{
  "schema_version": 1,
  "phase": "0.9B",
  "date": "2026-07-18",
  "scope": "offline_bounded_observer_feasibility_audit_only",
  "status": "BLOCKED",
  "decision": [
    "OBSERVER_STARTUP_OR_EXIT_ABI_UNPROVEN",
    "NO_PROVEN_NON_PERSISTENT_OUTPUT_CHANNEL"
  ],
  "baseline_commit": "833874f4196825765e2dfaa28327daea73919d01",
  "branch": "codex/chimera-gfx-phase09b-observer",
  "authorization": {
    "authorized": false,
    "transfer_authorized": false,
    "execution_authorized": false,
    "installation_authorized": false,
    "lifecycle_authorized": false,
    "autoload_authorized": false,
    "backup_creation_authorized": false,
    "automatic_retry": false
  },
  "canonical_state_preserved": {
    "historical_phase08_status": "READ_ONLY_PREFLIGHT_BLOCKED",
    "phase09a_status": "DESIGN_ONLY",
    "firmware_runtime_behavior": "UNPROVEN",
    "stock_hashes": "reference_only",
    "payload_manager_backup": "HARD_BLOCKER",
    "device_contact_performed": false,
    "device_transfer_performed": false,
    "device_execution_performed": false
  },
  "permanent_denylist_binding": {
    "sha256": "4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63",
    "status": "BLOCKED",
    "permanent": true,
    "execution_eligible": false
  },
  "source_commits": {
    "hardened_elfldr": "197623058f509eddde18868dafcb92fdcac66464",
    "controlled_payload_manager": "e23d94ff91233aa770e2342800c1467875bdef44",
    "elfldr_public_base": "699e8bcff03e91e8d6ca6eba281af25c5a58d8c2",
    "payload_manager_public_base": "cfbc70f30f419b09bf2b52283f7409e2d3117ee1",
    "ps5_payload_sdk_v0_41": "d2e2e585740362976a39fdd5ccf390f199a7bc37",
    "lifecycle_probe_source": "fe08300339a13f899fb78ea404ada381a5cba87c"
  },
  "source_tree_status": {
    "hardened_elfldr": "clean",
    "controlled_payload_manager": "clean",
    "elfldr_public_base": "clean",
    "payload_manager_public_base": "clean",
    "ps5_payload_sdk_v0_41": "clean"
  },
  "source_evidence": [
    {
      "component": "hardened_elfldr_controlled_route",
      "path": "../chimera-elfldr/socksrv.c",
      "sha256": "d642ced3e9b4a296dd15e355050ebe956f53a6dfdaa6ac10109cd067a3bba3d7",
      "lines": ["129-145", "289-365"],
      "finding": "The controlled route passes stdio=-1 to elfldr_spawn and sends only a fixed loader-generated exit message."
    },
    {
      "component": "hardened_elfldr_entry_and_stdio",
      "path": "../chimera-elfldr/elfldr.c",
      "sha256": "9949f8e4037984d10f1f5aa498e4665593d1fac8a33614d7f2141349839bb803",
      "lines": ["273-415", "450-545", "643-759"],
      "finding": "The loader places payload_args_t in RDI and a saved RIP on the stack; stdio duplication occurs only when stdio>0. The loader also performs process and kernel mutations before entry."
    },
    {
      "component": "hardened_elfldr_log",
      "path": "../chimera-elfldr/log.h",
      "sha256": "cf1a85e7b047fbd4164b48241896fd955d384efc7e475a54fb24a62f53d2029e",
      "lines": ["1-49"],
      "finding": "Logging targets stdout and klog; neither is a proven controlled observer response channel."
    },
    {
      "component": "controlled_payload_manager_transport",
      "path": "../chimera-ps5-payload-manager/src/verified_launcher.c",
      "sha256": "066100ca4917c7acc560e2e85666ca136cd7ccfd9094417377048f41106dd56e",
      "lines": ["31-116", "119-185"],
      "finding": "The verified transport opens and hashes read-only, sends a header and bytes, then closes without receiving a payload result."
    },
    {
      "component": "controlled_payload_manager_loopback_adapter",
      "path": "../chimera-ps5-payload-manager/src/ps5_launcher.c",
      "sha256": "29c1a5fd01784a59e88b3698940f120cb03020071bc2b7d74a1da1a51524ef59",
      "lines": ["18-70"],
      "finding": "The adapter provides connect, send_all and close_socket only; no receive callback exists."
