133d7fffa9a2cc080ed53a3367bfdfc3b4820ef151bff346ef65 docs/retroarch/phase-1.0cq-full-output-native-sdl-one-shot-gate.md
3ffc2d6cf4014f81a049d1da9dc7b458e57edacf5a8253348e00818a1bd8f44b docs/retroarch/phase-1.0cr-audited-sdl-archive-export-gate.md
3351d4275da1fc31e0059bef554b9909bceca8efc019f96ff52cb96c0ce22579 docs/retroarch/phase-1.0cs-export-parent-correction-gate.md
ada914d4117acf181544477887206466a8d5bb04c59cbe5aff001968c2d2b835 docs/retroarch/phase-1.0ct-sdl-archive-export-result.md
af8cd79c521f0fce620a9eb761ebc95bd2f3f4bfea565a3b32e6e6e919c12bcb docs/retroarch/phase-1.0cu-exact-sdl-header-export-gate.md
0252173b805880f4fd864b73b79284fd89fc37f9e19e356ceac7ff64dc1c9ee9 docs/retroarch/phase-1.0cv-launch-canary-offline-build-gate.md
13149aed840b070e59cec1deffc8f3f43d0dda0fe4f75e5598807016b75d64aa docs/retroarch/phase-1.0cw-launch-canary-artifact-audit.md
017dfb7d36094ea159d894aa9c14567d1e9a2db87d7bfb6279144d72b2ba70b9 docs/retroarch/phase-1.0cx-isolated-reproducibility-build-gate.md
e5c90154336da5afc89f54ed804943747e8f715e3c394c9a3a475f2bdeb103c9 docs/retroarch/phase-1.0cy-launch-canary-reproducibility-result.md
2bf57f963a7f1281d55755c5dd5293140347d2cd0a22b446607d29a47d70d50d docs/retroarch/phase-1.0cz-inactive-launch-canary-runner.md
21e12364bfe942a174f5a00997dd389c004e731fadd9c9a1f796a8300b9bf863 docs/retroarch/phase-1.0d-crt-entry-canary.md
513282e0c04211831e0202b0beea3320a4e92a3804bffd2858d1d58f47163231 docs/retroarch/phase-1.0d-early-diagnostic-design.md
3b4543a38fe8e978014dac8eea78e7b8e42f64e1ce9cd8d8753133db27bd9edd docs/retroarch/phase-1.0d-loader-static-model.md
1ffaecfcb46c8a428717aadf4d67b6ba324a8bf27749193ef838cab2a9f72372 docs/retroarch/phase-1.0d-loader-to-entry-analysis.md
e254b5ad5578cf17a99ac2af8410aa034e3211d0c26c2fbc3576e60cac561980 docs/retroarch/phase-1.0d-next-device-test-ladder.md
5f456adffcc2769312a0c5db72f24e02657de1a918ff15d8ba02a9c127024a74 docs/retroarch/phase-1.0d-startup-import-closure.md
1c06cdb914a0be1001e580b2f1340d4de72eb50e8c49156dfa914d9afe06e2e7 docs/retroarch/phase-1.0db-post-cz-differential-analysis.md
4388ebce6ada766b087d0a203ddd4aefc548d840532c2c670977a1ab8de9b04f docs/retroarch/phase-1.0dc-inactive-bigapp-comparison-gate.md
f5a3c8d8ba5eae4b9ba3e207d44b5594bc4e9c3a5e76ef44a4c65804df21ff92 docs/retroarch/phase-1.0dd-minimal-launcher-source-prerequisite-audit.md
c1b528bcb26017826d7d4eb2859bb5640ae715f21d6d04cd8def4458d1157c91 docs/retroarch/phase-1.0de-independent-abi-provenance-search.md
0601340177d3877b2617d65f16cfb501a6b886a08610c78b66bb4b833c1e9684 docs/retroarch/phase-1.0df-inactive-title-presence-observer.md
6b2737c96153b69ae88a019a5f8703e857ee69726afd0d8e89f9444f773546bb docs/retroarch/phase-1.0dg-title-presence-primitive-audit.md
f3b04baf12a0995f66a5e041d17170553ab6a1f4b2ff04e2bb1d6dfc4bed51f0 docs/retroarch/phase-1.0dh-hash-bound-snapshot-query.md
0f10dba8db8f6632920b41a011f4f7fc564ad0c542677069f6a995484b162575 docs/retroarch/phase-1.0di-live-acquisition-boundary.md
2fc4553ac748f4180bb3bacd9ad59da033c525e84b3fab6e499308935766abd1 docs/retroarch/phase-1.0dj-di-t2-result.md
3cd253161d9f9e30d66060e9ca8b88a680428d1f65fb54f2b7f138ab25ed4564 docs/retroarch/phase-1.0dk-port-status-result.md
8c3d49373697ac6d285c6cc1f281aaa1b1ea2d31cbe9312c10698f412acd6de9 docs/retroarch/phase-1.0dl-official-shsrv-artifact-audit.md
6005967a871ccc5f7daddafc96c988837f11addaf8720c8fdf48d56287a5e739 docs/retroarch/phase-1.0dm-bounded-snapshot-observer.md
6ac0bd089b740ae8dab1899fe673a1f29d4ede4e156456a6237fbbde11e014f8 docs/retroarch/phase-1.0dn-inactive-snapshot-receiver.md
1a9dacff044f9d07c8aee9fd1165a40572de74bd193945f02ce724b4e9d2361e docs/retroarch/phase-1.0do-inactive-snapshot-runner.md
0742f0a36e138e83d31432dfc7d79b5f37ed848ef7c1ddc4ac42675656ecb0ba docs/retroarch/phase-1.0do-snapshot-result.md
ccd174358fc3a75747079f132c483ea9d1f4b578c0494be8617425d47efd307c docs/retroarch/phase-1.0dp-listener-status-result.md
6035916a2b8bca82e763e4733c2547a63bdf036278bb5dd22f93b7395001192b docs/retroarch/phase-1.0dq-bounded-fake00000-inventory.md
046dfcb1f314c5ef17ca2ebe7dd7365c6e7e07e9c8609a5a362b117705609a5b docs/retroarch/phase-1.0dr-inventory-result.md
8be5db151b8c7d9a2da092b7a6429ca9266226fe060d5b08079ead896639c5a0 docs/retroarch/phase-1.0ds-bounded-fake00000-metadata.md
3e824ca6d3566da6768313e45cbf80e610aceced36f5462a7543bd7601c0ebc8 docs/retroarch/phase-1.0dt-metadata-result.md
80e5ca91e652c61e44d2130cd691ca4d710323863cbe9f3bdb6a7edc27992cf8 docs/retroarch/phase-1.0du-exact-package-stat.md
aec2ce9b966aabe5fddd9d75ddd225cb213fb0ac5b49b07dee9940e260e1a62a docs/retroarch/phase-1.0dv-package-stat-result.md
425c90cdc5fed883bed07d9b5698a676968fdc69526ea61d25705d70b95b19e2 docs/retroarch/phase-1.0dw-exact-package-readback.md
9155fb6f7f7442b8ab324283843bb4acfc8e92f9d5703e4d86b8b700de005938 docs/retroarch/phase-1.0dx-official-package-correlation.md
2ffc2b2fe95c5799eb16966233f955fc25e2dc9fa5bc6ac4fa1312e9fb490745 docs/retroarch/phase-1.0dx-package-readback-result.md
ff259d12d4cfd2a4472b216f7c7ebcdfe27b9578e43fe79d96670840274eed8f docs/retroarch/phase-1.0dy-upstream-websrv-audit.md
3dbb3eb66244a25cd8079ff9ca06a850817eb472775858e5197e3015771a1df0 docs/retroarch/phase-1.0dy-websrv-listener-result.md
cf16f0236a617c4697b17287d2d0769504e19cda6f50241e672e93a714084983 docs/retroarch/phase-1.0dz-direct-launcher-decision.md
d4ec002b7370c09ab6f36f587661704280769d3cc1e7f4c77d2dbcc71d0ca0cf docs/retroarch/phase-1.0e-device-observations.md
1c185d12e60deedda833bfaa9e0ce55946bf55d4f11149351c8ff58b089d5b44 docs/retroarch/phase-1.0e-inherited-result-channel.md
b9d069e019ce3ac095bb7b0abd3777b5bd19a26bd79bdcd491e628d24ab96b14 docs/retroarch/phase-1.0e-next-device-test.md
228e06d48643f5faa6f2cae8cace40d010ddb3f0a76bfaaaa1a1ab22896a512e docs/retroarch/phase-1.0ea-expanded-launch-evidence.md
b66aef08168fb0e5ad7869e593304af219f7a0a0ba4a3ba220328f178c9d2135 docs/retroarch/phase-1.0eb-public-launch-matrix.md
fa08bf2d97a014dd87df8f92f7a67f428a9aa26d4b946407d1ff7f160415f68b docs/retroarch/phase-1.0f-startup-interval.md
ca9f346e3ca521459afed554913e66a9862f3d27930d0ae535eb493f71b45955 docs/retroarch/phase-1.0g-device-result.md
a53790b14a7fd6f251937570501943a63970d2deb1872765b6dd99c5cd0d7998 docs/retroarch/phase-1.0g-one-shot-runner.md
18dc3333de9cea654c711b934af19f82936ec9f4ef87234a4a46543330abbd03 docs/retroarch/phase-1.0h-device-result.md
a13196de45802bc5b248e41324a88630709b20730a4dea1149f251dbfa293cdc docs/retroarch/phase-1.0h-startup-args.md
4bd329ac2f0ef7da0660706ce51ceecdd3cfabc9ab69942fd95f880f5c82330e docs/retroarch/phase-1.0i-flip-and-write-analysis.md
cf0170391eee2144d10bb888397482a7f343fdf48ce90821b02078b3d522ba57 docs/retroarch/phase-1.0j-write-firewall-diagnostic.md
11714d28d240eefcb480f3fb6ea0b2b443b94dd338d485116e855fae13a24c59 docs/retroarch/phase-1.0k-write-diag-one-shot-runner.md
4c1f10e895bb273800a7709ae1e227b0c695f827054ee42d2eb68818cfc981f0 docs/retroarch/phase-1.0l-write-firewall-result-analysis.md
a8767a48fe8829d9105e484062dd368b5431ec20bcc9c25c228d3bbcef19fc1d docs/retroarch/phase-1.0m-write-free-defaults.md
4f1e540712b257d677b95eca822a44be837bd1f10e8ba05d3b0aece7ae9d81a9 docs/retroarch/phase-1.0n-inactive-one-shot-runner.md
b177c9c86c87d1e46fa3b72748fa45d39384518993fdbce582432d8c40980d76 docs/retroarch/phase-1.0o-write-free-device-result.md
2aaee1b64f4f7072f241ee001c411c00c91caee328455ac2f3ba2f3295bf4dd8 docs/retroarch/phase-1.0p-terminal-ordering-analysis.md
19955a833cdee3ea45a2ee8bd69859c6b8aed4f45430d384d1ab32b0cf07df22 docs/retroarch/phase-1.0p-videoout-submit-analysis.md
e03a063eff4ab5b20e3bc67248eb2a458363cbb95f772e47607cae2e78b4d7ea docs/retroarch/phase-1.0q-public-videoout-evidence.md
2c13fe97dbdb0fc3067fda6f8ae22f4925eda0bea85925088f0c61a438dc77f1 docs/retroarch/phase-1.0r-launch-context-comparison.md
1bf68b8ab52218a08bc0d012dbf2f6c5616f05f33f3cb81ec27b8a1c9b2d4316 docs/retroarch/phase-1.0r-sdl2main-and-packaging-analysis.md
7b6e6e5f13679e7509f5c5bb2d22b00f7c52a556ad392b3e0ee0e934570720f6 docs/retroarch/phase-1.0s-bigapp-launch-contract.md
303c4433c385774776896052c41d2fc1a70423c3ac822a0ffa1931f7fa5f699c docs/retroarch/phase-1.0s-hbldr-shsrv-provenance.md
12214413ee5c8b4a3d96bbd3fb829a6007043f21e627c01159f440afdb5dfcce docs/retroarch/phase-1.0t-inactive-shsrv-identity-gate.md
76750a5c480ef5f361624d29100a9aeef00cdbddd253cbe08db3fc939152de49 docs/retroarch/phase-1.0u-local-shsrv-artifact-inventory.md
fcc59e096bcc14ac13b7b38cf71f5f643d69d90c7bd01658ed2bea562f0ee894 docs/retroarch/phase-1.0v-inactive-one-shot-shsrv-collector.md
9f941d306423ab952c15f71dd17630b2a7f717245ebba715108d975a91159593 docs/retroarch/phase-1.0w-self-review-and-inactive-client-architecture.md
bbef44998625c9aeb5ca3eed3d80c2e0e875d4f1f348f461c038414f01c833da docs/retroarch/phase-1.0x-inactive-injected-transport.md
74fbdcdb30b3b6b324b1bab3f2481adfba13097276eff379e42c60ad4625fdee docs/retroarch/phase-1.0y-offline-shsrv-framing-audit.md
ca3d644e121c4256b88d4e56fc2b95a731f95f90549646e3ae022f5125e44ad7 docs/retroarch/phase-1.0z-offline-passive-batch-contract.md
605bebac65c3043639f230fe32e0d9fa0e15c0a2e49fb193c8d01f4868a9fa64 docs/reviews/phase0-final-2026-07-17.md
9fe84b247e32ca3d59117683fc63f0efcb1872e9803413400cf939b72f08e050 docs/runtime/controlled-runtime-policy.md
82aaca085fb27843f9c1cbdb380d01732a98e3082bbad1a0c186fcb551cfe0b0 docs/runtime/kernelwrite-proof-matrix.md
e49440e9b92872dddeb222f689606761eecdbb96e5b7314994790de5e79ad6bf docs/runtime/loader-contract.md
73f55bf8b343e3dff0ea03f7e9987cf436c92daeb68f5f9309e2591536675dbf docs/runtime/minimal-crt-feasibility.md
0e809b29057759f309be6f5a0dc5adc6f19917297f2482867e6e03820f409004 docs/runtime/payload-manager-policy.md
714fe8598d9160a17b22216adbf03ecd63871fb9a437a49996295a9911c77ebe docs/runtime/phase-0.5-review.md
19631e2e77987b052bd070e08e2b58d080aa8edb1a2858c1edf90ceec7a705aa docs/runtime/phase-0.6-loader-audit.md
aedac5a7b7f10cdedeeeb35fc7e8befc5f931d0e84024609cc6169811892d333 docs/runtime/phase-0.6-review.md
1eb862f27eaca716b83d62cf6e98cd62c7a62e9fb3f725367e2177ab13ba497a docs/runtime/phase-0.7-hardening.md
3fbe086175a6048176075f447ec1482074928e3b5282db97ea2169395fe1d508 docs/runtime/phase-0.8-read-only-preflight.md
6133656597a608780f9cb73c4974ed8237a250daf3cb8b77f6745a1e6aacbb8a docs/runtime/phase-0.8-remediation.md
cf78fb86681002741eb042347176844583fac086ccd83b649f1b1ffbac0ae8a4 docs/runtime/phase-0.9-anti-brick-threat-model.md
d4e8f4e39e76f8e7fde85285ee245ae7443a7430d50c2b3aa1ee25cb4c836602 docs/runtime/phase-0.9-installation-transaction-design.md
5a03c0d13dec167e56192e6af14900208040ff94a64e63a89323f3c6a1757561 docs/runtime/phase-0.9-recovery-and-rollback-contract.md
7b6d26d4bc1b62f8dea4905caef78c9341c98139e78024ee4b7dfe680ced737c docs/runtime/phase-0.9b-bounded-observer-design.md
3aaa44de37e892657e8a31230e9fee22f00bd7865103d1bc8abef93591ee2984 docs/runtime/phase-0.9b-observer-limitations.md
be7c2ca486b36f3299a1e30d28b0ca95ca1f0589e272c05fb6999c608f437108 docs/runtime/phase-0.9b-observer-result-contract.md
e5d41cc9801bdf491c1423fb9cd36efbb84327e812a5624a46497ee323632998 docs/runtime/phase-0.9b-observer-static-audit.md
b1e5ec2501870800c260517401199d5a83f48c5222e9f8671d44db68d55ac49f docs/runtime/phase-0.9c-capability-closure.md
7e2d32865d747ffaa370bb01103f6aca95dfa77c8225784ef7be7196f3863cb0 docs/runtime/phase-0.9c-output-channel-feasibility.md
8c67055409ef766a6be9f5409b5349650f48f2f80ac3253e2867373e21d753fd docs/runtime/phase-0.9c-side-effect-model.md
23a2f4b7312219afc6cb2d97773fdc33c9d222a8eb21a1ba8bd4c8ed7280b03e docs/runtime/phase-0.9c-startup-exit-feasibility.md
8dfd5da1149f3af0af9d5a70b096ad6e49ab93d99ed85e986083ecefc3f40a03 docs/runtime/phase-0.9c-static-audit.md
947ca08ed995696b4f139e735f2249db4b30033d7c08ad5f1e70769ba5ba2be8 docs/runtime/phase-0.9d-bootstrap-recovery-chain.md
bbc1e606dd7c36668f24bd4a89697d7dcae191857143ffb8d4625bff1a14c400 docs/runtime/phase-0.9d-existing-stack-endpoint-matrix.md
f1018ffed4e8ffd737fc549c79b87aba22e56133172f8344df3efe6b9ef18bfb docs/runtime/phase-0.9d-independent-recovery-analysis.md
d26cf866eb43f75b9a6fa902738b27eccd3d305e8e991030628b327d1e4dbacc docs/runtime/phase-0.9d-off-device-backup-contract.md
398aa48132e856f4a6ee2ea5b14ca3fdc38e76006cc59e0f15cf2f0ea8ab8970 docs/runtime/phase-0.9d-operational-windows.md
f733e6c2cea3d03b7509dd95cc4b36dd0da546eba87c5b5aea271d4e330bcce3 docs/runtime/phase-0.9d-readback-feasibility.md
4cbfff8517f03960e98a5922da0f3645c99426d742989500635cb22719e635f4 docs/runtime/phase-0.9e-bootstrap-provenance.md
ef7e144a37a0d771e4249401104b84cbd0ad5c0611d0f92a5de6599a9568e23b docs/runtime/phase-0.9e-future-rescue-payload-contract.md
90e008313386a70966a191a62a45d7bfe9f64a12f408cfbfea41f2a095d283fc docs/runtime/phase-0.9e-independent-rescue-chain.md
ac9fd1462280f3b6a8fb465c547ff0ec20384901df3da8a51b45a43b39dd8a61 docs/runtime/phase-0.9e-loader-9020-protocol.md
ad97d281dc722c89de7618a74702ff94470003d246ce08228ea77b6690d4cf30 docs/runtime/phase-0.9e-output-architecture-options.md
4bc6960014dd91873cc3448631220e23637f8bca663106b74005716bdf2fc2eb docs/runtime/phase-0.9e-r-official-hostsender-audit.md
3ae48d9f2100b025945e1491692840f5e025af19fba1d042e89a3fa7f92ebd53 docs/runtime/phase-0.9e-r-official-release-correlation.md
9aaa11ee2e69a37f14bb94f88b47fc5c0c3655298d25d7eb78884dfcb7e7e106 docs/runtime/phase-0.9e-r-port9020-source-audit.md
9b2ad3c4ef4ce7dd6e503e4a02796112575883efde5eda07ca1ab093288e8c0c docs/runtime/phase-0.9e-r-provenance-gaps.md
b358f3ad9dda971a0484e4efb9e7218dc810e1b884b9c7a239c9ce3ba323ae0f docs/runtime/phase-0.9e-r-release-source-binding.md
6d3b63dd02fc521d1d1132df4fadecdeb4a87fdc378b8a553ce67e94dc9d048c docs/runtime/phase-0.9e-r2-community-backup-correlation.md
e19f7ecf5f665b7f4a7ac4425fe12548d5a837a0b667b73f7576b8f1b0762580 docs/runtime/phase-0.9e-r2-final-provenance-decision.md
860220412196e3c10a357f85427492e03e30e8287df872cefe846d9b0eee594e docs/runtime/phase-0.9e-r2-inner-archive-correlation.md
04ca2d4f7d5c3f841593b2cbe2f1665678ab08de2f6a6ac0dfb228366ba4fc98 docs/runtime/phase-0.9e-r2-local-download-provenance.md
a906f43cecbda0cf82d41af197dd6d04dec89f7116b541a8db1cf39e9dcef553 docs/runtime/phase-0.9e-r2-siecaf-structural-analysis.md
35cf63a6816d43188dcfd48bff6166ad13b2592301df172ab75a9bc6f680f870 docs/runtime/phase-0.9e-reboot-and-crash-model.md
6a922f766bac2a378c5c1f30efa1f652dca9341dbfb9d75c040279f8f4fa7393 docs/runtime/startup-callgraph.md
27dac7577376a0e0eb9db2664757a9d15932788ec595b53101bc32c09c5f5a55 include/chimera/gfx/adapters/retroarch.h
5cd48c985ce271f3c5604a0a75b79febe5d22c04b69da20e9050c0692f58a5a5 include/chimera/gfx/adapters/sdl2.h
8bfb4371f301d9ebe6d94ae8a936ee1fba9184750457650bac705325953a108b include/chimera/gfx/chimera_gfx.h
e9603b0e3792781ad5b511afb22ef61e3d4fd4c5a16bf928f8609193bcd97783 manifests/artifact-denylist.json
78d0d28da552550e4b7dabc5b9c25347fb2618c4664b7a554b87c6de69cd6c96 manifests/artifact-denylist.schema.json
749a850f2f2b98a3a99f63ef543b5725fd695212a3fa7aa013ed73c8ca1f87cd manifests/artifact-manifest.schema.json
f609057f40b5aefd008c1af7140cf3d7134a0c10753e827ce31055ddbc1e9eb0 manifests/artifacts/chimera-elfldr-phase07-fw-9.60.json
dea9097eb5a2580fc2d8b5891466c1f6d9a55e5f475b78b045b23c611c9b148f manifests/artifacts/chimera-gfx-capability-probe-0.1.0-fw-9.60.json
c0cc13ddcf090a940e94d4fbe7217c005811984299602bd2bc2e899da851f161 manifests/artifacts/chimera-gfx-capability-probe-0.1.0-none.json
1ca5e970cb0285bf9a31c4e3e6fa7f7e25d8a62bba2a0a34550410b189e95971 manifests/artifacts/chimera-gfx-lifecycle-probe-phase07-fw-9.60.json
8513ae052c27d9a42b49bc7e7a6be4ee06d093301309d70ef643a8f03a1e3be4 manifests/artifacts/chimera-gfx-phase1-videoout-clear-0.1.0-none.json
e9686874bc76d3637b5622734290a5adcc36aa7a1faac2482a1e8f954843a88b manifests/artifacts/chimera-payload-manager-phase07-fw-9.60.json
4ab3844528defc1c986dbfbc585014943760aec674f0f0000498cde55e1aaa6f manifests/controlled-runtime-profile.schema.json
86c22c80d3a882c836f79e27262d5b97e2a334b6feb651b8b5dcc382d760c974 manifests/ps5_gnm_symbols.json
8f1a8edaf50c09a51baf9bd4f76a09140191c500f6852ef7dc83f2c24d6d7eac manifests/retroarch/phase-1.0a-artifacts.json
cbe2ff6a8c5e8c7a80d3b132cafb0ed55762b10bcb306b1177038db57fed22fb manifests/retroarch/phase-1.0a-build.json
800ca442351dc146f5bc67723d4296f36de13bd0b6ae19dcb640fe9eb6cc7db1 manifests/retroarch/phase-1.0aa-offline-fake-adapter.json
e6027123ac9e399ddfb68a235830997caee6c5d4910939288b69e9ff9a1edf3f manifests/retroarch/phase-1.0ab-live-adapter-feasibility.json
0053358fc05c3be6adc7a92b263fd904061d34cfd3b28820792930337f9c731c manifests/retroarch/phase-1.0ac-dormant-adapter.json
0fcc592d0b7bbe0fd2edd04fc234bd3f57bb989618ad19867925b20320a4d34d manifests/retroarch/phase-1.0ad-inactive-activation.json
eeebff316a84b184bb802485e0ed5ad42016f3236ba44c04e718c9fb08ca680d manifests/retroarch/phase-1.0ae-launcher-architecture.json
c0e74c0e828168faede5f3db3e9964b6191d6cd9d9834dc3926e0807feee273c manifests/retroarch/phase-1.0af-bigapp-lifecycle-model.json
4178adf244650d7359cf400492a8d8404b60296a5aee5fc88df4a32adf61bdf1 manifests/retroarch/phase-1.0ag-bounded-elf-contract.json
ecb38325bcfdda905a5909f82ca690a174806d0108a45e716b4f8f5a58da168d manifests/retroarch/phase-1.0ah-dynamic-contract.json
c0d19a8a4df45f2311861c1cd1e7ab30d262c97ddc5d317e6229a3ec27d415f5 manifests/retroarch/phase-1.0ai-mapping-model.json
2883c11d3e798ca6f838bb5f8978f2b95a1598630d15a7d9b0d3b35ed3338144 manifests/retroarch/phase-1.0aj-primitive-audit.json
3322d42eb18718f1de7c85d043e68f37a9c5b5632f0d9565fd3f7b6d2ffd3d00 manifests/retroarch/phase-1.0ak-hybrid-composition.json
4a143c0fb2aae98ee0c7452326f8a2fd72afc24d79867282b82ab77cb58c188a manifests/retroarch/phase-1.0al-mdbg-copy-audit.json
c02d59b2d3ced8fb1e50700cd85b60f69f99be9c8ff9559ac4e18512e4992a96 manifests/retroarch/phase-1.0am-bounded-copy-model.json
6754ce238b4e696c76e8fceee0fe6d3347b09568b3f883ec4a1ac52a9f7e83fc manifests/retroarch/phase-1.0an-service-lifecycle-audit.json
46dd4144a4392cbc08a1f1b38087c8858cdff0e3c3935fc16a51e85eff1a812c manifests/retroarch/phase-1.0ao-worker-supervisor-model.json
f2e7d5e28df5b294d055378ec239120d13fb8ba0f895a1f7ef981a739a19d423 manifests/retroarch/phase-1.0ap-worker-feasibility-audit.json
04d5e26c3dcb54ddd029e477e329d1824fae3ab851752cac35c3b450975e7cfc manifests/retroarch/phase-1.0aq-worker-result-record.json
86f101a48aadd1586594f3b4cbbd6d84a01b8cf51c664dd8512c8bab50e00f22 manifests/retroarch/phase-1.0ar-result-channel-model.json
750764e8ea177afb0fc7c21d7c4f1441bd90bb539917c2506ecb61f8aa39fc2a manifests/retroarch/phase-1.0as-channel-primitive-audit.json
17584b4ee70ecca138b8fbddf03526b6070daa6ccb4aa366231457b5272df9da manifests/retroarch/phase-1.0at-fd-deadline-model.json
10687d050b1354efd7edbbd0e6739255278dc5edc85e3312ea85497f9052ceef manifests/retroarch/phase-1.0au-live-channel-feasibility.json
364e1ca4c052f69165ed2c38d3a20b6729fe8cb192199f3afc9ebe706a14b391 manifests/retroarch/phase-1.0av-launch-context-canary-contract.json
425bf66d12e1b9c0e9a26790ea58372ad5736ab6886028c57c4a1be241927a68 manifests/retroarch/phase-1.0aw-canary-source-delta-audit.json
ed9208ea371c36a6025334dc58b5261b4e754cf97bc6b6962bce26b4fe445ddc manifests/retroarch/phase-1.0ax-canary-protocol-model.json
c9d161f1cd7053f32480d9c9f8b31902107d5af78518cbfaeb5d08676fc63a2e manifests/retroarch/phase-1.0ay-target-source-base.json
0dee988ed67b7f8ea81bc80f0b2fe22818196868510794c68560b5a910624a79 manifests/retroarch/phase-1.0az-host-av-source.json
24779e3572f71084d157dbcfc83cf15f55999a15acdffcfc02043ec48bcaa730 manifests/retroarch/phase-1.0b-artifact.json
8ee4305bc2d7e5d75d3f7a4b0b335de39c68932ca49c199310cda9f2279dd69f manifests/retroarch/phase-1.0b-build.json
e3f1941e9218d72299010bf9481931ffd70abd2e0b0f1c69561e7db05befb951 manifests/retroarch/phase-1.0b-runtime-contract.json
5a028550751b20555855de3f0cc538f91e7d574533a40b48b76442ee5e42cb22 manifests/retroarch/phase-1.0ba-target-profile-callsite-audit.json
201b08ac542b94d4c7c47e3f45fdaceb2f54d7da11b5f5c8007a8ec162c3daf3 manifests/retroarch/phase-1.0bb-source-only-launch-canary-profile.json
8b7f2793fb1cce79cf701efee01af307b5c7ccce98e6d0506913929b319207b3 manifests/retroarch/phase-1.0bc-cross-build-prerequisite-audit.json
2f4ca8b0e50da928bba52ea6a7b49333ba6682bea336bfb7d289e87179f81be0 manifests/retroarch/phase-1.0bd-dormant-sdl-materializer-policy.json
c5e502a4b2d1f3fc873df4d0be3c08a8444d381c7bb734e152deea9aa0d14874 manifests/retroarch/phase-1.0be-fake-only-sdl-materializer.json
cb02fabb01770738a1322715648da4adabbbf064af759c92a4f90eb141e1ca03 manifests/retroarch/phase-1.0bf-live-sdl-adapter-boundary-audit.json
14373371cbf032ce139507c8ab0d4204e5da382dfb4a20be4dfd14d95af07efc manifests/retroarch/phase-1.0bg-dormant-sdl-request-compiler.json
d64f17854e1ae7c2f6f183a5f4ea33f9bce9340c89c0638bfad171688bf7554b manifests/retroarch/phase-1.0bh-bounded-sdl-executor.json
0f53877e27aec5a432b7d5d650f4f4203d7419d4d0a220c27de9913095452267 manifests/retroarch/phase-1.0bi-real-facade-and-tool-install-audit.json
aa4d6ee9df8e2fe67ce1d30d3bb62d5c7593f43770a86e0ea8c1f0f8122176fa manifests/retroarch/phase-1.0bj-exact-host-tool-install-result.json
fb2e32e17e9d9984cb6054ca2d057f162a208364de77720c39834c45227fead0 manifests/retroarch/phase-1.0bk-bounded-real-facade-host-fixture-gate.json
f4b2b98bcba59ec161f52297ef4998ff4db782957806883e55a479ffc3d2a437 manifests/retroarch/phase-1.0bl-fixture-import-failure-and-new-gate.json
ace70d11be0a30caf4e93a4a7b92d1f9627645284c9a9b6c92bbfd86f9e86664 manifests/retroarch/phase-1.0bm-real-facade-fixture-result.json
de3606c7f4c5f029c160d4508e82b38067302a72aff02cfdb7cde3741672ed49 manifests/retroarch/phase-1.0bn-materializer-preflight-patch-chain-audit.json
7f65395e0a91ccaff90319d018d09d15eed71c2de0383e491ef991e1ff5b5ce6 manifests/retroarch/phase-1.0bo-patch-chain-remediation-result.json
833be486e1c90fe917d5872904823bb0c673814fd18d54dca57f5f08a7ea812f manifests/retroarch/phase-1.0bp-one-shot-sdl-materialization-gate.json
fe80f9a526c0ac928d50b64de71673ab2f93a34aba223bfd9ae79a08183c5ab1 manifests/retroarch/phase-1.0bq-inline-invocation-failure.json
0bf54f5566abd876d1041879f430e355431bdfdf3b4144b9427531305d16fa00 manifests/retroarch/phase-1.0br-script-entrypoint-one-shot-gate.json
fa923e5f33967606c65c585eb1a1273fd7e64faf1650776e33717f73f1861987 manifests/retroarch/phase-1.0bs-read-only-status-timeout.json
313e95ccc61cdb6005e39a7cb4c4ab82cc9e4e791889e90e8bea5f1a826fed84 manifests/retroarch/phase-1.0bt-corrected-timeout-one-shot-gate.json
4085201165f16771b793a5e9866d90992589080da841b44847d7761b68e78b46 manifests/retroarch/phase-1.0bu-wsl-git-status-timeout-and-windows-git-fixture-gate.json
fb326bcb93ea777991918bf06956613136639f8fffe8b68b697e0d75c7d9d852 manifests/retroarch/phase-1.0bv-windows-git-fixture-result-and-request-correction-gate.json
82f7f20d6cf829ce3a7621ade6ca5124e12c35a79898d4cb1eb9df93d1643f4d manifests/retroarch/phase-1.0bw-corrected-sdl-materializer-one-shot-gate.json
ac40bda2d1893d09a86f47d09475c43d608360f2d04fc1192a382c24f9bb9adc manifests/retroarch/phase-1.0bx-changed-files-timeout-and-read-only-fixture-gate.json
d44773c113c716d6fc158aa34673c6d676b13d50742def7e453c90f175647486 manifests/retroarch/phase-1.0by-windows-git-stage-fixture-failure-and-file-hash-gate.json
06ddaafc41354cc03ecbf5ad8efab9f9ebaee7534ea9e152344d71b6bfacd686 manifests/retroarch/phase-1.0bz-exact-sdl-stage-cleanup-gate.json
63b62ca819431f739d45be14c7453c66f23b78ae5ca52ece28ffef911d38f671 manifests/retroarch/phase-1.0c-device-smoke-result.json
960b248cd57c1b82c1c81f02376ce37a49e0ca7b871ab63ca33326302608d8e3 manifests/retroarch/phase-1.0ca-cleanup-result-and-hash-verifier-correction-gate.json
e4894b904e01eb2c3b191d1696679f5d02e5c7026be3c37eaf218ff0296c13bb manifests/retroarch/phase-1.0cb-hash-verified-sdl-materializer-one-shot-gate.json
52262a2f86664b1493b8a5c5d738a217a090b39b1f05907106483c18017fa6f4 manifests/retroarch/phase-1.0cc-cmake-timeout-and-exact-output-cleanup-gate.json
cd491f229682cbdcaa0866f84109bb3a1a831c0634679d02926b4d9e4a9a737b manifests/retroarch/phase-1.0cd-cleanup-result-and-configure-timeout-correction-gate.json
9ef6f65bd4641f6b5d1e2e5facd7ea5642d51b7da7b208be99f9df30ed0e0187 manifests/retroarch/phase-1.0ce-extended-configure-sdl-materializer-one-shot-gate.json
1ba00ed257d680ab229fa39ca11b6e7b4070c3ce52aab347e039607ede51ebf9 manifests/retroarch/phase-1.0cf-repeated-configure-timeout-and-cleanup-gate.json
1be804144320648ba42bc2fecb8e80dced8c3422dca40f350b5077989fdea9cf manifests/retroarch/phase-1.0cg-native-wsl-sdl-materializer-design-gate.json
9b03963689440e30d73f847abaa55d137fca8366e5f07ec2ef57831ba8d11e3a manifests/retroarch/phase-1.0ch-native-wsl-sdl-materializer-one-shot-gate.json
3b469a4363ded25ac8a0055e504e87c2b667a5c035be145e112b01e2ecf5742c manifests/retroarch/phase-1.0ci-native-sdk-bottleneck-and-cleanup-gate.json
c330690cb3df7c5858a21fd450a3106df281838e81b8abfb6dca234bd1942c9b manifests/retroarch/phase-1.0cj-native-sdk-stage-design-gate.json
667807cb1ebb2f18779d41978abe02ba1dc60185e0f7554d37df8b5584de8b1e manifests/retroarch/phase-1.0ck-native-sdk-sdl-materializer-one-shot-gate.json
0a94ffbb3554ed55d63d5e138d03479d9bbdaf14948051bf4bd7db7f07b6136f manifests/retroarch/phase-1.0cl-native-sdk-configure-progress-and-cleanup-gate.json
861fc229b4066089610ee7e1982512a775f391772bae24fd35603743cc6ba996 manifests/retroarch/phase-1.0cm-measured-configure-timeout-correction-gate.json
b6535723c1f129366c71324a9d38e76940977816e1410d388a478bdbc175bac3 manifests/retroarch/phase-1.0cn-measured-native-sdl-materializer-one-shot-gate.json
3dba9f8b230e034f16c11ba22b4aeffe2f8dabafc4233a4218da8b577b5479e3 manifests/retroarch/phase-1.0co-configure-success-build-output-limit-cleanup-gate.json
3f3af1e73ecb060d2869fdaebb18f1055a61183037542e3dc202bcadf501094f manifests/retroarch/phase-1.0cp-build-output-limit-correction-gate.json
8d120585502993c93d5475ce31b1f1b484611bc649cb61fa4055d09a6fffa593 manifests/retroarch/phase-1.0cq-full-output-native-sdl-one-shot-gate.json
b2206270e5004a9588b9da3b5210dd8df076bee2beefee349075f491e468bb98 manifests/retroarch/phase-1.0cr-audited-sdl-archive-export-gate.json
260937d3b5626305f256925535c0d4aaa10db4dc32bbf45fcba014eddac9b545 manifests/retroarch/phase-1.0cs-export-parent-correction-gate.json
9e979b08288b77a6f8dc5a32ede41e59eda1e465768f3ec75c16207522bbd4fc manifests/retroarch/phase-1.0ct-sdl-archive-export-result.json
a1a864ad0a330f7e119464b6149d6f4831c7f6f5d5972f2ee3ff20ac9a93af65 manifests/retroarch/phase-1.0cu-exact-sdl-header-export-gate.json
3ff666f2157511d76b525ee271f931bce2d2d35c72d4178dd87096089305b809 manifests/retroarch/phase-1.0cv-launch-canary-offline-build-gate.json
de31fe618c8fda49cb7bb0a1d056a44c0f0745d1249fdfdfe9cdff6d7facd849 manifests/retroarch/phase-1.0cw-launch-canary-artifact-audit.json
e063ea356b8b2b114c26f69680ab677817b0696e23898dbcd6fb8e99dd20d399 manifests/retroarch/phase-1.0cx-isolated-reproducibility-build-gate.json
850d0a2860ebb53ff69bcfd3cb0ac268809d470bb208d16db18bf76a63fc3c36 manifests/retroarch/phase-1.0cy-launch-canary-reproducibility-result.json
da52b5a7787be14f8e0b182132bab2744fd6e1946eab94676bd26877077c490c manifests/retroarch/phase-1.0cz-launch-canary-one-shot-active.json
c0eaf1e4c3f9f02f3446cf651cb046634252aae4ec36bb06d5e5be8a02a482ba manifests/retroarch/phase-1.0cz-launch-canary-one-shot-runner.json
ebedd74cf0ad8e7eb087c1ce1df659698d02e1956e07dd842a0cea526eef5818 manifests/retroarch/phase-1.0cz-one-shot-approval-template.json
f5ef0be57ee523683409926d9b51f7da2774414b9ec0d8465a16aecead247134 manifests/retroarch/phase-1.0d-canary-artifact.json
e6f9fb7ce4fe21b4b7632c52b26d600f54f631849c69da95b477728e665e4c52 manifests/retroarch/phase-1.0d-early-diag-artifact.json
24168ea339a5e1234f8405b81029090eff00f17ebfa226dcf0325a2d4e19ed87 manifests/retroarch/phase-1.0d-loader-model-results.json
f745c8762d1b88743751df1af625b3a08e452dff8d2a16091abd9eed82647e50 manifests/retroarch/phase-1.0da-raw-elfldr-baseline-result.json
dc5ce0c80ae771c35f16ea51b3ef4e2369133dc150b3f39bc39a81805d6fd6c7 manifests/retroarch/phase-1.0db-post-cz-differential-analysis.json
729bc5c19d46966049a5ee1863df4efa3aa736dc90cf23c120fff8159c2e76f4 manifests/retroarch/phase-1.0dc-inactive-bigapp-comparison-gate.json
