# Phase 0.5 startup offline evidence — 2026-07-17

## Outcome

Decision: **BLOCKED**. The stock SDK v0.41 startup is `UNSAFE`, and the exact
loader caller needed to prove safe return from a replacement is absent. No
custom `_start` source and no PS5 ELF were created.

No PS5 connection, transfer, execution, VideoOut open, module load, network
initialization, GNM operation, framebuffer mutation, credential change,
syscall-bound change, MMIO access, or firmware change occurred.

## Offline startup audit

`tools/audit_ps5_startup_feasibility.py` was run twice independently against
the pinned SDK source and install. Both JSON outputs were byte-identical:

- startup audit SHA-256:
  `d0e8202c1a07e4104476cadf6c14a1dea2d724b1d97495dddcdf05858f6c8d4a`;
- 12 transitive stock CRT sources enumerated;
- six other CRT-named installed files confirmed as empty archives;
- 31 functions and 182 call/tail-call edges reachable from stock `_start`;
- reachable prohibited set: `__patch_init`, `kernel_copyin`, `kernel_copyout`,
  `kernel_set_ucred_caps`, and `kernel_set_ucred_attrs`;
- compiler `-###` trace confirmed that `-nostartfiles -nodefaultlibs` adds no
  stock CRT or default library and produced no ELF;
- non-SDK local loader-contract hits: zero.

## Policy verification

The real legacy artifact, its updated manifest, and the permanent denylist were
evaluated together. The policy tool returned exit 2 with both
`ARTIFACT_PERMANENTLY_DENYLISTED` and
`MANIFEST_EXECUTION_INELIGIBLE`.

JSON Schema validation passed for all three tracked artifact manifests and the
permanent denylist.

## Host and static tests

- Windows MSVC warnings-as-errors build: passed.
- Windows CTest: 14/14 passed.
- WSL Clang 18 plus clang-tidy build: passed.
- WSL Clang CTest including formatting: 15/15 passed.
- WSL GCC 15 ASan+UBSan build: passed.
- WSL GCC ASan+UBSan CTest: 15/15 passed.
- Python syntax compilation for every changed tool/test: passed.
- `git diff --check`: passed at review time.

An initial Clang ASan configure did not compile a project source because the
local Clang install lacks `libclang_rt.asan*`. GCC's available ASan/UBSan
runtime was used successfully instead. The failed configure is an environment
toolchain limitation and was not reported as a passed test.

## Bound hashes

| Record | SHA-256 |
|---|---|
| permanent denylist | `e9603b0e3792781ad5b511afb22ef61e3d4fd4c5a16bf928f8609193bcd97783` |
| denylist schema | `78d0d28da552550e4b7dabc5b9c25347fb2618c4664b7a554b87c6de69cd6c96` |
| startup audit JSON | `d0e8202c1a07e4104476cadf6c14a1dea2d724b1d97495dddcdf05858f6c8d4a` |
| non-build decision | `b04dd224c00af0c7228c582f6ba3ca55ef03e9453287f233a0c4ff2e545092fc` |
| machine proof matrix | `aefd1d1e663be617ed1042c6a1d68b9f21dd0c137f0c601d15cdcbfdf03dadb7` |
| permanently blocked legacy ELF | `4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63` |

The last hash names pre-existing bytes only. It is not a Phase-0.5 artifact and
must not be transferred or executed.