Publish Chimera GFX source

docs/adr/0001-standalone-repository.md

@@ -0,0 +1,15 @@
+# ADR-0001: Standalone repository
+
+- Status: accepted
+- Date: 2026-07-16
+
+## Decision
+
+`chimera-gfx` is a new repository and workspace, not a subdirectory, worktree,
+submodule, or branch of the existing Chimera project.
+
+## Consequences
+
+It has an independent Git history, private Gitea origin, license, CI, release
+policy, dependencies, and risk boundary. No path or build step refers to the
+existing Chimera repository.

docs/adr/0002-export-names-are-not-abi.md

@@ -0,0 +1,21 @@
+# ADR-0002: Export names are not ABI definitions
+
+- Status: accepted
+- Date: 2026-07-16
+
+## Context
+
+The public PS5 Payload SDK v0.41 contains GNM export stubs but no GNM headers,
+structure definitions, or GPU samples.
+
+## Decision
+
+An export name proves only that the pinned stub set exposes that name. No C
+prototype, calling convention detail, structure layout, ownership rule, or
+semantic behavior is inferred from it. Phase 0 may resolve a name and record a
+boolean, but may not call the result.
+
+## Consequences
+
+Even `sceGnmAreSubmitsAllowed` is not called. Each future ABI must be accepted
+through a new evidence record before use.

docs/adr/0003-fail-closed-probe.md

@@ -0,0 +1,20 @@
+# ADR-0003: Fail-closed capability probe
+
+- Status: accepted
+- Date: 2026-07-16
+
+## Decision
+
+The PS5 probe is disabled in ordinary builds. A probe build embeds exactly one
+approved firmware identifier, defaulting to `NONE`. Runtime requires an exact
+firmware match and the literal `--acknowledge-read-only-probe` argument before
+module loading. The checked-in firmware matrix is empty.
+
+The platform shim may call only `dlopen`, `dlsym`, and `dlclose`. Logs contain
+symbol names and booleans, never addresses. There is no deploy target.
+
+## Consequences
+
+Default artifacts cannot discover symbols on hardware. A deliberately gated
+artifact still requires separate human authorization before transfer or
+execution. Loader-internal side effects remain an explicitly recorded unknown.

docs/adr/0004-license.md

@@ -0,0 +1,15 @@
+# ADR-0004: GPL-3.0-or-later
+
+- Status: accepted
+- Date: 2026-07-16
+
+## Decision
+
+Project-owned code is licensed GPL-3.0-or-later.
+
+## Rationale
+
+The planned RetroArch adapter targets a GPLv3 project and the PS5 Payload SDK is
+generally GPLv3-or-later. A common GPL-compatible project license keeps the
+combined distribution boundary understandable. Third-party code is not
+vendored and retains its own notices.

docs/adr/0005-versioned-resource-lifecycle.md

@@ -0,0 +1,24 @@
+# ADR-0005: Versioned resource lifecycle and host present model
+
+- Status: accepted
+- Date: 2026-07-17
+
+## Decision
+
+API version 2 includes opaque contexts, surfaces, and textures, plus sized
+descriptors for texture upload and present. Context destruction returns
+`RESOURCE_BUSY` while child handles exist. The version-1 `chimera_gfx_destroy`
+symbol remains as a void compatibility wrapper for childless contexts. The
+mock backend implements the complete ownership model in host memory and records
+deterministic present serials and content hashes.
+
+The mock present is a state transition, not a graphical operation. It creates
+no window, accesses no display, and advertises both `NON_RENDERING` and
+`HOST_TEST_ONLY`. The PS5 backend is a separate compiled unit that refuses
+context creation with `SAFETY_POLICY`.
+
+## Consequences
+
+Adapter work can compile and test lifecycle assumptions before a hardware ABI
+exists. Future backends must preserve validation and cleanup semantics, but
+must not inherit mock capabilities without evidence.

