chimera-gfx-Public/TEST_PLAN.md

Test plan

Test classes

Host unit tests

• API rejects null, undersized, wrong-version, unknown-backend, unknown-flag, and render-request configurations.
• mock context lifecycle and capabilities are deterministic.
• surface/texture validation, upload, present ordering, ownership, limits, and resource-busy cleanup are deterministic;
• adapter queries never claim acceleration or hardware contexts;
• probe logic handles complete, partial, and failed resolution without exposing addresses or invoking callbacks as functions.
• repeated cleanup is safe where the API contract permits it.

Static policy tests

• generated symbol include matches the JSON manifest byte-for-byte;
• no GNM identifier appears as a C call expression;
• no submit, draw, dispatch, flip, queue-map, resource-registration, MMIO, or firmware-patch operation is called by project C sources;
• the PS5 platform shim uses only the approved dynamic-loader surface;
• no build target contains deploy, upload, send, run-ps5, or boot hooks;
• the discovery-only firmware allowlist is exactly ["9.60"], the CMake default remains NONE, and Phase-1 rejects every non-NONE gate;
• Phase-1 firmware validation precedes SDL_Init and present;
• the Phase-1 target is off by default and never links SDL2main.

Reproducibility checks

• SDK release download matches the locked SHA-256 and size;
• generated files are current;
• clean host configure/build/test works without network access;
• Docker base is pinned by digest and direct tool packages are version-pinned;
• PS5 compile uses the locked SDK and produces an ELF without contacting a PS5.
• artifact generation binds the byte hash and clean source commit; verification rejects changed bytes or execution claims;
• artifact consumers reject execution_eligible=false, malformed inputs, and permanent denylist hashes;
• the Phase-0.5 minimal-startup option fails configuration while its loader caller contract is unproven;
• Phase-0.6 exact loader/manager identities, binary audit, call graph, effect classes, and blocked artifact state validate offline;
• Phase-0.7 hardened loader, controlled manager, and lifecycle probe have byte-identical double clean builds, exact import/DT_NEEDED inventories, complete call-edge inventories, and a passing static deployment gate;
• Phase-0.8 records a blocked offline preflight whenever exact permission, collector side-effect freedom, two-source firmware identity, current live topology, or byte-exact rollback evidence is absent; tests reject any invented on-device action, authorization, or completed dataset;
• Phase-0.8R rehashes the three immutable Phase-0.8 records, keeps every authorization and retry field false, preserves the permanent denylist and hard Payload Manager-backup gate, and rejects promotion of HTTP routes, OPTIONS, host evidence, the permission template, or RetroArch work;
• Phase-0.9A validates 20 anti-brick invariants, two separate component transactions, five empty authorization templates, all 14 power-loss boundaries, fail-closed approval transitions and every declared virtual fault while preserving READ_ONLY_PREFLIGHT_BLOCKED;
• Phase-0.9A simulator results always identify themselves as host-only, perform no filesystem/network/target I/O, never claim PS5 evidence, and stop before execution even when the synthetic switch primitive is enabled;
• Phase-0.9B validates the blocked startup/exit and output-channel gates, exercises the proposed result contract entirely in memory, and rejects any observer source, target artifact, authorization or fabricated artifact audit;
• Phase-0.9C validates the complete startup/exit model, prohibited normal-CRT effects, incomplete freestanding dependency closure, absence of a safe exit terminal, all four output architectures, fixed 4096-byte D1 framing, nonce/request/checksum/deadline/completion/cleanup rules, firmware-source conflict and absence, observation side effects, capability blockers, exact source and immutable hashes, and the absence of target source, ELF, map or lifecycle/install/autoload package;
• hardened launcher tests cover deadlines, step budgets, credential restore, cleanup, child termination/reaping, receiver-side hashing, and denylisting;
• controlled-manager tests cover same-FD hashing/streaming, symlinks, truncation, mismatch, denylisting, TOCTOU, loopback-only transport, and negative compile-time artifact configuration;
• every potentially eligible artifact requires an exact controlled runtime profile and firmware argument; missing/mismatched/hard-effect profiles fail;
• SPDX inventory and artifact schema validate without network access.
• the compiled probe has no direct Sce imports and the disabled Phase-1 ELF has exactly the reviewed 15-name Sce import set with no GNM/keyboard/IME imports.

Commands

Host:

cmake --preset host-debug
cmake --build --preset host-debug
ctest --preset host-debug

The default host suite is standalone and uses only tracked repository inputs. Validators that require exact sibling repositories, ignored linker maps/ELFs, or pinned work/upstream checkouts are deliberately excluded from that suite. Register them only in a prepared, phase-specific evidence workspace:

cmake -S . -B build/external-evidence \
  -DBUILD_TESTING=ON \
  -DCHIMERA_GFX_REGISTER_EXTERNAL_EVIDENCE_VALIDATORS=ON
cmake --build build/external-evidence
ctest --test-dir build/external-evidence -N

Run only the named validator whose exact sibling commits and ignored artifacts were prepared, using its phase command below or ctest -R <exact-name>. Historical validators intentionally bind different RetroArch revisions and cannot be treated as one shared-worktree suite. Missing, dirty, mismatched, or incomplete external evidence must fail the selected validator. Leaving them unregistered never promotes an evidence claim; the corresponding artifact and device authorization fields remain false. The current workspace disposition is recorded in docs/evidence/external-evidence-integrity-2026-07-29.md.

