# Phase 1.0DY upstream websrv audit

Status: `UPSTREAM_WEBSRV_EXECUTION_BLOCKED_BROAD_MUTATING_SURFACE`

The current official release is v0.33, source commit
`baabe27e5449baeb059b850d0393c31fdee219b7`. Its source does create the
documented port-8080 listener, but it also exposes generic filesystem and POST
routes and links package installation, fake-app creation, ptrace,
kernel/credential mutation, RWX changes and launch machinery without the
bounded Chimera lifecycle contract.

Starting this upstream artifact would materially exceed a request to restore
the launcher page and violates the persistent-write and unknown-effect hard
stops. It is therefore not built, downloaded as an executable, transferred or
authorized. A future offline phase must remove generic endpoints, bind one
exact RetroArch artifact, prohibit persistent setup and bound every wait and
cleanup path before a new hardware request can be considered.