chimera-gfx-Public/FIRMWARE_COMPATIBILITY.md

# Firmware compatibility

Firmware `9.60` remains the only exact firmware in scope. Separately approved
Phase-1.0D runs have proven SDK CRT/main/notification execution on that device,
but they do not prove the Phase-0 capability probe, GNM, general VideoOut,
rendering, cleanup or compatibility of any other artifact. On 2026-07-22 the
exact Phase-1.0E result artifact received and consumed one single-use
authorization; all authorization fields are again false.

| Firmware | Discovery build | Probe executed | Result | Evidence | Rendering |
|---|---:|---:|---|---|---:|
| _none_ | no | no | unknown | no hardware authorization | prohibited |
| `9.60` | yes, offline only | no | unknown; SDK CRT execution blocker | `docs/evidence/probe-9.60-offline-2026-07-17.md` | prohibited |
| `9.60` Phase 0.6 lifecycle | no artifact built | no | blocked: exact loader has unbounded/unknown effects | `docs/runtime/phase-0.6-loader-audit.md` | prohibited |
| `9.60` Phase 0.7 lifecycle | yes, offline only | no | hardened runtime ready for a separately approved installation; hardware behavior unproven | `docs/runtime/phase-0.7-hardening.md` | prohibited |
| `9.60` Phase 0.8 preflight | no new artifact | no | read-only on-device preflight blocked: collector side-effect freedom and current rollback state unproven | `docs/runtime/phase-0.8-read-only-preflight.md` | prohibited |
| `9.60` Phase 0.9A anti-brick | no target artifact | no | offline design only; filesystem atomicity, durability and independent recovery unproven | `docs/runtime/phase-0.9-installation-transaction-design.md` | prohibited |
| `9.60` Phase 0.9B observer | no target artifact | no | blocked before build: startup/exit ABI and non-persistent output channel unproven | `docs/runtime/phase-0.9b-bounded-observer-design.md` | prohibited |
| `9.60` Phase 0.9C feasibility | no target artifact | no | blocked: startup/exit/cleanup, current bounded output, firmware source two, and observation effects remain unproven | `docs/runtime/phase-0.9c-static-audit.md` | prohibited |
| `9.60` Phase 0.9D readback | no target artifact | no | blocked: existing stack has no PS5-to-host file response; live paths and recovery remain unproven | `docs/runtime/phase-0.9d-readback-feasibility.md` | prohibited |
| `9.60` Phase 0.9E-R provenance | no target artifact | no | local outer Y2JB backup does not match any current official asset; official source has no 9020 listener implementation | `docs/runtime/phase-0.9e-r-official-release-correlation.md` | prohibited |
| `9.60` Phase 0.9E-R2 inner provenance | no target artifact | no | local inner differs from the mandatory official and selected community inners; MediaFire maker/source and deployment remain unbound | `docs/runtime/phase-0.9e-r2-final-provenance-decision.md` | prohibited |
| `9.60` Phase 1.0D RUN A/B | yes, exact one-shot artifacts | yes, two separately authorized runs | C1 proves SDK CRT/main/notification; RUN-B stage remains unclassified because its notification was unreadable | `docs/retroarch/phase-1.0e-device-observations.md` | unproven |
| `9.60` Phase 1.0E result channel | yes, exact one-shot artifact | yes, one authorized run | inherited stdout returned valid D00-D02 with platform result `0`; remote EOF before D03; permission consumed | `docs/retroarch/phase-1.0e-inherited-result-channel.md` | unproven beyond D02 |
| `9.60` Phase 1.0F interval diagnostic | yes, offline exact artifact | no | I00-I14 source interval prepared and statically audited; no device authorization | `docs/retroarch/phase-1.0f-startup-interval.md` | unproven beyond D02 |
| `9.60` Phase 1.0G interval run | exact one-shot artifact | yes, consumed | valid through I03; deterministic no-argument/no-menu help exit before I04 | `docs/retroarch/phase-1.0g-device-result.md` | SDL/VideoOut unproven |
| `9.60` Phase 1.0H startup args | yes, offline exact artifact | no | scoped argc-2 correction built and statically audited; no device authorization | `docs/retroarch/phase-1.0h-startup-args.md` | unproven beyond I03 |
| `9.60` Phase 1.0H one-shot run | exact one-shot artifact | yes, consumed | I04 and SDL/VideoOut reached; buffers registered; first flip submit and SDL init returned `-1` | `docs/retroarch/phase-1.0h-device-result.md` | visible flip unproven |
| `9.60` Phase 1.0I postmortem | no new artifact | no new run | offline source/map/disassembly binds submit `(handle,0,1,0)`; exact E118 operation, submit errno and root cause remain unproven | `docs/retroarch/phase-1.0i-flip-and-write-analysis.md` | no new rendering evidence |
| `9.60` Phase 1.0J-1.0O diagnostics/results | exact offline artifacts and consumed one-shot runs where recorded | only separately authorized J/K/O attempts | first blocked write was `MKDIR`; write-free M reached VideoOut but first flip still returned `-1`; all permissions consumed | `docs/retroarch/` Phase-1.0J through O records | visible presentation and cleanup unproven |
| `9.60` Phase 1.0P-1.0S analysis | no new target artifact | no new run | public VideoOut semantics and a source-proven launch-context fix remain unavailable; hbldr/shsrv is only a source candidate | `docs/retroarch/` Phase-1.0P through S records | parameter or launcher change blocked |
| `9.60` Phase 1.0T-1.0AY offline route design | host-only models and source audits | no device request | deployed shsrv identity remains unknown; result-channel, launch-context, protocol and exact source-base work are offline only | `docs/retroarch/` Phase-1.0T through AY records | no firmware/rendering evidence |