    },
    {
      "component": "controlled_payload_manager_service",
      "path": "../chimera-ps5-payload-manager/src/controlled_manager.c",
      "sha256": "042b55b2cece32effed636529249fd18061a2fe3c5e70c7f755f2817cfb84b99",
      "lines": ["208-235", "243-365"],
      "finding": "The manager is a persistent listener and its upload/delete paths mutate files; it is not an admissible observer output collector."
    },
    {
      "component": "sdk_crt_startup",
      "path": "work/upstream/sdk/crt/crt.c",
      "sha256": "3875f4739ec40b33f1f4967a1acbb585a527d2c281a360153e1f69c8b945932a",
      "lines": ["48-80", "150-220"],
      "finding": "Normal _start invokes runtime initialization and __patch_init before main; its terminate path depends on runtime symbol resolution or returning to a hijacked process."
    },
    {
      "component": "sdk_crt_patch",
      "path": "work/upstream/sdk/crt/patch.c",
      "sha256": "4f76a677bba54f4641e1cf2755768c29afb7464a35b2f21e85db2aa2785eceac",
      "lines": ["25-50", "58-101"],
      "finding": "__patch_init writes syscall boundaries, credential capabilities and attributes."
    },
    {
      "component": "sdk_crt_object_set",
      "path": "work/upstream/sdk/crt/Makefile",
      "sha256": "6a62f777f32ab05cbe7bff81c00cfd6639ba8bf440aba611a40ff0b62732568b",
      "lines": ["19-26", "50-54"],
      "finding": "crt1.o transitively contains crt, syscall, klog, kernel, rtld, mdbg and patch objects."
    },
    {
      "component": "sdk_compiler_wrapper",
      "path": "work/upstream/sdk/host/bin/prospero-clang",
      "sha256": "0cf49ae43d6110a7606c0ee4d702fc4b5d5e1c3ae9a722945a48b80294e295ba",
      "lines": ["25-47", "69-84"],
      "finding": "The wrapper adds crt1.o unless -nostartfiles is present and removes default libraries for -nodefaultlibs."
    },
    {
      "component": "sdk_linker_script",
      "path": "work/upstream/sdk/host/elf_x86_64.x",
      "sha256": "169b80d01da601ef96bbc584986608dec1d9c01397eae81eccd4e1a66b0a6c6a",
      "finding": "The script defines image, init/fini and BSS boundaries but does not prove loader cleanup after a custom entry returns."
    },
    {
      "component": "installed_sdk_crt1",
      "path": "work/toolchains/ps5-payload-sdk-v0.41/target/lib/crt1.o",
      "size": 112256,
      "sha256": "0e4c1e5e38f22026580e856238a53e75d9e112f99a34bfe5495a3a0ffac15238",
      "finding": "Installed startup object identity recorded; it was not linked into a Phase-0.9B artifact."
    },
    {
      "component": "lifecycle_probe_source",
      "path": "samples/lifecycle_probe/main.c",
      "sha256": "1ae7df1fe921ccab2a252f77975d3d441ef7725e34535b024580c0d4a242d766",
      "finding": "The prior lifecycle probe uses the normal SDK runtime, a notification API and _exit; it is unchanged and is not an observer ABI proof."