PS5 compile-only:

cmake -S . -B build-ps5 \
  -DCMAKE_TOOLCHAIN_FILE="$PS5_PAYLOAD_SDK/toolchain/prospero.cmake" \
  -DCHIMERA_GFX_BUILD_PS5_PROBE=ON
cmake --build build-ps5 --target chimera-gfx-capability-probe

The expected default artifact contains a firmware gate value of NONE and cannot enter symbol discovery. No test command in this repository executes it.

Exact 9.60 offline build from WSL/Linux and a clean tree:

bash tools/build-firmware-probe.sh 9.60

The script builds only chimera-gfx-capability-probe, forces CHIMERA_GFX_BUILD_PHASE1_VIDEOOUT_CLEAR=OFF, verifies the exact six undefined imports, audits the pinned SDK startup/loader/cleanup chain, and marks the artifact execution-ineligible. It does not connect to or execute on a PS5.

Phase-0.5 startup audit (WSL/Linux, offline, produces JSON only):

python3 tools/audit_ps5_startup_feasibility.py \
  --root . \
  --sdk-source work/upstream/sdk \
  --sdk-install work/toolchains/ps5-payload-sdk-v0.41 \
  --objdump /usr/bin/llvm-objdump-18 \
  --readelf /usr/bin/readelf \
  --output manifests/runtime/phase-0.5-startup-audit.json

The command invokes the compiler only with -###; it does not compile or link an ELF. Repeating it must leave the JSON byte-identical. Enabling CHIMERA_GFX_BUILD_PS5_MINIMAL_STARTUP is a negative test and must fail before any target is created.

Phase-0.6 exact loader/runtime audit (WSL/Linux, offline):

python3 tools/audit_ps5_loader_runtime.py \
  --root . \
  --loader-source work/upstream/elfldr-v0.23 \
  --loader-asset work/upstream/release-assets/elfldr-ps5-v0.23.elf \
  --payload-manager-source work/upstream/pldmgr-v0.3.1 \
  --sdk-source work/upstream/sdk \
  --readelf /usr/bin/readelf \
  --objdump /usr/bin/llvm-objdump-18 \
  --output manifests/runtime/phase-0.6-loader-runtime-audit.json

Run it twice from clean exact checkouts and compare output SHA-256. It only reads public source and an ignored release asset, then writes JSON. It does not connect to a PS5. Because the decision is blocked, no lifecycle compile, linker map, probe disassembly, double ELF build, transfer, or execution occurs.

Phase-0.7 full offline audit:

python3 tools/audit_phase07_artifacts.py \
  --root . \
  --loader-root ../chimera-elfldr \
  --manager-root ../chimera-ps5-payload-manager \
  --sdk-install work/toolchains/ps5-payload-sdk-v0.41 \
  --output manifests/runtime/phase-0.7-offline-audit.json

The tool performs two clean builds of all three artifacts, requires byte-identical ELF output, records full imports, DT_NEEDED, relocations, sections, linker maps, disassembly, and reachable call edges, and rejects source identity drift. Full reports are written below ignored outputs/phase07/audit/; the machine audit and all report hashes are committed. It never contacts or executes on a PS5.

The static policy check must pass for the exact local lifecycle bytes while continuing to report execution_authorized=false:

python3 tools/check_artifact_execution_policy.py \
  --manifest manifests/artifacts/chimera-gfx-lifecycle-probe-phase07-fw-9.60.json \
  --denylist manifests/artifact-denylist.json \
  --artifact outputs/phase07/artifacts/chimera-gfx-lifecycle-probe.elf \
  --runtime-profile manifests/runtime/controlled-ps5-runtime-profile.json \
  --firmware 9.60

Wrong firmware, altered bytes, blocked hash, missing hardened identity, installed/executed state drift, widened budgets, or a hard effect must fail.

After all source and evidence are committed and the tracked worktree is clean, create the deterministic offline review and rollback archives:

python3 tools/package_phase07_review.py --root .

The command accepts only the exact reviewed hashes, embeds the clean repository HEAD, and writes below ignored outputs/phase07/packages/. It contains no PS5 connection, transfer, installation, or execution operation.

Phase-0.8 read-only preflight record:

python3 tests/test_phase08_preflight.py --root .

This is an offline record-validation command. It does not contact the PS5. The current expected result is READ_ONLY_PREFLIGHT_BLOCKED: no exact permission record or admissible no-side-effect collector exists, and current device and rollback evidence is absent. Do not use the stock Payload Manager HTTP routes as a Phase-0.8 collector.

Phase-0.8R remediation and regression guardrails:

python3 tools/validate_phase08_remediation.py --root .
python3 tests/test_phase08_remediation.py --root .

When the ignored exact Payload Manager v0.3.1 source checkout is already present locally, its commit and relevant source-file hashes can also be revalidated without network access:

python3 tools/validate_phase08_remediation.py \
  --root . \
  --require-local-source

These commands only read repository evidence and run in-memory negative variants. They do not build a target, contact a remote or PS5, create an artifact, or claim hardware safety.

Phase-0.9A offline anti-brick design and simulator:

python3 tests/test_phase09_transaction.py --root .
python3 tools/simulate_phase09_transaction.py \
  --component hardened_elfldr \
  --run-fault-suite
python3 tools/simulate_phase09_transaction.py \
  --component controlled_payload_manager \
  --run-fault-suite

The simulator uses virtual objects held in memory. It has no output-file, device, network, compiler, transfer, install or execution operation. The default transaction stops because PS5 switch atomicity and durability are unproven. Its synthetic atomic model exists only inside the fault suite and does not establish PS5 behavior.