aa0657e1b51f457a65f134e533799f5bee58560fcc7f8761f6539811f75ef6ee manifests/retroarch/phase-1.0dd-minimal-launcher-source-prerequisite-audit.json
0fd33ad39747cab0b7ff22488363a36b774dc0e516df89c604216824ad9eef75 manifests/retroarch/phase-1.0de-independent-abi-provenance-search.json
b0cce485969e20ba607311afc9b9d566d135a1cf0ab1ac240ef95c69f9bcba5f manifests/retroarch/phase-1.0df-inactive-title-presence-observer.json
506a93ec2c710ef0881dc8d73899ab391a9ab848cc01fd110f9f59e9a8b1b2b2 manifests/retroarch/phase-1.0dg-title-presence-primitive-audit.json
47313c6693f50f21cf086e66681e118ed6556493813f263c6e81eb6e6ebf08fe manifests/retroarch/phase-1.0dh-hash-bound-snapshot-query.json
d70f01d4180a25a57c78c2de17134817c5b04be53533a95be6112a17b487b101 manifests/retroarch/phase-1.0di-live-acquisition-boundary.json
746e3843561dfd04bfe9b734d515d581bf4d62f5880a85a34364059b6ddb0798 manifests/retroarch/phase-1.0dj-di-t2-result.json
981c0b4d68b24351279cac97d7493cd46c4d5e441dad007b0de44a3deabba600 manifests/retroarch/phase-1.0dk-port-status-result.json
1f40fde01dab9f2211420d3545d49cb645f5b4a1897a2544793f482fec6cd330 manifests/retroarch/phase-1.0dl-official-shsrv-artifact-audit.json
e622860221cb14819e53cfdf06adcaa73cfdcd84b84476cec3c33ec94247e195 manifests/retroarch/phase-1.0dm-bounded-snapshot-observer.json
1714fbbf6a0027dda58d4e7ba60f8bded6dc1d0f39b8533b5bc51b5445d43d0b manifests/retroarch/phase-1.0dn-inactive-snapshot-receiver.json
4961884183ca8ff1ace22d61ab65e831fcb4127d1655a6178f936d83ff7bfc19 manifests/retroarch/phase-1.0do-inactive-snapshot-runner.json
d7c3f224f1fd0033eaf393177be694c18b40769d176966acf84910ffafad9c20 manifests/retroarch/phase-1.0do-snapshot-result.json
d906133bf58c94433950cdcfb97a3faf08a489816e9d107ee36ac615344036f3 manifests/retroarch/phase-1.0dp-listener-status-result.json
416bc37d71f1cfa4bad878c6a62cf54bfb3f8adae9ae8a753a35a3fdf5d6090b manifests/retroarch/phase-1.0dq-inventory-observer.json
15551279dfc71a9dbdce555d999f7370cb9f401869acdcd752a60787b092ed1a manifests/retroarch/phase-1.0dr-inactive-inventory-runner.json
2f21095849779bfd912180baebd6456f20bd9c851d04da03d77974634671fd60 manifests/retroarch/phase-1.0dr-inventory-result.json
d236090b3d708b4b1a3cbd63dbbcfeaf8ea0644f426d8b253ea4fd2b43811c8f manifests/retroarch/phase-1.0ds-metadata-observer.json
1f5655faf888a1ababc5a5eb0e46e7fb13b21993f8d68b151114c482ee01ebf8 manifests/retroarch/phase-1.0dt-inactive-metadata-runner.json
1c0c34761665eb2fc99faff0a4aca76e45994682d731408af8bc7d3323826be2 manifests/retroarch/phase-1.0dt-metadata-result.json
f733d3cd241595b290dd7d17d974758a0ac5119c8eb81445ef4b23ca1d8e4fd6 manifests/retroarch/phase-1.0du-package-stat.json
eebb773917ae80f1b962ab371a10b3df8376e1bd34d531cc7ad6cb1e791a8b3b manifests/retroarch/phase-1.0dv-inactive-package-stat-runner.json
ae15c7ac53e646288f96135e2da451152616bf214ccceb84b546444f54f46806 manifests/retroarch/phase-1.0dv-package-stat-result.json
f16c7eca137c1504a2be3b5eeda07a4473533902f5feffb7bc3a51602ab5a495 manifests/retroarch/phase-1.0dw-package-readback.json
0527d11ff28f27cebadee13f7ed5e0e0004ab2aaf475858d3cfcd5e22fe15b9f manifests/retroarch/phase-1.0dx-inactive-package-readback-runner.json
c45c99d75e2b9a664cbfb9f72b0e4e653a9881287b523e618d663f68018b5fa5 manifests/retroarch/phase-1.0dx-package-readback-result.json
22186efb400f3ad98f5238696462ab3f22f1476183ab20fc46ba7917a151dd09 manifests/retroarch/phase-1.0dy-upstream-websrv-audit.json
b96002e2479e3fca267ca07c6d8cb95245dee56d06689b10db984ecc497589d2 manifests/retroarch/phase-1.0dy-websrv-listener-result.json
410860fb773435849f0a8cce8dcc2eeb2353b8443b6dce56435a8e039aeac2c4 manifests/retroarch/phase-1.0dz-direct-launcher-decision.json
38961a3ea6ef498e80678d70556b4053f3612915858c22234e5201231eddba7a manifests/retroarch/phase-1.0e-result-channel.json
33722cae870ef6a229a833b4f5fbe57d31e5a604fc9ecf0a44108ac20f35cc44 manifests/retroarch/phase-1.0ea-expanded-launch-evidence.json
ddef7de517d4f5d8d5e4b8f292aeecc20421e2571ec52eba1195baeab9156df6 manifests/retroarch/phase-1.0eb-public-launch-matrix.json
159dfa77b781ef0eefb01b840952afa196d922b3e305cc790a8aa2e18a1ade8d manifests/retroarch/phase-1.0f-startup-interval.json
670ea54567dce43b4ab0324713992f5bc90ffd95997d1bee2fcf8c9702e928ea manifests/retroarch/phase-1.0g-device-result.json
effcd84daf9d245aed4e9f7917048b174b7ab092d40b3fefef9ba480c664be1b manifests/retroarch/phase-1.0g-one-shot-approval-template.json
b1627c2c5056e30a48fcb7898219759c8bd9d3a37405900c6e47863f138907e9 manifests/retroarch/phase-1.0g-one-shot-runner.json
28a9748503010cfa4a3cb0c96ce01ba69218750489011eb39dd6a7bbdb1370bb manifests/retroarch/phase-1.0h-device-result.json
aa8973452bed8f667514f9cd0f77cb777214b8dad68f56e7d63a64386427d9c9 manifests/retroarch/phase-1.0h-startup-args.json
612367070ddf114c3b4e633afdb237914f63a96f60dba2e5969622854620e03f manifests/retroarch/phase-1.0i-flip-and-write-analysis.json
7323a8f965f3bb117a88b4fc8ef7234e980e3f2f88a2962a15718a15b31d0c83 manifests/retroarch/phase-1.0j-write-firewall-diagnostic.json
e59c8944d6e428b6c7d5cc395230536c8d4c62ac4902c7273d95c5065146e043 manifests/retroarch/phase-1.0k-one-shot-approval-template.json
a72ce22a9d49c572137b4161f5c2ead363446f411fa33b1ee10e7716dcb0566b manifests/retroarch/phase-1.0k-write-diag-one-shot-runner.json
4b54b6a23ff9afb1960f29ffed1ce18cca601f661e37f36fc53364cf5e16b0ac manifests/retroarch/phase-1.0l-write-firewall-result-analysis.json
661482c9c73a1c40944d2ccf7c62ec8fadee061dbc1e9b746e13f2aef886a167 manifests/retroarch/phase-1.0m-write-free-defaults.json
ac6917d246a589879ddc159ee23c73b9b6630ca4bb29b6acb25020a3eee4ce9c manifests/retroarch/phase-1.0n-one-shot-approval-template.json
cb0f4ac8fe8baf697855c7b146310fe6ec58c98dd940cf3af7fc7246a8434aa2 manifests/retroarch/phase-1.0n-write-free-one-shot-runner.json
a92650732bc2fd4509970eb8c731e06ba1b91eff5c1bb7f9e2b844ac58ca8537 manifests/retroarch/phase-1.0o-write-free-device-result.json
dc5ef42c5e058883f86d1312da2b2b1cccf987029d4947f7fed7a722ba1118f2 manifests/retroarch/phase-1.0p-videoout-submit-analysis.json
c4b7de21ae1a738a46c03aad74613edf49b07125669ce5112c879d31cf8de24e manifests/retroarch/phase-1.0q-public-videoout-evidence.json
89a80e6f9619b2fd77de3b1542c0c9997fdc06917661bc5ed4042f458493a1e6 manifests/retroarch/phase-1.0r-launch-context-analysis.json
257f49dd4214d7599069772aff9efd82b1593d919abe9e27f1aebdc3e2faa723 manifests/retroarch/phase-1.0s-launcher-provenance.json
55b09535401f1c7d0149b67951b10fe8a90bbd17f94036dbcb1d166a8a7f1f10 manifests/retroarch/phase-1.0t-shsrv-identity-gate.json
397d5db1e19cef7d64f058a7f9f2312d7e93a3426640b48452ab633b0e2368d7 manifests/retroarch/phase-1.0u-local-shsrv-inventory.json
f898a4df1e1c03db89bdecf79fda3c17c331fd7a1254bd13ab1107d371ed1d9f manifests/retroarch/phase-1.0v-inactive-shsrv-collector.json
1fe676cbc4651e0289043fe770ff08a749d1c304fcceee39cc191242ca17c7af manifests/retroarch/phase-1.0w-inactive-client-architecture.json
3c96e6fc35032eba436136009d0daf13cfb0ebb84085d279d5a7956b5ac3f311 manifests/retroarch/phase-1.0x-inactive-transport.json
4f0f8e37280c493d4b05741e213b029c23e8a83b6e8ad0e4559a8baf73e1a2da manifests/retroarch/phase-1.0y-shsrv-framing.json
d5d1ba0e18a1f8530c7f4e60ee69db0cf74b0bd1d6c0b9683258c4ef2b689085 manifests/retroarch/phase-1.0z-passive-batch.json
8e7074fbbc875678909cf98666d5c35cd0f7662519363aa1c7c699dcff5b5e00 manifests/retroarch/upstreams.json
ddba34f78a750482fa910f03fcd43341d3a9407b2c4082f4d8ad5957bcc76dea manifests/runtime/controlled-ps5-runtime-profile.json
aefd1d1e663be617ed1042c6a1d68b9f21dd0c137f0c601d15cdcbfdf03dadb7 manifests/runtime/kernelwrite-proof-matrix.json
b04dd224c00af0c7228c582f6ba3ca55ef03e9453287f233a0c4ff2e545092fc manifests/runtime/minimal-startup-artifact-decision.json
d0e8202c1a07e4104476cadf6c14a1dea2d724b1d97495dddcdf05858f6c8d4a manifests/runtime/phase-0.5-startup-audit.json
8cabbdad5cd79b15d7268586a41a7db8f000a26c4047593bda4521c99e8d1811 manifests/runtime/phase-0.6-loader-runtime-audit.json
68cbb2d3ffbf5490ae52e13e822ddd12b0344317986dea8e16cea91e90ec4a3e manifests/runtime/phase-0.7-kernelwrite-proof-matrix.json
28229d54e64dc9896c991715715df086257bda0b18010fe3714ba18023c1759b manifests/runtime/phase-0.7-offline-audit.json
47d7f452f8799979fe99b3e6d56859f03544112725bf7e5b349eba5ed81b3322 manifests/runtime/phase-0.8-read-only-preflight.json
a9dafed8c83722c43709dcf90ea117c21d6f996ff8fe233810ed08aa20cbe071 manifests/runtime/phase-0.8-remediation.json
39fd7c70cae998d9d74e7caf1ff3c19f9f76f7de2e5a50bc09baede4ba53e9e9 manifests/runtime/phase-0.9-anti-brick-design.json
efcea3b0001ef5b2da65c372ceb93ee2fec09c9331b2e4cbb6008212504c0918 manifests/runtime/phase-0.9b-observation-plan.schema.json
104c4a667ad17f9827fc7276852c6faeef96effb8e3561a5ebc19a62c7d51634 manifests/runtime/phase-0.9b-observer.json
84eb737ff3486d0c5d8b5ecf06809f93bc573497da4919595b4c1817fd34247c manifests/runtime/phase-0.9c-feasibility.json
31cca2363069789dc0da7561204ae0bf02b39b616655bc5eb3302505549cd101 manifests/runtime/phase-0.9c-feasibility.schema.json
86e5aaf034685dbe058b71ffeec645b682f0a8cc7d249e8ac0397155233991de manifests/runtime/phase-0.9d-existing-stack-readback.json
d1c60b9ec80f27df7368b53d13bc1f0efafd7bd551e972a3cc9f59f94a43db80 manifests/runtime/phase-0.9d-existing-stack-readback.schema.json
5dfa9bfe2ae751b2f0ea0e03c60c1a4471a35452389cf471456e6c54eb4601cf manifests/runtime/phase-0.9e-bootstrap-provenance.json
00b15c2ad3ff91aade8f0355803248d2388193fbbd78c0f86043601daf2c9df9 manifests/runtime/phase-0.9e-bootstrap-provenance.schema.json
a7ca8b4e8072cb60ad4cd4869f6c508e8014059c8d81ad3b94a8d9e8cd0db4cb manifests/runtime/phase-0.9e-loader-protocol.json
f51d0d3fe7712991beff4a3db60ef2dee9889dfb18f512e8ffd1e8090f6e644a manifests/runtime/phase-0.9e-loader-protocol.schema.json
ea84f1885ad4286670a401cbf73e9a371cdcd03a1f247908b90ea27553ee820e manifests/runtime/phase-0.9e-r-port9020-audit.json
8ace6eaef67765fd5ec9d7ce511536a84b39d2464fb25e50f8f7d1111ef96477 manifests/runtime/phase-0.9e-r-port9020-audit.schema.json
3c71bc0651f468c87910a78d1cc5463eec6ce8352059797c77aefdb4da1cf1ff manifests/runtime/phase-0.9e-r-release-correlation.json
0bc4df92ad14b7a42901697ac129a0f8f9261c9e73efb81fbfdcb2746689af52 manifests/runtime/phase-0.9e-r-release-correlation.schema.json
68713fd95c5d3662354380bb14be7461029449d119f2dedacfe463ea58668780 manifests/runtime/phase-0.9e-r2-inner-correlation.json
18f47668c69501e26080b93fb17f5610c7037a10b971f0ee9059b66a81f98c4a manifests/runtime/phase-0.9e-r2-siecaf-fingerprints.json
6b7a07df79d81d246fb7c28a34e997ae53d76a2fe3b24a577e244f8f9fedf9b3 manifests/sbom.spdx.json
7d1c817a0af968763e29edefcc79ea12ff213582d487bfbbe76e0daa87d7b85a manifests/upstreams.lock.json
8df5e97bef1771c9d7e12ae6fb370441f5ba1c6264e6b1b5411b63a7f4c9f33b packaging/Dockerfile
5da245c2190344d11a583aadcdee733aca2afa1c53ffd55cca4d6410f86d3ce7 packaging/README.md
25ac5acfba0406feca9bc98c7221d391e22750ea98a4f8bfd18b8811cb9aa1c8 packaging/patches/sdl2-phase1-video-only.patch
26211a596cbda55e523f1dbc0a742854110ef120bbe3bf9e7b34dfae2e1f97a2 packaging/phase07/README-installation-review.md
f47b934cc748b0d32fd640963c610bfe5dd60061da4b801307b5bc0ef59cd916 packaging/phase07/README-rollback.md
15332856199f90c50ebf556a6b7c248b1e1b493803a5ad3b160d1b37f531697c packaging/phase09b/SHA256SUMS.txt
318be72b5d0d57cbd7f7a3767527d5a09305f328b75a05e0ff9a43d677d2b48e packaging/phase09c/SHA256SUMS.txt
bb27384a4a88b7b588323e8f0246b2765c019b3739c41e3ba798c9a36d4d47b4 packaging/phase09e/SHA256SUMS.txt
50d766c63d6b9d56cb4bfc4573ba789fb5fac7690434f77284e9cc6557d4db8b packaging/phase09er/SHA256SUMS.txt
fe0896ea39c671861f4d2850678edb097adae36e49c7735554ce08913a401686 packaging/phase09er2/SHA256SUMS.txt
b9b600a256d21f856c94e7d64be40b1f493e57e1e68fb146ca092c6cc984002c packaging/retroarch/phase10a/SHA256SUMS.txt
18eb49c600810c724e36df4bcea25b3f0e9e58c755ed97618127a570b029de29 packaging/retroarch/phase10b/SHA256SUMS.txt
d634dd78b29265b10805053f619d6307e292cd2ff9a0d9e0e77e535d6c07c570 packaging/retroarch/phase10c/SHA256SUMS.txt
21dbae8c7728995df0765bcd0ba3ff054778149a8dbbd53dc1129f65750a9ee8 packaging/retroarch/phase10d/SHA256SUMS.txt
c3673efc2816de41440e8da91a436185ae0852872f6ae8e01bba15ab1dc93369 packaging/retroarch/phase10e/SHA256SUMS.txt
63bc1b7912df0ae2ac750684ba3dad65bc97cc9a1b7b92b35f0fdad66a2b5f24 packaging/retroarch/phase10f/SHA256SUMS.txt
4fe39356f6abf09cc67452b402469deab2d7c7c17a21b768259086b92c5395a3 packaging/retroarch/phase10g/SHA256SUMS.txt
d837ec91b36a975a30378fdcf998e0375a85fef613f251bf09f7a0e5bacd5aa4 packaging/retroarch/phase10h/SHA256SUMS.txt
0ac35d7ab28b9c27268989450dd3aa6415508410f813be49be0439960a86e168 packaging/retroarch/phase10j/SHA256SUMS.txt
053a5f7eb89ded685939611472d033952fe66f2e5e1c739b392f9455fdc04c9d packaging/retroarch/phase10k/SHA256SUMS.txt
9f2ed5f4237459624c9f70670434e64e5c36c86eefde29b8d9266328cc1582d3 packaging/retroarch/phase10m/SHA256SUMS.txt
e63fff5dbf7537efc82889b59f88fab18487f4cd93e031cab3b4f02131bec5f9 packaging/retroarch/phase10n/SHA256SUMS.txt
b1a0c3c0da844616d361131b36adc172cb2b980df94d73778dcf723c6479b240 samples/capability_probe/main.c
1791b0abbca0f59e296c2ec5f12b325ae99db76ca26e8580a4229fb2d654fd85 samples/clear_screen/README.md
1ae7df1fe921ccab2a252f77975d3d441ef7725e34535b024580c0d4a242d766 samples/lifecycle_probe/main.c
b18f0789c5a9fbfdb9814aa540e7e5fefd567aeefb03cf79fd5e9711e644e1b7 samples/phase1_videoout_clear/main.c
b12ec726e142e4b10c98d371c1c804864c5c37dfb070576fc8b51f9b74218238 src/backends/mock/mock_backend.c
45e16afad30eb49638877fcdc9e4f62af2343204407c5f95cbea911b2abcb6ab src/backends/ps5/firmware_gate.c
bfbfd48e9bb595fce781e77b4359f2a4ed6d7f268ac211e3b1a7b6df73b2e280 src/backends/ps5/firmware_gate.h
8c123c36ba52298a2cfe508d91c78b5489d4c1d043774742d13895fd76de1ba4 src/backends/ps5/generated_probe_symbols.inc
1649b4387f58e92753b7a8b530a762e20adb157f7ce55d0a5f5c56822c48b17f src/backends/ps5/probe.h
3ae29e1322ad569240dd8e5ac3bc141d9880c2b77641b02429cca4472ec19c77 src/backends/ps5/probe_logic.c
50adec6ca971a7a7a9540861e6a93f7902578b0b8b24f1c9d2ac42b348b4d3bf src/backends/ps5/probe_platform.c
1126fdae32cffc494ac3308807987675fd5086cb62a15396c0ad55acdb629b4e src/backends/ps5/probe_platform.h
ce83fc5e5a25f1b9ba4e26e1c7b46fea0539b47fdc1499ffc4d86ecaf9e7bb1c src/backends/ps5/ps5_backend.c
31545d7d1d6a54fe99d420afbd7ba8b66ed9017dfbf4697fe99874ea7816f34f tests/phase09b_observer_model.py
144c5ab0b33a0ef4cdc6fcfaa52a576f090af61e79a5706f60ec21cb02d9686f tests/phase09c_feasibility_model.py
e2f074e844102177f45fb0f97254108ee641db00931bb037574dee82111f316f tests/phase10w_fake_transport.py
00653d250c102303e9bad525e9a40f9e0b074aea8d35135bd40620f4110ef7b1 tests/test_adapters.c
51b137a732d0dea5bcb1a71ef8ab222107acb0be9162e34856301a6b81ffdb18 tests/test_artifact_audit.py
86ca41d02c38ba1daa69571dd3f4e8b66cfa6848cf824aec0dd9deac557aee90 tests/test_core.c
a9f5e65c34e5175da2b4fd78a801e55b865aa472b0c08ea1c3dbc39f8f607bca tests/test_execution_policy.py
8399c395b9e3c9c5e40f58f84d14fb215feb66eb5013cc781995f949203216b6 tests/test_firmware_gate.c
a305e244c641bae3e42cda81444294703562e5c48e944478a84d0fb66df71db7 tests/test_manifest_tools.py
c82bd968b80a7c213498021151d8711a454192d07ae96a03762734155ce9e50a tests/test_minimal_startup_block.py
48d2cefe09d2da9f3c6f4f5c26512fb0013190678c78578c431b2fdd632584c4 tests/test_mock_integration.c
6ab05b7e1c4945b2f98afa2d642cf30735030bfdb641a25f330dda6aae949c0a tests/test_phase05_audit.py
60a6e4b0e9edb58943e09bfa9cfdb286ad9ac02c9542597f7a3ad0646007e8ba tests/test_phase06_audit.py
5a51528e60721c9579d5ceb345f33b571071159d5adb8b255252c4ae2befdced tests/test_phase07_audit.py
8a4ad7c70de28ffe3148fd3fd1f68c36a872c53c691c9068e1ff163970863c48 tests/test_phase08_preflight.py
0721b8c75bfeaff3e58095cd2e302cf14f3304d0031bde3bacc3774685d1fb55 tests/test_phase08_remediation.py
e1ae56d0d9cd3a181675bdbb2197a84216a8e014a2fb758c3e357c7386c463b9 tests/test_phase09_transaction.py
38f49333b92b23eec3a82ee832e602baf3cd7fff9d6b93d04864e61d209942f3 tests/test_phase09b_observer_audit.py
bd910012b5e2d6d79d9067e29410d30ac53f834c3c93ee4e60495f11543f7c9f tests/test_phase09c_feasibility.py
abc73d05a1a72e60ce588917fac5e183091175d5ad85ec680fa9f3672c1dd8b5 tests/test_phase09c_protocol.py
840060bb2a00b9130a923dea7da610df9432d26c47d38bac2575573d24b5b8d4 tests/test_phase09d_readback.py
a458d1e71711b4fc856f6bd869429a9e08f45358bec6bc28bb97a3c7c903e79c tests/test_phase09e_bootstrap.py
8c013795d2706b1d1c2f3f097701667f51e5d3d3a2eaa592ed1836f9c143f633 tests/test_phase09er2_correlation.py
71d0a87e4127afe28aa184855b7f16fd1fdd242d65dba0a924260ae36908ebe6 tests/test_phase09er_provenance.py
18a5470a651fcbe4b23f2a68cba499dd19d3da15a229623c054be0b598025699 tests/test_phase10aa_offline_fake_batch.py
39597e991b15bcfa9aa28cb2f68c87ed048c38482c6dbf81a28c56ccfceb0a48 tests/test_phase10ab_nonblocking_trace_model.py
9c8c611dbab5e43df71d523169d9a1bf7579ed1918943df7531bf75ef4b9abfc tests/test_phase10ac_dormant_adapter.py
5800f8bc393921b31fcf0df3bd853b5936ec2ad5a3fef100505ab04af9729d15 tests/test_phase10ad_activation_contract.py
d112a5202fd3520a407256ebb64e1b06e37f76a52d7e6cfe95d2410ae4c834a1 tests/test_phase10af_bigapp_lifecycle_model.py
774afc1151044f4362bcfcd92fad97286d23477046fb4b542a4cf739723b0c36 tests/test_phase10ag_bounded_elf.py
d78eb2441e091bb98586aae36a4e0b1aca24ea8a62feb27103c1e1461b4aa415 tests/test_phase10ah_dynamic_contract.py
d5454bcb6f249fccf99d6883a4248d00c6daa5dcac7ff640e9e72418378e6529 tests/test_phase10ai_mapping_model.py
8f76fb3f9d91ed96e2a19c4b3386915f306187a1f0ee2e842d24351c282ef026 tests/test_phase10ak_hybrid_composition.py
6f9f97134efb83e50881fae813cb0119d4da2f17fda979ffe841209e8e5c8895 tests/test_phase10am_bounded_copy_model.py
fe90f44d4f8da27f5fc0c8110551647d039257a2e3f3d9d10d56603c1275bfa9 tests/test_phase10ao_worker_supervisor_model.py
774c1eaee561b4058d8069d263f07d30a2e575dd8a063edabb73cc0065193ded tests/test_phase10aq_worker_result_record.py
a8dfc17daf3d05dade537aacd4cd60482958a30a527c7bfc60ae9cba5355e1b4 tests/test_phase10ar_result_channel_model.py
ca365b93b955d24b5ce3653cb20cef1fccddc91eca8d6382a56220accecdeafe tests/test_phase10at_fd_deadline_model.py
095aec531c123a634e8267c7f97c64ea95b8ff603a2d7c6d4e996e2bbb51508d tests/test_phase10av_launch_context_canary.py
9d7adb3f2a35b7af1f671aa967f4f247ed82f562ce2c9139d5c36e174ecb5306 tests/test_phase10ax_canary_protocol_model.py
ecef8f126e2245d707a776b4fd02aad13553e6e79515287e1002d2855a8db2d2 tests/test_phase10dc_bigapp_gate_contract.py
3760fa60e66857b24bf507f196060ec9e4d8b96ebce3843ab02fc185c0f8c0b8 tests/test_phase10df_title_observer_contract.py
1215d7750ad9b767a77530c37c24a4cc603c9f969c7dbadec1632a7f2a26b0d1 tests/test_phase10dh_snapshot_query.py
5bfffdf92733cd9e05adf8d00a8f4c3234fec00f5b5f4ffc56104eee8be11777 tests/test_phase10dm_snapshot_protocol.py
5fceb7fe4429a77772c6b234ebb57bd9eb658cd81053f767b9d9e250d6feb580 tests/test_phase10dn_snapshot_receiver.py
cbb7569d1f0e29ab150a8e940c8325e7476a5426170d3b37854570ce432de5de tests/test_phase10do_one_shot_snapshot_runner.py
33f1bbc18903d63ee5aff38b3b16774cb5e95560ad2a73c147bd1ec03a7283ff tests/test_phase10dq_inventory_protocol.py
b34cafdb93296f7e1d3218d65fb840f720cc405fa9b4201f7573f3f2483f9407 tests/test_phase10dr_inventory_runner.py
2ef718cdb36d0199bb958ba645f14c269ec2bd01baa992ad4b88686ee89a9099 tests/test_phase10ds_metadata_protocol.py
f9501e4fac385e088ab3b0b008ada815a108c3ab3f800dae399178139a29f108 tests/test_phase10dt_metadata_runner.py
4d950a56efe3531d80b01b1ea8ab20415f600bad2734e41708183a2c7d9ef940 tests/test_phase10dv_package_stat_runner.py
61346236e3caf73a4d9f3ba1a2b13be1cab00df28ec1aea75d9455b8c6cf6bd4 tests/test_phase10dx_package_readback_runner.py
fdfb0146c75f65c507f801706ca49b0362b254dd0150ace0abfa73c7e0b3a85b tests/test_phase10t_shsrv_transcript.py
25157158560702b9a3167dd8575fe5e0053e57facdd9e76672d3bb699f10c05a tests/test_phase10v_shsrv_collector_model.py
c1f55c9668776befd682ae05ea18a6f007ea726804eab0f42e0ffbd523abd215 tests/test_phase10w_shsrv_client_policy.py
19709ed6ab456be428d262b3f0afb4f6f577b34e4db80e66a73ed63d9bf2cd43 tests/test_phase10x_inactive_transport.py
802742450d65b237c0865e5820a8523131391988ca9eadd206766fb51693ca95 tests/test_phase10y_shsrv_framing_model.py
7706cc212a0fc683eb32acaef26ecaa64cbe5784ea6aeeed7e29ade11612490c tests/test_phase10z_passive_batch_contract.py
9b75e5dd130ab463917cf54dd3462bfda5fcf56826cec32fa22db9ce0d7629f5 tests/test_probe.c
db1f24e53fffeae0a9a1594ca51e2f4f385b283d45d38fe687f5ca1dbb07726c tests/test_retroarch_phase10a.py
604697167eb023c7ad399b9f2b01e359947c0db9c31de2b98907edd062cac226 tests/test_retroarch_phase10aa.py
bf66aab2c6efe90672fe09b9fcebf34a8803230b50b4e80f6d6175d7bf4c6cc5 tests/test_retroarch_phase10ab.py
5a73c0d997a6224abdc7dd8a748d46fabe2d37cd436d005d30e9090c66c95d2d tests/test_retroarch_phase10ac.py
054f4a452f05e0c4b0e8cfac6b1b0060e173569a1e1a486d782cb59fd095050a tests/test_retroarch_phase10ad.py
5419a9ace55e84c959ba9346a16044df1a8526654b25e76674ace09dd2106965 tests/test_retroarch_phase10ae.py
d8186a0ac570f7de218ea4b19840d61273ca2f6c91cefde23e65f8c8da494082 tests/test_retroarch_phase10af.py
40b012da64d8b9db9dbd05145ff91dea5797efe39b4705eddfd19edc83633707 tests/test_retroarch_phase10ag.py
d15c1fe5641dbc94c296fd5b44febfa93bbb6b87db6a3635b1becb03386d19e2 tests/test_retroarch_phase10ah.py
1db69f54d59f902aa3a2e14415765c9b32d67b89ff4979675d7555c24fe06a45 tests/test_retroarch_phase10ai.py
1db322e7272f8f3cd9c5ce0416040d2a0fa39ec6c711ceff27e9782fcaeb407a tests/test_retroarch_phase10aj.py
e9964da392acfce8a8e8e55c46c72bba20f5907fdc509e206d32f55fc386f69d tests/test_retroarch_phase10ak.py
27a1f1820a7d3a18a8952c509aeb7b7a77bc449774fd208ec96a4e96e914153e tests/test_retroarch_phase10al.py
11e4ef3dddacba6c32cfa03a55b4de652f023eedac2ebe2cd9dd778b3562e1e4 tests/test_retroarch_phase10am.py
fb6a193be0b9c7592f0ee01e27ad2af4f7c73050bea2d3e8c11016f02206eedd tests/test_retroarch_phase10an.py
5e5f4c166816a094ad4d58d328d5c77a027630a0dcc1bc8a917819daacaa0849 tests/test_retroarch_phase10ao.py
0067417aa508db2e883843b17d3167dd2709b2ca57a92fca5bec6f9aed77a0f1 tests/test_retroarch_phase10ap.py
cafbecd799e83ae493a22e9c80573154978c052b1caa812203e32bb78e07545b tests/test_retroarch_phase10aq.py
a60d1fcf0178208e62ea6c309f15292b59bdc1e8a7f2759067edda855f0dfbb3 tests/test_retroarch_phase10ar.py
08b10cd9d8577faf534dd51a68e98ec8e618e7226eb8cf14e8827bfb59357e0d tests/test_retroarch_phase10as.py
ef755634399b3e95ac935223b203e04c401d8b8685a4fe28557643c3cd4fe2f8 tests/test_retroarch_phase10at.py
3ca082442d0a86abb7df532bec8f9fb015ab05075860e0272f05c6285309530d tests/test_retroarch_phase10au.py
f833fadb2c8f3bef55c81365913d83ec999906b62d550e434308e6e25d92cb0a tests/test_retroarch_phase10av.py
d716211934aa42c0f3e71207648ee04f1cdb22ff226b7b32a135906c29f0f5da tests/test_retroarch_phase10aw.py
589d10cca4d809b727b16d5b7a1bb2aed34b258daa4c2d28ee6888f96fb78167 tests/test_retroarch_phase10ax.py
7bd02713b38ab3989e0a055d5f1a17796a85befd46116a2ae78a877ee446e20f tests/test_retroarch_phase10ay.py
b8220454a887736d0daf4f94ce2549bf9c885524960b2926e4b813156f64e53f tests/test_retroarch_phase10az.py
843d347899ad2fadcf840cfbb3e9b0b9fa67a3e0943e6752b994238ed28194f4 tests/test_retroarch_phase10b.py
27fa35227652c2c2abb0a1f5f59f6ac67f09cfbd897f527a896dfac7ebb2ced2 tests/test_retroarch_phase10ba.py
9c5624ce945d2af4d670a34ea4025561b9a92ba037bec7ef6a55b98c73ff139f tests/test_retroarch_phase10bb.py
8fd5352804efb57daa785f4d9bab36f77713ed12f197e2bea5284755a2c1e440 tests/test_retroarch_phase10bc.py
840bc7a537f37743682735eb25355bdc1ee27cef8c7556618356490cb62e5513 tests/test_retroarch_phase10bd.py
27f9ea8a5f8f84e1c84a0bf6f62455e67f555437a1bef70b750318ed73507d8c tests/test_retroarch_phase10be.py
da5bbfa7f0ecb642d4ca5c2a3f32a5688602ce662397e83c16ee7f6c4e2c043b tests/test_retroarch_phase10bf.py
9f845988d081d2846a3cf8709fba58eb51c387dc088df93e58025b295261a4bd tests/test_retroarch_phase10bg.py
296ffe0cfb9551cefb3a4c503f94e48db360f42f66f8757910cfb293c98e001f tests/test_retroarch_phase10bh.py
35560a7d3ee1aebe74e62211553abb3b497b1a3e114833fbcd5f5da3587c11c3 tests/test_retroarch_phase10bi.py
8f3f7176d12705c52df8f0b9d70d97c61b543ae1b1e951e58c0ecd32df93c992 tests/test_retroarch_phase10bj.py
73cc51e4233a79eefd7e82aac4068a25b8d1c7c2a949db83e5c5b9ac983591df tests/test_retroarch_phase10bk.py
8187c74eab446d1d02efb36386aa694957051af36dbdbd145a62457113249abf tests/test_retroarch_phase10bl.py
bc0a39a35c1b55b44aa5180e1d3432a7a0313a135057b8ced478de4ef7694b35 tests/test_retroarch_phase10bm.py
6d41c40bd61ca73e486a639a9fad0a9c066861860c17c9c9b2929fc36eafe1e8 tests/test_retroarch_phase10bn.py
bebbe4cd0a62b048760c46da8d114d4c984055f16a181a58dbf6c59ccc739b2a tests/test_retroarch_phase10bo.py
78f2357d8d1a37b60aedfb993966f240c8e3c35bc8d841c2ea6f53b9ef3be5f4 tests/test_retroarch_phase10bp.py
4bb880cd9f76e21471b9b299ca4e9bb239276ed7cdcac77a6d8b32eec58fa125 tests/test_retroarch_phase10bq.py
a463ee38718138a52a1fc84aba96595e4ddfe7928b17dbc46f357694086b4d36 tests/test_retroarch_phase10br.py
63c1ce5714a815b9e30f11d4a905715cc3189972f8096f8972a2a7dbedc4069b tests/test_retroarch_phase10bs.py
42fff30438830cf28e498cdc6254416719c53bc514308214d869342a7958a586 tests/test_retroarch_phase10bt.py
91912291937314eb8c10b926e0d300be435852244e0e45d05f3dc855826750c9 tests/test_retroarch_phase10bu.py
a5398751b35db977c040f10576445aa3634d78f51596917ba70fae7e92a3b0b7 tests/test_retroarch_phase10bv.py
d186b0f2b80a0e744caf808fdb9538ebbfc0dd812053ff71b206c53d39153abc tests/test_retroarch_phase10bw.py
a503d6908081ba51bacd3532340614b13b8b9c06648047e197ded51d7c19af78 tests/test_retroarch_phase10bx.py
d304ca6c54e58bc86f6395111747681d303eaabba8c39c74e041e81ccb663e72 tests/test_retroarch_phase10by.py
059a1ae5981389cc2eabe16e035b3f2e348a758603509f90ded50fb020747e28 tests/test_retroarch_phase10bz.py
59fd653fd55b9e2183d36e3073ea0d4d8a6b9066e0faea44644903d711845713 tests/test_retroarch_phase10ca.py
a7b308ba734872396dbe2c8fb4f65bfe853649a848d4a8dc8bc64a751b479699 tests/test_retroarch_phase10cb.py
731de085e2b32db646626b315b6ceece1a5b2afc4862fa8836a2636d51e6522e tests/test_retroarch_phase10cc.py
3ce8b17df36a5b64dff7766cfef30a14f99b6953115e6b075393f638d9e280a5 tests/test_retroarch_phase10cd.py
dce0c5739a308eb55000fd06518db036a1712e09ddd0009705ad2d407f81f7fe tests/test_retroarch_phase10ce.py
87e485a65242f2ccf88cfd0232b98daddf799b11f92c64f353a9cca7cdd1d53a tests/test_retroarch_phase10cf.py
84cd491cd51524701d3296e48a04010033614a52f4a657543264e3627df5bac1 tests/test_retroarch_phase10cg.py
61f7b8c08fdc1d6666073643a93b7fc9ca8eaf3c6c0f61503e0b953860eae180 tests/test_retroarch_phase10ch.py
2ce97a0c0d1c6ed9a3558b2423c1e27e3d3360fc1611b3b93c9aafe9209ac6ba tests/test_retroarch_phase10ci.py
9693a45763687fa0a3da43416bf20bc70db155742d57a8657db1095b087f9c07 tests/test_retroarch_phase10cj.py
19e20a8432d5c9af206b24551b334d06a14c3da7ecc81fea5763a0a64c23898c tests/test_retroarch_phase10ck.py
7efb1804466bf0ac4112a27aadf6d30213b3b6bfb2be92976756a2459fe7e2c2 tests/test_retroarch_phase10cl.py
4c7d1c30bf3ebacea50562d89bf39819196c8671fa268a823b8b8e20c18ef9fc tests/test_retroarch_phase10cm.py
0cfe172f0a9d38671fefd39e174751ee94ba7270e9f651f25c8c983e8bdd704b tests/test_retroarch_phase10cn.py
005bb665194f7669d24e78ef19901df41e7f5099e7cb81abc8058b6b6c69baa1 tests/test_retroarch_phase10co.py
a78a91a776e31e1bf471a1b0f2101a01ec8013b2e74d35045b8a95f537edbc7a tests/test_retroarch_phase10cp.py
121bd9b70f0eb729fa434728dcf71ccd1cbeadfe97fa7d20244c6e1c173aa808 tests/test_retroarch_phase10cq.py
de77a8629895d41345919dc2ed65bb356527d13ace0100c907a4aac706c79caa tests/test_retroarch_phase10cr.py
659cc7451635ca3b5fe78ceb8af2b6f0d00725aacccb6fd63611818439dde95e tests/test_retroarch_phase10cs.py
c34ebcfe235db49cb0db5a9d6d67807749c2500a14c6a03ef0d735a494fed797 tests/test_retroarch_phase10ct.py
297d0efd0f1f949f6a2602c05d1b7bda1bbecb99feb90deab975677cfc445203 tests/test_retroarch_phase10cu.py
2d5be765d5082ea7e847205e7da638e398a17750fc416baa428eb85bacec3dfe tests/test_retroarch_phase10cv.py
a5873e20783004ec187af2c959fcfb57dcf363f9d4108bd8c6cd186f5a459cbb tests/test_retroarch_phase10cw.py
5b177be12ce6e454f8294d57f494b172321395becf02b2b7cb0d78d74303fb34 tests/test_retroarch_phase10cx.py
ca82ec5e63f005c91c17d6d0ffbfc54f6ece138ff2d02d83bfb1814c616b831a tests/test_retroarch_phase10cy.py
