# Phase-0.7 offline build evidence — 2026-07-17

- Public SDK: v0.41,
  `d2e2e585740362976a39fdd5ccf390f199a7bc37`
- Firmware build gate: exact `9.60`
- Host validation: MSVC 19.50 `/W4 /WX`; Clang 18
  warnings-as-errors/clang-tidy/format; GCC 15 ASan/UBSan
- Fuzz fallback: 100,000 deterministic ASan/UBSan inputs for both controlled
  header and verified metadata
- Cross-build: all three targets with warnings-as-errors
- Reproducibility: two clean byte-identical builds per ELF
- Console actions: none

The complete machine evidence is
`manifests/runtime/phase-0.7-offline-audit.json`. Full ignored reports and
artifacts are packaged below `outputs/phase07/`.

## Exact outputs

| Artifact | SHA-256 | Size | Undefined imports | `DT_NEEDED` |
|---|---|---:|---|---|
| hardened elfldr | `63e810982471eb40cae3a20aa9df9a0a02892f420e429874fae4e99aa400b561` | 397000 | none | `libSceLibcInternal.sprx`, `libSceNet.sprx`, `libkernel_web.sprx` |
| controlled Payload Manager | `8fecf8241a46246eddbd21e8bb4d875f5d76f1f4f4c6a11384df1f131aa5e5b1` | 99560 | none | `libSceLibcInternal.sprx`, `libSceNet.sprx`, `libkernel_web.sprx` |
| lifecycle probe | `bfb4a5cc768e162fe4c2fddf41c3978e152722918a39085277fd172cb95a7182` | 112680 | `_exit`, `sceKernelSendNotificationRequest` | `libSceLibcInternal.sprx`, `libkernel_web.sprx` |

The lifecycle project's called functions are exactly one
`sceKernelSendNotificationRequest` followed by `_exit`. The normal SDK startup
is statically included and reaches `__patch_init` before `main`; that fact is
proven from source, linker map, disassembly, and the 499-edge lifecycle
callgraph rather than inferred from imports. The hardened loader audit records
1032 call edges and the controlled manager records 478.

The lifecycle linker map also contains stock-SDK `__dlopen`, `__dlsym`,
`sceKernelLoadStartModule`, and `sceKernelStopUnloadModule` symbols. Direct
static reachability proves the rtld initialization path but cannot resolve all
116 indirect lifecycle edges. The audit therefore records linked symbols,
direct `_start` reachability where symbolization permits it, and every
unresolved indirect edge separately. No graphics/display-sensitive symbol is
linked in any of the three audited ELFs.

## Final offline tests

- Chimera GFX Windows host build: MSVC `/W4 /WX`, 16/16 CTest passed.
- Hardened elfldr: MSVC 1/1; Clang 18 plus clang-tidy 1/1; GCC 15
  ASan/UBSan 1/1; 100,000-input sanitizer fuzz pass.
- Controlled Payload Manager: MSVC 1/1; Clang 18 plus clang-tidy 2/2; GCC 15
  ASan/UBSan 2/2; 100,000-input sanitizer fuzz pass.
- All three PS5 cross-builds passed warnings-as-errors and reproduced the
  exact hashes and sizes above.
- Negative lifecycle firmware `9.50` configure failed before creating a build
  graph.
- Controlled-manager build without exact hash/size/artifact ID failed.
- Static execution-policy refusal suite, manifest schemas, Phase-0.5/0.6
  historical gates, Phase-0.7 proof matrix, safety audit, and secret scans
  passed.

The local Clang installation does not contain the optional
`libclang_rt.asan`/libFuzzer runtime archives. Clang warnings and clang-tidy
therefore run without sanitizers; GCC supplies the ASan/UBSan and deterministic
fuzz coverage. This is a host-tool packaging limitation, not a target
compiler, linker, or ABI blocker.