# Roadmap and gates Progress is gate-based. A later phase may be designed and compiled offline, but no hardware behavior may be transferred or executed before its gate. ## Phase 0 — research and non-rendering implementation (offline complete) - [x] Standalone repository boundary - [x] Primary-source research snapshot and upstream pins - [x] Threat model, ABI evidence table, and unknowns register - [x] Versioned context, capability, resource, present-model, and cleanup API - [x] Deterministic non-rendering mock and fail-closed PS5 backend - [x] Compilable RetroArch and SDL2 adapter interfaces - [x] Host unit/integration tests and static safety audit - [x] Checksummed SDK bootstrap and pinned container recipe - [x] Read-only capability manifest and compile-only probe - [x] SPDX SBOM and artifact-manifest schema/tooling - [x] Independent final review record (`docs/reviews/phase0-final-2026-07-17.md`) - [x] Exact 9.60 discovery-only offline build authorization and runtime audit - [x] Identify SDK v0.41 pre-main kernelwrite execution blocker - [x] Phase-0.5 stock CRT, compiler, linker, loader-contract, and transitive object audit - [x] Permanent artifact denylist and fail-closed Payload Manager policy gate - [x] Block minimal startup construction because safe loader return is unproven - [x] Phase-0.6 exact installed Payload Manager/elfldr identity and source audit - [x] Controlled runtime profile and fail-closed exact-firmware/hash/budget gate - [x] Stop lifecycle-probe construction on persistent and unbounded effects - [x] Phase-0.7 hardened elfldr with bounded ptrace, complete restoration, cleanup, watchdog, and receiver-side hash/denylist enforcement - [x] Phase-0.7 controlled Payload Manager with same-FD hash-to-stream, loopback-only versioned transport, and atomic non-autoload upload - [x] Phase-0.7 exact 9.60 lifecycle probe, double clean cross-build, linker map, disassembly, complete callgraphs, and machine proof matrix - [x] Hash-bound installation-review and rollback preparation without console contact - [x] Phase-0.9D existing-stack endpoint, flag, path, readback, and recovery audit; no PS5-to-host file route found - [x] Phase-0.9E bounded bootstrap provenance search and opaque candidate audit - [x] Phase-0.9E-R official release/tag/source/sender audit; local backup classified `LOCAL_BACKUP_NOT_CORRELATED` - [x] Phase-0.9E-R2 inner, SIECAF, community, browser, and exact MediaFire correlation; local backup classified `LOCAL_BACKUP_UNCORRELATED` - [ ] Exact-used Y2JB/other host package and port-9020 listener provenance - [ ] Independent host-to-memory, output, restart, and live-file contracts - [ ] Phase-0.9F offline rescue-payload design gate opened - [x] Two exact, separately approved Phase-1.0D one-shot executions recorded; C1 proven and RUN-B D-stage unclassified - [x] Phase-1.0E inherited-stdout result channel built, host-tested and audited and exercised once with exact authorization; D00-D02 proven, incomplete before D03, authorization consumed - [x] Phase-1.0F I00-I14 startup-interval artifact built reproducibly and audited offline; no transfer, execution or result reception authorized - [x] Phase-1.0G manifest-only one-shot host runner prepared and fake-socket tested; durable pre-connect attempt receipt, no device authorization - [x] One exact Phase-1.0G run consumed; D00-D02/I00-I03 and deterministic no-argument/no-menu exit proven, no retry or device write - [x] Phase-1.0H minimal `-v` startup-argument correction built twice and audited offline; exact artifact remains device-ineligible - [x] One exact Phase-1.0H run consumed; I04/SDL/VideoOut/buffer registration proven, first flip submit `-1`, no retry - [x] Phase-1.0I offline source/map/disassembly postmortem; exact submit tuple proven, write operation and submit errno remain unobserved Exit evidence: host tests pass, safe PS5 targets compile, generated files are current, no deploy target exists, Git is clean, private origin is synchronized, and no secrets or unreviewed binary artifacts are tracked. ## Phase 1 — controlled presentation experiments Gate: explicit artifact-specific hardware authorization plus all controls in `SAFETY.md` and `docs/phase1/`. Offline preparation: - [x] Minimal SDL2 CPU-framebuffer/VideoOut clear design - [x] Pinned SDL build with reviewed video-only overlay - [x] Fail-closed compile target and artifact-manifest workflow - [x] Firmware/ABI checklist and cleanup/rollback plan - [ ] Proven bounded