    }
  ],
  "capability_matrix": [
    {
      "needed_fact": "firmware_source_1",
      "local_api": "kernel_get_fw_version reads sdk_ps5_ver from libSceLibcInternal process parameters",
      "source": "work/upstream/sdk/crt/kernel.c:148-171",
      "evidence": "SOURCE_PRESENT_RUNTIME_UNPROVEN",
      "implement": false
    },
    {
      "needed_fact": "firmware_source_2",
      "local_api": null,
      "source": null,
      "evidence": "UNPROVEN",
      "implement": false
    },
    {
      "needed_fact": "file_metadata",
      "local_api": "open(O_RDONLY|O_NOFOLLOW|O_CLOEXEC), fstat, lstat, close",
      "source": "../chimera-ps5-payload-manager/src/verified_launcher.c:76-115,174-184",
      "evidence": "SOURCE_AND_HOST_TEST_EVIDENCE_ONLY",
      "implement": false
    },
    {
      "needed_fact": "object_identity",
      "local_api": "st_dev, st_ino and st_size pre/post comparison",
      "source": "../chimera-ps5-payload-manager/src/verified_launcher.c:26-29,87-101,174-176",
      "evidence": "SOURCE_AND_HOST_TEST_EVIDENCE_ONLY",
      "implement": false
    },
    {
      "needed_fact": "sha256",
      "local_api": "bounded SHA-256 over an already-open descriptor",
      "source": "../chimera-ps5-payload-manager/src/verified_launcher.c:31-55 and src/sha256.c",
      "evidence": "SOURCE_AND_HOST_TEST_EVIDENCE_ONLY",
      "implement": false
    },
    {
      "needed_fact": "mount_information",
      "local_api": "getmntinfo/getfsstat sample",
      "source": "work/upstream/sdk/samples/mntinfo/main.c and libc/getmntinfo.c",
      "evidence": "SDK_SAMPLE_PRESENT_FIRMWARE_9_60_RUNTIME_UNPROVEN",
      "implement": false
    },
    {
      "needed_fact": "processes_services",
      "local_api": "sysctl KERN_PROC snapshot sample; no complete service mapping",
      "source": "work/upstream/sdk/samples/ps/main.c",
      "evidence": "PARTIAL_SOURCE_PRESENT_RUNTIME_AND_SERVICE_SEMANTICS_UNPROVEN",
      "implement": false
    },
    {
      "needed_fact": "listeners",
      "local_api": null,
      "source": null,
      "evidence": "UNPROVEN",
      "implement": false
    },
    {
      "needed_fact": "autoload_configuration",
      "local_api": "stock config readers exist but paths are not current-device evidence and HTTP status routes mutate global state",
      "source": "../chimera-ps5-payload-manager/src/config.c, src/autoload.c, src/http_server.c",
      "evidence": "UNSAFE_OR_UNPROVEN",
      "implement": false
    },
    {
      "needed_fact": "output_channel",
      "local_api": null,
      "source": "../chimera-elfldr/socksrv.c:129-145,361-365; ../chimera-ps5-payload-manager/src/ps5_launcher.c:18-70",
      "evidence": "PROVEN_ABSENT_ON_CONTROLLED_ROUTE",
      "implement": false
    },
    {
      "needed_fact": "monotonic_time_deadline",
      "local_api": "clock_gettime(CLOCK_MONOTONIC) used by hardened loader watchdog",
      "source": "../chimera-elfldr/ps5_controlled.c:26-59",
      "evidence": "SOURCE_AND_HOST_TEST_EVIDENCE_ONLY",
      "implement": false
    },
    {
      "needed_fact": "process_exit",
      "local_api": "normal CRT payload_terminate/payload_exit or custom entry return",
      "source": "work/upstream/sdk/crt/crt.c:150-220; ../chimera-elfldr/elfldr.c:380-415",
      "evidence": "OBSERVER_STARTUP_OR_EXIT_ABI_UNPROVEN",
      "implement": false
    }
  ],
  "build_gate": {
    "startup_and_exit_abi_proven": false,
    "non_persistent_output_channel_proven": false,
    "normal_sdk_crt_kernelwrite_free": false,
    "custom_freestanding_cleanup_proven": false,
    "observer_source_created": false,
    "observer_target_declared": false,
    "target_build_performed": false,
    "double_clean_build_performed": false,
    "reason": "BLOCKED_BEFORE_SOURCE_AND_BUILD"
  },
  "implementation": {
    "observer_only": true,
    "observer_logic_implemented": false,
    "observations_implemented": [],
    "unsupported_or_unproven": [
      "observer_self_identity_at_runtime",
      "firmware_source_1_at_runtime",