8fdde81f139651398212613c3ac811d93f4342d21e8d041f7f85a296c203a0ba tests/test_retroarch_phase10cz.py
9737d19f992e8259d51fab1e1cb88b3ab28db3b45226b601ec485d040be01623 tests/test_retroarch_phase10d.py
e3b8719b9defcaa779f9ef32a7764bc3cc3b85b319e255cecec9b51826b20a5c tests/test_retroarch_phase10db.py
3d1e579c6e21ce073ae2b25078ae697580561cde199b6d5e0821ce41baebde7f tests/test_retroarch_phase10dc.py
14a3427669964fb012a590b4f8311fbecf8c562a831648cdd528bdf818c059c4 tests/test_retroarch_phase10dd.py
c6f0aa744234f8c6dcdb6eac3ee52ae39b155704545fda7ffdfda7af80940303 tests/test_retroarch_phase10de.py
ca14f35e69692d6a0aaa2b4957b6c8432db6d17b8bb771e4c20c4b5b56284768 tests/test_retroarch_phase10df.py
4e23d2fe055a69677ed3fc79524a79d4865622fe7d6965c360ba6dc9b56e02c6 tests/test_retroarch_phase10dg.py
2df3032db4d6f72b0cea178a054ad51a4f05b48a53061a5fff010cd07cfc7f9a tests/test_retroarch_phase10di.py
6096020b8e1d3b2daa7157ce99efe9d1de62a1a2272f6fa7b7221a29da9b0e87 tests/test_retroarch_phase10dj.py
df611a6f444b162b9b2c93ae3b002bc61776451aff0cde01d1bfa3efd0155b3d tests/test_retroarch_phase10dk.py
ce187acc66b649481957d94b675941b196e190a3c144f55fd4228fc2ca7001c6 tests/test_retroarch_phase10dl.py
46b11621aad630501d6e5aa8ae4cf6ecd0ad12cc5a847d3e1ba0ab0e26f2e7d8 tests/test_retroarch_phase10dm.py
ade663284982f0ce098a70cee4984f314678a7aadf0d0a0688ed6245bfbac113 tests/test_retroarch_phase10dn.py
ba5a1cc897ab81787cb8e1f3ff88103a70398c6db72292f625db6a624e86f320 tests/test_retroarch_phase10dz.py
1fd17f2135b88815f356764b9ddbd617151c681c85c1fe74f7de20ba0f71fdab tests/test_retroarch_phase10e.py
56ddb0dd92eb0685980296c38bfd0b512593977a30e3834bf38049451ff8587e tests/test_retroarch_phase10ea.py
b67efe56403c9e43edb469941b46a5bb277c44af8bb84a40779f98b99e3ea3d9 tests/test_retroarch_phase10eb.py
ffa05661c5441ddf3d7cf86a711973f128b2cf8ea91e2350aaa9a76be8bf8b06 tests/test_retroarch_phase10f.py
914bbf1604f5fef01ebd94039ce6d1135ac69fb5199242325c671dfdd4f48c5c tests/test_retroarch_phase10g.py
1133d7b5ec08d3c372e9c1f486835b1d5d69eb730a9fea8eee12903c65e1a4f2 tests/test_retroarch_phase10g_result.py
0c85f61a8a3934bb8904234ab97a675a8e86b4dcb863fc899578f773caf2973f tests/test_retroarch_phase10h.py
ac77c73859f191e63e1499dd88054160d2caa7e17eb290554e36cd600b0f4041 tests/test_retroarch_phase10h_result.py
6cfcf46bd2854a986077d94dc1348d6dd8d1542835b3187a621ffc909746cb77 tests/test_retroarch_phase10i.py
fd1a7556b5f7e54f2faa7e334df84a713f70ff390cc8ec6b8658dee5fb8ae592 tests/test_retroarch_phase10j.py
f49e68f9c1ec816d63b01729650938ebe39ceed5650b8f233b4ff20c5228c280 tests/test_retroarch_phase10k.py
7c9f5fdc718b1909c01baae81c430656befc9d12733a3994d997b9bb785a5601 tests/test_retroarch_phase10l.py
5041695fd882c96f1c0a475a6dfc56d42b99fc66cc525298abaad7cc07efeee5 tests/test_retroarch_phase10m.py
442545472bd43dcba89a2ce87bbfa1f4e9079a3d653f1dd4cc91664350c1694e tests/test_retroarch_phase10n.py
30f116bc6236ccb7643a8aa82cec16204ba0b890b406b43a85f717c7983e21b5 tests/test_retroarch_phase10o.py
a49c49aaa9b41f716eba531956b13f708c20c3f10ee3899cd840f1d4c04236e5 tests/test_retroarch_phase10p.py
e0cc4d907326b56d092b55a539f8288f75b9e92488def1dc13fd3b75c47c0d6d tests/test_retroarch_phase10q.py
5cc20dc708fb1ffe877ee16602ce2d79f09758d1c4791f67cc03e091897c63a5 tests/test_retroarch_phase10r.py
80ca9a684ba9859d1399faf337b63a0c6995ddf59ff408b009760ee966793e92 tests/test_retroarch_phase10s.py
581dc379049e161793ed9fc73f457d299e985927f505a97df19ae6bffe9cbfbe tests/test_retroarch_phase10t.py
03b0365ef5445a541d270ed20fff24546c234927be864a0c501e4f6b3288973e tests/test_retroarch_phase10u.py
de927a641b586aaa9678c7b86104fb03bfba87f3b5cf6e6e00726fdcea3f5280 tests/test_retroarch_phase10v.py
62d6a1fd3a815e16744e2946b80b30d580a98315875caf548af0446ac7713a5d tests/test_retroarch_phase10w.py
70d30bd40ae91578a53886be07d92f0f3e32182445f2c75cc76ca210fbe872b0 tests/test_retroarch_phase10x.py
0eb1e254f48a3fcbd8808d4ea5754fb41d598c4303a874a355f75c49792cf370 tests/test_retroarch_phase10y.py
b4dcef0d162584e046714e708072d7168872ebdf8edb22e45f19af7daf245d3a tests/test_retroarch_phase10z.py
953aa89ac468a14fa3f8168599a162e737c60828276d0a24862484a7dfeb0b78 tests/test_siecaf_header_parser.py
85ac29a7966959df6d32e8b34767041c3ad1b8ae1b6cd9af1e1410b1f8999c52 tools/audit_phase07_artifacts.py
857723841da449e8387059d01d3d0af2e4a6f2f9f3d210ee9bf717f39093ce99 tools/audit_phase0_safety.py
c7f0be413dcd16fb13277bc9dfa60f619ef14aaddaf7599bd769a4864c32ff6f tools/audit_ps5_artifacts.py
d1d42236df6697eb82f99bf9b2f2c27b3b264bb1cfbcdd68ce4b48e0993d0fca tools/audit_ps5_loader_runtime.py
e2b2abeba5b682aebc0efd3d16769b0d8c540c8c17bffe38d1773772f73ec607 tools/audit_ps5_sdk_runtime.py
4e15adf9e4f2b500cc563420da596dd8b3d149e0983840273e0743dbe30d4d4a tools/audit_ps5_startup_feasibility.py
7f5689fe2f1f6d0070f13ddb10abd651bb723714f7310e41d2e13a772f28353b tools/bootstrap-ps5-sdk.ps1
1a42349ee47f12a932fb88c913573d5afc208bf775a9ee77ae831c3e84e1b0d6 tools/build-firmware-probe.sh
3dc8abeb81244fb5b817215c043284b0ccc736e1468cde02eca82863c7e13a11 tools/build-host.ps1
d6b872d118e0c62f01b3576aa0926ffe775155dc7836e7623237f4d0dd49aca2 tools/build-phase1-videoout.sh
7d10ff0fd31ff9b0db25b10f7a0a49640cfc8f40474e04e31ef2b8843adee30f tools/build_phase10dm_observer.py
cf017a25c2fbacce003fae2aea99a26f3a03354e6206ef910e3357ef1335e659 tools/build_phase10dq_inventory.py
ac5800d50cf58a16af9fbe1ad252c72ba22398ce21e95e4499a514f31dc1913d tools/build_phase10ds_metadata.py
3c67ba564414170a5df9594de190124941131b898b5b32e11d17a3912e52821d tools/build_phase10du_package_stat.py
c4e693d95e492bbf9cfb7cb2444ddc3048b89fa12c4afd03996e7a5580c81bda tools/build_phase10dw_package_readback.py
3d03ad950e1fc95e8f7b3144d5a94df8f890408b175abb1f18c63b901656527e tools/check_artifact_execution_policy.py
640e8fa19776ff47ce0542de66c3997361d3b71544ab36b2bc4051a386d5aad7 tools/check_format.py
277bf1fabf77967f071103f320a485c0e6c7d8e69b3129471e2e3300ef166d92 tools/export-public-source.sh
9031659644a64be079211bfb867e5a993e49b9612a7bae6ad034065ff0a2e47b tools/generate_artifact_manifest.py
52c908a63423327fa6fb7b8e68cbc40fabee25ee0598a0b578c363203273a33c tools/generate_probe_symbols.py
c34574ba024b863d3ce1ad97ba555b56894a21836d7b418b0d5140b3cb65fab3 tools/inspect_siecaf_header.py
710dca22e3522336f45f76a0fe96c8746622d6b7bb168ad2e1e5490321d9538b tools/package_phase07_review.py
8e1cac255f85d2cd14baf8fbc27d631c9b607fc7d19fc57c65462089f0574055 tools/phase10aa_offline_fake_batch.py
7d1aa32d49b91b1e5cf3a085dda033767bdf17ab34389ff044f7403f86287959 tools/phase10ab_nonblocking_trace_model.py
6f28926b59fd9afa6de1ff36d4fa9b013d7e027c9adc0bffd9445d7c89acf939 tools/phase10ac_dormant_adapter.py
b28c80a34bc30ae2d4db8df1360c8d5ce3515de8b91d2bba409a0a404da4b79a tools/phase10ad_activation_contract.py
00c8bed501715d737ad1328f3d4c98fe16f69c061016a939ecb3774d9c1f28f3 tools/phase10af_bigapp_lifecycle_model.py
748c93eb5c9275c992e4b471747ff0dbbcf71cd5b795f44d47f2c82e19691270 tools/phase10ag_bounded_elf.py
51ffa5d8acc475f1edae48f104d27c48ba2725459b217326694f1361552aee3c tools/phase10ah_dynamic_contract.py
26c01c09086f04650dc8834205439e21a9fbe5f92ec78d15a769dbb09487fac0 tools/phase10ai_mapping_model.py
35115ccdc201f7c6040eb0d0638d4ece7f36ddc1386ed8c4352f7c73426d3751 tools/phase10ak_hybrid_composition.py
025976fe8736caea6ee33ae107f97411ff2f5981b16f7005098eb9314b1ddeb3 tools/phase10am_bounded_copy_model.py
9093142ba53790cc6faee38d1c53d2b5221946a60f37c72cc3e24299e56a1b0c tools/phase10ao_worker_supervisor_model.py
e05a754165e78eb42ac46f5783efdb73da015a547c87628384f8eb24f95ff28b tools/phase10aq_worker_result_record.py
416a17addde1ecf114f2f9924287c3358c9a10c84bed251c008d2aee6e4dd1c8 tools/phase10ar_result_channel_model.py
341f90e559c3611b9921c21a906baa01c82a49597d886c53fddd6fa3e0903e2d tools/phase10at_fd_deadline_model.py
a03cd687e9e5d9d61cce768ebc662babe11bebe1972eaf18f6ead4dd616db5d4 tools/phase10av_launch_context_canary.py
faa43bc3b767208bfa2e4cd7bf804384bf497bb5651f6d0aa945b1b300649a02 tools/phase10ax_canary_protocol_model.py
b8e965f343a0c3df5cf7026b68f547a81dad08d4b2e0934e4f9721de8b99010f tools/phase10dc_bigapp_gate_contract.py
2679f03617241abf37ca547141a2a51e3f89b75fec957a1da4f13b904d931f2d tools/phase10df_title_observer_contract.py
0e35c097cebd4213f8ff50ce16dafb4af60bc0576b29f8ea52789acb5fa6183d tools/phase10dh_snapshot_query.py
00b29d72b6274fe0ab07b6524c0bbecf76b9f15f59421c9255ca93f24d38c177 tools/phase10dm_snapshot_protocol.py
99f6195347c1b5340a45b33b035a642f8f3cb3cb50ea6be9604108b5a641ef6a tools/phase10dn_snapshot_receiver.py
d70733fc87492e3008ff521cdf525bcd84b2782690f3d3cadbe50febb4ac32ae tools/phase10do_one_shot_snapshot_runner.py
a465a225042d44270b10b499f0b2f37fea680155bc207f3135909559587c18ac tools/phase10dq_inventory_protocol.py
0ee3f4c3b6f3ee7f87a89f4aa560837665172c1af3dcc595144fd08eb5a46e3d tools/phase10dr_inventory_runner.py
210c9e38d7409cab451c0bf0fca04b49243d07bdf43fc59b2b61c50da59a4007 tools/phase10ds_metadata_protocol.py
eeda75cd3b56d07d24ff1cd6daa6c9f1af5c233fdee2adca7d0ddc991fc56808 tools/phase10dt_metadata_runner.py
69cbb715651bc3fcb4c769632961c6791a3d4ce456b695a16e973006d9e04f03 tools/phase10dv_package_stat_runner.py
558d101c4f95c2999223035fc648d4b7a3576672cf5068b0864658e0a36fb01e tools/phase10dx_package_readback_runner.py
4701a057a98b4874e49e1bcf11db9a9a3a105e48f2c25e42796bff10f238f7c2 tools/phase10t_shsrv_transcript.py
f8a306dafee5d135919bec5afda789dd741e57f39803b7683fb8747c186db25c tools/phase10v_shsrv_collector_model.py
747d23c88f2722e8e8846599c3ac1dae3826eb3fca881caaad36b251f30f3592 tools/phase10w_shsrv_client_policy.py
568d7578482ecf2fcd9e29085b2eb9d8705fc699611508acdf22afd30f2ddd23 tools/phase10x_inactive_transport.py
5081898ec86be52900670be2f9949a20b9abb7781a6b04d5337178a8340775d4 tools/phase10y_shsrv_framing_model.py
0728c2be7f368e0a7f4b68efe86f6e0c5c2f50704a41d0e1992b0bfec19dde06 tools/phase10z_passive_batch_contract.py
bf03a5c321d0e5e4f262220e9074f0e4aacb39a840e2ecd5ae5510b91b66b7ad tools/scan_secrets.py
f8074515d2e2de7e921d4daf59699bb100eada303169ce6f33547e14c908707e tools/simulate_phase09_transaction.py
2e76cc74e639376c0f2f88fb8e175e3134bfa5d18b236d39df2fee31cb61075e tools/validate_phase08_remediation.py
e7bf50c3437a8749b56a5986efce1b6e768a6faa024560cd7261d508f92d8844 tools/validate_phase09b_observer_audit.py
ab1e078bd35d9abc923621e21a07f4f2544debdac71e7532d54fb200cee1eb13 tools/validate_phase09c_feasibility.py
2ddfd7c78bf1122b8d5705925b111afa6204713dffeab2fb4a398cd82944f5c4 tools/validate_phase09d_readback.py
4425bd6a4aff14569ca1426772afba3a53e91d63194f8d98c51491acff40986c tools/validate_phase09e_bootstrap.py
345b1359cd23d7ae46b6e96962b0a74b40de5d76539a5a93aa58784abb4af1a6 tools/validate_phase09er2_correlation.py
7a4751031fcffd32b04d692a7eb180a11be8ad114131862a8717119b0363b918 tools/validate_phase09er_provenance.py
84d9dc52d1558c3a92ef70922350f153d0fe5296db45dc696f8adebf28dfd0d5 tools/validate_retroarch_phase10a.py
472efd01edaf4adfc4ed6eefcc6afe33c0d8e8e6d5c3cad82687e2bceb500a2c tools/validate_retroarch_phase10aa.py
c3baec66024fd6e1e235fb8211cb79d021053f81302c29148617072e9a542d84 tools/validate_retroarch_phase10ab.py
d96450e3099505b79803f7d9b4658a6a37e5807bbcafb149b037fe4131eb0342 tools/validate_retroarch_phase10ac.py
af0db2c20b1e11f7f3f1fdeb7cbe867a2c075e5b50816c77ff8f245a1925083c tools/validate_retroarch_phase10ad.py
99ced5c158e541d86b6d0fb4bfd0e46e24f7ac4ebc3be779712909690189224d tools/validate_retroarch_phase10ae.py
dba0ce0e4642c20e97b86ff160dc2c45c96425bb302ec7d384e7bbc76c38941a tools/validate_retroarch_phase10af.py
834060368a5a5739e025e651368f81e6ed2dbd7fdb98ca46f6577ecdb93ff8ac tools/validate_retroarch_phase10ag.py
38ee0cf4f8abd234eb6b75d1acaf2b85349e37c5767bbb8ef80e87f6065e5449 tools/validate_retroarch_phase10ah.py
6f954f903780902f92ada9d63e7595f71f46cbc9a8eb5cc72688174b88ffd51c tools/validate_retroarch_phase10ai.py
407284e2ca23d9b9b2841dad915bf46c9e023b3248925f6139e5bb54feb52d4e tools/validate_retroarch_phase10aj.py
7c789a62dc4aee94616c97ae783a8d7c48df70cc0c7dc908bc71bd413d8ba8ce tools/validate_retroarch_phase10ak.py
51c443b37eb0605e0427d1ec5e2651959996c0d09ebc274ffbf98cd09a1cdb78 tools/validate_retroarch_phase10al.py
648180288ee418e5846a59d6b4ecca680a6f72ed6883bac40d9a956b21e13429 tools/validate_retroarch_phase10am.py
c29710d10ca9b722a6869475cef6afd8002e86d1cf59cfcb7f2e655721e7186f tools/validate_retroarch_phase10an.py
009501a4d31a5750f52590a9a1a93b6cf0d1e90bfd6cb6e607d54ae937601099 tools/validate_retroarch_phase10ao.py
4c512802cd0c96332240dc175637ed5b7608863081bff23074cb6e4141f4e60b tools/validate_retroarch_phase10ap.py
3844c1eb92b99ef29e3087d682234e47889f64769697f02daa972fb2e5cec5b8 tools/validate_retroarch_phase10aq.py
efc86fb3c9ca39140979bc545449709d91140378c77e99171634bd52ee50ce54 tools/validate_retroarch_phase10ar.py
dd0a1547efac0213b929edf24505b8c077c58d4b535d47adccfd2af26309bb21 tools/validate_retroarch_phase10as.py
d0e8b5737b3fd507e303cea8d204601001e4d482b82e37119f443212c70f0b77 tools/validate_retroarch_phase10at.py
53f24bc4f9d9ba79c9adce95b014f7818b95c94cc819c163a8dce2d66566897f tools/validate_retroarch_phase10au.py
5b791d63e52b79c09ae7013c60c23a554ae1c9a15d4d1803d2f036957f29751b tools/validate_retroarch_phase10av.py
f0a5bb4fa950e553b4a5321fb53a7cc2e1dd544e757ad0370898c1f77d312a71 tools/validate_retroarch_phase10aw.py
e95865f7a5dcd7fe2c3b8760dd5dfcd642080613fb47387b5480232dfef07a0e tools/validate_retroarch_phase10ax.py
214e2eaef44ce7f3f8a621de60bebc8342b9080984fcee8b39d564ccdbb2ec1c tools/validate_retroarch_phase10ay.py
731bb068c47142461fdd51e55a551277f00454e56c8c87714060beaa030a196a tools/validate_retroarch_phase10az.py
cb2bfedace580c349119aca814f30d5152f70691290e866a537d330da03a04c8 tools/validate_retroarch_phase10b.py
39ac367b38cd9a2fd952efb991cdef03c877542a040768f9ffccc7ab38b31dec tools/validate_retroarch_phase10ba.py
1e6fd33f843a3b604def6299e4eca6c36c71def837d851b2adb197930e2212ef tools/validate_retroarch_phase10bb.py
d130c216435e69a6190b5ab3544941b5b5c9b585bab99d9fa0b23a5cca748277 tools/validate_retroarch_phase10bd.py
55250ccf93f7454f7c78b6e36cf2db21d52da56b5f35342e863aaa96fb0dab0f tools/validate_retroarch_phase10d.py
50c9a70f717b9d7f7b5cbf5e7ab4912f472bff4d981009367e0b93c0e2137b07 tools/validate_retroarch_phase10dc.py
ed58e5ced3a4e1d10402c5cd34979bf99132a1fedc3b69e14f6ea1f6dd9232dd tools/validate_retroarch_phase10df.py
1a53af97335f89146c34fa2e4de54240a5edf2a9c51bef29d64692328c2caa11 tools/validate_retroarch_phase10e.py
5fd8c2e8d1b5b342853e9bc24bbb740b500a274685b5593b88060bd1c8d2d636 tools/validate_retroarch_phase10f.py
c0972689bab5326ef57d48902ade2cb694bb33d3e21970107e9c68208e6e4895 tools/validate_retroarch_phase10g.py
c089596521cd1591b16cbc358b867e4676e3fbf5725846a34f89cd11ee31ea99 tools/validate_retroarch_phase10g_result.py
19c482436f36074b01ccb4964c3329812bf31eef84232f747eeb5dfa438d154c tools/validate_retroarch_phase10h.py
07396152097295fdf60157de2cacc441fcdc7a555e97594717613829a0cf60ee tools/validate_retroarch_phase10h_result.py
962075aefd4055389a609cda06e1a4e978e6386e0c524da8856559a01a95faec tools/validate_retroarch_phase10i.py
b0746656525e3fc562fe103b4d3d69a4a7ea15816f5406cfd5325b7e8146ea18 tools/validate_retroarch_phase10j.py
ea4fb2f0378dee60fbdf07a384d6972579ada196e538696486adfde99a900aa1 tools/validate_retroarch_phase10k.py
afb46f7a0f6f854373b9ec1d9a2fafb278bd458f67af143f1e71cf2b8fe06376 tools/validate_retroarch_phase10l.py
5ad7d83e02c968ab46c6ddab71b5544367eeabe53e7552ff144f57e54719fd61 tools/validate_retroarch_phase10m.py
38af9b6603ba343ceb7ab8af412987459aec14a5040057ea465b2ecd1b2bbddb tools/validate_retroarch_phase10n.py
583c618f912ac8431ca313b05a2532b9f4f32ab440855df9dba51d8743656d5f tools/validate_retroarch_phase10o.py
49f450660f9ed0accbc8e573001695c0f5622c2744ae807da05623a966bb0e50 tools/validate_retroarch_phase10p.py
e3ded400fd57b54fb196f854815f5e2cab4118f022676acadeebcbd75ef3ee9c tools/validate_retroarch_phase10q.py
7590c786e1bc4c54ade56e754d2987b1faeaa0ffd63ecceab9edbe350b37e9f2 tools/validate_retroarch_phase10r.py
3930d1435008b47fd41941290d6083b104af3076e29d26988966242a97c525ea tools/validate_retroarch_phase10s.py
4554b140aac177f535545e2a98f57cec40346a5d804a0d53986083de0105f30a tools/validate_retroarch_phase10t.py
3e6e41f3cfca7417f3565e584b7d3bfd3a436c34264488d3fdd2214f8bf5585f tools/validate_retroarch_phase10u.py
ed7055473214a461d288532d4080597dd4343cbc0957dd003fa82c6b8d1baaac tools/validate_retroarch_phase10v.py
acca7980d15e5477f9e32ce1652272d764557ae22dd9fd2793b6fe19f9211fce tools/validate_retroarch_phase10w.py
0278cd5877aa3d0246a60c8db3298cc76695566cf04e62d79e930e5fe8741e26 tools/validate_retroarch_phase10x.py
aecb092a9c85b14db0c9f7924c9f24cdf57897d236bc8ef3085515436b2e696a tools/validate_retroarch_phase10y.py
5148f436ec589b833781e5a534128029ff71dfa2cb1c0bfbb475221643be84cc tools/validate_retroarch_phase10z.py
bea78ee5ddafe80de428e7fbb33b90419e3e486069cd65abc2cea470463d4b25 tools/verify_artifact_manifest.py
a0501216bc5c5efc257baf86f4d57d2e2f8cce236ea56df440ab1651de48d89e tools/verify_manifests.py
README.md
+124
View File
@@ -0,0 +1,124 @@
# Chimera GFX
Chimera GFX is an experimental, open-source graphics abstraction for native
PlayStation 5 homebrew. It provides a small C11 API, a deterministic host
backend, and disabled-by-default platform adapters so graphics code can be
designed and tested without a console.
The project is useful today for:
- developing and testing renderer-independent code on a normal workstation;
- reviewing a capability-honest PS5 backend without enabling device actions;
- integrating the API boundary with SDL2 or RetroArch scaffolding; and
- reproducing the project's safety, provenance, and compatibility checks.
It is research software, not a finished PS5 graphics driver. There is no GNM
renderer, shader compiler, GPU allocator, deployment command, automatic
startup, or supported device-execution workflow in this repository.
## Current status
| Area | Status |
|---|---|
| Public C API | Implemented and versioned |
| Host mock backend | Implemented and covered by tests |
| PS5 capability probe | Compile-only and fail-closed by default |
| SDL2 / RetroArch adapters | Offline scaffolding; not a supported runtime |
| Hardware-accelerated rendering | Not implemented |
| Device deployment or execution | Intentionally absent |
The default firmware identifier is `NONE`. A firmware allowlist permits an
offline build only; it is not a compatibility claim or permission to transfer
or execute an artifact. See [SAFETY.md](SAFETY.md) and
[FIRMWARE_COMPATIBILITY.md](FIRMWARE_COMPATIBILITY.md).
## Build and test on a workstation
Requirements:
- CMake 3.21 or newer;
- Ninja;
- a C11 compiler; and
- Python 3.10 or newer.
```sh
cmake --preset host-debug
cmake --build --preset host-debug
ctest --preset host-debug
```
The host build is deterministic and does not communicate with a console.
Windows users can run the equivalent helper:
```powershell
./tools/build-host.ps1
```
## Use the API
Include the public header:
```c
#include <chimera/gfx/chimera_gfx.h>
```
The API models contexts, capabilities, surfaces, textures, uploads, presents,
errors, and ordered cleanup. Application code should query capabilities,
validate every result, and destroy child resources before their context.
The mock backend is the supported starting point for application development.
It performs host-memory state transitions only and produces no real graphics
output. The public declarations and lifecycle rules live in
[`include/chimera/gfx/chimera_gfx.h`](include/chimera/gfx/chimera_gfx.h); the
tests are executable usage examples.
## Optional PS5 compile check
The locked public SDK reference and checksum are recorded in
[`manifests/upstreams.lock.json`](manifests/upstreams.lock.json). After placing
that SDK in an ignored local workspace, a compile-only probe can be configured:
```sh
cmake -S . -B build-ps5 \
-DCMAKE_TOOLCHAIN_FILE="$PS5_PAYLOAD_SDK/toolchain/prospero.cmake" \
-DCHIMERA_GFX_BUILD_PS5_PROBE=ON
cmake --build build-ps5
```
Do not run the produced ELF. Building does not authorize transfer or execution,
and the repository deliberately contains no deploy, upload, boot, or run target.
## Repository map
- `include/chimera/gfx/` — stable public API and adapter interfaces
- `src/core/` — backend-independent validation and lifecycle logic
- `src/backends/mock/` — deterministic host backend
- `src/backends/ps5/` — fail-closed capability-probe implementation
- `samples/` — disabled or host-reviewable examples
- `adapters/` — SDL2 and RetroArch integration boundaries
- `tests/` — host tests and policy checks
- `manifests/` — upstream pins, provenance, and historical decisions
- `docs/` — architecture decisions, research history, and safety evidence
- `tools/` — reproducibility, validation, and audit helpers
For design context, read [ARCHITECTURE.md](ARCHITECTURE.md). Contributors
should start with [CONTRIBUTING.md](CONTRIBUTING.md), and security reports
should follow [SECURITY.md](SECURITY.md).
## Scope and safety
Chimera GFX accepts only public, redistributable technical information. Do not
contribute proprietary SDK material, leaked headers or binaries, exploit code,
DRM bypasses, firmware dumps, credentials, private network data, or copyrighted
game content.
Historical manifests document why experimental paths are blocked. They are not
instructions or active approvals. Every tracked execution authorization is
consumed or false, and generated artifacts, device captures, SDK archives, and
local operator records remain outside Git.
## License
Chimera GFX is licensed under
[GPL-3.0-or-later](LICENSE). Third-party references and their license evidence
are listed in [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).
RESEARCH.md
+162
View File
@@ -0,0 +1,162 @@
# Research record
Evidence cutoff: **2026-07-17**. Only primary upstream repositories and release
metadata are used below. Each statement is labelled `FACT`, `INFERENCE`, or
`UNKNOWN`.
## Evidence snapshot
### PS5 Payload SDK
- **FACT:** release `v0.41` maps to commit
`d2e2e585740362976a39fdd5ccf390f199a7bc37` and was published on
2026-06-28. [Release](https://github.com/ps5-payload-dev/sdk/releases/tag/v0.41)
- **FACT:** GitHub's `releases/latest` endpoint still resolved to v0.41 on
2026-07-17.
- **FACT:** GitHub release metadata reports `ps5-payload-sdk.zip` SHA-256
`ebfb0acb5260511951a80e17db41650c62d20a8caf8659a230b928dc85005984`.
- **FACT:** `sce_stubs/libSceGnmDriver.c` contains 158 export stubs, including
submit, draw, dispatch, compute-queue, embedded-shader, resource-registration,
and synchronization-related names. The file is assembly labels only and does
not establish C signatures. [Pinned stub](https://github.com/ps5-payload-dev/sdk/blob/d2e2e585740362976a39fdd5ccf390f199a7bc37/sce_stubs/libSceGnmDriver.c)
- **FACT:** the pinned SDK tree has no public GNM header and no GNM/GPU sample.
Its only GNM-named source files are the driver stub sets.
- **FACT:** the SDK's `hello_dlfcn` sample demonstrates `dlopen`, `dlsym`, and
`dlclose`; `hello_so` demonstrates shared-object linking/loading.
[Dynamic-loading sample](https://github.com/ps5-payload-dev/sdk/blob/d2e2e585740362976a39fdd5ccf390f199a7bc37/samples/hello_dlfcn/main.c)
- **FACT:** the pinned payload CRT calls `__patch_init` before `main`;
`crt/patch.c` writes process credential capability/attribute fields and
syscall-address bounds through SDK kernel read/write primitives.
[Pinned CRT startup](https://github.com/ps5-payload-dev/sdk/blob/d2e2e585740362976a39fdd5ccf390f199a7bc37/crt/crt.c)
[Pinned patch code](https://github.com/ps5-payload-dev/sdk/blob/d2e2e585740362976a39fdd5ccf390f199a7bc37/crt/patch.c)
- **FACT:** the pinned rtld's SPRX path can call
`sceKernelLoadStartModule`/`sceKernelStopUnloadModule`; the SPRX-specific
`init` and `fini` callbacks are empty in SDK source, but the system calls'
internal side effects are not established.
[Pinned SPRX loader](https://github.com/ps5-payload-dev/sdk/blob/d2e2e585740362976a39fdd5ccf390f199a7bc37/crt/rtld_sprx.c)
- **FACT:** `crt/Makefile` partially links 12 source objects into `crt1.o`; the
other six installed CRT-named files are empty archives at v0.41.
- **FACT:** the `prospero-clang` wrapper omits `crt1.o` for `-nostartfiles` and
omits libc/kernel/Sce default libraries for `-nodefaultlibs`. An offline
`-###` trace confirms both suppressions without producing an ELF.
- **FACT:** the SDK README points to external ELF-loader projects, but the exact
loader used for firmware 9.60 and its caller source are not part of the SDK or
the pinned local evidence set.
- **FACT:** unless otherwise marked, the SDK is GPLv3-or-later; FreeBSD headers
retain their BSD licenses. [SDK README](https://github.com/ps5-payload-dev/sdk/blob/d2e2e585740362976a39fdd5ccf390f199a7bc37/README.md)
### PS5 SDL2 fork
- **FACT:** inspected commit
`0baf4ac49382b537ba449901b5b6d0d189bb1fbb`, dated 2026-07-07.
[Commit](https://github.com/ps5-payload-dev/SDL/commit/0baf4ac49382b537ba449901b5b6d0d189bb1fbb)
- **FACT:** `src/video/ps5` implements a CPU framebuffer/VideoOut path and an
OSMesa context path. VideoOut registration and flip occur in the SDL backend,
not in `chimera-gfx` Phase 0. [PS5 video](https://github.com/ps5-payload-dev/SDL/blob/0baf4ac49382b537ba449901b5b6d0d189bb1fbb/src/video/ps5/SDL_ps5video.c)
- **FACT:** that backend owns direct-memory allocation, buffer tiling,
registration, flip submission, event waiting, and cleanup. Its public source
declares opaque VideoOut structures with `junk` fields; those layouts are not
copied into this project.
- **FACT:** SDL is Zlib-licensed at the pinned commit. The PacBrew recipe's
`license=('LGPL')` metadata conflicts with upstream `LICENSE.txt`; this
project follows the primary upstream license file.
- **FACT:** the native audio backend forces 48 kHz and uses AudioOut.
[PS5 audio](https://github.com/ps5-payload-dev/SDL/blob/0baf4ac49382b537ba449901b5b6d0d189bb1fbb/src/audio/ps5/SDL_ps5audio.c)
- **FACT:** native PS5 source directories exist for joystick, keyboard/IME,
filesystem, audio, video, and main; joystick code includes vibration and
light-bar operations. [PS5 joystick](https://github.com/ps5-payload-dev/SDL/blob/0baf4ac49382b537ba449901b5b6d0d189bb1fbb/src/joystick/ps5/SDL_ps5joystick.c)
### PacBrew
- **FACT:** inspected commit
`c2abcfcb60f569128abd0e8e70ad03a67bee5ea7`, dated 2026-07-07.
[Repository](https://github.com/ps5-payload-dev/pacbrew-repo/tree/c2abcfcb60f569128abd0e8e70ad03a67bee5ea7)
- **FACT:** the SDL2 recipe enables `SDL_OPENGL` and `SDL_LOADSO` but follows an
unpinned Git source with `sha256sums=('SKIP')`; this project therefore does
not treat that recipe as reproducible pinning.
[SDL2 recipe](https://github.com/ps5-payload-dev/pacbrew-repo/blob/c2abcfcb60f569128abd0e8e70ad03a67bee5ea7/SDL2/PKGBUILD)
- **FACT:** the Mesa 22.1.7 recipe enables OSMesa and gallium `swrast`, while
Vulkan, EGL, GBM, GLX, and GLES are disabled.
[Mesa recipe](https://github.com/ps5-payload-dev/pacbrew-repo/blob/c2abcfcb60f569128abd0e8e70ad03a67bee5ea7/mesa/PKGBUILD)
- **FACT:** package recipes exist for FBNeo, LakeSnes, Mednafen, DevilutionX,
and EDuke32. Their presence proves port work, not native GPU acceleration.
### RetroArch
- **FACT:** inspected commit
`32ee70cef5d4bdc32a4ca3b3b261209ce74b6e81`, dated 2026-07-16.
[Commit](https://github.com/libretro/RetroArch/commit/32ee70cef5d4bdc32a4ca3b3b261209ce74b6e81)
- **FACT:** the tree contains an SDL2 video driver and dynamic-library support
used for libretro cores. [SDL2 driver](https://github.com/libretro/RetroArch/blob/32ee70cef5d4bdc32a4ca3b3b261209ce74b6e81/gfx/drivers/sdl2_gfx.c)
- **FACT:** `Makefile.orbis`, `platform_orbis.c`, and an Orbis context driver are
available as PS4 integration references.
- **INFERENCE:** those PS4 files are useful for frontend lifecycle and build
concepts only. Their GPU assumptions must not be transferred to PS5.
### PS5 Linux
- **FACT:** inspected `ps5-linux-loader` commit
`8e7dd40df6144bed6194d165d48aa9468a7e13f3`, dated 2026-07-10.
[Repository](https://github.com/ps5-linux/ps5-linux-loader/tree/8e7dd40df6144bed6194d165d48aa9468a7e13f3)
- **FACT:** the loader targets a Linux kernel/initramfs boot flow and references
patched Linux components.