Phase-0.9B blocked bounded-observer audit:

python3 tools/validate_phase09b_observer_audit.py --root .
python3 tests/test_phase09b_observer_audit.py --root .

These commands read pinned local source evidence and run an in-memory host model. They fail if an observer source, target, ELF, map, install/lifecycle package, device address, read path, true authorization field or false positive artifact audit appears. They do not compile target code, contact a PS5, transfer, execute, install, create a backup, change services or start RetroArch/graphics work.

Phase-0.9C execution-feasibility closure:

python3 tests/test_phase09c_protocol.py --root .
python3 tools/validate_phase09c_feasibility.py --root .
python3 tests/test_phase09c_feasibility.py --root .

These commands use local source trees and finite host-only models. They do not compile or assemble target code, open a device path, use a network operation, create an ELF/map/package, or authorize a later action. The expected result is BLOCKED_MULTIPLE_FOUNDATIONAL_CONTRACTS; a passing host protocol does not establish a target startup, exit, output, firmware, cleanup, or side-effect contract.

Phase-0.9D existing-stack readback and recovery audit:

python3 tools/validate_phase09d_readback.py --root .
python3 tests/test_phase09d_readback.py --root .

The validator rehashes the five clean pinned source trees, immutable Phase records, and permanent denylist. The 30 negative guardrails reject mutating, launching, autoload-triggering, incompletely framed, retrying, or recovery-promoting variants. They create no target code or artifact, make no network request, and do not prove device behavior. The expected decision is BLOCKED_NO_READBACK_PATH.

Phase-0.9E external-bootstrap provenance audit:

python3 tools/validate_phase09e_bootstrap.py --root .
python3 tests/test_phase09e_bootstrap.py --root .

The validator rehashes the bounded local Y2JB-named candidate archive, its opaque SIECAF member, the clean pinned source trees, immutable historical records, source-bound post-bootstrap artifacts, and the permanent denylist. The 20 guardrails prohibit invented provenance, protocol promotion, target source or artifacts, live replacement, autoload, automatic retry, and false reboot or host-to-memory claims. The tests open no network port, create no protocol client or emulator, and provide no device evidence. The expected classification is BOOTSTRAP_IMPLEMENTATION_MISSING.

Phase-0.9E-R official-release correlation:

python3 tools/validate_phase09er_provenance.py --root .
python3 tests/test_phase09er_provenance.py --root .

The validator rehashes the unchanged local outer ZIP and opaque inner member, the official detached 1.6 source tree, immutable historical records, the permanent denylist, deliverables, and their checksum inventory. The 22 guardrails reject name/size-only matches, mirror provenance, opaque-content promotion, invented embedded-source identity, reference-only port promotion, duplex overclaims, target output, authorization, retry, and large tracked assets. They perform no network or device action. Expected decisions are OFFICIAL_RELEASE_NO_MATCH, PORT_9020_REFERENCE_ONLY, and LOCAL_BACKUP_NOT_CORRELATED.

Phase-0.9E-R2 inner and MediaFire correlation:

python3 tools/validate_phase09er2_correlation.py --root .
python3 tests/test_phase09er2_correlation.py --root .
python3 tests/test_siecaf_header_parser.py --root .

The validator rehashes the unchanged local outer and inner, all immutable historical manifests, the denylist, generated SIECAF record fingerprints, and the checksum inventory. It recomputes the local SIECAF parse and all normalized record hashes without needing downloaded evidence to remain. The 24 phase guardrails and 18 parser cases cover repacking, complete byte-match requirements, malformed and overflowing tables, ranges, duplicate/overlap reporting, redaction, large-file exclusion, authorization, retry, target absence, and runtime-evidence boundaries. Expected results are INNER_ARCHIVE_HASH_MISMATCH, SIECAF_LAYOUT_DIFFERENT, and LOCAL_BACKUP_UNCORRELATED.

The Phase-0.9D and Phase-0.9E validators deliberately require their original branch and original root-document checksums. CTest therefore leaves those two branch-local historical validators disabled on later phases; the current Phase-0.9E-R2 validator rehashes their immutable manifests instead. They can be registered only on the matching historical checkout with CHIMERA_GFX_RUN_BRANCH_LOCAL_HISTORICAL_VALIDATORS=ON.

Phase-1.0E inherited result-channel validation:

python3 tools/validate_retroarch_phase10e.py --root . \
  --retroarch-root ../chimera-retroarch \
  --loader-root ../chimera-elfldr
python3 tests/test_retroarch_phase10e.py --root .

In chimera-retroarch, run make -f Makefile.ps5 test-ps5-port, then perform two clean PS5_PROFILE=result-diag builds and compare both ELF and linker map byte-for-byte. Static audit must prove W^X, empty init/fini arrays, absent TLS, the complete import set, an import delta of exactly send, and the reachable SDK _start -> __patch_init path. The validator additionally checks the ignored RUN-C trace's exact size/hash and its one-connect/no-retry D00-D02 record when that local evidence is present. These commands are offline and do not authorize or perform any new connection, transfer, result reception or execution.

Phase-1.0F offline startup-interval validation:

python3 tools/validate_retroarch_phase10f.py --root . \
  --retroarch-root ../chimera-retroarch
python3 tests/test_retroarch_phase10f.py --root .