## Rules

- A firmware row is added only for an exact, reproducible identifier.
- Build allowlisting is not runtime compatibility evidence or execution
  permission.
- `symbol present` means only that lookup returned non-null on that observation.
- Presence does not establish signature, semantics, or rendering compatibility.
- Failure on an unlisted firmware is the expected fail-closed behavior.
- Compatibility does not transfer between firmware revisions.
- Every observation must reference the source commit, manifest hash, SDK lock,
  approval, and redacted crash/probe log.

The build cache variable `CHIMERA_GFX_PS5_ALLOWED_FIRMWARE` defaults to `NONE`.
Changing it is a deliberate build action, not a repository compatibility claim
and not permission to execute the artifact.

The default capability-probe and every VideoOut review artifact embed `NONE`.
The 9.60 capability artifact has its own digest, manifest, and offline review.
It remains execution-blocked because the pinned SDK payload CRT writes kernel
process state before `main`. VideoOut is not allowlisted for 9.60 and also
remains blocked by the unproven bounded-wait requirement in
`docs/phase1/HARDWARE_TEST_PLAN.md`.

Phase 0.5 did not create a firmware-9.60 startup artifact: the exact loader
caller, return, cleanup, crash, and pre-entry contract is unproven. The older
9.60 probe hash `4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63`
is permanently denylisted independent of future firmware or approval records.

Phase 0.6 exactly matched the installed Payload Manager v0.3.1 and elfldr
v0.23, but the firmware identifier is still user-attested rather than
device-attested. The lifecycle remains blocked by unbounded ptrace/payload
runtime, unproven return and cleanup, incomplete restoration, absent
launch-time hash enforcement, and the manager's persistent upload path.
`__patch_init` is now a documented payload-process-local effect and is not by
itself the blocker.

Phase 0.7 uses new private hardened elfldr and controlled Payload Manager
artifacts rather than reclassifying the old binaries. Exact firmware 9.60 is
explicitly confirmed by Jens but has not been queried from the device in this
task. Offline compiler, linker, test, disassembly, callgraph, and
reproducibility evidence supports
`READY_FOR_HARDENED_RUNTIME_DEPLOYMENT`. This is not an installed, transferred,
executed, or compatibility-tested state, and it authorizes no console action.

Phase 0.8 preserves that static Phase-0.7 decision but blocks the operational
read-only preflight before any connection. The stock Payload Manager HTTP
interface mutates in-process state, and no alternative collector currently
proves freedom from atime, audit, cache, metadata, service, or logging side
effects. Firmware 9.60 remains user-attested rather than confirmed by two
current device sources.

Phase 0.9A does not add firmware evidence. Its virtual host model cannot prove
PS5 filesystem identity, atomic switch, file or directory durability,
power-loss behavior, quiescence or independent recovery. Every such property
remains `UNPROVEN`, all device authorizations remain false, and no target
artifact is built.

Phase 0.9B also adds no firmware evidence. The normal SDK startup path violates
the phase's kernelwrite-free rule, a freestanding return/exit cleanup contract
is unproven, and the hash-bound controlled loader route does not return payload
output. The observer build stops before source or artifact creation. Firmware
9.60 remains user-attested and runtime-unproven.

Phase 0.9C identifies SDK `kernel_get_fw_version()` as source 1, but that
function reads a `libSceLibcInternal` process-parameter SDK field and has no
runtime observation in this phase. The SDK stub name
`sceKernelGetProsperoSystemSwVersion` has no accepted public signature,
semantics, side-effect contract, or firmware-9.60 evidence and is not source
2. The host result record can bind two exact values to a nonce, request ID and
artifact hash, but no target output implementation exists. Firmware agreement
therefore remains `BLOCKED_FIRMWARE_SOURCE_INCOMPLETE`.

