# ADR-0009: Block unproven minimal startup and permanently deny legacy ELF

Status: accepted
Date: 2026-07-17

## Context

SDK v0.41's stock `crt1.o` performs prohibited kernel credential and
syscall-bound writes before project `main`. Phase 0.5 tested whether omitting
the CRT could support a deterministic freestanding entry. Compiler and linker
evidence proves omission is mechanically possible, but no exact pinned loader
caller is locally available to prove stack, argument ownership, safe return,
post-return cleanup, crash handling, or pre-entry process changes.

The already-built firmware-9.60 capability probe has SHA-256
`4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63`
and must remain permanently blocked.

## Decision

Do not create a minimal-startup source or PS5 ELF while the caller contract is
unproven. Keep `CHIMERA_GFX_BUILD_PS5_MINIMAL_STARTUP` as an unconditional
configure-time failure with the evidence blocker stated in its message.

Require every artifact manifest to state `execution_eligible` explicitly. New
manifests default to false. Maintain a permanent SHA-256 denylist and a
fail-closed policy tool that refuses false eligibility, malformed records,
changed bytes, or a denylist match. Passing this static layer does not grant
execution authority.

## Consequences

- no Phase-0.5 PS5 ELF, linker map, artifact disassembly, or artifact hash
  exists;
- stock CRT evidence remains available for review without making a safe-runtime
  claim;
- the legacy firmware-9.60 ELF cannot become eligible through a later manifest
  edit or approval record;
- a Payload Manager can consume the JSON policy tool, but the manager's own
  implementation remains outside this repository and cannot be claimed
  reviewed here;
- work may continue through mock/software backends or a separately scoped
  Linux-on-PS5 backend.