flip wait or safe process supervisor - [x] Exact firmware supplied for an offline discovery build (`9.60`) - [x] Bounded hardened lifecycle prepared offline with only the explicit removable controlled-artifact write budget (Phase 0.7) - [ ] Hardened runtime separately approved, installed, and hash-verified - [ ] Successful separately approved discovery probe - [ ] Artifact-specific VideoOut execution approval After those gates, perform one CPU-filled frame through the existing SDL VideoOut route. Only then may a separate GNM resource/synchronization proof be designed, with every ABI reviewed independently. Embedded shaders remain an evidence and licensing question, not an implementation assumption. ## Phase 2 — native 2D blitter Texture upload, fullscreen primitive, nearest/bilinear sampling, aspect and integer scaling, overlays, buffering, and fences. Each feature requires a mock contract and bounded-failure test first. ## Phase 3 — RetroArch adapter - [x] Phase-1.0A real PS5 headless frontend with static deterministic smoke core - [x] Phase-1.0A SDL2/RGUI software profile linked offline - [x] Host ASan/UBSan smoke-core integration and static target audit - [x] Phase-1.0D CRT canary reached visible C1 on firmware 9.60 - [x] Phase-1.0D early diagnostic produced one unreadable notification; exact stage and graphics progress remain unproven - [x] Phase-1.0E machine-readable result-channel candidate prepared offline - [x] Separately authorized one-shot Phase-1.0E result-channel device test; D02 platform result `0`, EOF before D03, no retry/reconnect - [x] Phase-1.0F stream-only D02-to-D03 interval diagnostic prepared offline; exact artifact is device-ineligible pending separate future review - [x] Phase-1.0G fail-closed one-shot runner prepared offline; tracked manifest and approval template are inactive and contain no target - [x] Phase-1.0G result identifies the pre-SDL configuration exit before I04; follow-up artifact requires a new offline design and exact permission - [x] Phase-1.0H startup wrapper now models argc 2 without content/menu/config; H runner requires exact dual authorization and currently grants none - [x] Phase-1.0H runtime reached SDL VideoOut but failed its first flip submit; visible presentation, runloop and cleanup remain unproven - [x] Phase-1.0I bounds the E118 candidates and records the frame-zero inconsistency without claiming a root cause or authorizing a retest - [x] Phase-1.0M removes the source-bound playlist `mkdir` while preserving the global write firewall and reproducible artifact audit - [x] Phase-1.0N binds the M artifact to an inactive one-shot runner contract - [x] Phase-1.0O proves M reaches I04 and reproduces the VideoOut flip-submit failure with result `-1` and saved errno `0`; authorization is consumed - [x] Phase-1.0P proves the exact submit boundary and deterministic D12/D04 order while keeping the VideoOut ABI/root cause fail-closed - [x] Phase-1.0Q finds only one PS5 VideoOut declaration lineage and blocks parameter experiments for lack of independent public ABI evidence - [x] Phase-1.0R proves SDL2main adds no app/display registration, binds direct and manager launches to the same elfldr constructor, and blocks target changes because the separate hbldr/shsrv context remains unproven - [x] Phase-1.0S binds official hbldr/shsrv: it proves BigApp substitution but blocks route reuse because deployed identity, firmware behavior and safe bounded device operation remain unproven - [x] Phase-1.0T proves the existing shsrv shell cannot provide exact deployed identity, records unavoidable greeting effects, and designs an inactive redacting metadata gate without a network client - [x] Phase-1.0U performs the bounded local artifact inventory; no original shsrv target, receipt or transfer log is found, so direct host hashing is unavailable and global absence is not claimed - [x] Phase-1.0V implements a bounded offline one-shot Telnet/sanitization model with inactive approval and no network transport - [x] Phase-1.0W self-reviews/remediates the collector and proves an inactive dual-record client policy plus fake one-shot transport - [x] Phase-1.0X implements offline-only injected transport orchestration, consumed-attempt receipts and exclusive sanitized output; no real connection is authorized - [x] Phase-1.0Y audits prompt/Telnet/completion framing, identifies the raw and libtelnet/NVT source families and models both offline; deployed identity and