docs/adr/0006-phase1-sdl-videoout-boundary.md

@@ -0,0 +1,29 @@
+# ADR-0006: Phase-1 VideoOut experiment stays behind SDL2
+
+- Status: accepted
+- Date: 2026-07-17
+
+## Context
+
+The public SDK v0.41 exports VideoOut stubs but supplies no official VideoOut
+headers. The pinned PS5 SDL2 fork contains a working framebuffer route, but its
+backend declares opaque layouts with fields named `junk`. Those declarations
+are public source evidence of the upstream implementation, not a sufficiently
+proven ABI for duplication in `chimera-gfx`.
+
+## Decision
+
+The first presentation candidate calls only public SDL2 APIs. A reviewed
+Zlib-licensed build overlay removes SDL's unrelated keyboard/IME initialization
+from this candidate. Project code does not copy a VideoOut prototype or data
+layout. The target is disabled by default, requires the PS5 toolchain and an
+explicit SDL build path, and embeds the same `NONE` firmware gate as the probe.
+
+The candidate does not link SDL2main because that wrapper hides the splash
+screen before application-level firmware validation.
+
+## Consequences
+
+The upstream SDL backend remains the owner of VideoOut, direct memory, tiling,
+flip, and cleanup. Its unbounded flip wait is a known hardware-test blocker;
+successful offline compilation is not runtime approval or ABI proof.

docs/adr/0007-artifact-provenance.md

@@ -0,0 +1,15 @@
+# ADR-0007: Artifact provenance is machine-readable and fail-closed
+
+- Status: accepted
+- Date: 2026-07-17
+
+## Decision
+
+Every review or hardware candidate uses artifact-manifest schema version 1.
+The manifest binds filename, size, SHA-256, target, clean source commit,
+toolchain pins, optional SDL commit, firmware gate, and explicit non-execution
+state. Generation and verification are separate tested tools.
+
+An artifact with firmware identifier `NONE` is never allowlisted. Any rebuild,
+including a firmware-specific rebuild, creates a new digest and therefore
+requires a new artifact-specific approval.

docs/adr/0008-firmware-9.60-probe-build.md

@@ -0,0 +1,39 @@
+# ADR-0008: Firmware 9.60 is build-allowlisted; SDK-CRT execution is blocked
+
+- Status: accepted
+- Date: 2026-07-17
+
+## Context
+
+Jens reported exact PS5 firmware `9.60` and authorized an offline-only,
+non-rendering capability-probe build and audit. Transfer, connection, execution,
+VideoOut, framebuffer/GPU/GNM mutation, draw, dispatch, submit, flip, MMIO,
+register writes, and kernel/firmware changes remain prohibited.
+
+The pinned public SDK v0.41 source was audited beyond project `main`. Its
+payload startup calls `__patch_init` before `main`. That function changes the
+current process's kernel credential fields and syscall-address bounds using the
+SDK kernel read/write path. The SDK rtld also ensures `libSceSysmodule.sprx` is
+available during startup. A later project `dlopen` can load/start
+`libSceGnmDriver.sprx`; `dlclose` can stop/unload it.
+
+## Decision
+
+The discovery manifest and probe configure gate accept exactly `9.60`; the
+default remains `NONE`. This allowlist entry authorizes only a reproducible
+offline build. Phase-1 VideoOut rejects every non-`NONE` firmware gate.
+
+The resulting 9.60 ELF is named `offline-audit-only`, records zero transfer and
+execution, and is not execution-eligible. No literal execution approval is
+offered while the linked SDK CRT performs kernel writes before the project gate.
+
+## Consequences
+
+- Project code still invokes no resolved GNM pointer and contains no rendering,
+  submit, draw, dispatch, flip, or GPU-memory operation.
+- The artifact is useful for deterministic compilation, import/disassembly
+  review, hashing, and future startup research only.
+- A new ADR and a new hash-bound build are required after a public,
+  kernelwrite-free startup/loader route is proven.
+- Transfer or execution of this artifact would violate the current safety
+  policy even if Jens later supplied a generic execution approval.

