# Phase 0.9B bounded observer design

Status: **BLOCKED — OFFLINE AUDIT ONLY**.

No observer source, PS5 target, ELF, installation package, lifecycle package or
execution package was created. No PS5 connection, scan, transfer or execution
occurred. This document describes the rejected design boundary and the exact
evidence needed before implementation may start.

## Canonical boundary

- Historical Phase 0.8 remains `READ_ONLY_PREFLIGHT_BLOCKED`.
- Phase 0.9A remains `DESIGN_ONLY`.
- Firmware 9.60 runtime behavior remains `UNPROVEN`.
- Stock sizes and hashes remain `reference_only`.
- The byte-exact on-device Payload Manager backup remains a `HARD_BLOCKER`.
- Every authorization field remains `false`; automatic retry remains `false`.
- SHA-256
  `4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63`
  remains permanently denied and execution-ineligible.

## Source identities

| Source | Commit | Tree |
|---|---|---|
| hardened elfldr | `197623058f509eddde18868dafcb92fdcac66464` | clean |
| controlled Payload Manager | `e23d94ff91233aa770e2342800c1467875bdef44` | clean |
| public elfldr v0.23 base | `699e8bcff03e91e8d6ca6eba281af25c5a58d8c2` | clean |
| public Payload Manager v0.3.1 base | `cfbc70f30f419b09bf2b52283f7409e2d3117ee1` | clean |
| PS5 Payload SDK v0.41 | `d2e2e585740362976a39fdd5ccf390f199a7bc37` | clean |
| lifecycle-probe source | `fe08300339a13f899fb78ea404ada381a5cba87c` | byte identity checked |

The public bases establish provenance and the pre-hardening behavior. The
hardened source commits establish the only controlled route considered here.
No external source was contacted during this audit.

## Mandatory gates

| Gate | Required | Evidence | Result |
|---|---|---|---|
| kernelwrite-free startup | complete reachable startup path excludes kernel/process patch writes | SDK `crt/crt.c:48-80,193-220`, `crt/patch.c:25-101`, `crt/Makefile:19-26` | **FAIL** for normal CRT |
| custom entry ABI | entry register, BSS, stack, return, exit and cleanup are all proven | elfldr `elfldr.c:273-415`; prior Phase-0.5 audit | **UNPROVEN** |
| non-persistent output | payload bytes return over the hash-bound route without a device file, listener or global-state mutation | elfldr `socksrv.c:129-145,361-365`, `elfldr.c:499-520`; manager `verified_launcher.c:119-185`, `ps5_launcher.c:18-70` | **FAIL** |
| bounded exit | successful and failing observer paths terminate without relying on an unproven ABI | SDK `crt/crt.c:150-220`; hardened loader watchdog | **UNPROVEN** |

Both implementation gates fail independently. The build gate therefore stops
before observer source or target creation.

## Capability matrix

“Source present” does not mean firmware-9.60 behavior is proven. “Implement”
is `no` for every row because startup/exit and output fail first.

| Needed fact | Available local API | Source | Evidence | Implement |
|---|---|---|---|---|
| firmware source 1 | `kernel_get_fw_version()` reads `sdk_ps5_ver` | SDK `crt/kernel.c:148-171` | source present; runtime unproven | no |
| firmware source 2 | none established | — | unproven | no |
| file metadata | `open(O_RDONLY\|O_NOFOLLOW\|O_CLOEXEC)`, `fstat`, `lstat`, `close` | manager `verified_launcher.c:76-115,174-184` | source/host evidence only | no |
| object identity | pre/post `st_dev`, `st_ino`, `st_size` | manager `verified_launcher.c:26-29,87-101` | source/host evidence only | no |
| SHA-256 | bounded descriptor read plus local SHA-256 | manager `verified_launcher.c:31-55`, `src/sha256.c` | source/host evidence only | no |
| mount information | `getmntinfo()` / `getfsstat()` sample | SDK `samples/mntinfo/main.c`, `libc/getmntinfo.c` | sample present; runtime unproven | no |
| processes/services | `sysctl(KERN_PROC)` sample; no complete service map | SDK `samples/ps/main.c` | partial and runtime unproven | no |
| listeners | none established | — | unproven | no |
| autoload configuration | stock file readers and mutating HTTP handlers | manager `config.c`, `autoload.c`, `http_server.c` | unsafe or unproven | no |
| output channel | controlled route suppresses payload stdio and manager has no receive operation | elfldr `socksrv.c`, manager `ps5_launcher.c` | proven absent on controlled route | no |
| monotonic deadline | `clock_gettime(CLOCK_MONOTONIC)` in loader watchdog | elfldr `ps5_controlled.c:26-59` | source/host evidence only | no |
| process exit | normal CRT terminate path or custom return | SDK `crt/crt.c:150-220`, elfldr `elfldr.c:380-415` | observer ABI unproven | no |

Unknown capabilities remain unknown. There is no FreeBSD, PS4 or other
firmware fallback.

## Rejected runtime designs

### Normal SDK CRT

The installed compiler wrapper adds `crt1.o` unless `-nostartfiles` is used.
That object transitively contains `patch.o`. `_start()` calls
`payload_init()`, which calls `__patch_init()` before `main`.
`__patch_init()` changes credential capabilities/attributes and syscall
permission bounds. This violates the Phase-0.9B kernelwrite-free requirement.

### Freestanding custom `_start`

The loader places its `payload_args_t *` in `RDI`, stores the old instruction
pointer at `RSP-8`, and enters the ELF. Those operations show how control is
transferred; they do not prove that a bare `ret`, a direct process-exit import,
or another custom termination path performs every required cleanup safely.
The prior minimal-startup gate remains blocked. It was not bypassed.

### Controlled stdout/stderr

The controlled route passes `-1` as `stdio`. The elfldr duplicates the request
socket into standard descriptors only when `stdio > 0`. The manager transport
exposes connect, send and close callbacks but no receive callback. The fixed
`Controlled payload exited` response carries no observer data. The legacy
stdio route is not the hash-bound controlled route and is inadmissible.

### Notifications, klog and manager HTTP

A system notification is not a complete deterministic machine-readable return
channel. Klog is not proven to be a bounded host-return channel. The Payload
Manager HTTP service is a persistent listener, and ordinary routes change
process-global state; `/autoload_status` also changes autoload state. None is
admissible.

## Intended observer shape if gates are later proven

This is a non-implemented contract:

1. enter once through a source-bound, kernelwrite-free ABI;
2. emit a fixed offline-bound artifact identity;
3. initialize bounded in-memory results;
4. execute each explicitly authorized read at most once;
5. emit raw value or explicit error;
6. emit a final status;
7. terminate through a proven exit/cleanup path.

It would have no event loop, server, thread, callback, retry, sleep, process
signal, subprocess, module load, file mutation, lifecycle action, graphics,
SDL, RetroArch, GNM or VideoOut behavior.

## Decision

**BLOCKED — OBSERVER STARTUP OR EXIT ABI UNPROVEN; NO PROVEN
NON-PERSISTENT OUTPUT CHANNEL.**

The minimum missing evidence is:

1. a commit-bound, kernelwrite-free entry and termination contract that covers
   BSS, stack, return/exit, crash paths and loader cleanup; and
2. a commit-bound controlled response route that carries bounded observer
   bytes without a device file, new listener, persistent state or Payload
   Manager global-state mutation.