# Phase 0.7 hardened runtime — offline review

Decision: **READY_FOR_HARDENED_RUNTIME_DEPLOYMENT**.

This is an offline deployment-readiness decision. No PS5 connection,
installation, transfer, or execution occurred.

## Exact identities

| Component | Base | Hardened source | ELF SHA-256 | Size |
|---|---|---|---|---:|
| elfldr | `699e8bcff03e91e8d6ca6eba281af25c5a58d8c2` | `197623058f509eddde18868dafcb92fdcac66464` | `63e810982471eb40cae3a20aa9df9a0a02892f420e429874fae4e99aa400b561` | 397000 |
| controlled Payload Manager | `cfbc70f30f419b09bf2b52283f7409e2d3117ee1` | `e23d94ff91233aa770e2342800c1467875bdef44` | `8fecf8241a46246eddbd21e8bb4d875f5d76f1f4f4c6a11384df1f131aa5e5b1` | 99560 |
| lifecycle probe | Chimera GFX | `fe08300339a13f899fb78ea404ada381a5cba87c` | `bfb4a5cc768e162fe4c2fddf41c3978e152722918a39085277fd172cb95a7182` | 112680 |

All three pairs of clean builds are byte-identical. Complete disassembly,
symbol tables, relocations, normalized linker maps, and call-edge inventories
are in the ignored offline package under `outputs/phase07/audit/`; their
hashes and the complete call-edge lists are committed in
`manifests/runtime/phase-0.7-offline-audit.json`.

## Lifecycle binary boundary

The only undefined imports are:

- `_exit`
- `sceKernelSendNotificationRequest`

The only `DT_NEEDED` modules are:

- `libSceLibcInternal.sprx`
- `libkernel_web.sprx`

There are no GNM, VideoOut, SDL, SceNet, socket, download, thread, retry, or
autoload imports. The normal SDK startup object is statically present and
reaches its documented `__patch_init` and rtld initialization before `main`;
absence from imports is not used to hide that fact. The linker map also
contains `sceKernelLoadStartModule`/`sceKernelStopUnloadModule` through the
stock SDK rtld; its conditional module behavior is payload-process-local and
supervised by the external watchdog, but remains unobserved on firmware 9.60.
After one notification, `main` calls `_exit`, so the uncertain SDK
`main -> payload_terminate` return branch is not taken.

## Hardening closure

| Phase-0.6 finding | Phase-0.7 implementation | Review |
|---|---|---|
| unbounded ptrace loop | monotonic one-second deadline plus 65,536 steps | `SAFE` offline logic |
| incomplete child credential restore | UID, jaildir, rootdir, caps, auth-ID all restored and checked | `SAFE` offline logic |
| restore failure continues | fail-closed kill and deadline-bounded reap; no detach | `SAFE` offline logic |
| scattered cleanup | one tracked cleanup state machine for breakpoint, mappings, fds, child | `SAFE` offline logic |
| breakpoint page stays RWX | original byte restored and page reset RX | `SAFE` source fact |
| detached runtime unbounded | 2000 ms wait, SIGTERM grace, SIGKILL, reap | `SAFE` offline logic |
| ignored SIGCHLD/zombie risk | default SIGCHLD plus explicit reap | `SAFE` offline logic |
| path-based Manager load | one no-follow FD, fstat, hash, rewind, stream, post-check | `SAFE` offline logic |
| upload TOCTOU | exclusive temp, fsync, verify, atomic rename, inode check | `SAFE` offline logic |
| arbitrary controlled artifact | manager binary compiled for exact hash, size, and ID | `SAFE` offline configuration |
| sender-only hash | elfldr rehashes received bytes and checks denylist | `SAFE` offline logic |

`SAFE` here means source, test, map, and disassembly evidence agree. It is not
a hardware execution claim.

## Remaining risks

- No on-device observation exists yet; loader/firmware behavior remains
  unverified at runtime.
- QA flags are an existing expected volatile loader bootstrap effect.
- Normal SDK startup performs known process-local credential/capability and
  syscall-bound writes before `main`.
- The controlled manager listens for the later operator workflow, but accepts
  only the compiled exact artifact identity; installation security and
  network exposure still require a separate review.
- Abrupt platform failure can bypass userland reporting, though OS process
  teardown should reclaim child mappings and descriptors.
- Rollback has only been prepared offline; its on-device paths and installed
  hashes must be captured before any replacement.

These are deployment/execution residual risks, not unresolved compiler,
linker, or ABI blockers for preparing the hardened runtime.