In chimera-retroarch, run make -f Makefile.ps5 test-ps5-port, then perform two clean PS5_PROFILE=interval-diag builds from the manifest-bound commit and compare ELF and linker map byte-for-byte. Audit both copies for identical ELF model, imports, relocations and segment permissions. Disassembly must bind all I00-I14 callsites to the stream-only wrappers and the single existing send relocation. These commands never authorize a connection, transfer, result reception or execution.

Phase-1.0G offline one-shot-runner validation:

python3 tools/validate_retroarch_phase10g.py --root . \
  --retroarch-root ../chimera-retroarch
python3 tests/test_retroarch_phase10g.py --root .

In chimera-retroarch, make -f Makefile.ps5 test-ps5-port uses only injected fake sockets. It verifies exact manifest/approval binding, actual artifact rehashing, manifest-only F-protocol selection, exclusive trace creation and a durable consumed-attempt receipt created before the mocked transport. Negative tests prove that inactive, mismatched, reused, retrying or reconnecting inputs do not reach transport. These are host-policy tests, not device evidence.

Consumed Phase-1.0G result validation:

python3 tools/validate_retroarch_phase10g_result.py --root .
python3 tests/test_retroarch_phase10g_result.py --root .

These checks bind the immutable local trace hash, exact seven-frame sequence, ordinary stdout hash, one-shot counters and consumed authorization. They reject invented I04/terminal progress, retries, reconnects, active future authority or claims that SDL/VideoOut and cleanup were reached.

Phase-1.0H offline startup-argument validation:

python3 tools/validate_retroarch_phase10h.py --root . \
  --retroarch-root ../chimera-retroarch
python3 tests/test_retroarch_phase10h.py --root .

In chimera-retroarch, run make -f Makefile.ps5 test-ps5-port, then perform two clean PS5_PROFILE=startup-args-diag builds and compare the ELF and map byte-for-byte. Audit both ELFs for H magic, flag mask 0x07, unchanged imports/modules/relocations, no RWX, manifest-only dual-gated H selection and identical normalized disassembly. These are host/static checks, not device evidence.

Consumed Phase-1.0H result validation:

python3 tools/validate_retroarch_phase10h_result.py --root .
python3 tests/test_retroarch_phase10h_result.py --root .

These checks bind the 25-frame order, exact raw results, transport counters, trace/receipt hashes and consumed authority. Negative cases reject invented D11/flip success, retry, reconnect, visibility, cleanup and write-operation claims.

Phase-1.0I offline postmortem validation:

python3 tools/validate_retroarch_phase10i.py --root .
python3 tests/test_retroarch_phase10i.py --root .

These checks bind the consumed artifact/map identities, three linked blocking wrappers, exact submit tuple and failure branch. Mutation cases reject an invented write operation, errno, successful flip, event wait, root cause, active authorization, target action or device-test readiness. They are static host checks and create no target artifact or hardware evidence.

Phase-1.0J offline diagnostic artifact validation:

python3 tools/validate_retroarch_phase10j.py --root .
python3 tests/test_retroarch_phase10j.py --root .

Build the sibling RetroArch write-diag profile twice from clean state and compare the ELF and map byte-for-byte. Audit the ignored output for exact J magic and D13 fields, an immediate stop before I04, errno capture before any reporting, one frame-index source, no RWX, empty init/fini arrays, no TLS, the exact imports/modules/relocations and identical normalized disassembly. The GFX validator binds those results while mutation cases reject a live J runner, socket/receive capability, late stop, successful write, repeated submit, active authorization or hardware-proof claim. No run, upload or deploy target exists.

Phase-1.0K inactive one-shot runner validation:

python3 tools/validate_retroarch_phase10k.py \
  --root . --retroarch-root ../chimera-retroarch
python3 tests/test_retroarch_phase10k.py --root .

These host-only checks bind the unchanged J artifact, exact 30-entry wire table and host-runner commit. Mutation tests reject active authorization, artifact eligibility, a tracked target/run ID, D13 renumbering, a free protocol selector, retry, multiple connections, a late consumption receipt and any claim that fake-socket results are hardware evidence. The tracked manifest and approval template remain inactive and cannot open a socket.

Phase-1.0L consumed write-firewall result validation:

python3 tools/validate_retroarch_phase10l.py \
  --root . --retroarch-root ../chimera-retroarch
python3 tests/test_retroarch_phase10l.py --root .

These host-only checks bind the consumed K receipt and ignored trace identities, the exact nine-frame terminal sequence, D13(6,1) as the first and only blocked MKDIR, and the source/map/disassembly route through config_set_defaults. Mutation cases reject an invented operation, second write, I04/SDL progress, retry, reconnect, runtime path, cleanup proof or reusable authority. No target artifact is built or tracked.

Phase-1.0M offline write-free defaults validation:

python3 tools/validate_retroarch_phase10m.py \
  --root . --retroarch-root ../chimera-retroarch
python3 tests/test_retroarch_phase10m.py --root .

Build the sibling RetroArch write-diag profile twice from clean state. The checks bind the exact source guard, retained in-memory path derivation, all 17 write-wrapper link options, exact ignored ELF/map hashes, identical normalized disassembly, imports, modules, relocations and no-RWX result. Mutation cases reject a weakened firewall, lost path derivation, invented runtime progress, artifact eligibility, active authority or a device action. No run, upload or deploy target exists.

Phase-1.0N inactive one-shot runner validation:

python3 tools/validate_retroarch_phase10n.py \
  --root . --retroarch-root ../chimera-retroarch
python3 tests/test_retroarch_phase10n.py --root .