Phase 0.9D adds no firmware evidence and performs no device request. Its local
source audit finds only host-to-PS5 upload/launch and internal read paths, not a
binary-safe PS5-to-host component download. Configured, packaged, and
historical reference paths are not current live-path evidence. Firmware 9.60
therefore remains user-attested and runtime behavior remains `UNPROVEN`.

Phase 0.9E also adds no firmware evidence. The local Y2JB-named backup
candidate covers firmware 4.03 through 12.40 only by filename claim; its opaque
`SIECAF` content cannot be tied to the exact firmware-9.60 deployment or to an
auditable port-9020 listener. No bootstrap, restart, host-to-memory, output,
filesystem, autoload, crash, or reboot property was tested on hardware.
Firmware 9.60 remains user-attested and runtime behavior remains `UNPROVEN`.

Phase 0.9E-R confirms only that official release 1.6 source permits Lapse's
version-selection path through firmware 10.01. Because the local outer backup
matches no current official asset, that source logic is not bound to the
deployed bytes and is not runtime compatibility evidence for firmware 9.60.

Phase 0.9E-R2 adds no firmware evidence. Full host-side inner and SIECAF
comparisons are negative, and the MediaFire page exposes no source binding.
Even a positive structural or byte match would not prove current deployment.
Firmware 9.60 remains user-attested and runtime behavior remains `UNPROVEN`.

Phase-1.0D RUN A changes one narrow firmware statement: the operator visibly
observed the exact C1 marker, proving that hardened elfldr reached the normal
SDK CRT, `main` and the notification ABI on the firmware-9.60 console for that
exact canary hash. RUN B produced one unreadable notification and therefore
does not identify a D-stage. Phase-1.0E RUN C adds exact artifact-bound evidence
for D00-D02 and the inherited result channel. D02 reported platform result `0`;
remote EOF occurred before D03. It proves neither SDL/VideoOut nor rendering,
terminal status, cleanup or safe exit. Every authorization is false.
Phase 1.0F adds no firmware evidence: its I00-I14 artifact exists only as an
offline build and has never been transferred, received from or executed on a
device.
Phase 1.0G adds exact artifact-bound firmware evidence through I03. Captured
ordinary stdout proves the build took RetroArch's no-argument/no-menu help path
and exited before I04. It adds no SDL, VideoOut, rendering, terminal cleanup or
safe-exit evidence. Its one-shot permission is consumed.
Phase 1.0H adds no firmware evidence. It is an offline, reproducible correction
for that source-bound argument defect and remains transfer- and
execution-ineligible. Its modeled I04 boundary and all later stages are
unproven on firmware 9.60.
The later exact H permission was consumed once. It proves I04, I13/I14, D03,
a positive D05 VideoOut handle and D06 buffer-registration result `0`. D07 and
D04 both returned `-1`; no successful visible flip, runloop, full cleanup or
safe exit is proven. No retry occurred.

Phase 1.0M adds no firmware evidence. It removes the source-bound playlist
directory probe/`mkdir` from write-free builds and produces a reproducible,
statically audited artifact, but that new hash has never been transferred or
executed. I04, SDL, VideoOut, flip behavior, visible output and cleanup remain
unproven on firmware 9.60.

Phase 1.0N adds no firmware evidence. It prepares only an inactive,
manifest-selected host runner for the unchanged Phase-1.0M hash. Fake-socket
tests and static hash binding do not prove runtime behavior on firmware 9.60;
all target, transfer, execution and reception authorizations remain false.

The separately authorized Phase-1.0O attempt adds exact firmware-9.60 evidence
for the M hash: I04 and SDL video entry were reached, VideoOut opened, buffer
registration returned `0`, and the first flip submit returned `-1` with saved
errno `0`. No D13/write-firewall frame occurred. D12 reported runtime
failure/E104 and D04 reported SDL init `-1`. Visible presentation, successful
termination and cleanup remain unproven; the permission is consumed.

Phase 1.0P adds no firmware evidence. Its offline source/map/disassembly audit
proves the exact first-submit tuple and failure site, but the local public
sources do not prove the argument semantics, opaque attributes, flip-master
or active-app requirements, return-code meaning, visible output or cleanup.
The VideoOut root cause remains unresolved and no new device action is
authorized.

Phase 1.0Q adds no firmware evidence. Its public-source search establishes
that the current PS5 VideoOut declarations have one SDL lineage and no
independent public PS5 corroboration. PS4 analogues and host source scans do
not establish firmware-9.60 argument, layout, ownership or error semantics.