docs/adr/0009-block-unproven-minimal-startup.md

@@ -0,0 +1,43 @@
+# ADR-0009: Block unproven minimal startup and permanently deny legacy ELF
+
+Status: accepted
+Date: 2026-07-17
+
+## Context
+
+SDK v0.41's stock `crt1.o` performs prohibited kernel credential and
+syscall-bound writes before project `main`. Phase 0.5 tested whether omitting
+the CRT could support a deterministic freestanding entry. Compiler and linker
+evidence proves omission is mechanically possible, but no exact pinned loader
+caller is locally available to prove stack, argument ownership, safe return,
+post-return cleanup, crash handling, or pre-entry process changes.
+
+The already-built firmware-9.60 capability probe has SHA-256
+`4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63`
+and must remain permanently blocked.
+
+## Decision
+
+Do not create a minimal-startup source or PS5 ELF while the caller contract is
+unproven. Keep `CHIMERA_GFX_BUILD_PS5_MINIMAL_STARTUP` as an unconditional
+configure-time failure with the evidence blocker stated in its message.
+
+Require every artifact manifest to state `execution_eligible` explicitly. New
+manifests default to false. Maintain a permanent SHA-256 denylist and a
+fail-closed policy tool that refuses false eligibility, malformed records,
+changed bytes, or a denylist match. Passing this static layer does not grant
+execution authority.
+
+## Consequences
+
+- no Phase-0.5 PS5 ELF, linker map, artifact disassembly, or artifact hash
+  exists;
+- stock CRT evidence remains available for review without making a safe-runtime
+  claim;
+- the legacy firmware-9.60 ELF cannot become eligible through a later manifest
+  edit or approval record;
+- a Payload Manager can consume the JSON policy tool, but the manager's own
+  implementation remains outside this repository and cannot be claimed
+  reviewed here;
+- work may continue through mock/software backends or a separately scoped
+  Linux-on-PS5 backend.

docs/adr/0010-controlled-runtime-effects.md

@@ -0,0 +1,45 @@
+# ADR-0010: Controlled runtime effects and Phase-0.6 gate
+
+Status: accepted on 2026-07-17.
+
+## Context
+
+ADR-0009 asked whether a fully kernelwrite-free startup could be proven while
+the exact loader was absent. The current task corrects the safety model:
+documented, bounded, volatile runtime changes may be acceptable. Persistent
+writes and unbounded or unknown effects remain hard blockers.
+
+The installed Payload Manager and elfldr were subsequently identified exactly.
+Their public source exposes both acceptable volatile effects and unresolved
+unbounded paths.
+
+## Decision
+
+Classify each lifecycle effect as exactly one of:
+
+- `EXPECTED_VOLATILE_RUNTIME_EFFECT`;
+- `RESTORED_BY_LOADER`;
+- `PAYLOAD_PROCESS_LOCAL`;
+- `PERSISTENT_WRITE`;
+- `UNBOUNDED_OR_UNKNOWN`.
+
+Only the final two are categorical blockers. `__patch_init` is classified as
+payload-process-local and is no longer an automatic blocker.
+
+Every potentially eligible artifact must also have a profile named exactly
+`controlled-ps5-runtime`, with exact firmware/loader/SDK/artifact identity,
+an explicit list of expected volatile effects, zero persistent and filesystem
+writes, no payload network, a maximum 2000 ms runtime, no retry, no hard
+effects, and no hard blockers. Both the profile and static gate explicitly set
+`execution_authorized=false`; static eligibility never grants execution
+authority.
+
+## Consequences
+
+Phase 0.6 remains blocked because the exact chain has unbounded ptrace loops,
+no payload watchdog, unresolved termination/cleanup, incomplete credential
+restoration, no launch-time hash enforcement, and a persistent manager upload
+path. No lifecycle source or ELF is built.
+
+ADR-0009 and its Phase-0.5 evidence remain historical records. The permanent
+artifact denylist is unchanged.