These host-only checks bind the exact M artifact to the exact N runner commit and source hash. Mutation cases reject active eligibility or authority, a Phase-K scope, target/run fields, altered wire ordering, a free protocol selector, retries and widened attempt counts. The sibling fake-socket suite proves parser and gate behavior only. No target build or device action occurs.

Phase-1.0O consumed result validation:

python3 tools/validate_retroarch_phase10o.py \
  --root . --retroarch-root ../chimera-retroarch
python3 tests/test_retroarch_phase10o.py --root .

These offline checks bind the consumed run ID, authorization/receipt/trace hashes, exact one-shot counters, 25-frame sequence and source-bounded interpretation. Mutations reject reusable authority, retry/reconnect, an invented D13 or successful flip, invented errno, successful runner-terminal classification, visible presentation and cleanup. They never reconnect to the device and do not treat the result as authority for another run.

Phase-1.0P offline analysis validation:

python3 tools/validate_retroarch_phase10p.py \
  --root . --retroarch-root ../chimera-retroarch \
  --sdk-root work/upstream/sdk --sdl-root work/upstream/SDL
python3 tests/test_retroarch_phase10p.py --root .

These host-only checks bind the O artifact/trace identities, exact submit register tuple, SDK/SDL source commits and deterministic D12/D04 ordering. Mutations reject invented success or errno, semantic ABI promotion, new VideoOut calls, parser relaxation, parameter experiments and active authority. They build no target and perform no network or device operation.

Phase-1.0Q public evidence validation:

python3 tools/validate_retroarch_phase10q.py \
  --root . --sdk-root work/upstream/sdk --sdl-root work/upstream/SDL
python3 tests/test_retroarch_phase10q.py --root .

These offline tests validate the already-recorded source identities and do not access the network. Mutations reject mirrors, executed downloads, invented SDK headers or independent sources, PS4-to-PS5 promotion, semantic promotion, parameter changes, new VideoOut calls and every authorization.

Phase-1.0R launch-context validation:

python3 tools/validate_retroarch_phase10r.py \
  --root . --retroarch-root ../chimera-retroarch \
  --sdk-root work/upstream/sdk --sdl-root work/upstream/SDL \
  --elfldr-root ../chimera-elfldr \
  --manager-root ../chimera-ps5-payload-manager \
  --pacbrew-root work/upstream/pacbrew-repo
python3 tests/test_retroarch_phase10r.py --root .

These host-only checks rehash the exact wrapper, CRT, SDL video, elfldr, manager, RetroArch makefile, artifact and linker map. They verify the actual source tokens and repository commits, reject invented SDL2main registration, a distinct manager process, packaging-as-launcher claims, LNC-log root-cause promotion and every target/device authorization. They open no network socket and build no target.

Phase-1.0S launcher-provenance validation:

python3 tools/validate_retroarch_phase10s.py \
  --root . --shsrv-root work/upstream/shsrv \
  --shsrv-v07-root work/upstream/shsrv-v0.7 \
  --pacbrew-root work/upstream/pacbrew-repo
python3 tests/test_retroarch_phase10s.py --root .

These offline tests bind the clean official v0.7 and v0.19 commits, Git trees, file hashes, BigApp calls, persistent-write branch and PacBrew provenance limit. Mutations reject upstream-as-deployed promotion, VideoOut/runtime promotion, hidden staging, remount or fake-app effects, invented deadlines, route reuse and every target/device authorization. They do not build or run the downloaded source and perform no network or device operation.

Phase-1.0T inactive identity-gate validation:

python3 tools/validate_retroarch_phase10t.py \
  --root . --shsrv-root work/upstream/shsrv \
  --shsrv-v07-root work/upstream/shsrv-v0.7
python3 tests/test_retroarch_phase10t.py --root .
python3 tests/test_phase10t_shsrv_transcript.py --root .

These host-only tests bind the exact public shsrv source identities and the connection-to-shell/greeting effects. Mutation tests reject active authority, targets, retry, hidden serial transmission, exact-identity promotion and relaxed command or redaction policy. Synthetic transcript tests prove that sensitive values and unknown paths are discarded and that all source-family, metadata and weak-checksum combinations remain non-exact. They open no socket, write no transcript and perform no device operation.

Phase-1.0U bounded local-inventory validation:

python3 tools/validate_retroarch_phase10u.py \
  --root . --shsrv-root work/upstream/shsrv \
  --shsrv-v07-root work/upstream/shsrv-v0.7 \
  --pacbrew-root work/upstream/pacbrew-repo
python3 tests/test_retroarch_phase10u.py --root .

These host-only checks rehash the official wrapper and PacBrew recipe, bind the clean source commits and preserve the distinction between reference objects and deployed identity. Mutations reject global-absence claims, execution of a discovered sender, active authority and launch-context experimentation. They perform no search, network or device operation during CTest; the bounded inventory result is an immutable audit record.

Phase-1.0V inactive collector-model validation:

python3 tools/validate_retroarch_phase10v.py --root .
python3 tests/test_retroarch_phase10v.py --root .
python3 tests/test_phase10v_shsrv_collector_model.py --root .

These offline tests enforce the absence of network imports and live CLI arguments, exact source hashes, inactive activation, fixed bounds and non-promoted memory/device claims. Synthetic byte streams cover fragmented Telnet negotiation, subnegotiation, serial/telemetry redaction, oversize and chunk rejection, invalid UTF-8, incomplete control state, abort, one-shot sealing and literal-path filtering. No socket or device operation is used.