      "firmware_source_2",
      "mount_and_filesystem_information",
      "live_object_metadata",
      "live_sha256",
      "rollback_object_metadata_and_sha256",
      "processes_and_services",
      "listeners",
      "autoload_state",
      "bounded_runtime_output",
      "safe_process_exit"
    ],
    "host_contract_model_only": "tests/phase09b_observer_model.py"
  },
  "artifact": {
    "present": false,
    "path": null,
    "sha256": null,
    "size": null,
    "imports": [],
    "undefined_symbols": [],
    "dynamic_dependencies": [],
    "network_functions": [],
    "filesystem_reads": [],
    "installation_eligible": false,
    "lifecycle_eligible": false,
    "autoload_eligible": false,
    "execution_authorized": false,
    "execution_eligible": false
  },
  "static_artifact_audit": {
    "status": "NOT_PERFORMED_BLOCKED_BEFORE_BUILD",
    "elf_headers": "NOT_APPLICABLE_NO_ARTIFACT",
    "program_headers": "NOT_APPLICABLE_NO_ARTIFACT",
    "section_headers": "NOT_APPLICABLE_NO_ARTIFACT",
    "dynamic_dependencies": "NOT_APPLICABLE_NO_ARTIFACT",
    "imports_and_undefined_symbols": "NOT_APPLICABLE_NO_ARTIFACT",
    "exports": "NOT_APPLICABLE_NO_ARTIFACT",
    "relocations": "NOT_APPLICABLE_NO_ARTIFACT",
    "linker_map": "NOT_CREATED",
    "callgraph": "NOT_CREATED",
    "disassembly": "NOT_CREATED",
    "strings": "NOT_APPLICABLE_NO_ARTIFACT",
    "denied_capabilities": "NOT_APPLICABLE_NO_ARTIFACT",
    "filesystem_open_flags": "NOT_APPLICABLE_NO_ARTIFACT",
    "network": "NOT_APPLICABLE_NO_ARTIFACT",
    "threads_and_loops": "NOT_APPLICABLE_NO_ARTIFACT",
    "kernelwrites": "NOT_APPLICABLE_NO_ARTIFACT"
  },
  "reproducibility": {
    "status": "NOT_PERFORMED_BLOCKED_BEFORE_BUILD",
    "build_1_sha256": null,
    "build_2_sha256": null,
    "byte_identical": null,
    "toolchain": {
      "sdk_release": "v0.41",
      "sdk_commit": "d2e2e585740362976a39fdd5ccf390f199a7bc37",
      "installed_crt1_sha256": "0e4c1e5e38f22026580e856238a53e75d9e112f99a34bfe5495a3a0ffac15238",
      "current_windows_wrapper_executable_available": false
    }
  },
  "default_observation_plan": {
    "schema_version": 1,
    "plan_id": null,
    "authorized": false,
    "transfer_authorized": false,
    "execution_authorized": false,
    "installation_authorized": false,
    "lifecycle_authorized": false,
    "autoload_authorized": false,
    "backup_creation_authorized": false,
    "automatic_retry": false,
    "device_address": null,
    "device_identity": null,
    "observer": {
      "sha256": null,
      "size": null,
      "source_commit": null,
      "toolchain_identity": null
    },
    "firmware_gate": null,
    "allowed_observations": [],
    "read_paths": [],
    "output_channel": null,
    "maximum_runtime_ms": null,
    "maximum_execution_count": 0,
    "expires_at": null,
    "stop_criteria": []
  },
  "remaining_anti_brick_blockers": [
    "two_current_firmware_sources_absent",
    "current_live_paths_absent",
    "current_live_object_identities_absent",
    "current_live_sizes_and_sha256_absent",
    "mount_and_filesystem_properties_absent",
    "processes_and_services_absent",
    "listeners_absent",
    "autoload_state_absent",
    "rollback_backups_absent",
    "payload_manager_backup_hard_blocker",
    "recovery_independence_unproven",
    "power_loss_safe_switch_unproven",
    "component_order_unproven",
    "observer_startup_or_exit_abi_unproven",
    "no_proven_non_persistent_output_channel"
  ],
  "prohibited_actions": [
    "connect_to_ps5",
    "scan_ps5_ports",
    "use_usb",
    "transfer_observer",
    "execute_observer_or_elf",
    "install_or_replace_component",
    "create_backup",
    "change_configuration",
    "activate_autoload_or_retry",
    "reboot",
    "start_stop_restart_or_signal_process_or_service",
    "modify_hardened_elfldr_runtime",
    "modify_controlled_payload_manager_runtime",
    "modify_lifecycle_probe",
    "build_observer_until_both_hard_gates_are_proven",
    "start_graphics_sdl_retroarch_or_gnm_work"
  ]
}