chimera-gfx-Public/docs/retroarch/phase-1.0dy-upstream-websrv-audit.md

Phase 1.0DY upstream websrv audit

Status: UPSTREAM_WEBSRV_EXECUTION_BLOCKED_BROAD_MUTATING_SURFACE

The current official release is v0.33, source commit baabe27e5449baeb059b850d0393c31fdee219b7. Its source does create the documented port-8080 listener, but it also exposes generic filesystem and POST routes and links package installation, fake-app creation, ptrace, kernel/credential mutation, RWX changes and launch machinery without the bounded Chimera lifecycle contract.

Starting this upstream artifact would materially exceed a request to restore the launcher page and violates the persistent-write and unknown-effect hard stops. It is therefore not built, downloaded as an executable, transferred or authorized. A future offline phase must remove generic endpoints, bind one exact RetroArch artifact, prohibit persistent setup and bound every wait and cleanup path before a new hardware request can be considered.