# Kernelwrite proof matrix

Statuses mean: `SAFE` is proven only for the named scope, `UNSAFE` has a proven
policy violation, and `UNPROVEN` lacks necessary primary evidence. Absence of
an import is never used as the sole proof because SDK code is statically
combined in `crt1.o`.

| Component or behavior | Source | Linked in stock `crt1.o` | Reachable from stock `_start` | Status | Basis |
|---|---|---:|---:|---|---|
| `payload_args_t` order/offsets | public header + disassembly | yes | yes | `SAFE` | six x86-64 fields; `payloadout` at `0x28` |
| stock SDK startup | `crt/crt.c` | yes | yes | `UNSAFE` | invokes patch and rtld paths |
| `__patch_init` | `crt/patch.c` | yes | yes | `UNSAFE` | relocation and callgraph edge from `_start` |
| `kernel_copyin/out` | `crt/kernel.c` | yes | yes | `UNSAFE` | reachable read/write transport |
| `kernel_set_ucred_caps` | `crt/kernel.c` | yes | yes | `UNSAFE` | reaches `kernel_copyin` |
| `kernel_set_ucred_attrs` | `crt/kernel.c` | yes | yes | `UNSAFE` | reaches `kernel_copyin` |
| syscall address lower/upper bounds | `crt/patch.c` | yes | yes | `UNSAFE` | writes offsets `0xf0` and `0xf8` |
| JIT capability change | `crt/patch.c` | yes | yes | `UNSAFE` | `caps[15] |= 0x40` before credential write |
| ptrace attribute change | `crt/patch.c` | yes | yes | `UNSAFE` | `attrs[3] |= 0x80` before attribute write |
| runtime symbol discovery | `syscall.c`, `crt.c`, rtld | yes | yes | `UNSAFE` for minimal profile | multiple reachable dynamic resolutions |
| `__dlopen`/`__dlsym` facade | `rtld_dlfcn.c` | yes | no static startup edge | `UNSAFE` linked capability | absence from imports is not absence from bytes |
| Sce module load/start | `rtld_sprx.c` | yes | yes | `UNSAFE` | `__rtld_sprx_init` reaches function-pointer call |
| Sce module stop/unload | `rtld_sprx.c` | yes | cleanup-dependent | `UNPROVEN` cleanup | no guarantee after crash or partial init |
| SO mapping/`mprotect` | `rtld_so.c` | yes | path-dependent | `UNSAFE` linked capability | forbidden for minimal profile |
| socket-overlap helper | `kernel.c` | yes | no static startup edge | `UNSAFE` linked capability | still present in monolithic startup object |
| new network initialization | driver adds `libSceNet` | dependency present in stock links | module-init internals unknown | `UNPROVEN` | no caller/module initialization contract |
| GNM calls | no Phase-0.5 candidate source | no candidate | no candidate | `SAFE` source scope only | no custom source or artifact created |
| VideoOut calls | no Phase-0.5 candidate source | no candidate | no candidate | `SAFE` source scope only | no custom source or artifact created |
| SDL calls | no Phase-0.5 candidate source | no candidate | no candidate | `SAFE` source scope only | no custom source or artifact created |
| direct MMIO/register writes | audited project source | no candidate | no candidate | `SAFE` source scope only | none added |
| `-nostartfiles -nodefaultlibs` suppression | compiler `-###` | not linked in trace | n/a | `SAFE` driver fact | no CRT or default library added |
| loader stack/return contract | exact caller absent | n/a | n/a | `UNPROVEN` | callee cannot prove caller |
| pre-entry loader changes | exact caller absent | n/a | before entry | `UNPROVEN` | incoming kernel access exists; origin unknown |

The full source hashes, stock-object hashes, relocation-table hash,
disassembly hash, all reachable edges, and linked-but-unreachable prohibited
functions are in `manifests/runtime/phase-0.5-startup-audit.json`.

## Phase 0.6 controlled-runtime classification

The table above preserves the stricter Phase-0.5 "kernelwrite-free" question.
Phase 0.6 uses the user's corrected policy: a documented temporary runtime
write is not automatically unsafe. Only `PERSISTENT_WRITE` and
`UNBOUNDED_OR_UNKNOWN` are hard blockers.