- **INFERENCE:** Linux amdgpu/RADV progress demonstrates that the hardware can
be driven under a custom Linux stack; it does not provide a native PS5
userland ABI or a reusable driver implementation for this project.
## ABI evidence table
| Class | Area | Primary evidence | What the evidence supports | Policy |
|---|---|---|---|---|
| FACT | Export names | SDK `libSceGnmDriver.c` | names exist in the v0.41 stub set | resolve only |
| FACT | Target ISA | public SDK toolchain | compile target is x86-64 PS5 userland | does not prove a function ABI |
| INFERENCE | Runtime module name | stub filename plus SDK `.sprx` convention | `libSceGnmDriver.sprx` is a candidate | load only behind gates |
| UNKNOWN | GNM signatures | no pinned public header | no callable prototype is proven | never call |
| UNKNOWN | GNM structures | no pinned public definition | no layout is proven | never construct |
| UNKNOWN | Firmware stability | no public compatibility matrix | 9.60 is a build identifier, not known compatible firmware | 9.60 build only; never infer compatibility |
| FACT | SDK payload startup | pinned `crt/crt.c` and `crt/patch.c` | pre-main kernel process-state writes occur | execution blocked |
| FACT/UNKNOWN | SPRX loader lifecycle | pinned rtld source/system-module implementation boundary | load/start and stop/unload are requested; system internals unknown | offline audit only |
| UNKNOWN | Embedded-shader semantics | export names only | no identifier or binary contract | never call |
| UNKNOWN | Submission/sync semantics | export names only | no ownership or timeout contract | never call |
| FACT | SDL2 public API | pinned SDL headers and `LICENSE.txt` | application API and Zlib terms at that commit | Phase-1 candidate only |
| FACT | Pinned SDL implementation | pinned PS5 SDL source | exact source-level VideoOut sequence at that commit | indirect through SDL only |
| UNKNOWN | SDL runtime behavior | no approved observation | firmware compatibility, timeout, and cleanup on PS5 | do not execute |
| FACT/UNKNOWN | minimal startup | compiler can omit stock CRT; exact loader caller is absent | source-level omission only, not safe return | do not build an ELF |
The complete Phase-0 lookup subset and per-symbol evidence are in
`manifests/ps5_gnm_symbols.json`. Symbol presence never upgrades ABI confidence.
## Unknowns register
| ID | Unknown | Why it blocks progress | Evidence needed |
|---|---|---|---|
| U-001 | exact signatures for every candidate GNM export | a wrong call can corrupt memory immediately | acceptable public header/source or independently validated ABI evidence |
| U-002 | command-buffer and packet formats | cannot safely build GPU work | public, licensed format evidence plus review |
| U-003 | GPU-visible memory allocation and cache rules | resources may alias or be incoherent | proven userland allocation contract |
| U-004 | resource registration ownership/lifetime | cleanup and crash safety are unknown | proven signatures and lifecycle evidence |
| U-005 | queue, fence, and timeout semantics | a wait or queue action could hang | bounded synchronization contract |
| U-006 | VideoOut/GNM buffer compatibility | presentation ownership is unknown | separate, minimal Phase-1 evidence |
| U-007 | embedded shader identifiers and binary contract | cannot safely bind a shader | licensed public evidence and test plan |
| U-008 | runtime module name across firmware | even discovery may fail | approved hardware observation per firmware |
| U-009 | system-module initialization side effects | SDK call chain is known; firmware module internals are not public | acceptable public evidence plus separately approved observation |
| U-010 | supported firmware set | no hardware evidence exists | one manually approved probe at a time |
| U-011 | bounded SDL flip-event wait | safe timeout/cleanup cannot be guaranteed | licensed bounded-wait change or proven supervisor semantics |
| U-012 | SDL cleanup after forced process termination | recovery behavior is unknown | approved observation or public lifecycle evidence |
| U-013 | kernelwrite-free PS5 payload startup | SDK v0.41 CRT patches kernel process state before `main`; Phase 0.5 cannot prove a safe replacement | exact pinned loader caller plus complete entry/return/cleanup/crash audit |
| U-014 | loader changes before `_start` | incoming args already expose kernel access, but the creation path is absent | exact loader source and configuration used for firmware 9.60 |
Unknowns are closed only by updating this file, the relevant ADR, and the
firmware matrix with a primary source or an explicitly approved observation.
## Assumptions register
Assumptions are design choices, not compatibility claims.
| ID | Assumption | Scope | Falsification or review trigger |
|---|---|---|---|
| A-001 | `libSceGnmDriver.sprx` is a useful runtime candidate | discovery-only probe | approved lookup fails or a public source establishes another module |
| A-002 | Mock limits of 4096 pixels and 16 live resources are sufficient for lifecycle tests | host tests only | an adapter test requires a larger deterministic bound |
| A-003 | RGBA8 is enough to stabilize the initial public upload contract | mock and software-frame planning | RetroArch/SDL integration proves another minimum format is required |
| A-004 | The existing SDL CPU-framebuffer route is safer than duplicating its opaque VideoOut layout | first Phase-1 design | official public VideoOut headers and bounded lifecycle become available |
| A-005 | 1920x1080 and one fixed frame minimize first-test state | disabled Phase-1 candidate | exact firmware/display evidence requires a different supported mode |
| A-006 | A firmware-specific rebuild must receive a new approval because its digest changes | all hardware candidates | never relaxed; enforced artifact-provenance rule |
ROADMAP.md
+225
View File
@@ -0,0 +1,225 @@
# Roadmap and gates
Progress is gate-based. A later phase may be designed and compiled offline,
but no hardware behavior may be transferred or executed before its gate.
## Phase 0 — research and non-rendering implementation (offline complete)
- [x] Standalone repository boundary
- [x] Primary-source research snapshot and upstream pins
- [x] Threat model, ABI evidence table, and unknowns register
- [x] Versioned context, capability, resource, present-model, and cleanup API
- [x] Deterministic non-rendering mock and fail-closed PS5 backend
- [x] Compilable RetroArch and SDL2 adapter interfaces
- [x] Host unit/integration tests and static safety audit
- [x] Checksummed SDK bootstrap and pinned container recipe
- [x] Read-only capability manifest and compile-only probe
- [x] SPDX SBOM and artifact-manifest schema/tooling
- [x] Independent final review record (`docs/reviews/phase0-final-2026-07-17.md`)
- [x] Exact 9.60 discovery-only offline build authorization and runtime audit
- [x] Identify SDK v0.41 pre-main kernelwrite execution blocker
- [x] Phase-0.5 stock CRT, compiler, linker, loader-contract, and transitive
object audit
- [x] Permanent artifact denylist and fail-closed Payload Manager policy gate
- [x] Block minimal startup construction because safe loader return is unproven
- [x] Phase-0.6 exact installed Payload Manager/elfldr identity and source audit
- [x] Controlled runtime profile and fail-closed exact-firmware/hash/budget gate
- [x] Stop lifecycle-probe construction on persistent and unbounded effects
- [x] Phase-0.7 hardened elfldr with bounded ptrace, complete restoration,
cleanup, watchdog, and receiver-side hash/denylist enforcement
- [x] Phase-0.7 controlled Payload Manager with same-FD hash-to-stream,
loopback-only versioned transport, and atomic non-autoload upload
- [x] Phase-0.7 exact 9.60 lifecycle probe, double clean cross-build, linker
map, disassembly, complete callgraphs, and machine proof matrix
- [x] Hash-bound installation-review and rollback preparation without console
contact
- [x] Phase-0.9D existing-stack endpoint, flag, path, readback, and recovery
audit; no PS5-to-host file route found
- [x] Phase-0.9E bounded bootstrap provenance search and opaque candidate audit
- [x] Phase-0.9E-R official release/tag/source/sender audit; local backup
classified `LOCAL_BACKUP_NOT_CORRELATED`
- [x] Phase-0.9E-R2 inner, SIECAF, community, browser, and exact MediaFire
correlation; local backup classified `LOCAL_BACKUP_UNCORRELATED`
- [ ] Exact-used Y2JB/other host package and port-9020 listener provenance
- [ ] Independent host-to-memory, output, restart, and live-file contracts
- [ ] Phase-0.9F offline rescue-payload design gate opened
- [x] Two exact, separately approved Phase-1.0D one-shot executions recorded;
C1 proven and RUN-B D-stage unclassified
- [x] Phase-1.0E inherited-stdout result channel built, host-tested and audited
and exercised once with exact authorization; D00-D02 proven, incomplete
before D03, authorization consumed
- [x] Phase-1.0F I00-I14 startup-interval artifact built reproducibly and
audited offline; no transfer, execution or result reception authorized
- [x] Phase-1.0G manifest-only one-shot host runner prepared and fake-socket
tested; durable pre-connect attempt receipt, no device authorization
- [x] One exact Phase-1.0G run consumed; D00-D02/I00-I03 and deterministic
no-argument/no-menu exit proven, no retry or device write
- [x] Phase-1.0H minimal `-v` startup-argument correction built twice and
audited offline; exact artifact remains device-ineligible
- [x] One exact Phase-1.0H run consumed; I04/SDL/VideoOut/buffer registration
proven, first flip submit `-1`, no retry
- [x] Phase-1.0I offline source/map/disassembly postmortem; exact submit tuple
proven, write operation and submit errno remain unobserved
Exit evidence: host tests pass, safe PS5 targets compile, generated files are
current, no deploy target exists, Git is clean, private origin is synchronized,
and no secrets or unreviewed binary artifacts are tracked.
## Phase 1 — controlled presentation experiments
Gate: explicit artifact-specific hardware authorization plus all controls in
`SAFETY.md` and `docs/phase1/`.
Offline preparation:
- [x] Minimal SDL2 CPU-framebuffer/VideoOut clear design
- [x] Pinned SDL build with reviewed video-only overlay
- [x] Fail-closed compile target and artifact-manifest workflow
- [x] Firmware/ABI checklist and cleanup/rollback plan
- [ ] Proven bounded flip wait or safe process supervisor
- [x] Exact firmware supplied for an offline discovery build (`9.60`)
- [x] Bounded hardened lifecycle prepared offline with only the explicit
removable controlled-artifact write budget (Phase 0.7)
- [ ] Hardened runtime separately approved, installed, and hash-verified
- [ ] Successful separately approved discovery probe
- [ ] Artifact-specific VideoOut execution approval
After those gates, perform one CPU-filled frame through the existing SDL
VideoOut route. Only then may a separate GNM resource/synchronization proof be
designed, with every ABI reviewed independently. Embedded shaders remain an
evidence and licensing question, not an implementation assumption.
## Phase 2 — native 2D blitter
Texture upload, fullscreen primitive, nearest/bilinear sampling, aspect and
integer scaling, overlays, buffering, and fences. Each feature requires a mock
contract and bounded-failure test first.
## Phase 3 — RetroArch adapter
- [x] Phase-1.0A real PS5 headless frontend with static deterministic smoke core
- [x] Phase-1.0A SDL2/RGUI software profile linked offline
- [x] Host ASan/UBSan smoke-core integration and static target audit
- [x] Phase-1.0D CRT canary reached visible C1 on firmware 9.60
- [x] Phase-1.0D early diagnostic produced one unreadable notification;
exact stage and graphics progress remain unproven
- [x] Phase-1.0E machine-readable result-channel candidate prepared offline
- [x] Separately authorized one-shot Phase-1.0E result-channel device test;
D02 platform result `0`, EOF before D03, no retry/reconnect
- [x] Phase-1.0F stream-only D02-to-D03 interval diagnostic prepared offline;
exact artifact is device-ineligible pending separate future review
- [x] Phase-1.0G fail-closed one-shot runner prepared offline; tracked manifest
and approval template are inactive and contain no target
- [x] Phase-1.0G result identifies the pre-SDL configuration exit before I04;
follow-up artifact requires a new offline design and exact permission
- [x] Phase-1.0H startup wrapper now models argc 2 without content/menu/config;
H runner requires exact dual authorization and currently grants none
- [x] Phase-1.0H runtime reached SDL VideoOut but failed its first flip submit;
visible presentation, runloop and cleanup remain unproven
- [x] Phase-1.0I bounds the E118 candidates and records the frame-zero
inconsistency without claiming a root cause or authorizing a retest
- [x] Phase-1.0M removes the source-bound playlist `mkdir` while preserving
the global write firewall and reproducible artifact audit
- [x] Phase-1.0N binds the M artifact to an inactive one-shot runner contract
- [x] Phase-1.0O proves M reaches I04 and reproduces the VideoOut flip-submit
failure with result `-1` and saved errno `0`; authorization is consumed
- [x] Phase-1.0P proves the exact submit boundary and deterministic D12/D04
order while keeping the VideoOut ABI/root cause fail-closed
- [x] Phase-1.0Q finds only one PS5 VideoOut declaration lineage and blocks
parameter experiments for lack of independent public ABI evidence
- [x] Phase-1.0R proves SDL2main adds no app/display registration, binds direct
and manager launches to the same elfldr constructor, and blocks target
changes because the separate hbldr/shsrv context remains unproven
- [x] Phase-1.0S binds official hbldr/shsrv: it proves BigApp substitution but
blocks route reuse because deployed identity, firmware behavior and safe
bounded device operation remain unproven
- [x] Phase-1.0T proves the existing shsrv shell cannot provide exact deployed
identity, records unavoidable greeting effects, and designs an inactive
redacting metadata gate without a network client
- [x] Phase-1.0U performs the bounded local artifact inventory; no original
shsrv target, receipt or transfer log is found, so direct host hashing is
unavailable and global absence is not claimed
- [x] Phase-1.0V implements a bounded offline one-shot Telnet/sanitization
model with inactive approval and no network transport
- [x] Phase-1.0W self-reviews/remediates the collector and proves an inactive
dual-record client policy plus fake one-shot transport
- [x] Phase-1.0X implements offline-only injected transport orchestration,
consumed-attempt receipts and exclusive sanitized output; no real
connection is authorized
- [x] Phase-1.0Y audits prompt/Telnet/completion framing, identifies the raw
and libtelnet/NVT source families and models both offline; deployed
identity and exact completion stay unproven
- [x] Phase-1.0Z implements an offline passive, source-family-tolerant
LF-batch contract with deadline-only sealing, strict completeness and no
Telnet command emission or live transport
- [x] Phase-1.0AA integrates Z bytes, synthetic deadline and exclusive X
evidence through an exact built-in fake adapter only
- [x] Phase-1.0AB audits the exact local runtime and models receipt,
nonblocking connect, complete send, bounded receive, deadline and close;
hard scheduling and remote cleanup remain partial/unproven
- [x] Phase-1.0AC implements a dormant target-free adapter around an exact
built-in fake syscall facade; no socket import, address or activation
path exists
- [x] Phase-1.0AD defines an inactive numeric-target and activation-record
contract with exact launcher/payload/approval hashes and no live ability
- [x] Phase-1.0AE selects the nonpersistent official shsrv v0.7 lineage and
rejects v0.19 fake-app/remount behavior; target implementation is blocked
- [x] Phase-1.0AF implements an injected host-only BigApp lifecycle model with
bounded ticks, unique-child correlation and exhaustive failure cleanup
- [x] Phase-1.0AG implements a bytes-only bounded ELF64 admission contract;
the historical M bytes are absent and therefore not newly admitted
- [x] Phase-1.0AH bounds the loader/CRT relocation split and exact per-artifact
DT_NEEDED inventory without mapping or loading anything
- [x] Phase-1.0AI models allocation, exact copy/BSS, RELATIVE application,
final permissions, sync, commit and full-region rollback
- [x] Phase-1.0AJ binds the v0.7 and hardened elfldr primitive sources,
rejects direct v0.7 loader reuse and records the remaining composition
and cleanup-ownership gaps
- [x] Phase-1.0AK models hybrid primitive composition, every temporary JIT
resource and fail-closed child termination after cleanup failure
- [x] Phase-1.0AL audits exact SDK `mdbg_copyin` partial-copy and credential
restoration semantics and blocks direct reuse
- [x] Phase-1.0AM models bounded exact-progress copying, independent all-field
restoration, child cleanup and compromised-service containment
- [x] Phase-1.0AN binds service fail-stop behavior and proves restart ownership,
`PT_IO` hard preemption and exact progress remain absent
- [x] Phase-1.0AO models one-shot worker preemption under an explicit supervisor
with no automatic restart, retry or real capability
- [x] Phase-1.0AP audits current official SDK/shsrv worker creation, termination,
identity and result-channel evidence; only creation is a source candidate
- [x] Phase-1.0AQ implements a fixed 128-byte worker-result record with
precommitted nonce, attempt, PID pair and monotonic generation
- [x] Phase-1.0AR models exclusive single-writer framing, every partial-read
split, deadline/EOF, overflow and containment without live transport
- [x] Phase-1.0AS audits public pipe/poll, rfork FD semantics, close ownership,
nonblocking reads and monotonic deadline evidence
- [x] Phase-1.0AT models RFFDG inheritance, exclusive pipe-end close order,
EINTR and one absolute deadline through fake operations only
- [x] Phase-1.0AU reassesses live channel feasibility: public primitive
signatures are complete, but official safe composition and runtime proof
remain absent
- [x] Phase-1.0AV defines a target-free launch-context A/B canary with identical
payload bytes, separate approvals and a distinct post-D04 terminal
- [x] Phase-1.0AW binds the exact canary source delta, v0.7 raw stdout candidate
and blocking launcher effects; no artifact is permitted
- [x] Phase-1.0AX implements byte-exact CHD10AV1/D14 framing and the cleanup
predicate for host tests only
- [x] Phase-1.0AY selects the exact inactive Phase-1.0N source base and requires
a separate worktree, preserving the current checkout
- [ ] Implement and host-test the AV source structure in that isolated worktree
without a target profile, cross-build or artifact
- [ ] First static emulator core with legally redistributable test content
- [ ] Dynamic core loading contract and implementation
Hardware-rendered libretro contexts remain disabled.
## Phase 4 — SDL2 accelerated renderer
Reusable SDL renderer backend and simple shaders, without replacing unrelated
native SDL platform facilities.
## Phase 5 — separately evaluated context expansion
Consider a broader hardware-render context or small OpenGL subset only after
the 2D path is stable. A full Vulkan or Mesa driver is explicitly not an early
goal.
SAFETY.md
+610
View File
@@ -0,0 +1,610 @@
# Safety and threat model
## Non-negotiable boundary
This project uses only userland behavior and public, open-source information.
It excludes kernel and hypervisor code, exploit development, DRM bypass,
proprietary SDK material, leaked or decrypted headers/binaries, direct MMIO or
register writes, clock/SMU/fan control, boost settings, and firmware patches.
No payload or ELF may be transferred to or executed on a PS5 without explicit
approval from Jens in the active task. There is no boot-time or automatic
execution path.
Documented temporary process/kernel runtime changes made by the exact public
loader or SDK may be classified as expected volatile, restored by the loader,
or payload-process-local. They are not automatically unsafe. Persistent writes
and unbounded or unknown effects remain hard blockers.
## Assets and adversaries
Protected assets include the console's stability, display availability, user
data, network credentials, private repository credentials, and the accuracy of
the project's compatibility claims.
Relevant failure or threat sources:
- an incorrect guessed ABI that corrupts stack or memory;
- a command submission that hangs the GPU or display path;
- unbounded waits or incomplete cleanup after partial initialization;
- symbol presence being mistaken for compatible semantics;
- firmware drift;
- malicious or compromised upstream artifacts;
- secrets entering logs, manifests, commits, or remote URLs;
- a build or CI target silently becoming a deployment path.
## Phase-0 controls
| Risk | Control | Verification |
|---|---|---|
| ABI guess is called | No GNM declarations or calls; symbol addresses never escape | `phase0_safety_audit` test |
| GPU work is submitted | No submit/draw/dispatch/flip call sites | source allowlist audit |
| GPU memory changes | No GPU allocator, mapper, resource registration, or command buffer | source and build-graph audit |
| Probe runs accidentally | target disabled by default; runtime acknowledgement; firmware gate | CMake tests and code review |
| Unknown firmware runs | default is `NONE`; discovery build accepts only exact `9.60` | unit test, CMake gate, compatibility file |
| Automatic deployment | no deploy/test/run target; output is compile artifact only | CMake audit |
| Supply-chain substitution | immutable upstream commit and release SHA-256 | lock manifest and bootstrap script |
| Secret disclosure | secret filename ignores, no credential scripts, boolean-only logs | repository scan before push |
| Adapter accidentally claims hardware | compiled queries report unavailable and reject hardware requests | adapter tests |
| Resource lifecycle leaks | context refuses destruction while child handles exist | mock integration tests |
| Phase-1 target enters normal build | separate option defaults off and requires PS5 plus explicit SDL path | configure and source audit |
| Pre-gate SDL side effect | candidate does not link SDL2main; gate precedes `SDL_Init` | source-order audit and ELF imports |
| SDK CRT changes kernel state before `main` | classify exact effects; permanent legacy artifact remains blocked | pinned-source runtime audits and ADR-0010 |
## Probe side-effect statement
After its firmware gate, project code requests only system module loading,
symbol lookup, boolean logging, and module unloading. It does not request a GNM
operation. The pinned SDK source proves that `dlopen` can call
`sceKernelLoadStartModule` and that `dlclose` can call
`sceKernelStopUnloadModule`; module start/stop internals remain unknown.
More importantly, SDK v0.41's payload CRT runs before `main`. Its startup calls
`__patch_init`, which writes process credential capability/attribute fields and
syscall-address limits through the SDK's kernel read/write primitives. The CRT
also sets libc `__isthreaded`, initializes syscall/kernel/log/rtld state, may
load `libSceSysmodule.sprx`, allocates loader bookkeeping, relocates the
payload, and runs constructors. Normal termination runs payload destructors;
project `dlclose` requests module stop/unload only when this open loaded it.
There is no guaranteed cleanup after a hang, crash, partial load, or failed
stop/unload.
Therefore **no GPU mutation or rendering operation is requested by project
code**. The existing ELF remains permanently ineligible by artifact-specific
denylist, independently of the corrected Phase-0.6 classification model.
The firmware-9.60 capability artifact with SHA-256
`4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63`
is permanently blocked in `manifests/artifact-denylist.json`. Its manifest
states `execution_eligible=false`, and all new manifests default to the same
false value. `tools/check_artifact_execution_policy.py` must be the first
static gate used by repository tooling and Payload Manager integrations:
missing or false eligibility, malformed input, changed bytes, or a denylist
match returns `DENY`. A pass is not execution authorization.
## Phase-0.5 startup result
The stock v0.41 CRT is `UNSAFE`. Omitting it is mechanically possible, but the
loader caller and its return, cleanup, crash, and pre-entry behavior are
`UNPROVEN`. No minimal startup source or ELF exists, and the corresponding
CMake option fails closed. See `docs/runtime/` and
`manifests/runtime/phase-0.5-startup-audit.json`.
## Phase-0.6 historical lifecycle result
The installed Payload Manager v0.3.1 and elfldr v0.23 are exact public-release
matches. Temporary QA flag, credential, ptrace, mapping, and SDK startup
effects are classified individually. The lifecycle still fails closed because
it has `PERSISTENT_WRITE` and `UNBOUNDED_OR_UNKNOWN` effects: unbounded ptrace
loops, no detached-child watchdog, unresolved return/reaping/cleanup,
incomplete credential restoration, no launch-time hash check, and a manager
upload path that writes `/data/pldmgr/payloads`.
That result remains immutable evidence for the unmodified public-release
chain. It is not the current runtime profile.
## Phase-0.7 offline deployment-readiness result
The hardened elfldr and controlled Payload Manager close the Phase-0.6
implementation blockers with bounded ptrace steps, complete checked credential
restoration, centralized cleanup, a two-second kill/reap watchdog, exact
same-file-descriptor hashing, and receiver-side digest/denylist enforcement.
The lifecycle ELF is a normal SDK v0.41 payload that sends one notification
and calls `_exit`.
The current `controlled-ps5-runtime` profile binds exact firmware 9.60, SDK,
source commits, hashes, sizes, expected effects, a removable controlled
artifact-directory write budget, no payload network, 2000 ms maximum runtime,
and no retry. It is `READY_FOR_HARDENED_RUNTIME_DEPLOYMENT` only:
`installed=false`, `execution_authorized=false`, `transferred=false`, and
`executed=false`.
No PS5 connection, transfer, installation, or execution was used to reach
this decision. Hardware behavior remains unproven. The normal CRT
`__patch_init` path is process-local but means the lifecycle is not a
kernelwrite-free artifact. The old blocked hash remains permanently denied.
See `docs/runtime/phase-0.7-hardening.md` and
`manifests/runtime/phase-0.7-offline-audit.json`.
## Phase-0.8 read-only preflight result
The offline collector-admissibility review is
`READ_ONLY_PREFLIGHT_BLOCKED`. The exact Payload Manager v0.3.1 HTTP handler
sets an in-process active flag for every non-`OPTIONS` request.
`/autoload_status` additionally sets `autoload_triggered` and reads the
autoload configuration. Direct filesystem collection has no pinned collector
or proof excluding atime, audit-log, cache, metadata, service-state, or
on-device-log changes.
No on-device session was started and no PS5 connection was made. Current
firmware, live object identities, listeners, startup state, and rollback
backups remain unobserved. The exact stock Payload Manager backup is therefore
a hard open gate. Installation, lifecycle, execution, and automatic retry
remain unauthorized. See `docs/runtime/phase-0.8-read-only-preflight.md` and
`manifests/runtime/phase-0.8-read-only-preflight.json`.
## Phase-0.9A anti-brick design result
The offline anti-brick layer is `DESIGN_ONLY`. It models exact pre-image
identity, separate reopened backup, inactive staging, quiescence, an atomic
switch, post-switch verification and separately authorized rollback. No such
PS5 switch or recovery primitive is claimed. All fourteen interruption
boundaries remain `UNPROVEN`, so the design is not installation-suitable.
The host simulator performs only in-memory logical writes and cannot connect,
transfer, install, execute, open a target artifact or start a compiler. Its
synthetic atomic primitive is fault-test scaffolding, not hardware evidence.
The byte-exact on-device Payload Manager backup and recovery independent of
both elfldr and Payload Manager remain catastrophic hard gates. No
authorization is granted and automatic retry remains false.
## Phase-0.9B observer feasibility result
The offline result is `BLOCKED`. Normal SDK v0.41 startup is not
kernelwrite-free because `_start()` reaches `__patch_init()` before `main`.
Omitting the CRT is mechanically possible, but safe custom entry, return/exit,
crash handling and loader cleanup remain `UNPROVEN`.
The hash-bound hardened elfldr route deliberately gives the payload no
stdout/stderr socket, and the controlled Payload Manager transport does not
receive payload output. Notifications, klog and stock manager HTTP are not a
proven bounded non-persistent result channel. No observer source, target, ELF,
linker map or package was created. All device authorizations remain false, and
no PS5 action occurred. See
`docs/runtime/phase-0.9b-observer-static-audit.md`.
## Phase-0.9C execution-feasibility result
The offline classification is
`BLOCKED_MULTIPLE_FOUNDATIONAL_CONTRACTS`. Source review proves that a normal
SDK entry is side-effecting before `main`; a freestanding entry has no closed
stack/BSS/relocation/TLS, read, monotonic-time, return, exit, or cleanup
contract. A normal `ret` resumes an unproven SceSpZeroConf continuation, and a
watchdog kill is not accepted as safe exit.
The 4096-byte D1 result format passes deterministic host tests, but no current
caller-owned target buffer, copy-out, cleanup finalizer, or manager delivery
exists. Firmware source two is absent; an SDK export name alone is not an ABI.
Filesystem and platform reads may still affect metadata, atime, audit, caches,
counters, service/security state, open bookkeeping, accounting, object
lifetime, or races. No target source, ELF, map or package was built, and no PS5
action or authorization occurred. See
`docs/runtime/phase-0.9c-static-audit.md`.
## Phase-0.9D existing-stack readback result
The offline decision is `BLOCKED_NO_READBACK_PATH`. The full and controlled
Payload Manager profiles contain uploads, installs, deletes, launch-time file
reads, directory/configuration observations, and process actions, but no
binary-safe file-download response. Hardened elfldr returns fixed status text;
its controlled manager transport sends and closes without receiving component
bytes.
The full-profile `server_active_flag` is process-local and only suppresses a
fallback notification in audited source. It is `LOW_VOLATILE`, but has no
in-process reset and must be explicitly accepted in any future permission.
`/autoload_status` is excluded because it sets `autoload_triggered` and can
alter worker timing. No PS5 was contacted, no file was transferred, and no
target, observer, client, backup, package, staging action, or authorization was
created. See `docs/runtime/phase-0.9d-readback-feasibility.md`.
## Phase-0.9E bootstrap provenance gate
The exact external exploit/host and rudimentary port-9020 listener must be
available and provenance-bound before they can be considered an independent
rescue executor. A matching filename, an opaque console backup, a public
upstream, a generic sender command, or a conceptual dependency graph is not
enough. Unknown filesystem staging or autoload effects are brick-relevant and
remain hard stops.
No Phase-0.9F target design is authorized while the receive, mapping,
entrypoint, live-file, output, cleanup, crash, and reboot contracts are
missing. Phase 0.9E permits only local hashing, source/binary inspection,
schemas, manifests, and host-only policy tests. It permits no network socket,
device client, transfer, target build, payload, install, execution, autoload,
retry, or recovery action.
Phase 0.9E-R permits only bounded official `Gezine/Y2JB` GitHub acquisition
and private-origin push. Official metadata excludes every current release
asset from matching the local backup, and official source contains no
port-9020 listener implementation. The ignored official source tree is
inspection-only; downloaded code was not executed. No outer association may
be promoted to opaque inner provenance, and neither an operator attestation
nor host tests are runtime evidence. All device, build, transfer, execution,
installation, lifecycle, autoload, write, and retry authorizations remain
false.
Phase 0.9E-R2 permits only host-side hashing, bounded browser metadata copies,
the exact MediaFire object page, one mandatory official backup, and
source-motivated community assets. Downloaded archives are static evidence:
never execute or restore them, never track them, and remove temporary copies.
The SIECAF parser is read-only and may inspect only public fixed-width
structural metadata; it may not decrypt, guess keys, extract, write, or invoke
`ps5-bar-tool`. MediaFire metadata, structural similarity, and an inner match
would each remain non-runtime evidence. The actual result is
`LOCAL_BACKUP_UNCORRELATED`, so Phase 0.9F and every authorization remain
blocked.
## Phase-1.0E inherited result boundary
Prior RUN A and RUN B permissions were artifact-specific and consumed. RUN A
visibly reached C1; RUN B produced an unreadable notification and no exact
D-stage may be inferred. Phase 1.0E may record those observations and build a
new execution-ineligible diagnostic candidate offline. Its later exact
one-shot authorization was consumed on 2026-07-22.
The only added target operation is one nonblocking `send` attempt per reached
D-stage through stdout inherited from hardened elfldr's legacy raw-ELF
connection. It may not open a target socket, connect, listen, read requests,
retry, write the device filesystem, install or activate autoload. The host may
model one connect/send/write-half-close/bounded receive with fake sockets, but
no real device use occurs without new exact artifact-specific permission that
also names result reception. EOF, timeout, partial frames and send failure are
terminal, never retry triggers. The normal SDK CRT effects remain explicit;
this result channel is not side-effect-free. RUN C used the permitted single
connection and validated D00-D02 before remote EOF. It did not retry or
reconnect. D03, SDL, VideoOut, rendering, terminal status and cleanup remain
unproven. All authorization fields and artifact eligibility are now false.
## Phase-1.0F startup interval boundary
Phase 1.0F may prepare an exact artifact offline to place I00-I14 checkpoints
inside the source interval after D02 and through entry to D03. These
checkpoints may only reuse the existing nonblocking, signal-suppressed inherited
stdout send. They do not send notifications and may not add a socket, connect,
listener, receive path, address, port, filesystem write, install, autoload,
retry or reconnect.
The distinct `CHD10F01` parser remains offline-only: the live CLI is not
activated for it and must continue to reject the ineligible manifest. Normal
SDK CRT patch effects and the existing SDL/VideoOut imports remain explicit;
the artifact is not side-effect-free and static success is not hardware
evidence. No prior authorization carries forward. Device connection, transfer,
result reception and execution each require a new exact permission.
## Phase-1.0G one-shot runner boundary
Phase 1.0G may prepare and host-test a manifest-driven runner, but its tracked
manifest and approval template remain inactive. The interval protocol cannot
be selected through a free command-line switch. Activation requires both an
exact active manifest and a separate untracked local approval whose artifact,
firmware, target, protocol, limits and unique run identifier agree.
The runner must rehash the actual artifact before transport and exclusively
create and `fsync` a consumed-attempt receipt before opening a socket. This
fail-closed receipt prevents a host crash from silently making the same
permission reusable. Retry, reconnect, resume and trace overwrite remain
forbidden. The current repository contains no active target, run identifier or
authorization; no device action is allowed by Phase 1.0G itself.
The later exact Phase-1.0G authorization was consumed by one attempt. Valid
frames ended at I03 and ordinary stdout proved the deliberate no-argument,
no-menu help/exit path before I04. There was no retry or reconnect. This result
does not authorize another action and does not prove SDL, VideoOut, rendering
or terminal cleanup.
## Phase-1.0H startup-argument boundary
Phase 1.0H may correct only the proven `!HAVE_MENU && argc == 1` exit. The
reviewed profile adds RetroArch's existing verbose flag, generating `-v`, and
must retain null content/config/core paths, static contentless core, write
firewall, bounded runtime and the inherited one-send-per-stage stream. It must
allow H only through an exact active manifest plus separate matching local
approval, never a free protocol switch. No target, run ID, retry, reconnect,
installation, autoload or device-write authority may be tracked by default.
The exact H artifact is offline evidence only. It remains transfer-, execution-
and installation-ineligible, and all authorizations are false. Phase-1.0G
authority was consumed and cannot authorize H. A later action requires a new
exact artifact-specific permission; static success does not prove I04, SDL,
VideoOut, rendering, terminal status or cleanup.
The later exact Phase-1.0H authorization was consumed once. Its trace reached
I04, SDL2 video, VideoOut open and buffer registration, then the first flip
submit returned `-1` and SDL init returned `-1`. The diagnostic pattern was
copied into mapped display memory before the failed submit. D12 also records a
write-firewall rejection during configuration parsing; the exact requested
operation is unobserved. No retry is authorized. Do not infer a visible frame,
runloop entry, complete cleanup or safe exit.
## Phase-1.0I offline postmortem boundary
Phase 1.0I may inspect only the consumed H trace, exact source, ignored local
artifact/map and disassembly. It proves the submitted tuple
`(handle, 0, 1, 0)` and narrows E118 to linked `OPEN` or `STREAM` wrappers. It
does not know the exact blocked operation, original submit `errno`, VideoOut
argument semantics or root cause. The diagnostic/normal frame-zero/frame-one
mismatch is a source candidate only.
No target build, artifact, device client, connection, transfer, execution,
result reception or retry belongs to Phase 1.0I. A later offline design must
capture errno before reporting, transmit the exact write operation and stop
before I04 on a firewall shutdown. Selecting a different frame ID requires a
new ADR, new artifact audit and separate future authorization.
## Phase-1.0O consumed write-free result
The exact M artifact was transferred and executed once. The exclusive receipt
was created before the only connection; there was one send, zero retries and
zero reconnects. No installation, autoload, persistent staging or device
filesystem write occurred. The diagnostic pattern did mutate mapped display
memory and one VideoOut flip submit was attempted, as bounded by the approval.
The run passed I04 with no D13, then reproduced the first flip-submit failure.
D07 reports `-1` and saved errno `0`; E104 is the overlay's generic
`framebuffer_fail` label after that failure, not proof of an allocation fault.
The subsequent D04 after terminal-flagged D12 prevents a successful terminal
classification. Do not infer visible output, event-wait behavior, complete
cleanup or safe exit. The authorization is consumed and no action carries.
## Phase-1.0P offline VideoOut analysis
Phase 1.0P performs source, map, relocation and disassembly inspection only.
It proves the consumed artifact called `sceVideoOutSubmitFlip(handle,0,1,0)`
and received `-1` with saved errno `0`. It does not prove the semantic ABI,
opaque buffer contract, flip ownership, visible presentation or cleanup.
An exported symbol name is not permission to call a status or flip-master
function. No argument experiment, target build, parser relaxation or device
action is permitted by this analysis. The D12-before-D04 order is
source-deterministic, and D12 remains a shutdown request rather than proof of
lifecycle completion.
## Phase-1.0Q public evidence boundary
The bounded official-source inventory found no independent PS5 VideoOut ABI.
SDK v0.41 provides export names only; the PS5 declarations and opaque records
originate together in one SDL lineage, and relevant official ports consume
that same fork. OpenOrbis defines only the analogous PS4 contract.
Do not promote source repetition, a successful registration return, a PS4
constant or an exported status/flip-master name into PS5 semantic proof. No
submit parameter, buffer layout, ownership state or error interpretation may
change from Phase 1.0Q, and no target or device action is authorized.
## Phase-1.0R launch-context boundary
The exact PS5 SDL2main adds no application ID, title identity, LNC setup,
VideoOut ownership or process creation. Its `LoadExec("exit")` occurs only
after `SDL_main` returns, and the tested RetroArch path already performs SDL's
splash-hide call before VideoOut open. Direct and Payload Manager raw-ELF
routes use the same hardened elfldr process constructor.
Do not treat PacBrew packaging, `homebrew.js` path/argument descriptors,
LakeSnes documentation, or the non-unique LNC log as proof of a different
working display context. The exact hbldr/shsrv launcher and runtime active-app
state are unbound. Keep
`NO_SOURCE_PROVEN_LAUNCH_CONTEXT_FIX_TARGET_CHANGE_BLOCKED`: no SDL2main,
LNC/SystemService, submit, VideoOut, target-build, transfer or execution
change is authorized.
## Phase-1.0S hbldr/shsrv boundary
Official source proves that hbldr is materially different from raw elfldr: it
launches a BigApp through SystemService and replaces the resulting process
with a device-resident ELF. This is source evidence for a launch-context
difference, not proof of VideoOut permission, visible output, safe cleanup or
firmware-9.60 behavior. The exact deployed shsrv identity is unknown.
Never invoke or copy the existing route under this gate. It may kill the
running BigApp, performs kernel/ptrace process changes, lacks a hard deadline,
requires prior target staging, and current versions may remount `/system_ex`
and create persistent `FAKE00000` content without an atomic write, rollback or
power-loss protocol. Keep
`BIGAPP_CONTEXT_SOURCE_PROVEN_DEPLOYED_IDENTITY_UNPROVEN_DEVICE_PATH_BLOCKED`.
No port-2323 connection, shsrv request/deployment, hbldr command, target build,
device file, app termination, remount, transfer or execution is authorized.