exact completion stay unproven - [x] Phase-1.0Z implements an offline passive, source-family-tolerant LF-batch contract with deadline-only sealing, strict completeness and no Telnet command emission or live transport - [x] Phase-1.0AA integrates Z bytes, synthetic deadline and exclusive X evidence through an exact built-in fake adapter only - [x] Phase-1.0AB audits the exact local runtime and models receipt, nonblocking connect, complete send, bounded receive, deadline and close; hard scheduling and remote cleanup remain partial/unproven - [x] Phase-1.0AC implements a dormant target-free adapter around an exact built-in fake syscall facade; no socket import, address or activation path exists - [x] Phase-1.0AD defines an inactive numeric-target and activation-record contract with exact launcher/payload/approval hashes and no live ability - [x] Phase-1.0AE selects the nonpersistent official shsrv v0.7 lineage and rejects v0.19 fake-app/remount behavior; target implementation is blocked - [x] Phase-1.0AF implements an injected host-only BigApp lifecycle model with bounded ticks, unique-child correlation and exhaustive failure cleanup - [x] Phase-1.0AG implements a bytes-only bounded ELF64 admission contract; the historical M bytes are absent and therefore not newly admitted - [x] Phase-1.0AH bounds the loader/CRT relocation split and exact per-artifact DT_NEEDED inventory without mapping or loading anything - [x] Phase-1.0AI models allocation, exact copy/BSS, RELATIVE application, final permissions, sync, commit and full-region rollback - [x] Phase-1.0AJ binds the v0.7 and hardened elfldr primitive sources, rejects direct v0.7 loader reuse and records the remaining composition and cleanup-ownership gaps - [x] Phase-1.0AK models hybrid primitive composition, every temporary JIT resource and fail-closed child termination after cleanup failure - [x] Phase-1.0AL audits exact SDK `mdbg_copyin` partial-copy and credential restoration semantics and blocks direct reuse - [x] Phase-1.0AM models bounded exact-progress copying, independent all-field restoration, child cleanup and compromised-service containment - [x] Phase-1.0AN binds service fail-stop behavior and proves restart ownership, `PT_IO` hard preemption and exact progress remain absent - [x] Phase-1.0AO models one-shot worker preemption under an explicit supervisor with no automatic restart, retry or real capability - [x] Phase-1.0AP audits current official SDK/shsrv worker creation, termination, identity and result-channel evidence; only creation is a source candidate - [x] Phase-1.0AQ implements a fixed 128-byte worker-result record with precommitted nonce, attempt, PID pair and monotonic generation - [x] Phase-1.0AR models exclusive single-writer framing, every partial-read split, deadline/EOF, overflow and containment without live transport - [x] Phase-1.0AS audits public pipe/poll, rfork FD semantics, close ownership, nonblocking reads and monotonic deadline evidence - [x] Phase-1.0AT models RFFDG inheritance, exclusive pipe-end close order, EINTR and one absolute deadline through fake operations only - [x] Phase-1.0AU reassesses live channel feasibility: public primitive signatures are complete, but official safe composition and runtime proof remain absent - [x] Phase-1.0AV defines a target-free launch-context A/B canary with identical payload bytes, separate approvals and a distinct post-D04 terminal - [x] Phase-1.0AW binds the exact canary source delta, v0.7 raw stdout candidate and blocking launcher effects; no artifact is permitted - [x] Phase-1.0AX implements byte-exact CHD10AV1/D14 framing and the cleanup predicate for host tests only - [x] Phase-1.0AY selects the exact inactive Phase-1.0N source base and requires a separate worktree, preserving the current checkout - [ ] Implement and host-test the AV source structure in that isolated worktree without a target profile, cross-build or artifact - [ ] First static emulator core with legally redistributable test content - [ ] Dynamic core loading contract and implementation Hardware-rendered libretro contexts remain disabled. ## Phase 4 — SDL2 accelerated renderer Reusable SDL renderer backend and simple shaders, without replacing unrelated native SDL platform facilities. ## Phase 5 — separately evaluated context expansion Consider a broader hardware-render context or small OpenGL subset only after the 2D path is stable. A full Vulkan or Mesa driver is explicitly not an early goal.