Phase 1.0R adds no firmware evidence. Source proves only that SDL2main is a
lifecycle wrapper and that the tested artifact already hides the splash before
VideoOut open. It does not prove the firmware-9.60 active-app, flip-owner,
launcher, process, visibility or cleanup contract. The observed LNC log remains
a non-unique correlation, not a firmware interpretation or root cause.

Phase 1.0S adds no firmware evidence. Official shsrv source proves that hbldr
creates a BigApp-based process context, but source cannot prove that the route
works on this firmware-9.60 device, grants flip ownership, or fixes the exact
submit failure. The deployed shsrv version, target fake-app state, visibility,
crash and cleanup behavior remain unobserved.

Phase 1.0T adds no firmware evidence. It statically proves that the audited
shsrv source emits firmware, serial and telemetry on connection and that its
existing identity-related commands cannot return an exact deployed SHA-256.
No port-2323 connection occurred, so the deployed shsrv family, compile
metadata, device paths and all firmware-9.60 runtime effects remain unobserved.

Phase 1.0U adds no firmware evidence. Its bounded host inventory found no
original shsrv target binary or receipt to hash. Official source and packaging
metadata do not establish what runs on firmware 9.60, and no device identity,
path, version, greeting or behavior was observed.

Phase 1.0V adds no firmware evidence. Its Telnet and sanitization behavior is a
synthetic host model fed from stdin. It neither connects to nor observes the
firmware-9.60 device, and it does not prove the live greeting, prompt,
negotiation, timeout, disconnect, shell cleanup or deployed shsrv identity.

Phase 1.0W adds no firmware evidence. Its remediated collector, session policy
and fake transport use synthetic host input and an explicit synthetic clock.
Source-bound port 2323 and exact firmware text `9.60` are policy constraints,
not proof of a listener, negotiation, device identity, deployed bytes or
runtime behavior.

Phase 1.0X also adds no firmware evidence. Its receipt/output operations and
deadline/cleanup state are exercised only against injected fake adapters. The
official shsrv source describes a dynamic `PWD` prompt and automatic greeting,
but does not bind the deployed bytes or live Telnet stream on firmware 9.60.

Phase 1.0Y adds source-history evidence only. Official tags v0.7-v0.8 use raw
framing and v0.9-v0.19 use `libtelnet`/NVT, but no evidence selects which
family, revision or modified binary runs on firmware 9.60. Synthetic framing
tests therefore do not establish live line endings, prompt completion, echo,
short-write behavior or disconnect cleanup.

Phase 1.0Z adds no firmware evidence. Its one-batch formatter and deadline-only
accumulator run exclusively on synthetic host inputs. The tests show that the
contract tolerates modeled LF/CRLF output and rejects incomplete data; they do
not prove a listener, exact deployed shsrv bytes, live deadline behavior,
filesystem effects, cleanup or restart on firmware 9.60.

Phase 1.0AA adds no firmware evidence. Its exact fake adapter, synthetic clock,
exclusive temporary host files and scripted events exercise only local model
composition. Passing receipt/send/deadline/close tests cannot establish a live
listener, OS timeout behavior, target identity, shell cleanup or any behavior
on firmware 9.60.

Phase 1.0AB adds no firmware evidence. Local Windows Python runtime identities
and synthetic nonblocking traces describe only a possible host implementation.
They do not observe port state, packet delivery, shsrv cleanup or any behavior
on firmware 9.60.

Phase 1.0AC adds no firmware evidence. Its dormant adapter accepts only exact
built-in fake syscall steps and a synthetic clock. Passing its lifecycle and
cleanup cases does not establish a listener, deployed shsrv identity, network
timing, remote cleanup, launch context or any firmware-9.60 behavior.

Phase 1.0AU adds no firmware evidence. Exact official headers establish source
signatures for pipe, descriptor inheritance, nonblocking reads, monotonic time,
termination and reap. They do not establish their runtime behavior on firmware
9.60, and current official shsrv does not contain the bounded composition.

Phase 1.0AV adds no firmware evidence. Its two synthetic arms define how a
future exact-payload comparison would isolate launcher identity, but neither
arm has target source, an artifact, approval or device result. A modeled return
difference cannot prove a visible flip or firmware behavior.

Phase 1.0AW adds no firmware evidence. It proves only that official v0.7 source
passes raw stdout into the replaced BigApp and identifies the source changes a
future canary would need. No deployed identity, bounded launcher, target bytes
or firmware-9.60 result exists.

Phase 1.0AX adds no firmware evidence. Its valid D07/D04/D14 traces are
synthetic bytes and its cleanup predicate is a host reference. No target source,
artifact, device result or visible output implements that reference.

Phase 1.0AY adds no firmware evidence. Selecting an exact private Git commit
establishes only source lineage; it creates no target source delta, artifact or
firmware-9.60 observation.