## Phase-1.0T inactive shsrv identity boundary
The current shsrv source spawns a shell for every accepted connection and its
greeting automatically queries and transmits model, serial number, firmware,
temperatures and CPU frequency. Therefore a nominally read-only `help` request
is not side-effect-free and risks disclosing a device identifier. Phase 1.0T
contains no connector and authorizes no connection.
The offline parser must receive an already supplied transcript on stdin. It
must never persist raw input, serial, model or telemetry, and may retain file
metadata only for an independently supplied literal absolute path. `help`
identifies at most a source family; `stat` is metadata only; `sum` is a weak
16-bit rotating checksum and may cause atime/cache/accounting effects. None
can prove an exact binary. Wildcards, path discovery, content commands,
`hbldr`, launch, writes, signals, mounts, retry and reconnect remain forbidden.
All future windows are `DESIGNED_NOT_ACTIVE` and require separate exact review.
## Phase-1.0U bounded local inventory
Phase 1.0U found no deployed shsrv candidate within the declared Chimera,
attachment, known-download and ZIP-entry-name scope. This is not a global host
or device absence claim. The official source checkout, host telnet wrapper and
PacBrew recipe remain non-deployed references and must never be substituted
for exact installed bytes. No discovered script or binary was executed.
The inventory grants no connection, shell command, target build, transfer,
execution, installation, write, retry or launch-context experiment. Only the
next offline inactive collector-design phase may proceed. A future live
collector remains blocked behind a new exact approval and the Phase-1.0T
serial/telemetry side-effect acceptance.
## Phase-1.0V inactive collector-model boundary
Phase 1.0V is an offline stdin model with no network transport. It bounds raw
and sanitized input to 65,536 bytes, permits at most 256 chunks, rejects
incomplete Telnet controls and invalid UTF-8, and seals after one result. It
retains only the Phase-1.0T sanitized record. The internal bytearray is cleared,
but physical memory erasure is not proven.
The tracked activation and approval remain empty and false. Do not add an
address, port, command, socket, connect/send path, automatic reply, persistent
raw transcript, retry, reconnect, resume or fallback under this phase. Host
model success is not device, prompt, cleanup or deployed-identity evidence.
## Phase-1.0W reviewed inactive client architecture
Self-review remediates doubled-IAC state, empty-chunk accounting, path
allowlisting, firmware/compile metadata validation and numeric-parser error
normalization. Physical memory erasure remains unproven. The new policy accepts
only synthetic dual records and returns a frozen data plan; the fake transport
has no network primitives.
Keep the tracked activation and approval empty. Port 2323, one connection,
ten-second deadline and T2/T3 command tokens are future constraints, not
authority. A consumed receipt, exclusive sanitized output, monotonic deadline,
network transport, Telnet reply/prompt contract and deterministic close remain
missing. Do not connect, render shell lines or issue a request under this phase.
## Phase-1.0X inactive injected transport
The X orchestrator accepts only an already validated immutable session plan,
an injected adapter, an injected monotonic clock and a caller-owned host
evidence directory. Repository tests supply only fake adapters. The consumed
receipt is exclusively created and file-flushed before adapter open. Output is
sanitized, exclusively created and bound to the reopened receipt hash. There
is no overwrite, delete, raw-transcript persistence, target persistence, retry
or second open.
Do not interpret file `fsync` as directory-entry durability. A partial file is
invalid and deliberately not cleaned up; the run remains consumed. Deadline
checks surround adapter boundaries but cannot preempt a blocking real adapter.
Exact prompt and Telnet framing, OS socket timeouts, live close behavior and
deployed shsrv identity remain blockers. No real adapter, address, port,
connection, request or authority may be added under X.
## Phase-1.0Y offline shsrv framing
The Y model accepts synthetic bytes only. It distinguishes raw v0.7-v0.8 from
`libtelnet`/NVT v0.9-v0.19, never opens a transport and never formats a command.
Neither audited family proactively negotiates or server-echoes input. Current
source rejects unsupported `WILL`/`DO`; legacy source passes Telnet controls
into the shell. Future Chimera input must therefore emit no IAC commands.
A terminal `$ ` is not a live completion proof. `PWD` is not forcibly
overwritten, the external Telnet client's local echo is undefined, wire chunks
are arbitrary, and current pipe/socket handlers do not complete short writes.
The server also has no bounded session deadline. Preserve deadline-based
partial-result rejection, keep all authority false, and do not add a real
network adapter under Y.
## Phase-1.0Z offline passive batch
The Z contract produces one target-free ASCII/LF byte batch from a validated W
plan. It permits only `help`, or ordered `stat` and `sum` for one normalized
literal path. NUL, CR, IAC and shell separators cannot enter the batch. It has
no CLI, address, transport, clock or file output and authorizes no device use.
Incoming IAC fails closed; the model never sends a Telnet reply. Prompt text
and remote EOF are not completion boundaries. Only an explicit synthetic
hard-deadline event can seal, and incomplete help/stat/sum output remains
invalid. This does not prove live timeout preemption. A future T3 read may
still cause atime, cache, accounting and scheduler effects, while the automatic
sensitive greeting and shell/connection state require explicit acceptance.
Keep all authority false and add no real adapter under Z.
## Phase-1.0AA offline fake-adapter integration
AA accepts only exact built-in fake adapter, fake clock and fake evidence-store
types. Subclasses and arbitrary injected implementations are rejected, so the
module cannot be repurposed as a live transport boundary. It creates an
exclusive consumed receipt before fake open, permits one complete Z batch,
seals only at a valid synthetic hard deadline and closes exactly once.
EOF, blocked receive, early or missing deadline, data at/after deadline, IAC,
partial output and evidence collisions are failures. A receipt remains after a
failed fake attempt; no cleanup deletes it. Logical event-buffer clearing does
not prove physical erasure. Host `fsync` does not prove directory-entry
durability, and the synthetic clock cannot prove OS preemption. Keep every
authorization false and do not add a network adapter or device action under AA.
## Phase-1.0AB offline live-adapter feasibility
AB binds the local Python 3.13.2 Windows socket/select implementation but adds
no network import or adapter. Its trace model accepts synthetic operations only
and requires receipt-before-creation, nonblocking-before-connect, readiness and
`SO_ERROR`, positive bounded send/receive progress, deadline-only sealing,
sanitization, local close and then output.
Selector timeout is a maximum requested wait, not proof that host scheduling
cannot overshoot. Local `close` is not proof of remote shsrv/process cleanup.
Numeric-address parsing and the exact accepted Windows pending-connect error set
still require implementation review. Keep live implementation, socket creation,
DNS, target retention, connection and request as hard stops under AB.
## Phase-1.0AC offline dormant-adapter boundary
AC executes only against the exact built-in fake syscall facade and fake
clock. A precommitted receipt marker must precede synthetic creation;
nonblocking setup precedes synthetic connect; partial progress is explicit;
EOF, zero progress and data at the deadline fail. One fake local close is
attempted after every successfully opened path. Unused fake events are logically discarded,
which does not prove physical erasure or remote cleanup.
The module has no live adapter protocol, socket/selector import, DNS, address,
CLI, real clock or file output. All authorization remains false. AC permits
only a later offline inactive numeric-target/activation design; it does not
permit a transport implementation, connection, request or device action.
## Controls required before Phase 1
Phase 1 cannot begin until all of the following are recorded in a new ADR:
1. explicit hardware-test approval;
2. an allowlisted firmware and reproducible console identification method;
3. proven function signatures and data layouts from acceptable public sources;
4. a bounded timeout and operator recovery plan;
5. independently reviewed cleanup and crash-log paths;
6. a one-step-at-a-time test case with an SDL software/VideoOut fallback;
7. an explicit statement of exactly which buffer or GPU state may mutate.
Approval for one test does not authorize later tests.
## Timeout, watchdog, cleanup, and logs
The Phase-0 loop is statically bounded by the 21-entry manifest and always
attempts module cleanup after lookup begins. Dynamic-loader calls do not expose
a documented cancellation API, so an in-process forced timeout would risk
leaking loader state. The default `NONE` gate blocks the project-requested
module open. The 9.60 build gate does not remove the SDK CRT blocker and grants
no execution authority.
Before any approved hardware observation, a separate supervisor design must
define a wall-clock deadline, progress events, operator-visible failure state,
and a recovery action that does not kill a thread while it owns loader or GPU
state. The probe already emits deterministic JSON-line stage events suitable
for a redacted crash/timeout log; it never emits addresses. Later GPU phases
must add explicit per-operation deadlines and prove cleanup for each partially
completed state transition.
## Disabled Phase-1 candidate
The candidate source contains one SDL window-surface update, but it is outside
every default target and automated test. Its default `NONE` build exits before
SDL initialization. Project code contains no direct VideoOut or GNM prototype.
The pinned SDL backend's flip-event wait has no proven finite timeout; this is
recorded as a hardware blocker rather than hidden behind a forced thread kill.
See `docs/phase1/HARDWARE_TEST_PLAN.md`.
## Incident rule
On an unexpected return code, missing cleanup confirmation, display anomaly,
hang, reset, or firmware mismatch: stop, preserve non-sensitive logs, mark the
compatibility entry as failed or unknown, and do not retry automatically.
SECURITY.md
+41
View File
@@ -0,0 +1,41 @@
# Security Policy
## Supported code
Security fixes target the current `main` branch. Historical research and
experiment branches are evidence, not supported release channels.
## Reporting a vulnerability
Report suspected vulnerabilities privately to
[`security@itworx.tech`](mailto:security@itworx.tech). Do not
publish exploit chains, console-specific privileged addresses, credentials,
private network details, signing material, proprietary SDK or firmware
material, copyrighted dumps, payload delivery details that expose a live
target, or unredacted crash dumps in a public issue.
Include the affected component and commit, firmware or adapter boundary, a
minimal reproduction using synthetic inputs where possible, expected and
observed behaviour, and likely impact. Note whether the issue affects input
validation, ownership, lifecycle cleanup, firmware gating, artifact
provenance, hashing, resource bounds, or a documented safety boundary.
## Supported security boundary
Chimera GFX treats platform adapters, firmware assumptions, and native memory
boundaries as untrusted until explicitly validated. Contributions must preserve
bounded parsing, fail-closed compatibility checks, write-free diagnostics by
default, and the release requirements in `SAFETY.md`, `AGENTS.md`,
`FIRMWARE_COMPATIBILITY.md`, and the accepted ADRs. They must not silently add
deployment, automatic startup, proprietary dependencies, kernel or hypervisor
functionality, DRM bypasses, unbounded hardware access, or unsupported
compatibility claims.
Generated ELF files, core dumps, local build trees, device captures,
credentials, and operator-specific infrastructure are not source artifacts and
must not be committed.
## Disclosure
Coordinate remediation and disclosure with the repository owner before
publishing details that would materially increase exploitation risk.
TEST_PLAN.md
+1101
View File
File diff suppressed because it is too large Load Diff
THIRD_PARTY_NOTICES.md
+25
View File
@@ -0,0 +1,25 @@
# Third-party notices
No third-party source or binary is vendored in this repository.
| Project | Use | Pinned reference | License evidence |
|---|---|---|---|
| PS5 Payload SDK | external cross-toolchain and public stub evidence | v0.41 / `d2e2e585...` | GPLv3+ generally; BSD notices under `include/freebsd` |
| PS5 Payload Manager | exact installed runtime-control evidence; not redistributed | v0.3.1 / `cfbc70f30...` | GPLv3 |
| PS5 ELF Loader | exact installed loader evidence; not redistributed | v0.23 / `699e8bcff0...` | GPLv3-or-later |
| itsPLK ps5-elfldr | excluded comparison candidate; not installed or redistributed | v0.23.2 / `148b71c2fb...` | upstream GPL notice applies |
| PS5 SDL fork | external Phase-1 software-profile static link | `0baf4ac493...` / SDL 2.30.12 | Zlib (`LICENSE.txt`); reviewed overlay preserves this notice |
| RetroArch | separate private Phase-1 port fork; not vendored here | v1.22.2 / `69a4f0ea1...` | GPL-3.0-or-later (`COPYING` and source notices) |
| ps5-payload-shsrv | external protocol/source evidence; not built or redistributed | v0.7-v0.19 / `6f320637d...` current | GPL-3.0-or-later; bundled `libtelnet` files contain a public-domain dedication |
| PacBrew repository | build/port research | `c2abcfcb60...` | repository and per-package licenses apply |
| ps5-linux-loader | architecture research only | `8e7dd40df...` | upstream license/notices apply |
| actions/checkout | pinned Gitea CI checkout action | `11bd71901b...` | MIT |
The SDK release ZIP is downloaded into an ignored local `work/` directory or a
container layer and is not redistributed by this repository. Redistributors
must review the SDK's included notices and corresponding-source obligations.
`chimera-gfx` is GPL-3.0-or-later. This is compatible with linking the planned
adapter into GPLv3 RetroArch and with GPLv3-or-later SDK components, subject to
the normal GPL corresponding-source and notice requirements. This statement is
an engineering license choice, not legal advice.
adapters/retroarch/README.md
+11
View File
@@ -0,0 +1,11 @@
# RetroArch adapter boundary
The compiled scaffold exposes a dependency-free query contract. It reports
RGUI and SDL software fallback as the intended integration path, but reports
software-frame binding not yet implemented and hardware contexts unavailable.
Every hardware-context request returns `SAFETY_POLICY`.
The future driver lifecycle is: initialize a `chimera_gfx_context`, create one
surface, create/reuse textures for software core frames, upload a frame, present
through the selected backend, then destroy texture, surface, and context in
that order. No RetroArch private type or header enters the public library API.
adapters/retroarch/retroarch_adapter.c
+28
View File
@@ -0,0 +1,28 @@
/* SPDX-License-Identifier: GPL-3.0-or-later */
#include <chimera/gfx/adapters/retroarch.h>
chimera_gfx_status chimera_gfx_retroarch_query_scaffold(
chimera_gfx_retroarch_adapter_info *out_info) {
if (out_info == NULL || out_info->struct_size < sizeof(*out_info)) {
return CHIMERA_GFX_STATUS_INVALID_ARGUMENT;
}
out_info->struct_size = sizeof(*out_info);
out_info->api_version = CHIMERA_GFX_API_VERSION;
out_info->accepts_software_frames = 0u;
out_info->supports_hardware_contexts = 0u;
out_info->supports_rgui = 1u;
out_info->has_sdl_software_fallback = 1u;
return CHIMERA_GFX_STATUS_OK;
}
chimera_gfx_status
chimera_gfx_retroarch_bind_scaffold(chimera_gfx_context *context,
uint32_t request_hardware_context) {
if (context == NULL) {
return CHIMERA_GFX_STATUS_INVALID_ARGUMENT;
}
if (request_hardware_context != 0u) {
return CHIMERA_GFX_STATUS_SAFETY_POLICY;
}
return CHIMERA_GFX_STATUS_UNSUPPORTED;
}
adapters/sdl2/README.md
+11
View File
@@ -0,0 +1,11 @@
# SDL2 renderer adapter boundary
The compiled scaffold reports that no accelerated renderer exists and that the
current PS5 window, VideoOut, input, and audio facilities must remain owned by
SDL. Acceleration requests return `SAFETY_POLICY`; non-accelerated creation is
`UNSUPPORTED` until the real adapter phase.
The future renderer will translate SDL textures and presents to the stable
`libchimera-gfx` resource lifecycle without replacing SDL's platform backends.
The Phase-1 clear-frame sample is evidence for the existing SDL VideoOut route,
not an accelerated renderer implementation.
adapters/sdl2/sdl2_adapter.c
+28
View File
@@ -0,0 +1,28 @@
/* SPDX-License-Identifier: GPL-3.0-or-later */
#include <chimera/gfx/adapters/sdl2.h>
chimera_gfx_status
chimera_gfx_sdl2_query_scaffold(chimera_gfx_sdl2_adapter_info *out_info) {
if (out_info == NULL || out_info->struct_size < sizeof(*out_info)) {
return CHIMERA_GFX_STATUS_INVALID_ARGUMENT;
}
out_info->struct_size = sizeof(*out_info);
out_info->api_version = CHIMERA_GFX_API_VERSION;
out_info->accelerated_renderer_available = 0u;
out_info->reuses_ps5_window_backend = 1u;
out_info->reuses_ps5_input_audio = 1u;
out_info->software_fallback_required = 1u;
return CHIMERA_GFX_STATUS_OK;
}
chimera_gfx_status
chimera_gfx_sdl2_create_renderer_scaffold(chimera_gfx_context *context,
uint32_t request_acceleration) {
if (context == NULL) {
return CHIMERA_GFX_STATUS_INVALID_ARGUMENT;
}
if (request_acceleration != 0u) {
return CHIMERA_GFX_STATUS_SAFETY_POLICY;
}
return CHIMERA_GFX_STATUS_UNSUPPORTED;
}
cmake/README.md
+15
View File
@@ -0,0 +1,15 @@
# CMake helpers
Project-owned CMake modules are placed here as they become necessary. Phase 0
keeps policy in the top-level build so the enabled target graph is easy to
audit.
The Phase-1 VideoOut option imports an already verified static SDL build by
absolute path. It never downloads, patches, or executes a dependency during
CMake configuration; orchestration and pin checks live in
`tools/build-phase1-videoout.sh`.
The installed config exports the core as `chimera-gfx::chimera-gfx` and the
capability-honest interfaces as
`chimera-gfx::chimera-gfx-retroarch-scaffold` and
`chimera-gfx::chimera-gfx-sdl2-scaffold`.
cmake/chimera-gfx-config.cmake.in
+3
View File
@@ -0,0 +1,3 @@
@PACKAGE_INIT@
include("${CMAKE_CURRENT_LIST_DIR}/chimera-gfx-targets.cmake")
docs/DECISIONS.md
+16
View File
@@ -0,0 +1,16 @@
# Decision log
| Date | Decision | ADR | Status |
|---|---|---|---|
| 2026-07-16 | Create an independent `chimera-gfx` repository | ADR-0001 | accepted |
| 2026-07-16 | Treat GNM export names as discovery evidence only | ADR-0002 | accepted |
| 2026-07-16 | Keep the Phase-0 probe non-rendering and fail-closed | ADR-0003 | accepted |
| 2026-07-16 | Use GPL-3.0-or-later for project code | ADR-0004 | accepted |
| 2026-07-17 | Define the resource lifecycle through a non-rendering mock model | ADR-0005 | accepted |
| 2026-07-17 | Keep the first VideoOut experiment behind pinned SDL2 | ADR-0006 | accepted |
| 2026-07-17 | Bind every candidate to a machine-readable artifact manifest | ADR-0007 | accepted |
| 2026-07-17 | Allowlist 9.60 for probe builds while blocking SDK-CRT execution | ADR-0008 | accepted |
| 2026-07-17 | Block unproven minimal startup and permanently deny the legacy ELF | ADR-0009 | accepted |
New decisions that change safety, ABI, firmware, licensing, or adapter
boundaries require a numbered ADR and an update here.
docs/PUBLICATION_READINESS.md
+40
View File
@@ -0,0 +1,40 @@
# Publication readiness
The current source tip is prepared for public review. The repository remains
private until the history and security-contact decisions below are confirmed.
## Completed
- GPL-3.0-or-later license, contribution guidance, security policy, third-party
notices, and a user-oriented README are present.
- Development branches are consolidated into one reviewed candidate branch.
- No generated ELF, SDK archive, crash dump, device capture, or other binary
release artifact is tracked.
- Current source paths and manifests contain no private LAN repository URL or
operator-specific filesystem path.
- Host builds, policy tests, JSON validation, large-object review, and current
plus all-ref secret scans are part of the publication review.
- CI actions, container images, SDK downloads, and source revisions are pinned;
downloaded SDK bytes are verified before use. Distribution packages follow
the security-updated repository attached to the pinned base image rather than
stale exact package revisions.
- `SECURITY.md` publishes a fixed private reporting address.
- Pull requests from public forks cannot run on the self-hosted CI runner.
- `tools/export-public-source.sh` creates a parentless source candidate, strips
machine-local agent instructions, and rejects private deployment markers,
forbidden secret files, generated binaries, and oversized files.
## Decisions required before changing visibility
1. **Release policy.** Recommended: publish reviewed source only. Do not attach
runnable PS5 ELF artifacts; if that policy changes later, require reproducible
builds, checksums, corresponding source, and a separate safety review.
Historical commits contain an old private LAN URL, operator-specific paths, and
author email metadata. Keep that canonical history private and publish only the
parentless export from a reviewed commit. Deleting branches is not a substitute
for this export.
Generated payloads, crash dumps, SDK archives, local hardware captures, and
unredacted operator records are not public source artifacts and must remain
outside Git.
docs/adr/0001-standalone-repository.md
+15
View File
@@ -0,0 +1,15 @@
# ADR-0001: Standalone repository
- Status: accepted
- Date: 2026-07-16
## Decision
`chimera-gfx` is a new repository and workspace, not a subdirectory, worktree,
submodule, or branch of the existing Chimera project.
## Consequences
It has an independent Git history, private Gitea origin, license, CI, release
policy, dependencies, and risk boundary. No path or build step refers to the
existing Chimera repository.
docs/adr/0002-export-names-are-not-abi.md
+21
View File
@@ -0,0 +1,21 @@
# ADR-0002: Export names are not ABI definitions
- Status: accepted
- Date: 2026-07-16
## Context
The public PS5 Payload SDK v0.41 contains GNM export stubs but no GNM headers,
structure definitions, or GPU samples.
## Decision
An export name proves only that the pinned stub set exposes that name. No C
prototype, calling convention detail, structure layout, ownership rule, or
semantic behavior is inferred from it. Phase 0 may resolve a name and record a
boolean, but may not call the result.
## Consequences
Even `sceGnmAreSubmitsAllowed` is not called. Each future ABI must be accepted
through a new evidence record before use.
docs/adr/0003-fail-closed-probe.md
+20
View File
@@ -0,0 +1,20 @@
# ADR-0003: Fail-closed capability probe
- Status: accepted
- Date: 2026-07-16
## Decision
The PS5 probe is disabled in ordinary builds. A probe build embeds exactly one
approved firmware identifier, defaulting to `NONE`. Runtime requires an exact
firmware match and the literal `--acknowledge-read-only-probe` argument before
module loading. The checked-in firmware matrix is empty.
The platform shim may call only `dlopen`, `dlsym`, and `dlclose`. Logs contain
symbol names and booleans, never addresses. There is no deploy target.
## Consequences
Default artifacts cannot discover symbols on hardware. A deliberately gated
artifact still requires separate human authorization before transfer or
execution. Loader-internal side effects remain an explicitly recorded unknown.
docs/adr/0004-license.md
+15
View File
@@ -0,0 +1,15 @@
# ADR-0004: GPL-3.0-or-later
- Status: accepted
- Date: 2026-07-16
## Decision
Project-owned code is licensed GPL-3.0-or-later.
## Rationale
The planned RetroArch adapter targets a GPLv3 project and the PS5 Payload SDK is
generally GPLv3-or-later. A common GPL-compatible project license keeps the
combined distribution boundary understandable. Third-party code is not
vendored and retains its own notices.
docs/adr/0005-versioned-resource-lifecycle.md
+24
View File
@@ -0,0 +1,24 @@
# ADR-0005: Versioned resource lifecycle and host present model
- Status: accepted
- Date: 2026-07-17
## Decision
API version 2 includes opaque contexts, surfaces, and textures, plus sized
descriptors for texture upload and present. Context destruction returns
`RESOURCE_BUSY` while child handles exist. The version-1 `chimera_gfx_destroy`
symbol remains as a void compatibility wrapper for childless contexts. The
mock backend implements the complete ownership model in host memory and records
deterministic present serials and content hashes.
The mock present is a state transition, not a graphical operation. It creates
no window, accesses no display, and advertises both `NON_RENDERING` and
`HOST_TEST_ONLY`. The PS5 backend is a separate compiled unit that refuses
context creation with `SAFETY_POLICY`.
## Consequences
Adapter work can compile and test lifecycle assumptions before a hardware ABI
exists. Future backends must preserve validation and cleanup semantics, but
must not inherit mock capabilities without evidence.
docs/adr/0006-phase1-sdl-videoout-boundary.md
+29
View File
@@ -0,0 +1,29 @@
# ADR-0006: Phase-1 VideoOut experiment stays behind SDL2
- Status: accepted
- Date: 2026-07-17
## Context
The public SDK v0.41 exports VideoOut stubs but supplies no official VideoOut
headers. The pinned PS5 SDL2 fork contains a working framebuffer route, but its
backend declares opaque layouts with fields named `junk`. Those declarations
are public source evidence of the upstream implementation, not a sufficiently
proven ABI for duplication in `chimera-gfx`.
## Decision
The first presentation candidate calls only public SDL2 APIs. A reviewed
Zlib-licensed build overlay removes SDL's unrelated keyboard/IME initialization
from this candidate. Project code does not copy a VideoOut prototype or data
layout. The target is disabled by default, requires the PS5 toolchain and an
explicit SDL build path, and embeds the same `NONE` firmware gate as the probe.
The candidate does not link SDL2main because that wrapper hides the splash
screen before application-level firmware validation.
## Consequences
The upstream SDL backend remains the owner of VideoOut, direct memory, tiling,
flip, and cleanup. Its unbounded flip wait is a known hardware-test blocker;
successful offline compilation is not runtime approval or ABI proof.
docs/adr/0007-artifact-provenance.md
+15
View File
@@ -0,0 +1,15 @@
# ADR-0007: Artifact provenance is machine-readable and fail-closed
- Status: accepted
- Date: 2026-07-17
## Decision
Every review or hardware candidate uses artifact-manifest schema version 1.
The manifest binds filename, size, SHA-256, target, clean source commit,
toolchain pins, optional SDL commit, firmware gate, and explicit non-execution
state. Generation and verification are separate tested tools.
An artifact with firmware identifier `NONE` is never allowlisted. Any rebuild,
including a firmware-specific rebuild, creates a new digest and therefore
requires a new artifact-specific approval.
docs/adr/0008-firmware-9.60-probe-build.md
+39
View File
@@ -0,0 +1,39 @@
# ADR-0008: Firmware 9.60 is build-allowlisted; SDK-CRT execution is blocked
- Status: accepted
- Date: 2026-07-17
## Context
Jens reported exact PS5 firmware `9.60` and authorized an offline-only,
non-rendering capability-probe build and audit. Transfer, connection, execution,
VideoOut, framebuffer/GPU/GNM mutation, draw, dispatch, submit, flip, MMIO,
register writes, and kernel/firmware changes remain prohibited.
The pinned public SDK v0.41 source was audited beyond project `main`. Its
payload startup calls `__patch_init` before `main`. That function changes the
current process's kernel credential fields and syscall-address bounds using the
SDK kernel read/write path. The SDK rtld also ensures `libSceSysmodule.sprx` is
available during startup. A later project `dlopen` can load/start
`libSceGnmDriver.sprx`; `dlclose` can stop/unload it.
## Decision
The discovery manifest and probe configure gate accept exactly `9.60`; the
default remains `NONE`. This allowlist entry authorizes only a reproducible
offline build. Phase-1 VideoOut rejects every non-`NONE` firmware gate.
The resulting 9.60 ELF is named `offline-audit-only`, records zero transfer and
execution, and is not execution-eligible. No literal execution approval is
offered while the linked SDK CRT performs kernel writes before the project gate.
## Consequences
- Project code still invokes no resolved GNM pointer and contains no rendering,
submit, draw, dispatch, flip, or GPU-memory operation.
- The artifact is useful for deterministic compilation, import/disassembly
review, hashing, and future startup research only.
- A new ADR and a new hash-bound build are required after a public,
kernelwrite-free startup/loader route is proven.
- Transfer or execution of this artifact would violate the current safety
policy even if Jens later supplied a generic execution approval.
docs/adr/0009-block-unproven-minimal-startup.md
+43
View File
@@ -0,0 +1,43 @@
# ADR-0009: Block unproven minimal startup and permanently deny legacy ELF
Status: accepted
Date: 2026-07-17
## Context
SDK v0.41's stock `crt1.o` performs prohibited kernel credential and
syscall-bound writes before project `main`. Phase 0.5 tested whether omitting
the CRT could support a deterministic freestanding entry. Compiler and linker
evidence proves omission is mechanically possible, but no exact pinned loader
caller is locally available to prove stack, argument ownership, safe return,
post-return cleanup, crash handling, or pre-entry process changes.
The already-built firmware-9.60 capability probe has SHA-256
`4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63`
and must remain permanently blocked.
## Decision
Do not create a minimal-startup source or PS5 ELF while the caller contract is
unproven. Keep `CHIMERA_GFX_BUILD_PS5_MINIMAL_STARTUP` as an unconditional
configure-time failure with the evidence blocker stated in its message.
Require every artifact manifest to state `execution_eligible` explicitly. New
manifests default to false. Maintain a permanent SHA-256 denylist and a
fail-closed policy tool that refuses false eligibility, malformed records,
changed bytes, or a denylist match. Passing this static layer does not grant
execution authority.
## Consequences
- no Phase-0.5 PS5 ELF, linker map, artifact disassembly, or artifact hash
exists;
- stock CRT evidence remains available for review without making a safe-runtime
claim;
- the legacy firmware-9.60 ELF cannot become eligible through a later manifest
edit or approval record;
- a Payload Manager can consume the JSON policy tool, but the manager's own
implementation remains outside this repository and cannot be claimed
reviewed here;
- work may continue through mock/software backends or a separately scoped
Linux-on-PS5 backend.
docs/adr/0010-controlled-runtime-effects.md
+45
View File
@@ -0,0 +1,45 @@
# ADR-0010: Controlled runtime effects and Phase-0.6 gate
Status: accepted on 2026-07-17.
## Context
ADR-0009 asked whether a fully kernelwrite-free startup could be proven while
the exact loader was absent. The current task corrects the safety model:
documented, bounded, volatile runtime changes may be acceptable. Persistent
writes and unbounded or unknown effects remain hard blockers.
The installed Payload Manager and elfldr were subsequently identified exactly.
Their public source exposes both acceptable volatile effects and unresolved
unbounded paths.
## Decision
Classify each lifecycle effect as exactly one of:
- `EXPECTED_VOLATILE_RUNTIME_EFFECT`;
- `RESTORED_BY_LOADER`;
- `PAYLOAD_PROCESS_LOCAL`;
- `PERSISTENT_WRITE`;
- `UNBOUNDED_OR_UNKNOWN`.
Only the final two are categorical blockers. `__patch_init` is classified as
payload-process-local and is no longer an automatic blocker.
Every potentially eligible artifact must also have a profile named exactly
`controlled-ps5-runtime`, with exact firmware/loader/SDK/artifact identity,
an explicit list of expected volatile effects, zero persistent and filesystem
writes, no payload network, a maximum 2000 ms runtime, no retry, no hard
effects, and no hard blockers. Both the profile and static gate explicitly set
`execution_authorized=false`; static eligibility never grants execution
authority.
## Consequences
Phase 0.6 remains blocked because the exact chain has unbounded ptrace loops,
no payload watchdog, unresolved termination/cleanup, incomplete credential
restoration, no launch-time hash enforcement, and a persistent manager upload
path. No lifecycle source or ELF is built.
ADR-0009 and its Phase-0.5 evidence remain historical records. The permanent
artifact denylist is unchanged.
docs/adr/0011-phase07-hardened-controlled-runtime.md
+49
View File
@@ -0,0 +1,49 @@
# ADR-0011: Phase-0.7 hardened controlled runtime
- Status: accepted for offline deployment preparation
- Date: 2026-07-17
- Decision: `READY_FOR_HARDENED_RUNTIME_DEPLOYMENT`
## Context
Phase 0.6 identified exact upstream loader and Payload Manager versions but
found unbounded ptrace completion, incomplete credential restoration, missing
reaping/watchdog behavior, and a path-based unhashed launch route. Those
findings were implementation inputs, not permanent platform blockers.
Jens explicitly confirmed exact firmware 9.60. Independent device attestation
is therefore not a Phase-0.7 blocker. The controlled upload below
`/data/pldmgr/payloads/chimera-controlled` is an allowed, removable
application write and is not a firmware write.
## Decision
Use private GPL-3.0 hardening forks based on:
- elfldr `699e8bcff03e91e8d6ca6eba281af25c5a58d8c2`;
- Payload Manager `cfbc70f30f419b09bf2b52283f7409e2d3117ee1`;
- PS5 Payload SDK `d2e2e585740362976a39fdd5ccf390f199a7bc37`.
The controlled route is a versioned loopback-only protocol with exact
firmware, artifact ID, size, SHA-256, timeout, and no-retry metadata. elfldr
rehashes received bytes, enforces the permanent denylist, applies bounded
ptrace steps and cleanup, and reaps the child through a two-second watchdog.
The controlled manager is compiled for one exact lifecycle artifact and opens,
hashes, rewinds, and streams one no-follow file descriptor.
The lifecycle probe uses normal SDK v0.41 startup, performs one
`sceKernelSendNotificationRequest`, and calls `_exit`; it does not return
through `payload_terminate`.
## Consequences
The three ELFs are eligible for a later, separately authorized hardened
runtime installation. This decision does not authorize installation,
transfer, or execution. The previously blocked SHA-256
`4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63`
remains permanently denied.
Normal SDK startup still reaches documented process-local patch and runtime
initialization. The existing elfldr bootstrap still enables volatile QA flags.
Both facts are explicit expected runtime effects; neither is silently claimed
kernelwrite-free.
docs/adr/0012-phase10j-first-frame-identity.md
+38
View File
@@ -0,0 +1,38 @@
# ADR-0012: Phase-1.0J first-frame identity
- Status: accepted for offline diagnostic construction
- Date: 2026-07-22
- Decision: `FIRST_FRAME_INDEX_ZERO_SOURCE_CONSISTENCY_ONLY`
## Context
The consumed Phase-1.0H run submitted the diagnostic buffer with
`sceVideoOutSubmitFlip(handle, 0, 1, 0)` and received `-1`. The diagnostic
helper used buffer zero, while the patched normal SDL update path started its
frame counter at one. The public PS5 SDL source at commit
`0baf4ac49382b537ba449901b5b6d0d189bb1fbb` starts that normal counter at
zero. Phase 1.0I classified the mismatch as a strong source candidate, not a
proven firmware root cause.
## Decision
The Phase-1.0J SDL overlay defines one compile-time source of truth,
`CHIMERA_PS5_FIRST_FRAME_INDEX`, with value zero. The early diagnostic copy,
the early diagnostic submit and the normal update counter all derive their
initial index from that macro.
Zero is selected because it preserves the already-audited diagnostic tuple
and agrees with the public SDL source. It is not selected on the basis of an
unpublished ABI or an inferred firmware requirement.
## Consequences
The internal zero-versus-one inconsistency is removed and can be checked in
source, linker-map and disassembly evidence. This decision does not prove that
buffer zero is accepted on firmware 9.60, that the fourth flip argument has
the required semantics, or that the old mismatch caused the Phase-1.0H
failure.
Phase 1.0J remains an offline artifact phase. A separately reviewed exact
artifact and new explicit permission would be required before any connection,
transfer, result reception or execution.
docs/approvals/phase-0.8-bounded-observation-template.md
+131
View File
@@ -0,0 +1,131 @@
# Phase 0.8 future bounded-observation permission template
Status: **TEMPLATE ONLY — NOT AUTHORIZED**.
This file is not permission. Empty, `null`, zero, missing, ambiguous, expired,
or inconsistent input means `STOP`. Copying, editing, signing, or committing
the template does not itself authorize a connection, transfer, or execution.
Authorization can exist only through a new exact statement from Jens in the
active task after the proposed method and its complete effect contract have
been reviewed.
The template may describe only a separately named bounded-observation phase.
It cannot authorize installation, rollback creation, lifecycle execution,
autoload, retry, graphics work, or RetroArch work.
## Machine-readable default state
The validator requires every authority value below to remain `false` in the
repository template and every request-specific field to remain unfilled.
<!-- BEGIN PHASE08_BOUNDED_OBSERVATION_TEMPLATE -->
```json
{
"template_only": true,
"authorized": false,
"execution_authorized": false,
"transfer_authorized": false,
"installation_authorized": false,
"lifecycle_authorized": false,
"automatic_retry": false,
"required_fields": {
"exact_user_statement": null,
"authorization_date": null,
"expiration_time": null,
"device_identity": null,
"exact_purpose": null,
"exact_observations": null,
"method_or_collector_id": null,
"source_commit": null,
"collector_file_size": null,
"collector_sha256": null,
"firmware_gate": null,
"maximum_runtime_ms": null,
"maximum_execution_count": null,
"maximum_transfer_count": null,
"network_behavior": null,
"output_channel": null,
"allowed_volatile_effects": null,
"prohibited_persistent_effects": null,
"stop_criteria": null,
"cleanup_requirements": null,
"reporting_requirements": null,
"explicit_installation_exclusion": null,
"explicit_lifecycle_probe_exclusion": null,
"explicit_autoload_and_retry_exclusion": null,
"explicit_graphics_and_retroarch_exclusion": null,
"revocation_method": null,
"manual_confirmation_template_does_not_authorize": null
},
"fixed_exclusions": {
"installation": true,
"lifecycle_probe": true,
"autoload": true,
"automatic_retry": true,
"gnm": true,
"videoout": true,
"sdl": true,
"retroarch": true
}
}
```
<!-- END PHASE08_BOUNDED_OBSERVATION_TEMPLATE -->
## Required human review fields
Every field below must be supplied in a later review package. Do not fill it
in this repository template.
- Exact user statement:
- Authorization date and timezone:
- Expiration time and timezone:
- Device identity:
- Exact purpose:
- Exact observations:
- Method or collector ID:
- Source repository and commit:
- Collector filename:
- Collector byte size:
- Collector SHA-256:
- Exact firmware gate:
- Maximum runtime:
- Maximum execution count:
- Maximum transfer count:
- Network behavior, addresses, ports, direction, and connection count:
- Output channel and maximum output:
- Exhaustive allowed volatile effects:
- Exhaustive forbidden persistent and functional effects:
- STOP criteria:
- Cleanup requirements:
- Reporting and raw-evidence requirements:
- Explicit installation exclusion:
- Explicit lifecycle-probe exclusion:
- Explicit autoload and retry exclusion:
- Explicit GNM, VideoOut, SDL, and RetroArch exclusion:
- Revocation method and immediate-stop behavior:
- Manual confirmation that this template is not authorization:
No artifact ID, filename, size, SHA-256, path, ABI, syscall, loader contract,
transport, or execution mechanism is implied by these empty fields.
## Mandatory future effect boundary
A future request must enumerate every allowed category-C volatile effect
before authorization. All category-A persistent mutations and category-B
functional mutations remain prohibited unless a different, explicitly
mutating phase is designed and separately authorized.
Unknown behavior, an unspecified effect, an identity mismatch, a partial
dataset, a timeout, an expired authorization, a count overrun, an unexpected
log, or cleanup uncertainty means immediate `STOP` with no automatic retry.