docs/adr/0011-phase07-hardened-controlled-runtime.md

@@ -0,0 +1,49 @@
+# ADR-0011: Phase-0.7 hardened controlled runtime
+
+- Status: accepted for offline deployment preparation
+- Date: 2026-07-17
+- Decision: `READY_FOR_HARDENED_RUNTIME_DEPLOYMENT`
+
+## Context
+
+Phase 0.6 identified exact upstream loader and Payload Manager versions but
+found unbounded ptrace completion, incomplete credential restoration, missing
+reaping/watchdog behavior, and a path-based unhashed launch route. Those
+findings were implementation inputs, not permanent platform blockers.
+
+Jens explicitly confirmed exact firmware 9.60. Independent device attestation
+is therefore not a Phase-0.7 blocker. The controlled upload below
+`/data/pldmgr/payloads/chimera-controlled` is an allowed, removable
+application write and is not a firmware write.
+
+## Decision
+
+Use private GPL-3.0 hardening forks based on:
+
+- elfldr `699e8bcff03e91e8d6ca6eba281af25c5a58d8c2`;
+- Payload Manager `cfbc70f30f419b09bf2b52283f7409e2d3117ee1`;
+- PS5 Payload SDK `d2e2e585740362976a39fdd5ccf390f199a7bc37`.
+
+The controlled route is a versioned loopback-only protocol with exact
+firmware, artifact ID, size, SHA-256, timeout, and no-retry metadata. elfldr
+rehashes received bytes, enforces the permanent denylist, applies bounded
+ptrace steps and cleanup, and reaps the child through a two-second watchdog.
+The controlled manager is compiled for one exact lifecycle artifact and opens,
+hashes, rewinds, and streams one no-follow file descriptor.
+
+The lifecycle probe uses normal SDK v0.41 startup, performs one
+`sceKernelSendNotificationRequest`, and calls `_exit`; it does not return
+through `payload_terminate`.
+
+## Consequences
+
+The three ELFs are eligible for a later, separately authorized hardened
+runtime installation. This decision does not authorize installation,
+transfer, or execution. The previously blocked SHA-256
+`4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63`
+remains permanently denied.
+
+Normal SDK startup still reaches documented process-local patch and runtime
+initialization. The existing elfldr bootstrap still enables volatile QA flags.
+Both facts are explicit expected runtime effects; neither is silently claimed
+kernelwrite-free.

docs/adr/0012-phase10j-first-frame-identity.md

@@ -0,0 +1,38 @@
+# ADR-0012: Phase-1.0J first-frame identity
+
+- Status: accepted for offline diagnostic construction
+- Date: 2026-07-22
+- Decision: `FIRST_FRAME_INDEX_ZERO_SOURCE_CONSISTENCY_ONLY`
+
+## Context
+
+The consumed Phase-1.0H run submitted the diagnostic buffer with
+`sceVideoOutSubmitFlip(handle, 0, 1, 0)` and received `-1`. The diagnostic
+helper used buffer zero, while the patched normal SDL update path started its
+frame counter at one. The public PS5 SDL source at commit
+`0baf4ac49382b537ba449901b5b6d0d189bb1fbb` starts that normal counter at
+zero. Phase 1.0I classified the mismatch as a strong source candidate, not a
+proven firmware root cause.
+
+## Decision
+
+The Phase-1.0J SDL overlay defines one compile-time source of truth,
+`CHIMERA_PS5_FIRST_FRAME_INDEX`, with value zero. The early diagnostic copy,
+the early diagnostic submit and the normal update counter all derive their
+initial index from that macro.
+
+Zero is selected because it preserves the already-audited diagnostic tuple
+and agrees with the public SDL source. It is not selected on the basis of an
+unpublished ABI or an inferred firmware requirement.
+
+## Consequences
+
+The internal zero-versus-one inconsistency is removed and can be checked in
+source, linker-map and disassembly evidence. This decision does not prove that
+buffer zero is accepted on firmware 9.60, that the fourth flip argument has
+the required semantics, or that the old mismatch caused the Phase-1.0H
+failure.
+
+Phase 1.0J remains an offline artifact phase. A separately reviewed exact
+artifact and new explicit permission would be required before any connection,
+transfer, result reception or execution.