Phase-1.0W self-review and inactive client-architecture validation:

python3 tools/validate_retroarch_phase10v.py --root .
python3 tests/test_phase10v_shsrv_collector_model.py --root .
python3 tools/validate_retroarch_phase10w.py --root .
python3 tests/test_retroarch_phase10w.py --root .
python3 tests/test_phase10w_shsrv_client_policy.py --root .
python3 tools/validate_retroarch_phase10x.py --root . \
  --shsrv-root work/upstream/shsrv
python3 tests/test_retroarch_phase10x.py --root .
python3 tests/test_phase10x_inactive_transport.py --root .
python3 tools/validate_retroarch_phase10y.py --root . \
  --shsrv-root work/upstream/shsrv
python3 tests/test_retroarch_phase10y.py --root .
python3 tests/test_phase10y_shsrv_framing_model.py --root .

The V rerun proves the reviewed model's corrected hash and 21 edge cases. The W tests bind the data-only policy/fake-transport hashes, inactive records, source-bound port, dual-record match, approval lifetime, side-effect acceptance and one-shot command windows. Mutations reject targets in tracked state, second opens, command/target injection, retry, execution authority, missing effects, unknown approval fields, listener/policy mismatch, expired approval and invented live components. No socket is opened.

The X tests bind the W policy and remediated collector to an injected-only orchestrator. Eighteen mutation guardrails preserve inactive records, false authority, missing live framing and explicit durability/deadline limitations. Eighteen fault tests verify consumed-before-open ordering, exclusive files, close/reopen/hash validation, one-shot command order, sanitization, deadline and adapter failures, deterministic fake close and absence of socket/CLI code. They use no network and provide no hardware evidence.

The Y validator binds every official v0.9-v0.19 tag to the empty-option libtelnet family and keeps v0.7-v0.8 raw. Eighteen mutation guardrails reject authority, activation, family collapse, invented echo/negotiation, prompt promotion and live implementation. Twenty-two synthetic framing cases cover raw pass-through, NVT EOL, IAC escaping, unsupported-option replies, fragmentation, subnegotiation, prompt ambiguity and hard size bounds.

Phase-1.0Z passive-batch validation:

python3 tools/validate_retroarch_phase10z.py --root .
python3 tests/test_retroarch_phase10z.py --root .
python3 tests/test_phase10z_passive_batch_contract.py --root .

The validator binds V/W/X/Y and the Z model/test identities, exact inactive state, false authority, one LF batch and synthetic-deadline-only completion. Eighteen mutations reject activation, target retention, authority, retry, reconnect, CR/IAC, multiple batches, prompt/EOF completion and hardware-proof promotion. Twenty-five synthetic cases cover exact batch bytes, bounds, path injection, IAC rejection, raw LF and CRLF transcripts, complete help and stat/sum, partial rejection, abort and one-shot sealing. No network is used.

Phase-1.0AA offline fake-adapter integration:

python3 tools/validate_retroarch_phase10aa.py --root .
python3 tests/test_retroarch_phase10aa.py --root .
python3 tests/test_phase10aa_offline_fake_batch.py --root .

The validator hash-binds X, Z and the AA integration/tests, rejects network or real-clock imports, and enforces exact fake types and inert authorization. Twenty mutations prevent activation, target retention, live protocols, authority, retries, subclass promotion, EOF/early-deadline completion and hardware claims. Twenty-five integration cases cover receipt-before-open, single batch, complete help/stat/sum, synthetic deadline, close on all paths, exclusive evidence, sanitization and bounded fake-event failures.

Phase-1.0AB offline live-adapter feasibility:

python3 tools/validate_retroarch_phase10ab.py --root .
python3 tests/test_retroarch_phase10ab.py --root .
python3 tests/test_phase10ab_nonblocking_trace_model.py --root .

On the audited Windows host, additionally pass --python-root "C:\Program Files\Python313" to rehash the four recorded local runtime files. CI validates the immutable evidence record without assuming that its own Python installation is the audited host. Twenty mutations reject authorization, runtime/feasibility promotion, live imports and relaxed hard stops. Twenty-five trace cases cover immediate/pending connect, SO_ERROR, partial sends, interrupted/time-out waits, bounded receive, EOF, deadline races, sanitization, close and output ordering. No socket is opened.

Phase-1.0AC offline dormant-adapter validation:

python3 tools/validate_retroarch_phase10ac.py --root .
python3 tests/test_retroarch_phase10ac.py --root .
python3 tests/test_phase10ac_dormant_adapter.py --root .

The validator hash-binds the dormant adapter and its tests, rejects live imports, embedded addresses, activation and device authority, and requires the exact closed fake types. Twenty mutations protect the inactive record. Thirty- two synthetic cases cover create/nonblocking order, immediate and pending connect, SO_ERROR, partial progress, interruptions, timeout/deadline races, bounded reads, EOF, malformed output, one-close cleanup and result sanitization. No socket or real clock is used.

Phase-1.0AD inactive activation-contract validation:

python3 tools/validate_retroarch_phase10ad.py --root .
python3 tests/test_retroarch_phase10ad.py --root .
python3 tests/test_phase10ad_activation_contract.py --root .

The validator hash-binds the contract, tests and documentation. The tracked record is target-free and inactive. Synthetic candidate validation accepts only canonical private numeric IPv4, source-bound port 2323, a five-minute one-shot window and separate launcher, payload and approval hashes. It rejects DNS names, public/special addresses, retry, reconnect, resume, device writes, app termination and remount authority. No socket, clock, CLI or file output is present.