The approved observation count, transfer count, and execution count—if any—
must be literal bounded integers. No value carries into rollback preparation,
installation, lifecycle testing, graphics, or RetroArch.
## Revocation
Jens may revoke a later authorization at any time before or during the
authorized window. Revocation, ambiguity, interruption, or conflicting
instructions causes fail-closed stop. Revocation never triggers cleanup that
was not already explicitly reviewed and authorized.
docs/approvals/phase-0.9-backup-creation-template.md
+69
View File
@@ -0,0 +1,69 @@
# Phase 0.9 future backup-creation approval template
Status: **TEMPLATE ONLY — NOT AUTHORIZED**.
This template is for one possible future backup-creation change window for one
component. It cannot authorize observation collection, staging, switch,
installation, execution, lifecycle, autoload, retry or a second component.
<!-- BEGIN PHASE09_BACKUP_CREATION_TEMPLATE -->
```json
{
"template_only": true,
"template_action": "backup_creation",
"authorized": false,
"installation_authorized": false,
"execution_authorized": false,
"transfer_authorized": false,
"lifecycle_authorized": false,
"automatic_retry": false,
"required_fields": {
"exact_user_statement": null,
"active_task_id": null,
"authorization_issued_at": null,
"authorization_expires_at": null,
"device_identity": null,
"firmware_exact": null,
"component": null,
"exact_action": null,
"maximum_action_count": null,
"maximum_runtime_ms": null,
"live_path": null,
"live_mount_id": null,
"live_object_id": null,
"live_type": null,
"live_size": null,
"live_sha256": null,
"backup_path": null,
"backup_mount_id": null,
"minimum_free_bytes_and_metadata_reserve": null,
"reopen_and_rehash_contract": null,
"target_mapping": null,
"independent_recovery_executor": null,
"second_independent_recovery_path": null,
"allowed_persistent_effects": null,
"forbidden_effects": null,
"cleanup_contract": null,
"stop_conditions": null,
"revocation_method": null,
"reviewer": null
},
"fixed_exclusions": {
"staging": true,
"switch": true,
"installation": true,
"execution": true,
"second_component": true,
"lifecycle_probe": true,
"autoload": true,
"automatic_retry": true,
"graphics": true,
"retroarch": true
}
}
```
<!-- END PHASE09_BACKUP_CREATION_TEMPLATE -->
The exact current live identity and separate backup destination must be filled
from later admissible evidence. A stock reference hash does not fill this
template. The Payload Manager backup hard gate remains open.
docs/approvals/phase-0.9-observation-template.md
+64
View File
@@ -0,0 +1,64 @@
# Phase 0.9 future observation approval template
Status: **TEMPLATE ONLY — NOT AUTHORIZED**.
This template never grants permission. It is bound only to a possible future
observation action and cannot authorize backup creation, staging, switch,
installation, lifecycle, execution, autoload, retry, graphics or RetroArch.
Every request-specific value is deliberately empty.
<!-- BEGIN PHASE09_OBSERVATION_TEMPLATE -->
```json
{
"template_only": true,
"template_action": "observation",
"authorized": false,
"installation_authorized": false,
"execution_authorized": false,
"transfer_authorized": false,
"lifecycle_authorized": false,
"automatic_retry": false,
"required_fields": {
"exact_user_statement": null,
"active_task_id": null,
"authorization_issued_at": null,
"authorization_expires_at": null,
"device_identity": null,
"firmware_exact": null,
"firmware_source_one": null,
"firmware_source_two": null,
"component": null,
"exact_action": null,
"maximum_action_count": null,
"maximum_runtime_ms": null,
"collector_or_artifact_id": null,
"collector_or_artifact_size": null,
"collector_or_artifact_sha256": null,
"source_commit": null,
"allowed_observations": null,
"allowed_volatile_effects": null,
"forbidden_effects": null,
"output_contract": null,
"cleanup_contract": null,
"stop_conditions": null,
"revocation_method": null,
"reviewer": null
},
"fixed_exclusions": {
"backup_creation": true,
"staging": true,
"switch": true,
"installation": true,
"execution": true,
"lifecycle_probe": true,
"autoload": true,
"automatic_retry": true,
"graphics": true,
"retroarch": true
}
}
```
<!-- END PHASE09_OBSERVATION_TEMPLATE -->
Empty, ambiguous, expired, mismatched or unreviewed data means `STOP`. A copy,
signature, edit or commit of this file is not approval.
docs/approvals/phase-0.9-one-shot-execution-template.md
+64
View File
@@ -0,0 +1,64 @@
# Phase 0.9 future one-shot execution approval template
Status: **TEMPLATE ONLY — NOT AUTHORIZED**.
This template can be considered only after a separately approved switch,
durable post-switch identity verification and human review. It is bound to one
component and one manual execution. It does not authorize transfer,
installation, lifecycle-probe execution, autoload, retry or another component.
<!-- BEGIN PHASE09_ONE_SHOT_EXECUTION_TEMPLATE -->
```json
{
"template_only": true,
"template_action": "one_shot_execution",
"authorized": false,
"installation_authorized": false,
"execution_authorized": false,
"transfer_authorized": false,
"lifecycle_authorized": false,
"automatic_retry": false,
"required_fields": {
"exact_user_statement": null,
"active_task_id": null,
"authorization_issued_at": null,
"authorization_expires_at": null,
"device_identity": null,
"firmware_exact": null,
"component": null,
"exact_action": null,
"maximum_execution_count": null,
"maximum_runtime_ms": null,
"live_artifact_id": null,
"live_source_commit": null,
"live_size": null,
"live_sha256": null,
"live_mount_id": null,
"live_object_id": null,
"post_switch_verification_evidence": null,
"verified_backup_identity": null,
"independent_recovery_executor": null,
"success_criteria": null,
"stop_conditions": null,
"cleanup_contract": null,
"reporting_contract": null,
"revocation_method": null,
"reviewer": null
},
"fixed_exclusions": {
"transfer": true,
"installation": true,
"second_execution": true,
"second_component": true,
"lifecycle_probe": true,
"autoload": true,
"automatic_retry": true,
"graphics": true,
"retroarch": true
}
}
```
<!-- END PHASE09_ONE_SHOT_EXECUTION_TEMPLATE -->
The template itself is not a request and is not permission. Phase 0.9A does
not ask for execution approval.
docs/approvals/phase-0.9-staging-template.md
+63
View File
@@ -0,0 +1,63 @@
# Phase 0.9 future staging approval template
Status: **TEMPLATE ONLY — NOT AUTHORIZED**.
This template could bind one future inactive candidate-staging action. It
cannot authorize a live switch, installation, execution, lifecycle, autoload,
retry or a second component.
<!-- BEGIN PHASE09_STAGING_TEMPLATE -->
```json
{
"template_only": true,
"template_action": "staging",
"authorized": false,
"installation_authorized": false,
"execution_authorized": false,
"transfer_authorized": false,
"lifecycle_authorized": false,
"automatic_retry": false,
"required_fields": {
"exact_user_statement": null,
"active_task_id": null,
"authorization_issued_at": null,
"authorization_expires_at": null,
"device_identity": null,
"firmware_exact": null,
"component": null,
"exact_action": null,
"maximum_action_count": null,
"maximum_runtime_ms": null,
"candidate_artifact_id": null,
"candidate_source_commit": null,
"candidate_size": null,
"candidate_sha256": null,
"staging_path": null,
"staging_mount_id": null,
"staging_inactive_proof": null,
"verified_backup_identity": null,
"verified_backup_sha256": null,
"candidate_reopen_and_rehash_contract": null,
"allowed_persistent_effects": null,
"forbidden_effects": null,
"cleanup_contract": null,
"stop_conditions": null,
"revocation_method": null,
"reviewer": null
},
"fixed_exclusions": {
"live_switch": true,
"installation": true,
"execution": true,
"second_component": true,
"lifecycle_probe": true,
"autoload": true,
"automatic_retry": true,
"graphics": true,
"retroarch": true
}
}
```
<!-- END PHASE09_STAGING_TEMPLATE -->
A candidate hash or offline build record alone never authorizes staging.
docs/approvals/phase-0.9-switch-template.md
+67
View File
@@ -0,0 +1,67 @@
# Phase 0.9 future live-switch approval template
Status: **TEMPLATE ONLY — NOT AUTHORIZED**.
This template is limited to one future switch of one separately staged
component. It cannot authorize staging, execution, lifecycle, rollback,
autoload, retry or a second component.
<!-- BEGIN PHASE09_SWITCH_TEMPLATE -->
```json
{
"template_only": true,
"template_action": "live_switch",
"authorized": false,
"installation_authorized": false,
"execution_authorized": false,
"transfer_authorized": false,
"lifecycle_authorized": false,
"automatic_retry": false,
"required_fields": {
"exact_user_statement": null,
"active_task_id": null,
"authorization_issued_at": null,
"authorization_expires_at": null,
"device_identity": null,
"firmware_exact": null,
"component": null,
"exact_action": null,
"maximum_action_count": null,
"maximum_runtime_ms": null,
"live_path_mount_object_size_sha256": null,
"backup_path_mount_object_size_sha256": null,
"candidate_path_mount_object_size_sha256": null,
"target_quiescence_evidence": null,
"autoload_and_retry_disabled_evidence": null,
"atomic_switch_primitive_identity": null,
"atomicity_evidence": null,
"file_durability_evidence": null,
"directory_durability_evidence": null,
"power_loss_evidence": null,
"post_switch_verification_contract": null,
"independent_recovery_executor": null,
"rollback_target_mapping": null,
"allowed_persistent_effects": null,
"forbidden_effects": null,
"stop_conditions": null,
"revocation_method": null,
"reviewer": null
},
"fixed_exclusions": {
"staging": true,
"execution": true,
"second_component": true,
"lifecycle_probe": true,
"autoload": true,
"automatic_retry": true,
"in_place_overwrite": true,
"two_step_rename_gap": true,
"graphics": true,
"retroarch": true
}
}
```
<!-- END PHASE09_SWITCH_TEMPLATE -->
While atomicity or durability is `UNPROVEN`, this template must remain empty
and no switch request may be made.
docs/approvals/phase-0.9b-observer-execution-template.md
+76
View File
@@ -0,0 +1,76 @@
# Phase 0.9B future observer execution template
Status: **TEMPLATE ONLY — NOT AUTHORIZED — BLOCKED**.
This file cannot authorize an action. There is no observer artifact to bind,
and the startup/exit and output-channel gates are blocked. Every
request-specific value is deliberately empty. Editing, signing, copying,
committing or pushing this template does not grant permission.
<!-- BEGIN PHASE09B_OBSERVER_EXECUTION_TEMPLATE -->
```json
{
"template_only": true,
"phase": "0.9B",
"action": "one_shot_observer_execution",
"status": "BLOCKED",
"authorized": false,
"transfer_authorized": false,
"execution_authorized": false,
"installation_authorized": false,
"lifecycle_authorized": false,
"autoload_authorized": false,
"backup_creation_authorized": false,
"automatic_retry": false,
"observer_only": true,
"required_fields": {
"exact_user_statement": null,
"active_task_id": null,
"authorization_issued_at": null,
"authorization_expires_at": null,
"device_identity": null,
"firmware_exact": null,
"firmware_source_one": null,
"firmware_source_two": null,
"observer_build_id": null,
"observer_source_commit": null,
"observer_size": null,
"observer_sha256": null,
"toolchain_identity": null,
"runtime_path": null,
"allowed_observations": null,
"allowed_read_paths": null,
"output_channel": null,
"maximum_runtime_ms": null,
"maximum_execution_count": null,
"stop_criteria": null,
"reviewer": null
},
"fixed_exclusions": {
"device_address": true,
"installation": true,
"lifecycle": true,
"autoload": true,
"automatic_retry": true,
"backup_creation": true,
"file_mutation": true,
"process_or_service_mutation": true,
"listener_creation": true,
"kernelwrite": true,
"graphics": true,
"sdl": true,
"retroarch": true
},
"blocking_facts": [
"OBSERVER_STARTUP_OR_EXIT_ABI_UNPROVEN",
"NO_PROVEN_NON_PERSISTENT_OUTPUT_CHANNEL",
"OBSERVER_ARTIFACT_ABSENT"
]
}
```
<!-- END PHASE09B_OBSERVER_EXECUTION_TEMPLATE -->
A future request would need a new active-task authorization bound to one exact
artifact, device, firmware, output channel, observation plan, runtime,
one execution and expiration. That later request still could not authorize
installation, lifecycle, backup creation, autoload or retry.
docs/approvals/phase-0.9e-r-y2jb-deployed-use-attestation.md
+57
View File
@@ -0,0 +1,57 @@
# Phase 0.9E-R Y2JB deployed-use operator attestation
Status: `UNATTESTED_TEMPLATE`
This template records a future operator statement. It is not device evidence,
runtime verification, permission, or approval. Do not add secrets, PS5
addresses, account identifiers, signed download URLs, or credentials.
```yaml
schema_version: 1
phase: PHASE_0_9E_R_Y2JB_DEPLOYED_USE_ATTESTATION
attested: false
attestation_date: null
operator: null
outer_zip:
file_name: null
sha256: null
size: null
obtained_from: null
installation_date_exact_or_estimated: null
installation_date_is_estimate: null
restore_or_install_method: null
firmware_at_restore_or_install: null
subsequent_changes:
another_y2jb_backup_applied: null
download0_dat_replaced_separately: null
youtube_or_appdata_changed: null
external_autoloader_used: null
external_autoloader_identity: null
host_sender:
tool_name: null
path_or_source: null
version_or_commit: null
sha256: null
default_port: null
ports_actually_selected: []
classification_when_completed: OPERATOR_ATTESTED_DEPLOYED_USE
runtime_verified: false
device_action_authorized: false
target_build_authorized: false
execution_authorized: false
installation_authorized: false
transfer_authorized: false
lifecycle_authorized: false
autoload_authorized: false
device_write_authorized: false
automatic_retry: false
```
An incomplete or completed statement never changes `runtime_verified` and
never authorizes a device action. Any later use requires a separate review and
artifact-specific authorization.
docs/approvals/phase-1.0aa-offline-fake-adapter.md
+25
View File
@@ -0,0 +1,25 @@
# Phase 1.0AA offline fake-adapter approval record
This tracked record is deliberately inactive and authorizes no live action.
- `active=false`
- `attested=false`
- `run_id=null`
- `target_address=null`
- `target_port=null`
- `window=null`
- `ps5_connection_authorized=false`
- `device_request_authorized=false`
- `result_receive_authorized=false`
- `target_build_authorized=false`
- `device_transfer_authorized=false`
- `device_execution_authorized=false`
- `installation_authorized=false`
- `autoload_authorized=false`
- `device_write_authorized=false`
- `automatic_retry=false`
- `reconnect_authorized=false`
- `resume_authorized=false`
The fake integration cannot consume a live approval and exposes no live
adapter. A later phase and new exact permission would be required first.
docs/approvals/phase-1.0ab-live-adapter-feasibility.md
+23
View File
@@ -0,0 +1,23 @@
# Phase 1.0AB live-adapter feasibility approval record
This tracked record is inactive and grants no network or device authority.
- `active=false`
- `attested=false`
- `target_address=null`
- `target_port=null`
- `run_id=null`
- `ps5_connection_authorized=false`
- `device_request_authorized=false`
- `result_receive_authorized=false`
- `target_build_authorized=false`
- `device_transfer_authorized=false`
- `device_execution_authorized=false`
- `installation_authorized=false`
- `autoload_authorized=false`
- `device_write_authorized=false`
- `automatic_retry=false`
- `reconnect_authorized=false`
- `resume_authorized=false`
The trace model cannot connect and cannot consume an approval.
docs/approvals/phase-1.0ac-dormant-adapter.md
+24
View File
@@ -0,0 +1,24 @@
# Phase 1.0AC inactive record
This is not a device approval.
```text
active=false
target_address=null
target_port=null
run_id=null
ps5_connection_authorized=false
device_request_authorized=false
result_receive_authorized=false
device_transfer_authorized=false
device_execution_authorized=false
installation_authorized=false
autoload_authorized=false
device_write_authorized=false
automatic_retry=false
reconnect_authorized=false
resume_authorized=false
```
Phase 1.0AC contains only host-side synthetic tests. No value in this file can
activate a transport or authorize a later action.
docs/approvals/phase-1.0b-device-smoke-template.md
+50
View File
@@ -0,0 +1,50 @@
# Phase 1.0B device-smoke approval template
This template is intentionally empty and non-authorizing.
```yaml
authorized: false
transfer_authorized: false
execution_authorized: false
installation_authorized: false
autoload_authorized: false
automatic_retry: false
artifact:
label: retroarch_ps5_software_smoke.elf
sha256: null
size: null
chimera_retroarch_source_commit: null
build_manifest_sha256: null
operator_observation:
firmware_text: null
firmware_expected: "9.60"
observed_by: null
observed_at: null
window:
maximum_transfers: 1
maximum_executions: 1
maximum_runtime_ms: 60000
live_replacement: false
retry: false
autoload: false
installation: false
expected_visible_phases:
- S07_RUNNING
- S08_SHUTDOWN_REQUESTED
expected_shutdown:
- OPTIONS_HOLD_2000_MS
- RUNTIME_LIMIT_60000_MS
- FRAME_LIMIT_3600
accepted_remaining_risks: []
operator_stop_criteria_reviewed: false
```
An edited copy is not valid unless every identity is exact and a new active
task explicitly grants that artifact-specific transfer and execution. This
template is not an execution package and contains no address, sender or
device command.
docs/approvals/phase-1.0cz-launch-canary-template.md
+10
View File
@@ -0,0 +1,10 @@
# Phase 1.0CZ launch-canary approval template
This tracked document is intentionally inactive and is not permission.
An active approval must be supplied separately in the active task by Jens and
must name the exact SHA-256
`8dadce9d9faaef21ea129a3d216c768eea9a3ca9bf8ecb8d852e376b58a9bf95`,
firmware 9.60, the raw-elfldr baseline route, target, port, unique run ID,
timeout, one transfer, one execution and one bounded result reception. It must
also state no installation, autoload, device write, retry, reconnect or reboot.
docs/approvals/phase-1.0do-snapshot-runner-template.json
+1
View File
@@ -0,0 +1 @@
{"active":false,"run_id":null,"target":null,"port":9021,"artifact_size":109896,"artifact_sha256":"147b5bede0f0b5b7d2be903bc72ff0d0541a2cdc28eae7d86b6bf95e1978ebdf","snapshot_path":null,"receipt_path":null,"not_before":null,"not_after":null,"one_connection":false,"one_transfer":false,"one_execution":false,"result_receive":false,"target_file_read":false,"device_write":false,"installation":false,"autoload":false,"retry":false,"reconnect":false}
docs/approvals/phase-1.0dr-inventory-runner-template.json
+1
View File
@@ -0,0 +1 @@
{"active":false,"run_id":null,"target":null,"port":9021,"artifact_size":110032,"artifact_sha256":"914fce06a490ad048fdd0a85ae117858e8904b47c72054bf12fbfebc213a6db8","output_path":null,"receipt_path":null,"not_before":null,"not_after":null,"one_connection":false,"one_transfer":false,"one_execution":false,"result_receive":false,"directory_inventory":false,"possible_atime_effect_acknowledged":false,"device_file_content_read":false,"persistent_device_write":false,"installation":false,"autoload":false,"retry":false,"reconnect":false}
docs/approvals/phase-1.0dt-metadata-runner-template.json
+1
View File
@@ -0,0 +1 @@
{"active":false,"run_id":null,"target":null,"port":9021,"artifact_size":109928,"artifact_sha256":"077307b98e44f566fa1db82b08cd5e71bd56bd9792826fc7254965fa768c0dc7","output_path":null,"receipt_path":null,"not_before":null,"not_after":null,"one_connection":false,"one_transfer":false,"one_execution":false,"result_receive":false,"four_exact_metadata_reads":false,"possible_atime_effect_acknowledged":false,"app_pkg_read":false,"backup_read":false,"persistent_device_write":false,"installation":false,"autoload":false,"retry":false,"reconnect":false}
docs/approvals/phase-1.0e-one-shot-result-test.md
+28
View File
@@ -0,0 +1,28 @@
# Phase 1.0E one-shot result test approval
Status: **CONSUMED — NO FURTHER DEVICE ACTION AUTHORIZED**.
On 2026-07-22 the repository owner issued an exact, artifact-bound approval.
The immediately preceding proposal bound that confirmation to:
- `retroarch_ps5_result_diag.elf`;
- 1,844,880 bytes;
- SHA-256
`1049c78099a60b472a3fb0e2999e3393b6ad76337a28532a7e53872e7772dedf`;
- exact firmware 9.60 and the separately confirmed current session address;
- one connection, one direct in-memory raw-ELF transfer, one execution;
- result reception through the same inherited connection; and
- no retry, reconnect, installation, autoload or device write.
The bounded host deadline is 75 seconds. The address is held only in the local
ignored approval record and is not committed. The first connection attempt
consumes this permission regardless of send, execution or result success.
Timeout, EOF, reset, parser failure or any exception stops the run without a
second connection.
This approval does not apply to any other artifact or later device action.
The attempt used one connection, transfer and execution and received validated
D00-D02 frames before remote EOF. No retry or reconnect occurred. All device,
transfer, execution and result-receive authorization fields were reset to
`false`; the artifact is no longer transfer- or execution-eligible.
docs/approvals/phase-1.0f-device-test-template.md
+24
View File
@@ -0,0 +1,24 @@
# Phase 1.0F device-test template — inactive
This is a non-authorizing review template for the offline Phase-1.0F artifact.
It is not permission to connect, transfer, receive results or execute.
```text
artifact=retroarch_ps5_interval_diag.elf
size=1845152
sha256=e8bfc01c61bfb14b5814280a6e5442f1a5ad05ace5439d1c09e7e5ee00cd0055
firmware=9.60
ps5_connection_authorized=false
device_transfer_authorized=false
device_execution_authorized=false
result_receive_authorized=false
installation_authorized=false
autoload_authorized=false
device_write_authorized=false
automatic_retry=false
```
Any future authorization must be a new explicit statement in the active task,
repeat the exact name, size and SHA-256, set the intended actions explicitly,
and bound connection, transfer, execution, reception and observation counts.
No authority carries from RUN A, RUN B or RUN C.
docs/approvals/phase-1.0g-one-shot-runner-template.md
+34
View File
@@ -0,0 +1,34 @@
# Phase 1.0G one-shot approval template — inactive
This is a review checklist, not an authorization. The tracked JSON template is
intentionally inactive and must never be edited into a reusable project-wide
permission.
Current values:
```text
authorized=false
consumed=false
ps5_connection_authorized=false
device_transfer_authorized=false
device_execution_authorized=false
result_receive_authorized=false
installation_authorized=false
autoload_authorized=false
device_write_authorized=false
automatic_retry=false
protocol_activation_authorized=false
run_id=null
target=null
port=null
```
A future approval, if Jens chooses to issue one, must name the exact artifact
name, size and SHA-256; firmware; one target; protocol `CHD10F01`; timeout;
unique run identifier; result reception; and one connection, transfer,
execution and receive. It must separately keep installation, autoload, device
write, retry, reconnect, resume and automatic reboot false.
The active record must stay outside tracked repository paths, carry an exact
approval reference, and be reviewed together with the active execution
manifest. No prior RUN A, B or C permission carries forward.
docs/approvals/phase-1.0h-device-test-template.md
+23
View File
@@ -0,0 +1,23 @@
# Phase 1.0H device-test template — inactive
This non-authorizing template identifies the offline Phase-1.0H artifact. It
is not permission to connect, transfer, receive results or execute.
```text
artifact=retroarch_ps5_startup_args_diag.elf
size=1845152
sha256=822f2cf1f4d33a514d2bdd88fde40ad580dda5d85f537362ef6dff2eafcb56b6
firmware=9.60
ps5_connection_authorized=false
device_transfer_authorized=false
device_execution_authorized=false
result_receive_authorized=false
installation_authorized=false
autoload_authorized=false
device_write_authorized=false
automatic_retry=false
```
Any possible device test requires a new active-task statement naming this
exact artifact, size and hash and separately bounding connection, transfer,
execution, receive and observation. This template grants nothing.
docs/approvals/phase-1.0k-write-diag-one-shot-template.md
+38
View File
@@ -0,0 +1,38 @@
# Phase 1.0K one-shot approval template — inactive
This is a review checklist, not authorization. Its tracked JSON companion is
permanently inactive and contains no device address, port or run ID.
Current state:
```text
authorized=false
consumed=false
ps5_connection_authorized=false
device_transfer_authorized=false
device_execution_authorized=false
result_receive_authorized=false
installation_authorized=false
autoload_authorized=false
device_write_authorized=false
automatic_retry=false
protocol_activation_authorized=false
run_id=null
target=null
port=null
```
Any later approval must be newly issued by Jens and bind exactly:
- `retroarch_ps5_write_diag.elf`;
- size `1845208`;
- SHA-256 `6ff0f7ea391da5f15ea43512a871078133e896a6900ae9f8f3fa75711abb8009`;
- firmware `9.60`;
- protocol `CHD10J01`, version 1, 64-byte frames;
- one explicit target, port, timeout and unique run ID;
- exactly one connection, transfer, execution and result reception.
It must keep installation, autoload, device write, retry, reconnect, resume and
automatic reboot false. The active approval must remain outside tracked
repository paths and agree byte-for-byte with a separately reviewed active
manifest. This template grants nothing and prior permissions do not carry.
docs/approvals/phase-1.0n-write-free-one-shot-template.md
+39
View File
@@ -0,0 +1,39 @@
# Phase 1.0N one-shot approval template — inactive
This is a review checklist, not authorization. Its tracked JSON companion is
permanently inactive and contains no device address, port or run ID.
Current state:
```text
authorized=false
consumed=false
ps5_connection_authorized=false
device_transfer_authorized=false
device_execution_authorized=false
result_receive_authorized=false
installation_authorized=false
autoload_authorized=false
device_write_authorized=false
automatic_retry=false
protocol_activation_authorized=false
run_id=null
target=null
port=null
```
Any later approval must be newly issued by Jens and bind exactly:
- `retroarch_ps5_write_diag.elf`;
- size `1845208`;
- SHA-256 `c99a0856309a357ad2667d89b4924e4063ad214cae09c8a419457b0732f583cd`;
- firmware `9.60`;
- protocol `CHD10J01`, version 1, 64-byte frames;
- scope `EXACT_ONE_SHOT_PHASE_1_0N`;
- one explicit target, port, timeout and unique run ID;
- exactly one connection, transfer, execution and result reception.
It must keep installation, autoload, device write, retry, reconnect, resume and
automatic reboot false. The approval must remain outside tracked repository
paths and agree with a separately reviewed active manifest. This template
grants nothing; consumed Phase-1.0K and all earlier permissions do not carry.
docs/approvals/phase-1.0t-shsrv-metadata-collection.md
+32
View File
@@ -0,0 +1,32 @@
# Phase 1.0T shsrv metadata collection approval
Status: `INACTIVE_TEMPLATE`
This document is deliberately unapproved. It is not a command list, device
client, or permission to connect.
```text
attested=false
active=false
ps5_connection_authorized=false
device_request_authorized=false
result_receive_authorized=false
process_side_effects_accepted=false
automatic_serial_query_accepted=false
automatic_telemetry_query_accepted=false
serial_redaction_contract_accepted=false
automatic_retry=false
reconnect_authorized=false
target_address=null
listener_already_running_attested=false
window=null
exact_literal_path=null
commands=[]
expires_at=null
```
Any future approval must name exactly one window, one connection, the exact
commands, a short deadline, and whether the unavoidable spawned shell and
automatic serial/telemetry reads are accepted. Acceptance does not authorize
hbldr, target staging, file writes, app termination, remount, execution,
autoload, retry or any other device action.
docs/approvals/phase-1.0v-shsrv-collector.md
+35
View File
@@ -0,0 +1,35 @@
# Phase 1.0V shsrv collector approval
Status: `INACTIVE_TEMPLATE`
This template grants no authority and cannot activate the offline model.
```text
attested=false
active=false
collector_source_sha256=null
ps5_connection_authorized=false
device_request_authorized=false
result_receive_authorized=false
automatic_serial_query_accepted=false
automatic_telemetry_query_accepted=false
spawned_shell_effects_accepted=false
sanitized_output_only_accepted=false
physical_memory_erasure_unproven_accepted=false
automatic_retry=false
reconnect_authorized=false
target_address=null
target_port=null
listener_already_running_attested=false
window=null
exact_literal_path=null
commands=[]
deadline_seconds=null
run_id=null
expires_at=null
```
Any future live collector requires a new phase because Phase 1.0V contains no
network transport. Filling this template does not add one and does not
authorize hbldr, file content reads, writes, execution, transfer, installation,
autoload, path discovery, retry or reconnect.
docs/approvals/phase-1.0w-shsrv-client.md
+43
View File
@@ -0,0 +1,43 @@
# Phase 1.0W shsrv client approval
Status: `INACTIVE_TEMPLATE`
There is no live client in Phase 1.0W. This template cannot activate the
policy model or create network capability.
```text
attested=false
active=false
policy_sha256=null
collector_sha256=null
run_id=null
target_address=null
target_port=null
window=null
exact_literal_path=null
commands=[]
deadline_seconds=null
expires_at=null
listener_already_running_attested=false
ps5_connection_authorized=false
device_request_authorized=false
result_receive_authorized=false
spawned_shell_effects_accepted=false
automatic_serial_query_accepted=false
automatic_telemetry_query_accepted=false
sanitized_output_only_accepted=false
physical_memory_erasure_unproven_accepted=false
target_build_authorized=false
device_transfer_authorized=false
device_execution_authorized=false
installation_authorized=false
autoload_authorized=false
device_write_authorized=false
automatic_retry=false
reconnect_authorized=false
resume_authorized=false
fallback_authorized=false
```
A later phase must create and audit a separate inactive transport before any
approval can be considered. No field in this template authorizes a connection.
docs/approvals/phase-1.0x-inactive-transport.md
+47
View File
@@ -0,0 +1,47 @@
# Phase 1.0X inactive transport approval
Status: `INACTIVE_TEMPLATE`
Phase 1.0X has no live network adapter. This record is deliberately inert and
cannot authorize or activate a connection.
```text
attested=false
active=false
policy_sha256=null
collector_sha256=null
transport_sha256=null
run_id=null
target_address=null
target_port=null
window=null
exact_literal_path=null
commands=[]
deadline_seconds=null
expires_at=null
listener_already_running_attested=false
ps5_connection_authorized=false
device_request_authorized=false
result_receive_authorized=false
spawned_shell_effects_accepted=false
automatic_serial_query_accepted=false
automatic_telemetry_query_accepted=false
sanitized_output_only_accepted=false
physical_memory_erasure_unproven_accepted=false
directory_entry_durability_unproven_accepted=false
blocking_call_preemption_unproven_accepted=false
target_build_authorized=false
device_transfer_authorized=false
device_execution_authorized=false
installation_authorized=false
autoload_authorized=false
device_write_authorized=false
automatic_retry=false
reconnect_authorized=false
resume_authorized=false
fallback_authorized=false
```
No value may be filled under Phase 1.0X. A later phase must first prove exact
prompt/Telnet framing and implement an independently reviewed inactive network
adapter. That work still would not inherit authority from this template.
docs/approvals/phase-1.0y-shsrv-framing.md
+33
View File
@@ -0,0 +1,33 @@
# Phase 1.0Y shsrv framing approval
Status: `INACTIVE_TEMPLATE`
This phase is source audit and synthetic modeling only. It contains no live
transport to activate.
```text
attested=false
active=false
framing_model_sha256=null
source_family=null
run_id=null
target_address=null
target_port=null
commands=[]
ps5_connection_authorized=false
device_request_authorized=false
result_receive_authorized=false
target_build_authorized=false
device_transfer_authorized=false
device_execution_authorized=false
installation_authorized=false
autoload_authorized=false
device_write_authorized=false
automatic_retry=false
reconnect_authorized=false
resume_authorized=false
fallback_authorized=false
```
No field may be filled under Phase 1.0Y. Official-source framing is not proof
of the deployed shsrv family, live prompt boundaries or firmware behavior.
docs/approvals/phase-1.0z-passive-batch.md
+27
View File
@@ -0,0 +1,27 @@
# Phase 1.0Z passive-batch approval record
This tracked record is deliberately inactive. It is not permission to connect,
send, receive or execute anything.
- `active=false`
- `attested=false`
- `run_id=null`
- `target_address=null`
- `target_port=null`
- `window=null`
- `exact_literal_path=null`
- `ps5_connection_authorized=false`
- `device_request_authorized=false`
- `result_receive_authorized=false`
- `target_build_authorized=false`
- `device_transfer_authorized=false`
- `device_execution_authorized=false`
- `installation_authorized=false`
- `autoload_authorized=false`
- `device_write_authorized=false`
- `automatic_retry=false`
- `reconnect_authorized=false`
- `resume_authorized=false`
Any later action requires a new exact artifact/session-specific approval and a
separate reviewed live-adapter phase. Nothing in this template activates one.
docs/approvals/phase07-hardened-installation-request.md
+39
View File
@@ -0,0 +1,39 @@
# Phase-0.7 installation authorization packet
Status: **NOT AUTHORIZED**. This file prepares a later installation request;
it grants no authority and contains no transfer or execution command.
## Hash-bound installation set
- elfldr:
`63e810982471eb40cae3a20aa9df9a0a02892f420e429874fae4e99aa400b561`
(397000 bytes)
- controlled Payload Manager:
`8fecf8241a46246eddbd21e8bb4d875f5d76f1f4f4c6a11384df1f131aa5e5b1`
(99560 bytes)
- lifecycle probe:
`bfb4a5cc768e162fe4c2fddf41c3978e152722918a39085277fd172cb95a7182`
(112680 bytes)
- firmware: exact `9.60`
- automatic retry: `false`
- lifecycle timeout: `2000 ms`
The permanent blocked hash
`4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63`
is excluded and must still be rejected.
## Exact later permission sentence
> Ik geef toestemming om uitsluitend op mijn PS5 met exact firmware 9.60 de
> geharde elfldr met SHA-256
> 63e810982471eb40cae3a20aa9df9a0a02892f420e429874fae4e99aa400b561
> en de controlled Payload Manager met SHA-256
> 8fecf8241a46246eddbd21e8bb4d875f5d76f1f4f4c6a11384df1f131aa5e5b1
> éénmalig te installeren, nadat de bestaande bestanden hashgebonden zijn
> geback-upt. Deze toestemming omvat geen overdracht of uitvoering van de
> lifecycle-probe en geen automatische start.
After that separate installation is verified, a second, artifact-specific
authorization would still be required to transfer and execute the lifecycle
probe. Installation permission must not be interpreted as execution
permission.
docs/approvals/phase07-lifecycle-transfer-execution-request.md
+41
View File
@@ -0,0 +1,41 @@
# Phase-0.7 lifecycle transfer and one-time execution request
Status: **NOT AUTHORIZED**. Do not use this request until the hardened elfldr
and controlled Payload Manager have been separately authorized, installed,
hash-verified on-device, and recorded in a new active task.
## Exact later execution subject
- lifecycle probe SHA-256:
`bfb4a5cc768e162fe4c2fddf41c3978e152722918a39085277fd172cb95a7182`
- size: 112680 bytes
- artifact ID: `chimera-gfx-lifecycle-phase07-fw960-v1`
- firmware: exact `9.60`
- maximum runtime: 2000 ms
- automatic retry: `false`
- requested action count: one transfer and one execution
## Preconditions
- on-device hardened elfldr hash equals
`63e810982471eb40cae3a20aa9df9a0a02892f420e429874fae4e99aa400b561`;
- on-device controlled Payload Manager hash equals
`8fecf8241a46246eddbd21e8bb4d875f5d76f1f4f4c6a11384df1f131aa5e5b1`;
- the original installed components have hash-bound backups;
- the permanent blocked hash is rejected by both installed consumers;
- the static policy gate is rerun against the exact transferred bytes;
- no autoload or automatic retry is enabled.
## Exact later permission sentence
> Ik geef toestemming om uitsluitend op mijn PS5 met exact firmware 9.60 de
> lifecycle-probe met SHA-256
> bfb4a5cc768e162fe4c2fddf41c3978e152722918a39085277fd172cb95a7182,
> 112680 bytes en artifact-ID
> chimera-gfx-lifecycle-phase07-fw960-v1 eenmalig over te dragen en eenmaal uit
> te voeren via de reeds geinstalleerde en exact geverifieerde geharde runtime,
> met een harde limiet van 2000 ms, zonder retry, autoload, VideoOut, GNM, SDL
> of netwerkgebruik door de probe.
This text is a future request template only. Its presence in the repository is
not approval.
docs/approvals/probe-9.60-transfer-execution.md
+94
View File
@@ -0,0 +1,94 @@
# Firmware 9.60 probe transfer and one-time execution package
Status: **BLOCKED — do not transfer and do not execute**.
This is the separate review package requested after the offline build. It is
not an authorization request because the current artifact cannot satisfy the
project's no-kernel-change boundary.
## Bound artifact
- Filename:
`chimera-gfx-capability-probe-0.1.0-fw-9.60-offline-audit-only.elf`
- SHA-256:
`4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63`
- Size: 110424 bytes
- Source commit: `ba8f6a40cf37dff628254caa9b11d83a73957cf8`
- Firmware build gate: exact `9.60`
- Manifest: `manifests/artifacts/chimera-gfx-capability-probe-0.1.0-fw-9.60.json`
- Offline evidence: `docs/evidence/probe-9.60-offline-2026-07-17.md`
- Transfer / execution recorded: false / false
- Execution eligible: false
- Permanent denylist: `manifests/artifact-denylist.json`
## Intended one-time project action
If a future replacement artifact closes every blocker, the first action would
be a single manual, foreground capability probe with application arguments:
```text
--firmware 9.60 --acknowledge-read-only-probe
```
Project code would open the candidate GNM module, perform exactly 21 `dlsym`
lookups, log names plus booleans, call none of the returned addresses, and
attempt `dlclose`. It would request no VideoOut, framebuffer, GNM command,
draw, dispatch, submit, flip, GPU-memory mutation, MMIO, or register operation.
There would be no retry or automatic boot path.
## APIs and side effects under review
Project path: `strcmp`, `chimera_gfx_firmware_gate_allows`,
`chimera_gfx_ps5_make_loader_ops`, `chimera_gfx_ps5_probe_symbols`, `dlopen`,
`open_module`, `dlerror`, `resolve_symbol`, `dlsym`, `log_line`, `snprintf`,
`write_log`, `fprintf`/`fwrite`, `close_module`, `dlclose`, and
`chimera_gfx_status_string`.
