148 lines
6.4 KiB
Markdown
148 lines
6.4 KiB
Markdown
# Phase 0.9C static audit
|
|
|
|
Date: 2026-07-18. Final classification:
|
|
**BLOCKED_MULTIPLE_FOUNDATIONAL_CONTRACTS**.
|
|
|
|
This audit stops before target implementation. No observer source, assembly,
|
|
object, ELF, map, target build, lifecycle package, installation package,
|
|
autoload package, transfer template, device address, device path, or
|
|
authorization exists.
|
|
|
|
## Exact source basis
|
|
|
|
| Source | Commit | Tree |
|
|
|---|---|---|
|
|
| hardened elfldr | `197623058f509eddde18868dafcb92fdcac66464` | clean |
|
|
| controlled Payload Manager | `e23d94ff91233aa770e2342800c1467875bdef44` | clean |
|
|
| public elfldr v0.23 | `699e8bcff03e91e8d6ca6eba281af25c5a58d8c2` | clean |
|
|
| public Payload Manager v0.3.1 | `cfbc70f30f419b09bf2b52283f7409e2d3117ee1` | clean |
|
|
| PS5 Payload SDK v0.41 | `d2e2e585740362976a39fdd5ccf390f199a7bc37` | clean |
|
|
| lifecycle source identity | `fe08300339a13f899fb78ea404ada381a5cba87c` | unchanged file hash |
|
|
|
|
Every reviewed file hash is recorded in
|
|
`manifests/runtime/phase-0.9c-feasibility.json`. The validator rehashes the
|
|
files and verifies all five external Git trees without network access.
|
|
|
|
## Immutable evidence
|
|
|
|
| Evidence | SHA-256 |
|
|
|---|---|
|
|
| Phase-0.8 document | `3fbe086175a6048176075f447ec1482074928e3b5282db97ea2169395fe1d508` |
|
|
| Phase-0.8 manifest | `47d7f452f8799979fe99b3e6d56859f03544112725bf7e5b349eba5ed81b3322` |
|
|
| Phase-0.8 original test | `8a4ad7c70de28ffe3148fd3fd1f68c36a872c53c691c9068e1ff163970863c48` |
|
|
| Phase-0.9A manifest | `39fd7c70cae998d9d74e7caf1ff3c19f9f76f7de2e5a50bc09baede4ba53e9e9` |
|
|
| Phase-0.9B manifest | `104c4a667ad17f9827fc7276852c6faeef96effb8e3561a5ebc19a62c7d51634` |
|
|
| Phase-0.9B schema | `efcea3b0001ef5b2da65c372ceb93ee2fec09c9331b2e4cbb6008212504c0918` |
|
|
|
|
Phase 0.9B remains a truthful historical blocked audit. It was not rewritten
|
|
as if Phase 0.9C evidence existed earlier.
|
|
|
|
## Startup and transitive code result
|
|
|
|
### Normal SDK path
|
|
|
|
`crt1.o` transitively includes `crt`, `syscall`, `klog`, `nid`, `kernel`,
|
|
`rtld`, `rtld_so`, `rtld_sprx`, `rtld_payload`, `rtld_dlfcn`, `mdbg`, and
|
|
`patch`. `_start` reaches `__patch_init` before `main`; credential
|
|
capabilities/attributes and syscall bounds are written. It also initializes
|
|
rtld, permits DT_NEEDED processing, relocations, constructors, heap
|
|
bookkeeping and module loading.
|
|
|
|
Result: `PROVEN_SIDE_EFFECTING`, unsuitable for the kernelwrite-free contract.
|
|
|
|
### Freestanding theoretical path
|
|
|
|
The compiler can suppress CRT/default libraries, and the loader can transfer
|
|
`e_entry` and `RDI`. The reviewed source does not close:
|
|
|
|
- stack alignment and saved-RIP continuation;
|
|
- BSS zero-fill, complete relocations, TLS, or register preservation;
|
|
- a callable read/syscall ABI without prohibited patch/runtime setup;
|
|
- monotonic time in the observer;
|
|
- normal return or process exit;
|
|
- error/deadline exit without crash/kill;
|
|
- mapping, descriptor, buffer, loader and manager cleanup; or
|
|
- result copy-out.