Phase-1.0AE minimal BigApp-launcher architecture validation:

python3 tools/validate_retroarch_phase10ae.py --root . \
  --shsrv-root work/upstream/shsrv \
  --shsrv-v07-root work/upstream/shsrv-v0.7
python3 tests/test_retroarch_phase10ae.py --root .

The external validator binds the official v0.19 and v0.7 commits, trees and hbldr/elfldr/ptrace source hashes. It proves only the offline lineage facts: v0.19 contains fake-app/remount behavior and v0.7 references the existing PPSA01659 title without those two mechanisms. Standard guardrails keep every authority false, reject killing an existing BigApp and preserve all firmware, VideoOut, cleanup and bounded-wait blockers.

Phase-1.0AF offline BigApp lifecycle-model validation:

python3 tools/validate_retroarch_phase10af.py --root .
python3 tests/test_retroarch_phase10af.py --root .
python3 tests/test_phase10af_bigapp_lifecycle_model.py --root .

The validator binds the AE decision, model and tests and rejects live imports, target claims and authority. Failure injection covers a pre-existing BigApp, every parent/child stage, unique-child timeout, replacement restoration, cleanup failure, tick exhaustion, wrong ordering and unused operations. These tests prove only the closed fake state machine.

Phase-1.0AG bounded ELF admission validation:

python3 tools/validate_retroarch_phase10ag.py --root .
python3 tests/test_retroarch_phase10ag.py --root .
python3 tests/test_phase10ag_bounded_elf.py --root .

The validator hash-binds AF, the bytes-only parser and its synthetic tests. Malformed identity, hash, type, machine, header tables, file/memory ranges, alignment, overlap, W+X, interpreter, entry and count cases fail closed. No path, mapping or execution interface exists, and the missing historical M bytes are never promoted from a size/hash reference into admitted evidence.

Phase-1.0AH dynamic/relocation contract validation:

python3 tools/validate_retroarch_phase10ah.py --root . \
  --shsrv-v07-root work/upstream/shsrv-v0.7 \
  --sdk-root work/upstream/sdk
python3 tests/test_retroarch_phase10ah.py --root .
python3 tests/test_phase10ah_dynamic_contract.py --root .

The external validator binds official shsrv v0.7 and SDK v0.41 source. Tests cover exact ordered dependencies, allowlisting, dynamic termination, RW/aligned targets, relative symbol/addend rules, GLOB_DAT rules, unknown types, missing relative closure and inherited ELF/hash rejection. No mapping or module load is performed.

Phase-1.0AI mapping transaction validation:

python3 tools/validate_retroarch_phase10ai.py --root .
python3 tests/test_retroarch_phase10ai.py --root .
python3 tests/test_phase10ai_mapping_model.py --root .

Failure injection covers reserve, mirror creation, every copy/BSS/relocation/ protection/sync/release stage, atomic deadline preemption, cleanup failures, W+X, page-rounded protection overlap, wrong bindings and unused operations. Success retains only the synthetic new region; failure requires mirror release and complete region unmap. No allocator or mapping API is called.

Phase-1.0AJ primitive source audit:

python3 tools/validate_retroarch_phase10aj.py --root . \
  --shsrv-v07-root work/upstream/shsrv-v0.7 \
  --hardened-elfldr-root ../chimera-elfldr
python3 tests/test_retroarch_phase10aj.py --root .

The validator hash-binds both source trees. Guardrails reject direct reuse of the unbounded v0.7 loader, require the temporary-resource and cleanup-ownership gaps to remain explicit, and keep all target and device authority false.

Phase-1.0AK hybrid composition model:

python3 tools/validate_retroarch_phase10ak.py --root .
python3 tests/test_retroarch_phase10ak.py --root .
python3 tests/test_phase10ak_hybrid_composition.py --root .

Failure injection covers every forward operation, reverse cleanup, cleanup failure containment through child termination, failed terminal termination, deadline preemption, invalid bounds/order and unused operations. The model has no process, mapping, clock, network or device capability.

Phase-1.0AL SDK mdbg copy audit:

python3 tools/validate_retroarch_phase10al.py --root . \
  --sdk-root work/upstream/sdk
python3 tests/test_retroarch_phase10al.py --root .

The external validator binds the exact SDK commit, implementation and public header. Guardrails preserve the observed restoration/progress gaps, reject direct reuse and keep every target and device authorization false.

Phase-1.0AM bounded copy/restore model:

python3 tools/validate_retroarch_phase10am.py --root .
python3 tests/test_retroarch_phase10am.py --root .
python3 tests/test_phase10am_bounded_copy_model.py --root .

Tests cover exact multi-chunk completion, partial/error/zero/oversized progress, both independent restore failures, capability-set failure, deadline and range overflow, incomplete completion and terminal cleanup failure. No credential, process, memory, clock, network or target interface exists in the model.

Phase-1.0AN service lifecycle and copy audit:

python3 tools/validate_retroarch_phase10an.py --root . \
  --hardened-elfldr-root ../chimera-elfldr
python3 tests/test_retroarch_phase10an.py --root .

The external validator binds the hardened fork and distinguishes fail-stop from restart/recovery. Guardrails keep blocking PT_IO copy, automatic restart, target implementation and every device authorization disabled.

Phase-1.0AO worker supervisor model:

python3 tools/validate_retroarch_phase10ao.py --root .
python3 tests/test_retroarch_phase10ao.py --root .
python3 tests/test_phase10ao_worker_supervisor_model.py --root .