Pinned SDK transitive path includes `__patch_init`, kernel credential and
syscall-permission writes, rtld initialization, possible
`sceKernelLoadStartModule` calls, SDK kernel reads while inspecting module
metadata, and possible `sceKernelStopUnloadModule` during cleanup. The complete
audited path is in the evidence document.
## Blocking findings
1. SDK v0.41 performs kernel process-state writes before `main`. The firmware
gate cannot prevent them.
2. No bounded/cancellable loader API or safe external supervisor has been
proven. A hang can prevent cleanup.
3. Module start/stop internals on firmware 9.60 are unknown.
4. The gate trusts a supplied string and does not attest firmware.
5. Runtime delivery of the required four arguments has not been observed.
Likely failure outcomes range from a clean refusal or loader error to a payload
crash, persistent loaded-module/process state, or a console restart. GPU/display
effects are not requested, but driver-internal effects cannot be ruled out.
## Timeout, cleanup, and recovery status
No safe timeout or forced-cancellation procedure exists for this artifact.
Normal cleanup attempts `dlclose`; crash/hang cleanup and CRT kernel-state
restoration are not guaranteed. Therefore no transfer, launch, kill, retry, or
recovery procedure is approved.
## Approval checklist
- [x] Offline artifact hash and source commit recorded
- [x] Full imports and call chain audited
- [x] VideoOut/Phase-1 excluded from the build
- [ ] Public, kernelwrite-free startup/loader path proven
- [ ] Replacement artifact built and newly hashed
- [ ] Firmware attestation and argument delivery proven
- [ ] Bounded timeout and cleanup/recovery proven
- [ ] New artifact-specific transfer approval
- [ ] New artifact-specific one-time execution approval
## Permission text
There is deliberately **no valid permission text for this hash**. Generic or
future approval must not be interpreted as authorization for it. After the
blockers are closed, a newly named and newly hashed replacement needs a new
package and an exact permission sentence that names that replacement hash.
ADR-0009 makes this hash permanently ineligible; closing future startup
blockers cannot rehabilitate these bytes.
docs/evidence/external-evidence-integrity-2026-07-29.md
+54
View File
@@ -0,0 +1,54 @@
# External evidence integrity check — 2026-07-29
## Decision
`EXTERNAL_EVIDENCE_WORKSPACE_NOT_REPRODUCIBLE`
This is a host-only integrity record. No PS5, network, transfer, target build,
installation, execution, result reception, autoload, or device write was used.
Every authorization remains false and automatic retry remains false.
## Findings
The standalone tracked-input suite passes, but the currently available sibling
workspace cannot reproduce every historical cross-repository validator:
- Phase-0.9B and Phase-0.9C source digests do not match several committed
blobs at the commits named by their historical manifests;
- the expected historical bytes are not present in any local commit of the
affected sibling repositories;
- Phase-1.0L and Phase-1.0M require ignored sibling audit documents that are
absent from the current RetroArch checkout;
- Phase-1.0P and Phase-1.0R bind older RetroArch revisions and Phase-1.0R also
requires ignored Phase-1.0M ELF/map evidence that is absent;
- a single sibling worktree cannot simultaneously represent all historical
revisions.
Worktree CRLF conversion is a separate source of false mismatches on Windows.
The historical validators and their checksum inventories are immutable and
were not rewritten. A future source-evidence contract should bind committed
Git blobs or explicitly normalized text, but that change must use a new schema
and record rather than altering the historical evidence package. Comparison
against committed blobs confirmed that several remaining mismatches are
genuine evidence-availability failures, not line-ending conversion.
## Test boundary
The default CTest suite uses tracked files only. Historical validators needing
sibling repositories, upstream trees, or ignored artifacts are registered only
with `CHIMERA_GFX_REGISTER_EXTERNAL_EVIDENCE_VALIDATORS=ON` and must be run one
at a time against the exact phase-specific workspace described in
`TEST_PLAN.md`.
Unregistered does not mean passed. Missing or mismatched external evidence
remains fail-closed and cannot support a compatibility, hardware-safety,
execution, cleanup, or recovery claim. The historical records are preserved;
their missing bytes are not reconstructed or replaced by current source.
## Recovery requirement
To re-establish a historical external validation, supply the original exact
ignored evidence and source bytes, verify their SHA-256 values independently,
and bind them to a clean phase-specific checkout. If those bytes cannot be
recovered, the affected source-binding claim remains unavailable permanently;
no manifest hash may be rewritten merely to make a validator pass.
docs/evidence/phase0-build-2026-07-16.md
+41
View File
@@ -0,0 +1,41 @@
# Phase-0 build evidence — 2026-07-16
This record captures local compile evidence only. No PS5 connection, transfer,
or execution occurred.
## Inputs
- source workspace: standalone `chimera-gfx`
- PS5 Payload SDK: v0.41 / commit `d2e2e585740362976a39fdd5ccf390f199a7bc37`
- SDK ZIP SHA-256:
`ebfb0acb5260511951a80e17db41650c62d20a8caf8659a230b928dc85005984`
- host compiler: MSVC 19.42.34436.0
- cross compiler: Ubuntu clang 18.1.8 (`20ubuntu8`)
- CMake: host 3.29.5-msvc4; cross 4.2.3
- Ninja: 1.13.2
## Host result
The Debug host library and test executables compiled with warnings as errors.
Clang-tidy completed during the WSL/Clang build. All 7 unit, manifest,
generated-file, safety, secret, and format checks passed.
## PS5 compile result
`chimera-gfx-capability-probe.elf` compiled as a 64-bit x86-64 PIE using the
public SDK toolchain, with `CHIMERA_GFX_PS5_ALLOWED_FIRMWARE=NONE` and warnings
as errors. Initial artifact SHA-256 before the final source split was
`618eadc14975eb3f20942ee2228007b2457c0f6c1b0e4daa72d17ae9feb64c5c`.
After splitting unused host allocation code out of the linked probe surface and
performing the final rebuild, the artifact SHA-256 is
`bc09865f6d26ba4fa86a5167b99841ad3ebee3629421a2cb4bae678bde63227f`.
Read-only symbol inspection found:
- GNM imports: 0
- VideoOut imports: 0
- loader entry points present: `dlopen`, `dlsym`, `dlclose`
- undefined allocation imports (`calloc`, `free`): 0
- representative GNM names present only as embedded lookup strings
This evidence does not claim runtime compatibility with any firmware.
docs/evidence/phase0-build-2026-07-17.md
+76
View File
@@ -0,0 +1,76 @@
# Phase-0 and offline Phase-1 build evidence
- Date: 2026-07-17
- Source commit: `72292f2d5788ad643e9d1816ce28ab754ef739b5`
- Branch: `main`
- Firmware gate: `NONE`
- Hardware transfer/execution: **not performed**
The source tree was clean when the two artifacts below were rebuilt. Generated
build directories and ELFs are ignored; only their machine-readable manifests
are tracked.
## Host verification
| Environment | Result |
|---|---|
| Windows, Visual Studio 2022 x64 Debug | 11/11 CTest tests passed |
| Windows, Visual Studio 2022 x64 Release | 11/11 CTest tests passed |
| WSL, Clang 18.1.8, clang-tidy 18, warnings as errors | 12/12 CTest tests passed |
| WSL, GCC 15.2.0, ASan + UBSan | 12/12 CTest tests passed |
| Installed core library consumer | compiled and exited 0 |
| Installed RetroArch/SDL2 scaffold consumer | compiled and exited 0 |
The tests include API/error/lifecycle validation, cross-context ownership,
resource limits, deterministic mock upload/present state, adapter refusal,
firmware-gate negative cases, symbol-manifest generation, artifact-manifest
tamper rejection, format, safety policy, and secret scanning.
The Clang ASan/UBSan variant was attempted but could not link because this WSL
installation lacks Clang 18's `compiler-rt` ASan archives. That attempt is not
counted as a passed test. The available GCC sanitizer runtime completed the
same 12-test suite successfully.
Docker was not installed in the local environment, so the pinned Dockerfile
was reviewed but not built. Its host and Phase-0 cross-build commands were run
directly with the same pinned compiler/SDK inputs. No Gitea job is claimed as
passed merely from being queued.
## Cross-build verification
The clean PS5 compile used:
- PS5 Payload SDK `v0.41`, commit
`d2e2e585740362976a39fdd5ccf390f199a7bc37`;
- PS5 SDL2 commit `0baf4ac49382b537ba449901b5b6d0d189bb1fbb`;
- the single reviewed keyboard/IME-removal overlay;
- SDL2main, audio, joystick, haptic, sensor, power, file, filesystem, locale,
misc, OpenGL, LoadSO, render, Vulkan, dummy/offscreen video, and HIDAPI
disabled for the Phase-1 candidate;
- warnings as errors and firmware identifier `NONE`.
All core, adapter, firmware-gate, probe, and disabled Phase-1 targets compiled
and linked. Static `prospero-nm` inspection then passed the strict import audit.
| Artifact | Size | SHA-256 | Static result |
|---|---:|---|---|
| `chimera-gfx-capability-probe.elf` | 110424 | `f0f74978ac62490ff2482386e9c4efa3ad6d6cc46e10d54c41cb8669b4449f36` | 0 direct Sce imports; 0 GNM imports |
| `chimera-gfx-phase1-videoout-clear.elf` | 1566368 | `2e826ac4ea2bffb626d82e370f98909bb508417d92b1ac3796e9f5a902e975c9` | exact reviewed 15-name Sce set; 0 GNM/keyboard/IME/UserService imports |
The 15 Phase-1 imports are six direct-memory/equeue functions, one
SystemService function, and eight VideoOut functions listed in
`docs/phase1/VIDEOOUT_CLEAR_EXPERIMENT.md`.
`llvm-objdump-18` confirmed the retained control-flow order in the Phase-1
`main`: firmware gate at offset `0x78`, `SDL_SetMainReady` at `0xa9`,
`SDL_Init` at `0xb4`, and the sole `SDL_UpdateWindowSurface` at `0x1fc`. The
probe likewise reaches its firmware gate before loader construction and probe
logic. With embedded identifier `NONE`, both return before the later calls.
The corresponding tracked manifests are:
- `manifests/artifacts/chimera-gfx-capability-probe-0.1.0-none.json`;
- `manifests/artifacts/chimera-gfx-phase1-videoout-clear-0.1.0-none.json`.
Both manifests verify against the local bytes and state `authorized: false`,
`transferred: false`, and `executed: false`.
docs/evidence/phase0.5-startup-offline-2026-07-17.md
+67
View File
@@ -0,0 +1,67 @@
# Phase 0.5 startup offline evidence — 2026-07-17
## Outcome
Decision: **BLOCKED**. The stock SDK v0.41 startup is `UNSAFE`, and the exact
loader caller needed to prove safe return from a replacement is absent. No
custom `_start` source and no PS5 ELF were created.
No PS5 connection, transfer, execution, VideoOut open, module load, network
initialization, GNM operation, framebuffer mutation, credential change,
syscall-bound change, MMIO access, or firmware change occurred.
## Offline startup audit
`tools/audit_ps5_startup_feasibility.py` was run twice independently against
the pinned SDK source and install. Both JSON outputs were byte-identical:
- startup audit SHA-256:
`d0e8202c1a07e4104476cadf6c14a1dea2d724b1d97495dddcdf05858f6c8d4a`;
- 12 transitive stock CRT sources enumerated;
- six other CRT-named installed files confirmed as empty archives;
- 31 functions and 182 call/tail-call edges reachable from stock `_start`;
- reachable prohibited set: `__patch_init`, `kernel_copyin`, `kernel_copyout`,
`kernel_set_ucred_caps`, and `kernel_set_ucred_attrs`;
- compiler `-###` trace confirmed that `-nostartfiles -nodefaultlibs` adds no
stock CRT or default library and produced no ELF;
- non-SDK local loader-contract hits: zero.
## Policy verification
The real legacy artifact, its updated manifest, and the permanent denylist were
evaluated together. The policy tool returned exit 2 with both
`ARTIFACT_PERMANENTLY_DENYLISTED` and
`MANIFEST_EXECUTION_INELIGIBLE`.
JSON Schema validation passed for all three tracked artifact manifests and the
permanent denylist.
## Host and static tests
- Windows MSVC warnings-as-errors build: passed.
- Windows CTest: 14/14 passed.
- WSL Clang 18 plus clang-tidy build: passed.
- WSL Clang CTest including formatting: 15/15 passed.
- WSL GCC 15 ASan+UBSan build: passed.
- WSL GCC ASan+UBSan CTest: 15/15 passed.
- Python syntax compilation for every changed tool/test: passed.
- `git diff --check`: passed at review time.
An initial Clang ASan configure did not compile a project source because the
local Clang install lacks `libclang_rt.asan*`. GCC's available ASan/UBSan
runtime was used successfully instead. The failed configure is an environment
toolchain limitation and was not reported as a passed test.
## Bound hashes
| Record | SHA-256 |
|---|---|
| permanent denylist | `e9603b0e3792781ad5b511afb22ef61e3d4fd4c5a16bf928f8609193bcd97783` |
| denylist schema | `78d0d28da552550e4b7dabc5b9c25347fb2618c4664b7a554b87c6de69cd6c96` |
| startup audit JSON | `d0e8202c1a07e4104476cadf6c14a1dea2d724b1d97495dddcdf05858f6c8d4a` |
| non-build decision | `b04dd224c00af0c7228c582f6ba3ca55ef03e9453287f233a0c4ff2e545092fc` |
| machine proof matrix | `aefd1d1e663be617ed1042c6a1d68b9f21dd0c137f0c601d15cdcbfdf03dadb7` |
| permanently blocked legacy ELF | `4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63` |
The last hash names pre-existing bytes only. It is not a Phase-0.5 artifact and
must not be transferred or executed.
docs/evidence/phase07-offline-build-2026-07-17.md
+61
View File
@@ -0,0 +1,61 @@
# Phase-0.7 offline build evidence — 2026-07-17
- Public SDK: v0.41,
`d2e2e585740362976a39fdd5ccf390f199a7bc37`
- Firmware build gate: exact `9.60`
- Host validation: MSVC 19.50 `/W4 /WX`; Clang 18
warnings-as-errors/clang-tidy/format; GCC 15 ASan/UBSan
- Fuzz fallback: 100,000 deterministic ASan/UBSan inputs for both controlled
header and verified metadata
- Cross-build: all three targets with warnings-as-errors
- Reproducibility: two clean byte-identical builds per ELF
- Console actions: none
The complete machine evidence is
`manifests/runtime/phase-0.7-offline-audit.json`. Full ignored reports and
artifacts are packaged below `outputs/phase07/`.
## Exact outputs
| Artifact | SHA-256 | Size | Undefined imports | `DT_NEEDED` |
|---|---|---:|---|---|
| hardened elfldr | `63e810982471eb40cae3a20aa9df9a0a02892f420e429874fae4e99aa400b561` | 397000 | none | `libSceLibcInternal.sprx`, `libSceNet.sprx`, `libkernel_web.sprx` |
| controlled Payload Manager | `8fecf8241a46246eddbd21e8bb4d875f5d76f1f4f4c6a11384df1f131aa5e5b1` | 99560 | none | `libSceLibcInternal.sprx`, `libSceNet.sprx`, `libkernel_web.sprx` |
| lifecycle probe | `bfb4a5cc768e162fe4c2fddf41c3978e152722918a39085277fd172cb95a7182` | 112680 | `_exit`, `sceKernelSendNotificationRequest` | `libSceLibcInternal.sprx`, `libkernel_web.sprx` |
The lifecycle project's called functions are exactly one
`sceKernelSendNotificationRequest` followed by `_exit`. The normal SDK startup
is statically included and reaches `__patch_init` before `main`; that fact is
proven from source, linker map, disassembly, and the 499-edge lifecycle
callgraph rather than inferred from imports. The hardened loader audit records
1032 call edges and the controlled manager records 478.
The lifecycle linker map also contains stock-SDK `__dlopen`, `__dlsym`,
`sceKernelLoadStartModule`, and `sceKernelStopUnloadModule` symbols. Direct
static reachability proves the rtld initialization path but cannot resolve all
116 indirect lifecycle edges. The audit therefore records linked symbols,
direct `_start` reachability where symbolization permits it, and every
unresolved indirect edge separately. No graphics/display-sensitive symbol is
linked in any of the three audited ELFs.
## Final offline tests
- Chimera GFX Windows host build: MSVC `/W4 /WX`, 16/16 CTest passed.
- Hardened elfldr: MSVC 1/1; Clang 18 plus clang-tidy 1/1; GCC 15
ASan/UBSan 1/1; 100,000-input sanitizer fuzz pass.
- Controlled Payload Manager: MSVC 1/1; Clang 18 plus clang-tidy 2/2; GCC 15
ASan/UBSan 2/2; 100,000-input sanitizer fuzz pass.
- All three PS5 cross-builds passed warnings-as-errors and reproduced the
exact hashes and sizes above.
- Negative lifecycle firmware `9.50` configure failed before creating a build
graph.
- Controlled-manager build without exact hash/size/artifact ID failed.
- Static execution-policy refusal suite, manifest schemas, Phase-0.5/0.6
historical gates, Phase-0.7 proof matrix, safety audit, and secret scans
passed.
The local Clang installation does not contain the optional
`libclang_rt.asan`/libFuzzer runtime archives. Clang warnings and clang-tidy
therefore run without sanitizers; GCC supplies the ASan/UBSan and deterministic
fuzz coverage. This is a host-tool packaging limitation, not a target
compiler, linker, or ABI blocker.
docs/evidence/probe-9.60-offline-2026-07-17.md
+147
View File
@@ -0,0 +1,147 @@
# Firmware 9.60 capability-probe offline evidence
Date: 2026-07-17. No PS5 connection, transfer, deployment, or execution was
performed.
## Artifact identity
| Field | Value |
|---|---|
| Artifact | `chimera-gfx-capability-probe-0.1.0-fw-9.60-offline-audit-only.elf` |
| Size | 110424 bytes |
| SHA-256 | `4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63` |
| Source commit | `ba8f6a40cf37dff628254caa9b11d83a73957cf8` |
| SDK | PS5 Payload SDK v0.41, commit `d2e2e585740362976a39fdd5ccf390f199a7bc37` |
| Build type | Release, C11, warnings as errors |
| Phase-1 VideoOut | explicitly `OFF`; target not built or linked |
| Transfer / execution | false / false |
| Execution eligibility | **false** |
Two clean builds around an audit-tool-only commit produced the same size and
SHA-256. The tracked manifest is
`manifests/artifacts/chimera-gfx-capability-probe-0.1.0-fw-9.60.json`.
## Firmware gate
The checked-in discovery allowlist is exactly `["9.60"]`; CMake still defaults
to `NONE`. Configure rejects `9.61`. The Phase-1 target rejects `9.60` and every
other non-`NONE` value.
The ELF embeds `9.60` and requires exactly these application arguments:
```text
--firmware 9.60 --acknowledge-read-only-probe
```
Disassembly places `chimera_gfx_firmware_gate_allows` at `main+0x7f`, before
`chimera_gfx_ps5_make_loader_ops` at `main+0xa5` and the probe call at
`main+0xb2`. This is only a comparison against an operator-supplied string; it
does not independently attest the console firmware. SDK startup occurs before
`main` and therefore before this gate.
## Complete dynamic import inventory
Undefined symbols (`prospero-nm -u`), exact set:
- `__stderrp`
- `__stdoutp`
- `fprintf`
- `fwrite`
- `snprintf`
- `strcmp`
`DT_NEEDED` modules (`llvm-readelf-18 --dynamic-table`), exact set:
- `libkernel_web.sprx`
- `libSceLibcInternal.sprx`
- `libSceNet.sprx`
There are zero direct `sce*`, GNM, VideoOut, SDL, draw, dispatch, submit, or
flip imports. `libSceVideoOut.sprx` text is present only because the SDK rtld
statically includes a general sysmodule-name table; there is no corresponding
import or call. `INIT_ARRAYSZ` and `FINI_ARRAYSZ` are both zero.
## Project-requested functions
Before the firmware gate, project `main` uses only argument checks, `strcmp`,
and a refusal log on error. After the gate, the complete project path is:
1. `chimera_gfx_ps5_make_loader_ops`;
2. `chimera_gfx_ps5_probe_symbols`;
3. internal `log_line`/`write_log` callbacks for boolean JSON events;
4. loader callback `open_module`, which calls
`dlopen("libSceGnmDriver.sprx", RTLD_LAZY | RTLD_LOCAL)`;
5. loader callback `resolve_symbol` 21 times; it calls `dlerror`, `dlsym`, then
`dlerror`; every returned address is reduced to a boolean and discarded;
6. `snprintf` plus `fprintf`/compiler-selected `fwrite` for boolean JSON lines;
7. loader callback `close_module`, which calls `dlclose`;
8. `chimera_gfx_status_string` and a final summary log.
No resolved GNM pointer is cast to a callable type or invoked. The 21 exact
names are machine-checked against `manifests/ps5_gnm_symbols.json`.
## SDK startup and loader side effects
Pinned-source review plus disassembly proves this pre-`main` success path:
1. `_start` clears payload BSS.
2. `__crt_syscall_init`, `__kernel_init`, and `__klog_init` initialize SDK
state from loader-supplied arguments.
3. libc `__isthreaded` is set to one.
4. `__patch_init` reads current process credentials, calls
`kernel_set_ucred_caps` and `kernel_set_ucred_attrs`, and performs two
`kernel_copyin` writes that change the process syscall-address bounds.
5. `__rtld_init` initializes SPRX/SO/payload/dlfcn support and may call
`sceKernelLoadStartModule` for `libSceSysmodule.sprx` if it is absent.
6. payload dependencies are opened and relocations modify payload memory;
payload init/fini arrays themselves are empty.
After the project gate, SDK `dlopen` first checks loaded modules through SDK
kernel reads. If GNM is absent it can call `sceKernelLoadStartModule`. It then
uses `kernel_copyout` to copy module metadata, symbol tables, and string tables
into allocated user memory. The pinned SPRX-specific `init` callback is empty,
but the internal behavior of the system load/start call is unknown.
These facts mean the ELF is non-rendering at project level but is not globally
non-mutating. The pre-`main` kernel writes violate the project's userland-only
execution boundary.
## Cleanup audit
The bounded project loop attempts `dlclose` after all lookups and on lookup or
format failures. SDK `dlclose` calls rtld fini, close, and destroy. The pinned
SPRX `fini` callback is empty. If this open loaded the module, `sprx_close`
calls `sceKernelStopUnloadModule`, then frees copied tables and clears local
state.
Cleanup is not guaranteed:
- there is no documented cancellation or bounded timeout around loader calls;
- a crash or hang can bypass `dlclose`;
- a stop/unload failure can leave the module loaded while SDK bookkeeping is
destroyed;
- the CRT's credential/syscall-permission changes have no matching restoration
path in the pinned source;
- a `libSceSysmodule.sprx` load during rtld initialization has no observed
matching unload in this call chain.
## Offline verification results
- Windows MSVC Debug: 11/11 tests passed.
- WSL Clang 18 with clang-tidy and formatting: 12/12 tests passed.
- Strict artifact audit: six exact undefined symbols, three exact
`DT_NEEDED` modules, empty init/fini arrays, all 21 manifest names, zero
direct Sce/GNM imports.
- SDK runtime source audit: passed and concluded execution eligibility false.
- Negative configure tests: firmware `9.61` rejected; Phase-1 with `9.60`
rejected.
- Artifact-manifest digest/size verification: passed.
- Secret scan and `git diff --check`: passed.
## Remaining blockers
The exact system-module initialization effects, runtime argument delivery,
firmware attestation, loader timeout behavior, and partial-failure recovery are
unproven. More decisively, the SDK v0.41 CRT performs prohibited kernel writes
before the project firmware gate. This exact artifact must not be transferred
or executed.
docs/phase1/APPROVAL_PACKAGE.md
+53
View File
@@ -0,0 +1,53 @@
# Hardware approval package
Status: **not authorized; offline review artifacts only**.
## Current offline review artifacts
| Artifact | Firmware | SHA-256 | Transfer/execution |
|---|---|---|---|
| `chimera-gfx-capability-probe.elf` | `NONE` | `f0f74978ac62490ff2482386e9c4efa3ad6d6cc46e10d54c41cb8669b4449f36` | false / false |
| `chimera-gfx-phase1-videoout-clear.elf` | `NONE` | `2e826ac4ea2bffb626d82e370f98909bb508417d92b1ac3796e9f5a902e975c9` | false / false |
| `chimera-gfx-capability-probe-0.1.0-fw-9.60-offline-audit-only.elf` | `9.60` | `4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63` | false / false; permanently denylisted |
The two `NONE` artifacts are tied to source commit
`72292f2d5788ad643e9d1816ce28ab754ef739b5`. The offline test and import
evidence is in `docs/evidence/phase0-build-2026-07-17.md`. These exact artifacts
cannot enter the project-requested GNM module open or SDL initialization because
their firmware gate is `NONE`. The SDK payload CRT still initializes before
`main`.
## First hardware gate
The first console action, if it ever becomes safe and receives new permission,
must be the non-rendering capability probe, not the VideoOut experiment.
Project code would call only `dlopen`, `dlsym`, `dlclose`, and standard output
functions. It would resolve the 21 manifest names, record only booleans, invoke
no resolved pointer, and request no submit, draw, dispatch, flip, or GPU-memory
operation.
Jens reported exact firmware `9.60` and authorized only its offline build and
audit. The pinned SDK v0.41 payload CRT performs prohibited kernel process-state
writes before `main`, so the resulting ELF is not execution-eligible even
though the project gate precedes `dlopen`. A kernelwrite-free startup route and
a newly built digest are required before execution can be considered.
## VideoOut gate after successful discovery
The later experiment would execute the exact SDL sequence and indirect API
inventory in `VIDEOOUT_CLEAR_EXPERIMENT.md`. Likely failures are a clean error,
payload crash, stuck payload, lost display ownership, or required controlled
console restart. Automatic retry is prohibited. The unbounded SDL flip wait is
an unresolved blocker even after symbol discovery.
## Authorization state
The 9.60 offline build authorization has been received. No transfer or execution
authorization has been received. No execution-permission wording is offered
while the SDK CRT blocker remains. The firmware-specific evidence and blocked
approval package must record the filename, SHA-256, exact source commit, all
imports, startup/loader/cleanup call chain, and offline tests. Approval never
carries forward to the VideoOut test.
The completed firmware-specific package is
`docs/approvals/probe-9.60-transfer-execution.md`.
docs/phase1/FIRMWARE_ABI_CHECKLIST.md
+39
View File
@@ -0,0 +1,39 @@
# Firmware and ABI checklist
## Firmware identity
- [ ] Exact user-visible firmware identifier supplied by Jens
- [ ] Reproducible identification method documented without kernel access
- [ ] Identifier added to one candidate build only
- [ ] `FIRMWARE_COMPATIBILITY.md` row created as untested
- [ ] No compatibility inferred from another revision
## Discovery gate
- [ ] Capability-probe artifact manifest and SHA-256 reviewed
- [ ] Explicit artifact-specific execution permission recorded
- [ ] Probe resolves names only and invokes no resolved pointer
- [ ] Redacted result log archived
- [ ] Runtime module candidate confirmed or rejected for this firmware
## SDL/VideoOut evidence
- [x] SDL source commit pinned
- [x] Zlib license and overlay notice recorded
- [x] Project code uses public SDL2 APIs only
- [x] Keyboard/IME initialization removed from the staged build
- [x] Direct GNM imports forbidden
- [ ] Bounded flip-wait or safe supervisor proven
- [ ] Cleanup behavior observed on this exact firmware
## Artifact review
- [ ] Clean source commit matches manifest
- [ ] SDK and SDL commits match locks
- [ ] Firmware is not `NONE`
- [ ] ELF filename, size, and SHA-256 match
- [ ] Imports match the API inventory
- [ ] Offline host, static-analysis, cross-compile, and secret tests pass
- [ ] Transfer and execution remain false until separately approved
Any unchecked runtime item blocks execution.
docs/phase1/HARDWARE_TEST_PLAN.md
+58
View File
@@ -0,0 +1,58 @@
# Phase-1 hardware test plan
## Preconditions
Every item must be complete before transfer:
- exact firmware is recorded and allowlisted for one artifact;
- the discovery-only capability probe has already completed on that firmware;
- source commit, SDK/SDL commits, artifact SHA-256, and static imports match the
reviewed manifest;
- the console has no unsaved work and automatic retry/boot integration is off;
- an operator and observer have the redacted JSON-stage log visible;
- the bounded-wait blocker below has an accepted resolution.
## Proposed timeline
1. Verify digest again immediately before transfer.
2. Transfer manually using an existing approved userland loader workflow.
3. Start once, manually. No boot hook or retry.
4. Require `firmware_gate`, `video_init`, `window_create`, `surface_acquire`,
and `cpu_fill` within five seconds total.
5. Permit exactly one `single_present` and a one-second hold.
6. Require `cleanup` and process exit within five seconds after present.
7. Preserve logs and mark the firmware row pass, fail, or anomalous.
## Watchdog and timeout
The application stages are bounded except the pinned SDL call
`SDL_UpdateWindowSurface`, whose backend waits for a flip event without a
publicly proven finite timeout. A cooperative application thread cannot safely
cancel it. Force-killing a thread while it owns VideoOut or direct-memory state
is prohibited.
Before authorization, one of these must be proven and separately reviewed:
1. a public, licensed SDL/VideoOut change that supplies a bounded wait and
returns control for cleanup; or
2. a userland process supervisor whose termination semantics guarantee OS
cleanup of VideoOut, equeue, and direct-memory ownership.
Until then, the operator wall-clock limit is a detection mechanism only, not a
safe watchdog, and the hardware test remains blocked.
## Cleanup, rollback, and emergency stop
Normal cleanup is `SDL_DestroyWindow` followed by `SDL_Quit`; the pinned
backend then closes VideoOut, releases direct memory, and deletes its equeue.
No second flip is attempted during cleanup.
On any error, missing stage, display anomaly, or deadline:
- do not retry;
- request normal userland process termination only if responsive;
- do not kill an individual worker thread;
- if display ownership does not return, use the console's normal controlled
restart procedure; never patch firmware, registers, clocks, or fans;
- after restart, use the existing SDL software path and mark the artifact and
firmware combination failed/unknown pending review.
docs/phase1/README.md
+13
View File
@@ -0,0 +1,13 @@
# Offline Phase-1 preparation
No Phase-1 artifact has been transferred or executed. This directory contains
the review package for the first CPU-framebuffer/VideoOut experiment:
- `VIDEOOUT_CLEAR_EXPERIMENT.md`: exact design and API inventory;
- `HARDWARE_TEST_PLAN.md`: staging, timeout, cleanup, rollback, and stop rules;
- `FIRMWARE_ABI_CHECKLIST.md`: evidence that must be completed per firmware;
- `APPROVAL_PACKAGE.md`: artifact-specific authorization gate.
The compile target is off by default and the produced review artifact embeds
firmware `NONE`, so it refuses before `SDL_Init`. This preparation does not
authorize a hardware test.
docs/phase1/VIDEOOUT_CLEAR_EXPERIMENT.md
+62
View File
@@ -0,0 +1,62 @@
# Minimal VideoOut clear-frame experiment
## Goal and non-goals
Display exactly one fixed 1920x1080 solid frame through the existing pinned
PS5 SDL2 CPU-framebuffer backend, hold it for one second, and cleanly release
SDL. This experiment does not use `libchimera-gfx` hardware contexts, GNM,
shaders, command buffers, compute, custom tiling code, input, audio, OpenGL,
OSMesa, or a render loop.
## Application sequence
Project code performs the following calls only after exact compile-time and
runtime firmware identifiers match and the literal acknowledgement is present:
1. `SDL_SetMainReady`
2. `SDL_Init(SDL_INIT_VIDEO)`
3. `SDL_CreateWindow`
4. `SDL_GetWindowSurface`
5. `SDL_MapRGBA`
6. `SDL_FillRect`
7. `SDL_UpdateWindowSurface` exactly once
8. `SDL_Delay(1000)`
9. `SDL_DestroyWindow`
10. `SDL_Quit`
The fixed color is RGBA `(0x18, 0x2a, 0x41, 0xff)`. Logs contain stage names
and booleans only.
## Indirect pinned-SDL behavior
At commit `0baf4ac49382b537ba449901b5b6d0d189bb1fbb`, the reviewed PS5 video
backend indirectly uses these public export names:
- initialization: `sceSystemServiceHideSplashScreen`, `sceVideoOutOpen`,
`sceKernelAllocateMainDirectMemory`, `sceKernelMapDirectMemory`,
`sceKernelCreateEqueue`, `sceVideoOutAddFlipEvent`,
`sceVideoOutSetFlipRate`, `sceVideoOutSetBufferAttribute2`, and
`sceVideoOutRegisterBuffers2`;
- single present: `sceVideoOutSubmitFlip` and `sceKernelWaitEqueue`;
- cleanup: `sceVideoOutDeleteFlipEvent`, `sceVideoOutClose`,
`sceKernelReleaseDirectMemory`, and `sceKernelDeleteEqueue`.
These are indirect implementation observations, not independently proven
`chimera-gfx` ABI declarations. The overlay removes keyboard and IME setup.
## Build boundary
`tools/build-phase1-videoout.sh` verifies both upstream commits, stages the
reviewed SDL overlay, disables SDL2main plus unrelated SDL subsystems, and
cross-compiles the probe and candidate. It then statically requires the exact
15-name Sce import inventory above and zero GNM, keyboard, IME, or UserService
imports. It contains no upload, run, host, port, or boot command. The default
firmware identifier is `NONE`.
## Known blocker
The pinned SDL backend waits inside `sceKernelWaitEqueue` with no publicly
proven bounded timeout in this call path. Project code cannot safely cancel
that wait. The artifact is suitable for offline inspection, but not yet for
hardware authorization until `HARDWARE_TEST_PLAN.md` records an accepted
supervisor/recovery mechanism and an exact firmware.
docs/retroarch/phase-1.0a-build-results.md
+169
View File
@@ -0,0 +1,169 @@
# Phase 1.0A build and artifact results
## Result
`RETROARCH_PS5_SOFTWARE_PORT_BUILT`
Both outputs are real RetroArch v1.22.2 frontends built from fork commit
`ca1b45680577befc743e1c92fa40687e1b1745e7`. They link the upstream
frontend/runloop and the static `chimera_smokecore`; the software target also
links RGUI and the reviewed PS5 SDL2 software backends. They were not run.
| Profile | Local output | Size | SHA-256 | Map SHA-256 |
| --- | --- | ---: | --- | --- |
| headless | `build/phase10a/final/retroarch_ps5_headless.elf` | 722392 | `fd595a826f64d18598be0b55e539bb524b33bd469b98f62c958ee50acb544628` | `fb935f7a768c91408a87290f03bad8ed59f5061de75232d5660957eff8ec017f` |
| software/RGUI | `build/phase10a/final/retroarch_ps5_software.elf` | 3318432 | `7beb09592404b5c1fb4161c632171d2901f3715db26e59458998690e8c49f3fc` | `1573a9951fa53bfa1bf304e0038e6f049f859fbfbe92f6a895196dc283c27597` |
The paths are relative to the separate `chimera-retroarch` repository. The
ELFs and maps are ignored local build outputs, not files in `chimera-gfx` and
not transfer, execution or installation packages.
## Builds and reproducibility
Every target comparison used fork commit
`ca1b45680577befc743e1c92fa40687e1b1745e7`, SDK commit
`d2e2e585740362976a39fdd5ccf390f199a7bc37`,
`SOURCE_DATE_EPOCH=1763597828`, `TZ=UTC` and `LC_ALL=C`.
Each repetition invoked `make ... clean` to completion before a separate
`make ... -j4 all`. An earlier concurrent `make clean all` experiment was
rejected as a race and is not evidence.
| Comparison | ELF | Linker map |
| --- | --- | --- |
| headless A versus B | byte-identical | byte-identical |
| software A versus B | byte-identical | byte-identical |
Compiler flags include warnings-as-errors, `-O2`, no debug data, source-prefix
maps, section garbage collection, `--as-needed` and `--build-id=none`. The
cross compiler reports Clang 18.1.8 for `x86_64-sie-ps5`; GNU Make 4.4.1 was
used under WSL2.
The static SDL2 archive is 3120572 bytes with SHA-256
`353065505f54e71fa8f7fff41e090dce52f39fe2aaafab85c4653648fc5f1b56`.
It was built from commit `0baf4ac49382b537ba449901b5b6d0d189bb1fbb`
plus the 5195-byte reviewed overlay whose SHA-256 is
`b547260d8af40ce2360575ab7831c009036c1f35f8b525cad6fd376dc5ca9d6b`.
## Host integration result
The host harness compiled with GCC 15.2.0, `-Werror`, AddressSanitizer and
UndefinedBehaviorSanitizer, with leak detection enabled. It completed:
- 600 frames;
- video FNV-1a-64 `43f920496eb5f435`;
- audio FNV-1a-64 `a48f47dc08c56625`;
- digital and analog input mapping: pass;
- Start-driven libretro shutdown callback: pass;
- init/deinit and ASan/UBSan/leak checks: pass;
- PS5 port structural validator: pass.
This is host evidence for the core and source contracts, not PS5 runtime
evidence.
## ELF audit
Both files are ELF64 little-endian x86-64 System V PIE/DYN binaries, dynamically
linked and not stripped. Neither has an interpreter, build ID, GNU-stack
program header, ELF TLS segment, `.tdata` or `.tbss`. Both have 20 section
headers; `.init_array` and `.fini_array` exist with zero size. The full section
set is `.text`, unwind tables, dynamic symbol/hash/string/relocation tables,
`.data.rel.ro`, `.got`, `.rodata`, empty init/fini arrays, `.dynamic`, `.data`,
`.bss`, `.comment` and static symbol/string tables.
| Field | Headless | Software/RGUI |
| --- | ---: | ---: |
| Entry point | `0x47d10` | `0x1c29c0` |
| Program headers | 4 | 4 |
| First LOAD | offset `0x4000`, size `0x4e570`, RWE | offset `0x4000`, size `0x1c93e0`, RWE |
| Other LOADs | two RW | two RW |
| `.rela.dyn` entries | 610 | 3373 |
| Dynamic symbols | 79 | 220 |
| Full symbols | 1387 | 7256 |
| Defined global symbols | 719 | 2403 |
| Undefined symbols/imports | 73 | 210 |
The executable first LOAD segment is also writable because the pinned SDK
linker script co-locates text that way. This is a material W^X weakness and a
future execution risk; offline build success does not waive it.
The linker maps prove inclusion of `frontend/drivers/platform_ps5.o` and
`cores/chimera_smokecore/chimera_smokecore.o` in both targets. The software
map additionally proves inclusion of `SDL_ps5video.c.o`, `SDL_ps5audio.c.o`
and `SDL_ps5joystick.c.o`, while PS5 keyboard and IME objects are absent from
the final link.
