# Phase 0.9B observer static audit

Status: **NOT PERFORMED — BLOCKED BEFORE SOURCE AND BUILD**.

This is a truthful negative audit record. No observer artifact exists, so no
ELF property can be reported as passing. Absence of imports or strings is not
used as a substitute for a reachable-code proof.

## Build decision

The source audit stopped the target build because:

- normal SDK startup reaches `__patch_init()` and performs prohibited writes;
- a freestanding observer return/exit and cleanup contract remains unproven;
- the hash-bound controlled route suppresses payload stdout/stderr; and
- the controlled manager sends the ELF and closes without receiving observer
  output.

No observer source path or CMake target was added. The existing
`CHIMERA_GFX_BUILD_PS5_MINIMAL_STARTUP` configure-time blocker remains intact.

## Required artifact audit status

| Audit | Status | Reason |
|---|---|---|
| SHA-256 and size | `NOT_APPLICABLE_NO_ARTIFACT` | no binary |
| source commit binding | `NOT_APPLICABLE_NO_ARTIFACT` | no target source |
| toolchain identity | `PARTIAL_OFFLINE_REFERENCE_ONLY` | SDK v0.41 pinned; no observer link |
| double clean build | `NOT_PERFORMED_BLOCKED_BEFORE_BUILD` | hard gates failed |
| ELF header | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
| program headers | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
| section headers | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
| dynamic dependencies | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
| imported/undefined symbols | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
| exported symbols | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
| relocations | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
| linker map | `NOT_CREATED` | no link |
| reachable callgraph | `NOT_CREATED` | no code |
| disassembly | `NOT_CREATED` | no code |
| strings | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
| denied capabilities | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
| filesystem open flags | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
| network functions | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
| threads/loops | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
| kernelwrites | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |

The validator fails if a Phase-0.9B ELF, map, observer target, observer source
directory, installation package or lifecycle package appears while the
manifest remains blocked.

## Transitive startup audit

### Normal SDK link

The SDK compiler wrapper at commit
`d2e2e585740362976a39fdd5ccf390f199a7bc37` selects
`target/lib/crt1.o` unless `-nostartfiles` is present. The CRT Makefile links:

`crt.o`, `syscall.o`, `klog.o`, `nid.o`, `kernel.o`, `rtld.o`, `rtld_so.o`,
`rtld_sprx.o`, `rtld_payload.o`, `rtld_dlfcn.o`, `mdbg.o`, and `patch.o`.

The installed `crt1.o` is 112256 bytes with SHA-256
`0e4c1e5e38f22026580e856238a53e75d9e112f99a34bfe5495a3a0ffac15238`.
It was inspected as source-bound evidence and was not linked into a new
artifact.

Reachable sequence from normal `_start`:

```text
_start
  -> clear BSS
  -> payload_init
     -> __crt_syscall_init
     -> __kernel_init
     -> __klog_init
     -> write __isthreaded
     -> __patch_init
        -> patch_kernel_ucred
           -> kernel_set_ucred_caps
           -> kernel_set_ucred_attrs
        -> patch_syscall_permissions
           -> kernel_copyin syscall low bound
           -> kernel_copyin syscall high bound
     -> __rtld_init
  -> payload_run
     -> constructors
     -> main
     -> destructors
  -> payload_terminate
```

Result: **UNSAFE** for the Phase-0.9B kernelwrite-free contract.

### Custom entry

`-nostartfiles -nodefaultlibs` can remove `crt1.o` and default libraries.
However, compile/link capability alone does not establish safe behavior.
elfldr `elfldr_prepare_exec()` shows `RDI=args`, `RIP=entry`, and the old RIP
stored on the adjusted stack. No source establishes the complete observer
post-return cleanup, process-exit, crash, or resource-lifetime contract for a
new bare entry. Result: **UNPROVEN**.

## Output audit

Controlled elfldr call path:

```text
controlled manager
  -> connect_loopback
  -> send_all(control header)
  -> send_all(ELF bytes)
  -> close_socket

elfldr controlled route
  -> payload_read_controlled
  -> payload_spawn
  -> elfldr_spawn(stdio = -1)
  -> no stdio duplication
  -> watchdog/reap
  -> fixed "Controlled payload exited" loader response
```

There is no manager receive callback and no payload-provided response body.
Result: **NO PROVEN NON-PERSISTENT OUTPUT CHANNEL**.

## Existing loader effects versus observer effects

The hardened loader performs ptrace, credential, mapping, socket-overlap,
breakpoint, protection and cleanup operations before and around entry. Those
are existing loader effects, not code introduced by an observer artifact.
They are still relevant to the risk of a later execution and do not make the
observer’s own startup kernelwrite-free.

Because no observer was built:

- observer imports: none to report;
- observer filesystem reads: none implemented;
- observer network functions: none implemented;
- observer threads or loops: none implemented;
- observer prohibited capabilities: none implemented; and
- absence of an artifact is not hardware-safety proof.

## Reproducibility

Build 1 hash: `null`.

Build 2 hash: `null`.

Final artifact hash/size: `null` / `null`.

Result: `NOT_PERFORMED_BLOCKED_BEFORE_BUILD`, not
`REPRODUCIBILITY_PASSED`.