Tests cover exact accepted results, deadline preemption, wrong identity, partial/restore failure, ambiguous start, pre-start failure, terminal cleanup failure, bounds and unused events. The model has no process, signal, clock, IPC, network or target interface and performs no retry or automatic restart.

Phase-1.0AP current-upstream worker feasibility audit:

python3 tools/validate_retroarch_phase10ap.py --root . \
  --sdk-root work/upstream/sdk \
  --shsrv-root work/upstream/shsrv-v0.7
python3 tests/test_retroarch_phase10ap.py --root .

The validator binds exact official commits and Git blobs without changing the pinned checkouts. Guardrails distinguish a worker-creation source candidate from runtime proof and keep preemption, result transport, target code, shsrv code reuse and device authority blocked.

Phase-1.0AQ fixed worker result record:

python3 tools/validate_retroarch_phase10aq.py --root .
python3 tests/test_retroarch_phase10aq.py --root .
python3 tests/test_phase10aq_worker_result_record.py --root .

Tests cover exact success/failure records, every single-byte mutation, truncation/extension/type errors, PID/nonce/generation/attempt mismatches, partial progress, restore bits, rehashed semantic corruption and numeric bounds. The parser has no random source, pipe, socket, process, clock or target ability.

Phase-1.0AR exclusive result channel model:

python3 tools/validate_retroarch_phase10ar.py --root .
python3 tests/test_retroarch_phase10ar.py --root .
python3 tests/test_phase10ar_result_channel_model.py --root .

Tests cover every two-part split, byte-at-a-time delivery, EOF, deadline, silence, overflow, damaged/wrong-identity records, writer precommit, crossing deadline, trailing events and invalid chunks. No live transport is opened.

Phase-1.0AS channel primitive and FD ownership audit:

python3 tools/validate_retroarch_phase10as.py --root . \
  --sdk-root work/upstream/sdk \
  --shsrv-root work/upstream/shsrv-v0.7
python3 tests/test_retroarch_phase10as.py --root .

The validator binds exact official Git objects. Guardrails preserve the RFCFDG close-all mismatch, absent exclusive close order, nonblocking callsite, absolute deadline, bounded reap, target code and device authorization.

Phase-1.0AT offline RFFDG FD/deadline model:

python3 tools/validate_retroarch_phase10at.py --root .
python3 tests/test_retroarch_phase10at.py --root .
python3 tests/test_phase10at_fd_deadline_model.py --root .

Failure injection covers every setup boundary, exact parent/child end ownership, partial records, EINTR, would-block, absolute deadline, EOF, overflow, damaged or trailing records and terminal cleanup. All operations are synthetic.

Phase-1.0AU live-channel feasibility reassessment:

python3 tools/validate_retroarch_phase10au.py --root . \
  --sdk-root work/upstream/sdk \
  --shsrv-root work/upstream/shsrv-v0.7
python3 tests/test_retroarch_phase10au.py --root .

The validator binds the exact official SDK headers and shsrv callsites. The guardrails keep API declarations separate from firmware behavior and reject the current RFCFDG, unbounded-wait and automatic-restart composition.

Phase-1.0AV target-free launch-context canary:

python3 tools/validate_retroarch_phase10av.py --root .
python3 tests/test_retroarch_phase10av.py --root .
python3 tests/test_phase10av_launch_context_canary.py --root .

Tests require identical payload identity, distinct launcher/run/approval bindings, submit-before-D04-before-terminal ordering, complete cleanup and zero retry/persistent-write counts. A return difference remains candidate-only.

Phase-1.0AW canary source-delta and effect audit:

python3 tools/validate_retroarch_phase10aw.py --root . \
  --retroarch-root ../chimera-retroarch \
  --shsrv-root work/upstream/shsrv-v0.7
python3 tests/test_retroarch_phase10aw.py --root .

The validator binds the historical M source and official shsrv v0.7 Git objects. Guardrails require a new magic, D14 cleanup predicate and byte-identical payload while retaining every BigApp effect and live-result blocker.

Phase-1.0AX host-only AV protocol model:

python3 tools/validate_retroarch_phase10ax.py --root .
python3 tests/test_retroarch_phase10ax.py --root .
python3 tests/test_phase10ax_canary_protocol_model.py --root .

Tests cover canonical 64-byte frames, every single-byte mutation, semantic stage types, duplicate/order errors, false cleanup claims, D12 terminal misuse and every individual D14 cleanup predicate.

Phase-1.0AY exact RetroArch source-base selection:

python3 tools/validate_retroarch_phase10ay.py --root . \
  --retroarch-root ../chimera-retroarch
python3 tests/test_retroarch_phase10ay.py --root .

The validator proves that the private N tip descends from M and retains every relevant target-source blob. Guardrails require an isolated worktree and forbid target profile, cross-build, artifact and runner activation.

Offline Phase-1 compile only:

bash tools/build-phase1-videoout.sh

The script verifies the SDK and SDL inputs, applies only the reviewed video-only overlay, disables SDL2main and unrelated subsystems, builds both fail-closed ELFs, and runs the strict static import audit. Do not execute either output.

Future installation and hardware-test template (not authorized)

Every approved hardware test must record:

• task approval reference and operator;
• console firmware identifier and allowlist entry;
• source commit and toolchain lock digest;
• exact operation permitted;
• timeout and recovery procedure;
• expected logs and success/failure criteria;
• cleanup evidence;
• result and any anomaly.

An empty or ambiguous field means the test does not run.