## Dynamic dependencies and imports
Headless `DT_NEEDED`:
- `libkernel_web.sprx`;
- `libSceLibcInternal.sprx`.
Software/RGUI additionally needs:
- `libSceVideoOut.sprx`;
- `libScePad.sprx`;
- `libSceUserService.sprx`;
- `libSceSystemService.sprx`;
- `libSceAudioOut.sprx`.
`--as-needed` removes the SDK's otherwise unconditional SceNet dependency.
There are no undefined socket/network, `dlopen`/`dlsym`, module-loader, GNM,
mount, reboot or console-shutdown symbols. The software target's complete Sce
API import set is AudioOut init/open/output/close; direct-memory and equeue
allocation/wait/release; Pad init/open/read/close plus linked-but-not-required
lightbar/vibration calls; UserService initialization/user queries;
`sceSystemServiceHideSplashScreen`; and VideoOut open/register/flip/event/
close operations. Full ordered import lists are in
`manifests/retroarch/phase-1.0a-artifacts.json`.
Generic RetroArch code keeps write-capable libc imports. Headless includes
`fopen`, `ftruncate`, `fwrite`, `mkdir`, `open`, `remove`, `rename` and
`write`; software also includes `setenv`. The fixed PS5 startup path blocks
configuration reads, supplies no content/config/SRAM/state/core/data path and
compiles the normal shutdown-save paths out. The claim is therefore
control-flow-specific, not global absence of write-capable code.
## Entry, shutdown and static reachability
Source and disassembly agree on this entry sequence:
`_start` clears BSS, performs the inlined SDK `payload_init` sequence
(`__crt_syscall_init`, `__kernel_init`, `__klog_init`, `__isthreaded`,
`__patch_init`, `__rtld_init`), constructs the SDK payload runtime, calls
`main`, which tail-jumps to `rarch_main`, then runs SDK fini/close/destroy and
termination handling. RetroArch selects `frontend_ctx_ps5`, performs a
contentless static-core launch, enters `runloop_iterate`, and reaches the
linked `retro_run`. Start requests the normal RetroArch/core shutdown path;
`retro_deinit` and the PS5 frontend deinit/shutdown callbacks are linked.
The SDK source and linked disassembly also prove that startup is not
kernelwrite-free: `__patch_init` reaches credential-capability/attribute
changes and syscall-bound writes through `kernel_copyin/out`. Those effects
are accepted for this authorized offline link milestone under the existing
ADR boundary, but remain unexecuted and hardware-unproven.
## String and policy audit
No personal absolute host path, credential, PS5/device address, install route,
Payload Manager modification, elfldr modification, lifecycle probe, deploy
client or execution helper was found. The generic RetroArch string pool keeps
`udp://127.0.0.1:`, an RTMP template, overlay “autoload” labels and downloader
localization even though networking, updater, dynamic cores and autoload
routes are compiled out. The software pool also yields byte-pattern false
positives `0.1.2.3` and `4.5.6.7`. SDK RTLD name tables contain module/dlsym
strings, but none is an undefined application import.
Full local audit output for each target contains the file classification,
ELF/readobj dump, complete symbols and undefined symbols, relocations,
disassembly, startup/shutdown slices and strings under
`build/phase10a/audit/{headless,software}` in `chimera-retroarch`.
The Chimera GFX secretscan passed across 658 text files and a clean archive of
all 21 fork-delta files passed separately. A whole-upstream RetroArch scan
also identified the pre-existing BearSSL sample private-key fixtures and
mbedTLS parser/writer source literals; these are official baseline dependency
test/source material, not additions or credentials introduced by this port.
No PS5 connection, request, transfer, execution, installation, autoload or
device write occurred.
docs/retroarch/phase-1.0a-driver-status.md
+55
View File
@@ -0,0 +1,55 @@
# Phase 1.0A driver status
| Component | Headless | Software/RGUI | Runtime classification |
| --- | --- | --- | --- |
| RetroArch frontend/runloop | Real linked code | Real linked code | Built offline |
| Platform frontend | `frontend_ctx_ps5` | `frontend_ctx_ps5` | Startup/return on device unproven |
| Video | `video_null` | RetroArch `sdl2` + SDL software + PS5 VideoOut | Linked, firmware runtime unproven |
| Menu | none | RGUI | Linked, display unproven |
| Input | `input_null` | RetroArch SDL + SDL PS5 Pad | Linked, one-controller runtime unproven |
| Joypad | null | SDL joypad over PS5 Pad | Buttons/axes source present; runtime unproven |
| Audio | `audio_null` | RetroArch SDL + PS5 AudioOut | 48 kHz stereo source present; runtime unproven |
| Core | static `chimera_smokecore` | static `chimera_smokecore` | Host-verified |
| Dynamic core | disabled | disabled | Not implemented |
| Config/VFS persistence | disabled default path | disabled default path | Generic write-capable code remains |
| Networking/updater | disabled | disabled | No network API imports expected |
| GNM/hardware context | absent | absent | Out of scope |
## Platform services
- lifecycle, contentless arguments and blocked config reads:
`frontend_ctx_ps5`;
- monotonic time and bounded sleeps: RetroArch/libretro-common POSIX paths
backed by the pinned SDK libc; no invented PS5 ABI;
- RetroArch worker threads: compiled out; the software profile may use SDL's
public pthread-backed audio primitives;
- logging: existing RetroArch stderr/stdout path only, with file logging off;
- VFS: generic code is linkable but the fixed PS5 wrapper supplies no content,
config, SRAM, state, core or data path;
- dynamic core loading and executable-memory policy: explicitly unsupported.
## Smoke core contract
- no content;
- 320x240 XRGB8888 at 60 Hz;
- 48 kHz deterministic stereo, 800 sample frames per video frame;
- D-pad and left analog stick offset the pattern;
- A toggles the background;
- Start requests clean libretro shutdown;
- no input means unbounded deterministic operation;
- no filesystem, networking, threads, JIT or frame-hot-path allocation.
Host result for 600 no-input frames:
- video FNV-1a-64: `43f920496eb5f435`;
- audio FNV-1a-64: `a48f47dc08c56625`;
- ASan/UBSan: pass;
- digital- and analog-input-dependent video change: pass;
- Start shutdown callback: pass.
## Explicitly unsupported
Persistent configuration, history, playlists, screenshots, saves, states,
content loading, dynamic cores, multiple controllers, haptics, touchpad,
gyro, lightbar, overlays, shaders and hardware-rendered cores are not silently
reported as working.
docs/retroarch/phase-1.0a-next-device-smoke-test.md
+65
View File
@@ -0,0 +1,65 @@
# Proposed first PS5 smoke test (not authorized)
This is a review package only. It is not a sender, execution package or device
instruction and it grants no authority.
## Candidate
The first useful device test would use the exact audited
`retroarch_ps5_software.elf`, not the headless ELF. The headless static core
has no observable result channel and intentionally runs indefinitely with null
input. The software candidate can provide visible, audible and controller
evidence and can request a clean shutdown.
Before any action, a later task must bind:
- source commit `ca1b45680577befc743e1c92fa40687e1b1745e7`;
- the 3318432-byte ELF with SHA-256
`7beb09592404b5c1fb4161c632171d2901f3715db26e59458998690e8c49f3fc`;
- firmware text `9.60`;
- a manual, non-autoload, non-installing one-shot loader route;
- an independently reviewed recovery path;
- a 100 ms flip timeout in the linked SDL object;
- no automatic retry;
- one explicit artifact-specific transfer authorization and one explicit
execution authorization.
## Exact proposed one-shot scope
1. Verify the local ELF hash against the reviewed manifest.
2. Verify autoload remains off and no live component will be replaced.
3. Transfer only that one ELF to a non-persistent one-shot loader path.
4. Execute once with no content and no arguments.
5. Observe whether a 320x240 moving pattern is presented through RGUI/SDL.
6. Observe bounded 48 kHz stereo test audio.
7. Check one controller: D-pad and left stick change pattern position and A
changes its background.
8. Press Start once and observe whether RetroArch returns cleanly.
9. Do not retry automatically. On crash, hang, missing output, timeout or
unexpected filesystem/service behaviour, stop and use the separately
reviewed recovery action.
10. Hash and preserve host-side logs/transcript; do not infer success for
unobserved subsystems.
## Explicit technical effects to accept later
The SDK CRT performs its previously documented bounded runtime initialization.
The software profile opens user/system service, VideoOut, Pad and AudioOut,
allocates heap/direct-memory buffers, creates SDL audio/thread primitives,
submits VideoOut flips, waits on an equeue with a 100 ms timeout, polls input
and writes audio. Logs, scheduler activity, process accounting and caches may
change. These are functional runtime effects, not a side-effect-free probe.
## Remaining risks
- loader entry/return and firmware-9.60 lifecycle remain hardware-unproven;
- VideoOut ownership or direct-memory assumptions may fail;
- the public SDL backend's partial-init cleanup has not been observed;
- a timeout may return an error but higher-level shutdown still needs proof;
- audio output is blocking and underrun/overrun statistics are absent;
- controller mappings/deadzone need device validation;
- generic RetroArch write-capable code remains in the ELF even though the
fixed first-run path blocks persistent writes;
- a crash or hang may require a reboot/new jailbreak session.
No transfer or execution may occur on the basis of this document alone.
docs/retroarch/phase-1.0a-pacbrew-sdl-analysis.md
+56
View File
@@ -0,0 +1,56 @@
# Phase 1.0A PacBrew and PS5 SDL analysis
## Identities
| Source | Identity |
| --- | --- |
| PacBrew repository | `c2abcfcb60f569128abd0e8e70ad03a67bee5ea7` |
| PS5 SDL fork | `0baf4ac49382b537ba449901b5b6d0d189bb1fbb` |
| SDL reported revision | `SDL-2.30.12-g0baf4ac4` |
| SDL license | Zlib |
The PacBrew SDL2 recipe builds the PS5 fork and enables OpenGL and LOADSO.
Those two options are intentionally disabled here. PacBrew recipes were also
reviewed for SDL2_image, SDL2_mixer, SDL2_ttf, freetype, zlib, libpng, OpenAL,
elfldr and representative emulator ports. None is needed by the two Phase
1.0A binaries beyond SDL2 itself.
## Native backend inventory
| Area | PS5 SDL implementation | APIs/dependencies | Phase 1.0A use |
| --- | --- | --- | --- |
| Video | Software surface, tiled direct-memory buffers, double buffer, VideoOut flip/equeue | `SceVideoOut`, kernel equeue/direct memory, user/system service | Enabled |
| Render | SDL software renderer targeting the window framebuffer | SDL core software renderer | Enabled |
| Input | Up to four PS5 Pad users, buttons, axes, connect/disconnect polling | `ScePad`, `SceUserService` | Enabled for one controller |
| Audio | 48 kHz, mono/stereo, S16 or F32, bounded 256-2048 sample buffers | `SceAudioOut` | Enabled, RetroArch requests stereo |
| Keyboard/IME | PS5 keyboard and IME dialog | `SceKeyboard`, `SceImeDialog` | Removed by reviewed overlay |
| Filesystem | PS5 implementation exists | user service/filesystem | Disabled |
| OpenGL/OSMesa | Optional source exists | Mesa/OSMesa | Disabled |
| LoadSO | Optional | dynamic loader | Disabled |
## Reviewed overlay
The fork carries only a patch, not SDL source. The patch:
- removes keyboard/IME initialization and event pumping;
- replaces twelve freshly created worker threads per frame with a checked
single-thread tile copy;
- rejects non-positive or non-tile-aligned framebuffer dimensions;
- passes a 100,000 microsecond timeout to `sceKernelWaitEqueue`;
- propagates copy and timeout errors to SDL.
SDL is configured with video, render, events, joystick, threads, timers and
audio on; filesystem, file, loadso, OpenGL, Vulkan, haptic, sensor, locale,
misc, libsamplerate, disk audio and dummy audio are off.
## Classification
`PS5_SDL_PARTIAL_CANDIDATE`
The source contains real PS5 video, controller and audio backends and the
software RetroArch profile links them. It is not `FULL` because firmware-9.60
runtime behaviour, VideoOut ownership, error cleanup, disconnect recovery,
audio underrun/overrun reporting, exact flip timeout semantics and shutdown
after partial initialization have not been verified on hardware.
Static build and host audits are not runtime evidence.
docs/retroarch/phase-1.0a-port-plan.md
+70
View File
@@ -0,0 +1,70 @@
# Phase 1.0A native RetroArch PS5 port plan
Date: 2026-07-19
## Outcome and boundary
Phase 1.0A creates a real native RetroArch target in the separate
`chimera-retroarch` repository. It does not add RetroArch source to
`chimera-gfx`. The implementation has three profiles:
| Profile | Purpose | Target result |
| --- | --- | --- |
| `ps5-headless-smokecore` | Real RetroArch frontend/runloop with null drivers | `retroarch_ps5_headless.elf` |
| `ps5-software-rgui-smokecore` | RGUI and SDL2 software video, Pad input and 48 kHz AudioOut | `retroarch_ps5_software.elf` |
| `host-smokecore-integration` | 600 deterministic libretro frames under ASan/UBSan | Host executable, removed after test |
The target outputs are offline research artifacts. They are not installation
or execution packages and carry no device authority.
## Layering
1. Upstream RetroArch remains the generic frontend, runloop, menu and driver
registry.
2. The PS5 layer adds the platform frontend, compile-time profiles and static
smoke core. The software profile selects existing RetroArch SDL2 drivers.
3. Chimera owns dependency locks, reproducible builds, artifact audits,
manifests, guardrails and a later human-reviewed smoke-test proposal.
## Work sequence
1. Pin the official stable RetroArch release and source archive.
2. Add the PS5 frontend and a warnings-as-errors headless build.
3. Add and host-test a deterministic, contentless static libretro core.
4. Cross-link the real headless RetroArch ELF.
5. Build the pinned PS5 SDL fork with a reviewed overlay.
6. Cross-link RGUI plus software video, input and audio.
7. Perform two clean builds of every successful profile and compare bytes.
8. Audit ELF headers, dynamic dependencies, symbols, relocations, executable
segments, map files, startup/shutdown disassembly, strings and policy
markers.
9. Commit the port to its separate private branch and record only identities,
results and safety evidence here.
## Compile-time safety policy
- networking, achievements, updater, core download and dynamic cores are off;
- no GNM, OpenGL, Vulkan, shaders or hardware libretro context is present;
- configuration reads are blocked by the PS5 frontend;
- no content, core, SRAM, state, config or data path is supplied;
- Salamander config and the normal shutdown save event are compiled out;
- the static smoke core has no filesystem, network, JIT, thread or hot-path
allocation code;
- build rules contain no sender, deploy, install or run action.
Generic RetroArch filesystem functions remain linkable and some libc write
imports remain in the ELFs. The safety claim is limited to the fixed default
launch control flow, not global absence of all write-capable library code.
Hardware behaviour on firmware 9.60 remains unproven.
## Non-goals
Dynamic libretro cores, persistent VFS paths, savestates, SRAM, playlists,
history, screenshots, multiple controllers, rumble, touchpad, gyro, shaders,
GNM acceleration, OpenGL/Vulkan contexts, packaging, installation and device
execution are outside Phase 1.0A.
The five explicit offline source/build/audit/private-push authorizations are
recorded as true for this phase. PS5 connection, device transfer, device
execution, installation, lifecycle, autoload and device writes remain false;
`automatic_retry=false`.
docs/retroarch/phase-1.0a-ps4-reference-delta.md
+29
View File
@@ -0,0 +1,29 @@
# Phase 1.0A PS4 reference delta
The official RetroArch Orbis port is a structural reference only.
| Orbis concept | PS5 Phase 1.0A decision | Evidence/status |
| --- | --- | --- |
| `Makefile.orbis` platform build | New `Makefile.ps5` using the open PS5 Payload SDK | Implemented |
| Orbis frontend registry | New `frontend_ctx_ps5`, first for `__PS5__` | Implemented |
| Orbis platform paths | No device paths at all | Safer default; future VFS work |
| PS4 native input | RetroArch SDL2 input over the PS5 SDL Pad backend | Linked; runtime unproven |
| PS4 native audio | RetroArch SDL audio over PS5 SDL AudioOut | Linked; runtime unproven |
| PS4 video/context | PS5 SDL software framebuffer and VideoOut only | Linked; no GNM/context |
| Static core support | Global libretro symbols provided by `chimera_smokecore` | Implemented and audited |
| Console definitions | `__PS5__`, `__PROSPERO__`, `PS5`, `RARCH_CONSOLE` | Compile-time only |
| Packaging/SELF | No conversion or packaging | Explicitly excluded |
Not reused from PS4:
- ABI declarations or structure layouts;
- Orbis library or stub names;
- PS4 paths, title identifiers or package logic;
- PS4 controller/audio/video calls;
- Auth info, SELF generation or installation;
- PS4 runtime or cleanup assumptions.
The PS5 ELF uses the public SDK v0.41 CRT and linker contract already audited
by Chimera. That startup has documented userland/kernel runtime effects and
adds SDK dynamic dependencies; it is not a PS4 ABI and is not claimed to be
side-effect free. Offline linking is authorized, device execution is not.
docs/retroarch/phase-1.0a-upstream-analysis.md
+67
View File
@@ -0,0 +1,67 @@
# Phase 1.0A upstream analysis
## Selected RetroArch base
| Field | Value |
| --- | --- |
| Official repository | `https://github.com/libretro/RetroArch` |
| Stable tag | `v1.22.2` |
| Commit | `69a4f0ea1e8aaf442ae4858f2e7f2b31a1776576` |
| Tree | `33babf9eb7699b5d571a3063ea21c3e488c159fe` |
| Commit date | `2025-11-20T00:17:08Z` |
| Source archive | official GitHub tag archive |
| Archive size | `71629881` bytes |
| Archive SHA-256 | `245ef18c8fa8fbd9fbb5eb25cf43e17c6aace2f95c1ed99873cbd794012bb232` |
| License | GPL-3.0-or-later (`COPYING` and source notices) |
| Acquisition date | `2026-07-19` |
The local fork starts at that exact commit. Its `upstream` fetch remote names
the official repository and its push URL is disabled. Project pushes are
restricted to the private Gitea `origin`.
## Areas inspected
The analysis covered `Makefile.common`, `Makefile.griffin`,
`Makefile.orbis`, frontend and driver registries, null/dummy drivers, RGUI,
static core glue, config/path startup, task queues, time/sleep, threads,
dynamic loading, VFS and logging. Reference platform implementations included
Orbis, Vita, Switch, PSP and null.
Relevant upstream mechanisms:
- `frontend_ctx_drivers[]` selects the first compiled platform frontend;
- video, audio and input arrays fall back to their null drivers;
- `Makefile.common` conditionally adds SDL2 video, input/joypad and audio;
- a static build resolves the global libretro API symbols at link time;
- configuration defaults derive driver names from compiled feature macros;
- RGUI is the smallest software-oriented menu driver;
- generic file/VFS/task code is widely shared even when persistent features
are disabled.
## Fork delta
The port adds:
- `Makefile.ps5` with explicit headless and software profiles;
- `frontend/drivers/platform_ps5.c`;
- `cores/chimera_smokecore/`;
- host tests and PS5 build validation;
- `pkg/ps5/` for the pinned SDL build and reviewed overlay;
- PS5 port documentation.
Small generic-source changes register the platform, block static Salamander
config I/O and normal shutdown saves for this profile, and add headers or
fallback locals required by the unusually small feature matrix. No proprietary
header, NID, syscall, firmware offset or device path is introduced.
## Static and dynamic core decisions
The static smoke core is linked into both ELFs and exports the real libretro
entrypoints consumed by RetroArch. Dynamic loading is deliberately disabled:
there is no proven native PS5 shared-core file/relocation/unload contract yet.
A later milestone must separately specify format, symbol binding, executable
memory, directory/VFS policy, ABI compatibility, error cleanup and unload.
No additional `libretro-samples` acquisition was needed because the required
deterministic input, video, audio and no-content behaviour was implemented in
the small GPL-compatible Chimera core and verified by a host harness.
docs/retroarch/phase-1.0aa-offline-fake-adapter-integration.md
+70
View File
@@ -0,0 +1,70 @@
# Phase 1.0AA: offline fake-adapter integration
Status: `OFFLINE_FAKE_BATCH_INTEGRATION_COMPLETE_LIVE_ADAPTER_BLOCKED`
Date: 2026-07-22
Phase 1.0AA connects the Phase-1.0Z passive batch contract to the Phase-1.0X
exclusive evidence model using only an exact built-in fake adapter and exact
synthetic clock. It creates no live adapter, socket, address, CLI, target code
or target artifact. No PS5 action occurred.
## Closed fake boundary
`run_offline_fake_batch` rejects subclasses and arbitrary adapter objects. The
only accepted components are:
- `OfflineFakeClock`, whose value changes only through explicit fake events;
- `OfflineFakeBatchAdapter`, which allows one fake open, one complete Z batch,
a bounded scripted event sequence and one fake close;
- `OfflineFakeEvidenceStore`, which exclusively creates local test evidence.
There is deliberately no adapter protocol that a network implementation could
quietly satisfy. The fake adapter records only the SHA-256 of sent bytes, not a
target. Scripted event buffers are logically discarded during close; physical
memory erasure remains unproven because caller-owned immutable bytes may still
exist.
## State and ordering
```text
validate W plan -> build and revalidate Z batch
-> exclusive consumed receipt
-> fake open exactly once
-> fake send exactly one complete batch
-> zero or more bounded DATA events before deadline
-> HARD_DEADLINE at or after the synthetic deadline
-> Z completeness validation and sanitization
-> fake close exactly once
-> exclusive receipt-bound sanitized output
```
The consumed receipt includes run ID, window, batch size, batch SHA-256,
deadline and the exact Z contract hash. It does not include a target or raw
transcript. A failure after receipt creation leaves the receipt intact and
creates no sanitized output; no cleanup deletes it.
Remote EOF, a blocked receive event, missing deadline, early deadline, data at
or after the deadline, IAC, partial output, a second fake send, a second fake
close and evidence collisions all fail closed. Prompt bytes remain ordinary
data and cannot seal a result.
## What the tests prove
The host tests prove internal ordering and rejection behavior of this exact
Python model. They do not prove:
- a live listener or exact deployed shsrv binary;
- OS socket timeouts or preemption of a blocking call;
- live fragmentation, short sends/writes, disconnect or cleanup;
- firmware-9.60 behavior;
- absence of atime, cache, accounting, scheduler or shell-process effects;
- physical erasure or containing-directory durability.
## Decision
The fake integration is complete and remains host-only. A live adapter is
blocked and unauthorized. The next permitted step is an offline feasibility
review for a future bounded live adapter: OS timeout/preemption semantics,
short-send handling, exclusive evidence ordering and failure cleanup must be
specified without adding a socket, address or device action.
docs/retroarch/phase-1.0ab-offline-live-adapter-feasibility.md
+79
View File
@@ -0,0 +1,79 @@
# Phase 1.0AB: offline live-adapter feasibility
Status: `PARTIAL_FEASIBILITY_LIVE_IMPLEMENTATION_BLOCKED`
Date: 2026-07-22
This phase audits the local Windows host runtime and models lifecycle ordering
with synthetic traces only. It adds no socket import, address, DNS, live
adapter, CLI or device action.
## Bound local runtime
| Object | Identity |
|---|---|
| Python | 3.13.2, MSC v.1942, 64-bit AMD64 |
| `socket.py` | 38,741 bytes; SHA-256 `523695ac3383799547b421b4fe18004de1e80181e97181b6d7a10533b47f4c49` |
| `selectors.py` | 20,060 bytes; SHA-256 `b3d6cebd4a3a03b4a614f12f171622ce4e4ba3295b9e8b89e2bde051003106eb` |
| `_socket.pyd` | 84,984 bytes; SHA-256 `8daefaff53e6956f5aea5279a7c71f17d8c63e2b0d54031c3b9e82fcb0fb84db` |
| `select.pyd` | 32,248 bytes; SHA-256 `baee284995b22d495fd12fa8378077e470978db1522c61bfb9af37fb827f33d1` |
| monotonic clock | `QueryPerformanceCounter()`, monotonic, non-adjustable, reported resolution `1e-07` seconds |
| default selector | `SelectSelector` on this runtime |
These identities are local host evidence only. They are not portable to a
different Python build and say nothing about the PS5.
## Source-bound findings
The local `_socket` interface states that:
- `setblocking(False)` is equivalent to timeout `0.0`;
- `connect_ex` returns an error number instead of raising for connection
results;
- `send` returns a byte count that may be smaller than the supplied buffer;
- `recv` returns at most the requested bytes and returns empty bytes after
remote close and drained data;
- `close` makes the local socket object unusable.
The local `selectors.py` documents a maximum wait parameter. On Windows its
`SelectSelector` passes readers, writers and exceptional writers to
`select.select`, merges exceptional sockets into writable results, and returns
an empty readiness set after `InterruptedError`. Therefore a pending connect
must inspect `SO_ERROR` after writability, and every empty/interrupted return
must recompute the remaining monotonic budget.
## Feasibility matrix
| Part | Classification | Reason |
|---|---|---|
| receipt before socket creation | `FEASIBLE_FROM_EXISTING_HOST_MODEL` | X/AA exclusive evidence already models this order |
| numeric-address-only input | `DESIGN_REQUIRED` | DNS must be excluded; no address parser is added here |
| nonblocking mode before connect | `FEASIBLE_FROM_LOCAL_RUNTIME` | exact local `_socket` contract exists |
| pending connect completion | `PARTIAL` | readiness plus `SO_ERROR` is source-bound; exact accepted Windows error set still needs implementation review |
| complete batch send | `FEASIBLE_FROM_LOCAL_RUNTIME` | repeated readiness and explicit partial-send loop are available |
| bounded receive memory | `FEASIBLE_FROM_EXISTING_MODEL` | 65,536-byte collector bound already exists |
| hard wall-clock deadline | `PARTIAL` | monotonic remaining budgets are feasible; selector/scheduler overshoot cannot be proven impossible |
| prompt-independent completion | `FEASIBLE_FROM_Z` | only deadline sealing is accepted |
| EOF behavior | `FEASIBLE_FAIL_CLOSED` | empty receive must be failure, never completion |
| local descriptor cleanup | `FEASIBLE_BY_DESIGN` | unregister/selector close/socket close can run in `finally` |
| remote shell cleanup | `UNPROVEN` | local close does not attest remote exit or firmware behavior |
| retry/reconnect/resume | `EXCLUDED` | forbidden by contract |
Overall classification: `PARTIAL_FEASIBILITY_LIVE_IMPLEMENTATION_BLOCKED`.
## Existing-client comparison
Earlier one-shot ELF runners used blocking `sendall`, write-half-close and
bounded receive for a different raw-ELF protocol. Their result manifests prove
those consumed runs only. They are not reusable for shsrv: Z sends a tiny shell
batch, must keep the write direction open while receiving, ignores prompts and
seals only at deadline. `sendall` also hides individual partial-send progress;
the future contract requires an explicit nonblocking send loop.
## Decision
The required sequence is implementable in principle on the exact local host,
but a hard scheduling bound and remote cleanup cannot be proven offline. A live
adapter remains blocked. The next permitted phase may build only a dormant,
target-free adapter around an injected syscall facade and fake OS results. It
must not import or instantiate a real socket until a later dedicated review.
docs/retroarch/phase-1.0ab-timeout-and-cleanup-contract.md
+50
View File
@@ -0,0 +1,50 @@
# Phase 1.0AB timeout and cleanup contract
This is a design contract, not live network code.
## Future required algorithm
1. Rehash policy, Z batch and approval before any capability creation.
2. Exclusively create, flush, close and reopen the consumed receipt.
3. Acquire one absolute monotonic deadline.
4. Create at most one stream socket and immediately set it nonblocking.
5. Start one numeric-address connect; never perform DNS.
6. For pending connect, wait for write/exception readiness using only the
recomputed remaining budget, then require `SO_ERROR == 0`.
7. Send the exact batch with an offset loop. Each call requires prior write
readiness; zero progress, excess count or error fails the attempt.
8. Switch to read readiness. Each read is bounded by both remaining collector
capacity and a small fixed chunk size.
9. Treat empty receive as remote EOF and fail immediately.
10. After every wait or operation, read monotonic time again. At or beyond the
deadline perform no further send or receive.
11. Ask Z to seal only because the hard deadline was reached. Partial or
malformed data remains invalid.
12. In `finally`, unregister if registered, close the selector and close the
local socket exactly once. Never retry, reconnect, resume or delete the
consumed receipt.
13. Create sanitized output only after successful Z sealing and local cleanup.
## Conservative race rule
When readiness and deadline coincide, the deadline wins. No additional bytes
are read or sent at `now >= deadline`. This can reject data already queued by
the OS, but it cannot silently extend the approved window.
## Failure classifications
| Event | Required result |
|---|---|
| connect error or nonzero `SO_ERROR` | fail, local cleanup |
| selector interruption | recompute remaining budget; no retry counter |
| selector timeout before absolute deadline | recompute; never seal early |
| partial send | advance offset only by reported positive count |
| zero send | fail |
| receive over 65,536 bytes | fail |
| remote EOF | fail |
| deadline without complete Z result | fail |
| cleanup exception | fail and retain receipt |
| output collision or short host write | fail and retain existing evidence |
`close()` proves only local object closure. It does not prove TCP packet
delivery, remote shsrv exit, process cleanup or reboot recovery.
docs/retroarch/phase-1.0ac-fake-syscall-contract.md
+24
View File
@@ -0,0 +1,24 @@
# Phase 1.0AC fake-syscall contract
This contract is executable only against the exact built-in fake facade.
| Synthetic operation | Accepted result | Rule |
|---|---|---|
| `CREATE_STREAM` | `OK`, `ERROR` | exactly once after a precommitted receipt |
| `SET_NONBLOCKING` | `OK`, `ERROR` | immediately after create |
| `START_CONNECT` | `IMMEDIATE`, `PENDING`, `ERROR` | contains no target or address |
| `WAIT_WRITE` | `READY`, `INTERRUPTED`, `TIMEOUT`, `ERROR` | remaining fake budget is rechecked |
| `GET_SO_ERROR` | `ZERO`, `NONZERO`, `ERROR` | mandatory after pending readiness |
| `WRITE_BYTES` | `PROGRESS`, `ZERO`, `ERROR` | positive progress cannot exceed remainder |
| `WAIT_READ` | `READY`, `INTERRUPTED`, `TIMEOUT`, `ERROR` | deadline wins a simultaneous readiness event |
| `READ_BYTES` | `PROGRESS`, `EOF`, `ERROR` | EOF is failure; total input is bounded |
| local close | `OK`, `ERROR` | one call after ownership; none if create failed |
The facade accepts at most 1,024 scripted steps. One step may advance the fake
clock by at most 60 seconds. These are model bounds, not proposed live values.
Unused synthetic steps are logically discarded at close; physical memory
erasure is not proven.
There is deliberately no adapter protocol, inheritance hook, address field,
network import or live factory. A later phase cannot reinterpret this fake as
device authorization.
docs/retroarch/phase-1.0ac-offline-dormant-adapter.md
+55
View File
@@ -0,0 +1,55 @@
# Phase 1.0AC: offline dormant adapter
Status: `OFFLINE_DORMANT_FAKE_SYSCALL_ADAPTER_COMPLETE_LIVE_ADAPTER_BLOCKED`
Date: 2026-07-22
Chimera GFX is a graphics/homebrew project. This phase adds host-side test
infrastructure for a possible future one-shot launcher observation; it is not
a security feature and it changes no RetroArch, SDL, VideoOut or target code.
## Closed capability boundary
`phase10ac_dormant_adapter.py` composes the Phase-1.0Z passive batch parser
with an exact built-in fake syscall facade. The facade consumes caller-created
synthetic outcomes. It cannot accept a live implementation and stores no
target. The module imports no socket, selector, DNS, real clock or filesystem
output interface and exposes no CLI.
The adapter requires a precommitted-receipt marker before the first synthetic
create step. It then models:
1. one create and immediate nonblocking setup;
2. immediate or pending connect completion;
3. readiness plus `SO_ERROR == 0` for a pending result;
4. an explicit partial-write loop for exactly one Phase-1.0Z batch;
5. bounded read readiness and at most 65,536 supplied bytes;
6. deadline-only result sealing;
7. one local close on success or any failure after successful create.
Timeout and interrupted-wait events stay inside the same synthetic attempt.
They never create a retry, reconnect or resume. When readiness coincides with
the deadline, the deadline wins and no subsequent fake read or write occurs.
EOF, zero progress, excess progress, malformed data and cleanup failure all
invalidate the run.
## Evidence boundary
The 32 host tests cover immediate and pending connect paths, partial writes,
interrupted and timeout waits, exact deadline races, EOF, receive limits,
malformed results, cleanup and closed fake types. They prove only the Python
model's behavior. They do not prove:
- a deployed shsrv identity or port-2323 behavior;
- Windows scheduler or real socket timing;
- a live connect, send, receive or remote-process cleanup;
- firmware-9.60 behavior;
- RetroArch launch context, SDL, VideoOut or rendering.
## Decision
The dormant fake-syscall adapter is complete. A live adapter remains blocked
and absent. The next permissible step is an offline-only Phase 1.0AD design
for numeric target validation and an inactive activation record. That phase
must still contain no socket creation, connection, device request or enabled
authorization.
docs/retroarch/phase-1.0ad-inactive-activation-contract.md
+24
View File
@@ -0,0 +1,24 @@
# Phase 1.0AD: inactive activation contract
Status: `INACTIVE_NUMERIC_TARGET_CONTRACT_COMPLETE_NO_LIVE_CAPABILITY`
Date: 2026-07-29
This phase closes the data boundary left by Phase 1.0AC. It does not add a
network adapter, target source, launcher, socket, DNS lookup, clock, CLI or
device action.
The tracked activation is entirely inactive and target-free. The host-only
contract can validate hypothetical future records, but validation neither
activates nor persists them. A candidate must use canonical private IPv4 text,
source-bound port 2323, a unique run ID, a window of at most five minutes and
separate SHA-256 identities for launcher, payload and untracked approval.
Retry, reconnect, resume, device writes, app termination and system remounts
are rejected. The contract deliberately cannot express authorization for
those effects.
The next useful phase is a separate offline architecture review of a minimal
BigApp launcher derived from official GPLv3 shsrv source. That review must
remove the general shell, persistent fake-app creation, remount behavior,
unbounded waits and arbitrary payload selection before target code is allowed.
docs/retroarch/phase-1.0ae-minimal-bigapp-launcher-architecture.md
+79
View File
@@ -0,0 +1,79 @@
# Phase 1.0AE: minimal BigApp launcher architecture
Status: `V07_NONPERSISTENT_LINEAGE_SELECTED_TARGET_IMPLEMENTATION_BLOCKED`
Date: 2026-07-29
## Objective
Identify the shortest public-source route from the proven raw-ELF VideoOut
failure to one bounded launch-context experiment. This is an offline source
review. It adds no target source, artifact, socket, transfer or execution.
## Source decision
Official shsrv v0.19 is not an acceptable base. Its hbldr path can remount
`/system_ex`, persistently create `FAKE00000`, copy an executable, kill the
running BigApp and enter unbounded ptrace/wait loops.
Official shsrv v0.7 is the selected reference lineage because it launches the
existing VideoPlayer WebApp title `PPSA01659` and contains no fake-app creation
or system-ex remount in its hbldr bundle. Selection is not authorization and
does not prove that the title exists, launches, owns VideoOut or behaves the
same way on firmware 9.60.
## Required minimal callgraph
The future design may model only this sequence:
1. validate one exact payload hash and fixed argument vector;
2. query the foreground user;
3. require that no BigApp is currently running;
4. attach to the source-proven SystemService parent;
5. arm bounded fork and exec observation before launch;
6. request launch of the fixed existing `PPSA01659` title;
7. detach the parent on every path;
8. replace only the newly observed child with the exact payload;
9. restore every temporary instruction and credential mutation;
10. detach the child or terminate only that newly created child on failure;
11. emit a bounded inherited result and stop.
The architecture must fail closed when a BigApp already exists. It must never
call `sceSystemServiceKillApp` as part of the experiment.
## Removed upstream behavior
- general Telnet shell and arbitrary command parsing;
- PATH search, arbitrary filesystem path and target-side ELF read;
- `FAKE00000`, `fakeapp_create_if_missing` and `remount_system_ex`;
- package installation, autoload and persistent writes;
- `hbdbg`, GDB wait and free-form arguments;
- arbitrary root/jail broadening unless separately proven indispensable and
exactly restored;
- unbounded `waitpid`, `pt_await_child`, `pt_await_exec`, `pt_call` and
`pt_syscall` loops;
- killing or replacing any pre-existing process;
- retry, reconnect and fallback title selection.
## Unclosed contracts
Target implementation remains blocked until an offline design proves:
- a deadline-capable wait primitive for every wait/step boundary;
- unique child correlation without acting on an unrelated process;
- complete parent detach and child cleanup for every failure edge;
- exact restoration of breakpoint bytes, page protections, credentials,
environment, root and jail changes;
- bounded ELF size, headers, segments, relocations and allocation;
- exact firmware-9.60 availability and role of `PPSA01659`, or a fail-closed
observation that does not install or mutate it;
- accepted public evidence for every SystemService/UserService declaration;
- an explicit policy for the unavoidable kernel/ptrace effects.
## Decision
The persistent v0.19 route is rejected. v0.7 is the preferred public-source
reference for a nonpersistent BigApp experiment, but copying or compiling it
is still blocked. The next phase may implement only a host lifecycle model
with injected fake operations and exhaustive failure cleanup. It may not add
PS5 headers, target source, syscall numbers, a target build or device action.
docs/retroarch/phase-1.0af-offline-bigapp-lifecycle-model.md
+25
View File
@@ -0,0 +1,25 @@
# Phase 1.0AF: offline BigApp lifecycle model
Status: `HOST_LIFECYCLE_MODEL_COMPLETE_TARGET_IMPLEMENTATION_BLOCKED`
Date: 2026-07-29
The host-only state machine implements the lifecycle selected in Phase 1.0AE
using exact built-in fake events. It contains no PS5 headers, process calls,
syscalls, socket, real clock, CLI or filesystem output.
The model refuses launch when a BigApp already exists. A successful synthetic
attempt must attach and arm the parent, request only fixed title `PPSA01659`,
observe one positive unique child identity, detach the parent, observe child
exec, replace one exact payload, restore temporary mutations, detach the child
and emit one result within 64 supplied ticks.
Failure injection proves the modeled unwind order. An acquired parent is
detached. A newly observed child is the only process eligible for termination.
If replacement began, restoration precedes termination. Cleanup failure is a
hard error rather than a clean result. These are properties of the model, not
firmware or runtime evidence.
Target implementation remains blocked. The next permitted work is a host-only
bounded ELF contract and validator so malformed or oversized payloads can be
rejected before any future launcher boundary.

Some files were not shown because too many files have changed in this diff Show More