| Component/effect | Classification | Review status | Basis |
|---|---|---|---|
| first-stage QA flag enable | `EXPECTED_VOLATILE_RUNTIME_EFFECT` | `SAFE` only as exact-source classification | loader bootstrap, before payload |
| child creation with `rfork_thread`/`execve` | `PAYLOAD_PROCESS_LOCAL` | `SAFE` source fact | separate SceSpZeroConf child |
| ptrace service authid, normal path | `RESTORED_BY_LOADER` | `SAFE` success path | authid backed up and restored |
| ptrace authid restore failure | `UNBOUNDED_OR_UNKNOWN` | `UNSAFE` for controlled profile | returns without a second restore |
| `pt_call`/`pt_syscall` completion | `UNBOUNDED_OR_UNKNOWN` | `UNSAFE` | no step or time bound |
| breakpoint byte | `RESTORED_BY_LOADER` | `SAFE` source fact | original byte copied back |
| breakpoint page RWX permission | `PAYLOAD_PROCESS_LOCAL` | `UNPROVEN` cleanup | permission not restored; relies on child exit |
| child root/jail/caps/authid | `RESTORED_BY_LOADER` on success | `UNPROVEN` partial | UID is not restored |
| payload mapping, argument page, sockets, pipe | `UNBOUNDED_OR_UNKNOWN` | `UNSAFE` for controlled profile | no success-path cleanup before detach |
| SDK `__patch_init` | `PAYLOAD_PROCESS_LOCAL` | `SAFE` classification, not execution proof | affects payload child; not an automatic blocker |
| SDK terminate branch | `UNBOUNDED_OR_UNKNOWN` | `UNSAFE` for controlled profile | return/exit/trap branch unresolved |
| detached payload runtime | `UNBOUNDED_OR_UNKNOWN` | `UNSAFE` | no two-second watchdog |
| child reaping | `UNBOUNDED_OR_UNKNOWN` | `UNSAFE` | SIGCHLD ignored; semantics undocumented |
| Manager load hash binding | `UNBOUNDED_OR_UNKNOWN` | `UNSAFE` | path streamed without SHA-256 check |
| Manager upload path | `PERSISTENT_WRITE` | `UNSAFE` | writes and commits under `/data/pldmgr/payloads` |

No source or binary evidence showed a GNM, VideoOut, SDL, direct MMIO, flash,
firmware, savegame, database, or system-configuration write in the proposed
payload path. Because no payload was built, that is a source-scope absence,
not an execution claim.

## Phase 0.7 hardened-runtime classification

The machine-readable counterpart is
`manifests/runtime/phase-0.7-kernelwrite-proof-matrix.json`.

| Component/effect | Phase-0.7 status | Classification | Evidence boundary |
|---|---|---|---|
| freestanding kernelwrite-free startup | `UNPROVEN` | historical blocked target | exact safe return contract still absent |
| stock SDK `__patch_init` | `UNSAFE` for a kernelwrite-free claim | `PAYLOAD_PROCESS_LOCAL` accepted effect | source, linker map, disassembly, reachable callgraph |
| stock SDK rtld module loading | `UNPROVEN` runtime branch; bounded externally | `PAYLOAD_PROCESS_LOCAL` accepted effect | linked module start/stop symbols, SDK source, child watchdog |
| ptrace step completion | `SAFE` offline | `BOUNDED_WATCHDOG` | source, unit/fuzz tests, disassembly |
| five-field credential restoration | `SAFE` offline | `RESTORED_BY_LOADER` | source, failure injection tests, callgraph |
| restoration failure | `SAFE` fail-closed logic | `FAIL_CLOSED_TERMINATION` | child killed/reaped; service disables ptrace |
| breakpoint byte/page | `SAFE` offline | `RESTORED_BY_LOADER` | source and disassembly |
| payload child lifetime | `SAFE` offline | `BOUNDED_WATCHDOG` | 2000 ms, SIGTERM, SIGKILL, reap |
| mapping/descriptor cleanup | `SAFE` offline | `OS_RECLAIMED_ON_EXIT` plus tracked cleanup | source, tests, callgraph |
| manager hash-to-stream binding | `SAFE` offline | `HASH_BOUND_SAME_FD` | source, TOCTOU and negative tests |
| receiver digest/denylist enforcement | `SAFE` offline | fail-closed | source, tests, disassembly |
| controlled artifact-directory write | `SAFE` for reviewed deployment budget | `ALLOWED_APPLICATION_WRITE` | exclusive temp, fsync, verify, atomic rename |
| GNM/VideoOut/SDL/MMIO/firmware mutation | `SAFE` absence claim | prohibited | source scan, imports, map, disassembly |
| firmware-9.60 runtime behavior | `UNPROVEN` | no execution evidence | no PS5 action occurred |
| installation, transfer, execution | `UNPROVEN` and unauthorized | action state false | manifests and offline audit |

The overall decision is
`READY_FOR_HARDENED_RUNTIME_DEPLOYMENT`, not `PROVEN KERNELWRITE-FREE`.
The known normal-CRT process-local write prevents the latter claim.