|
|
|
|
Result: `BLOCKED_STARTUP_ABI_UNPROVEN` and
|
|
`BLOCKED_EXIT_CLEANUP_UNPROVEN`.
|
|
|
|
## Output result
|
|
|
|
| Architecture | Audit result |
|
|
|---|---|
|
|
| D1 caller-owned buffer | coherent 4096-byte host contract; no current loader buffer, return finalizer, copy-out, or manager delivery |
|
|
| D2 existing request/response | rejected; manager is connect/send/close only |
|
|
| D3 loader-owned status | unproven; wait status is discarded and no record propagates |
|
|
| D4 process status | rejected; ambiguous, discarded, and too small |
|
|
|
|
The D1 host model validates magic/version, nonce, request ID, two firmware
|
|
fields, observer version, fixed/actual sizes, status, requested/observed/
|
|
unsupported bitmaps, truncation, artifact hash, body/final checksums, deadline,
|
|
completion, cleanup, zero padding and one-time consumption. No target code
|
|
implements it.
|
|
|
|
Result: `BLOCKED_NO_BOUNDED_OUTPUT_CHANNEL`.
|
|
|
|
## Firmware and side-effect result
|
|
|
|
SDK `kernel_get_fw_version()` is source 1 but reads a process-parameter SDK
|
|
field and is runtime-unobserved. A system-version export name in the SDK stub
|
|
has no accepted prototype or semantics and is not source 2. Result:
|
|
`BLOCKED_FIRMWARE_SOURCE_INCOMPLETE`.
|
|
|
|
No planned observation is proven free of metadata, atime, audit, cache,
|
|
counter, service/security, open-bookkeeping, process-accounting,
|
|
object-lifetime, or race effects. Result:
|
|
`BLOCKED_OBSERVATION_SIDE_EFFECTS_UNBOUNDED`.
|
|
|
|
## Target artifact audit disposition
|
|
|
|
| Audit item | Result |
|
|
|---|---|
|
|
| target source/assembly | `NOT_CREATED` |
|
|
| target compile/link | `NOT_PERFORMED` |
|
|
| ELF headers/program headers/sections | `NOT_APPLICABLE_NO_ARTIFACT` |
|
|
| imports/undefined symbols/DT_NEEDED | `NOT_APPLICABLE_NO_ARTIFACT` |
|
|
| relocations/init/fini/TLS | `NOT_APPLICABLE_NO_ARTIFACT` |
|
|
| linker map | `NOT_CREATED` |
|
|
| target reachable callgraph | `NOT_CREATED` |
|
|
| target disassembly | `NOT_CREATED` |
|
|
| double target build/hash | `NOT_PERFORMED` |
|
|
| lifecycle/install/autoload package | `NOT_CREATED` |
|
|
| execution eligibility | `false` |
|
|
| execution authority | `false` |
|
|
|
|
These are nonexistence results, not evidence that hypothetical bytes would be
|
|
safe.
|
|
|
|
## Offline verification
|
|
|
|
The final verification run is recorded as:
|
|
|
|
| Check | Result |
|
|
|---|---|
|
|
| Phase-0.9A host tests | `PASS` — 41 guardrails, 33 fault types for each of 2 components, and 14 power-loss boundaries |
|
|
| Phase-0.9A hardened-elfldr virtual fault suite | `PASS` — 33 fault results and 14 power-loss results; host simulation only, no hardware evidence, connection, or execution |
|
|
| Phase-0.9A controlled-manager virtual fault suite | `PASS` — 33 fault results and 14 power-loss results; host simulation only, no hardware evidence, connection, or execution |
|
|
| Phase-0.9B validator and host tests | `PASS` — blocked-audit validator and artifact guardrails |
|
|
| Phase-0.9C protocol cases | `PASS` — 21/21 |
|
|
| Phase-0.9C feasibility cases | `PASS` — 12/12 |
|
|
| full host configure/build/CTest | `PASS` — 22/22 |
|
|
| manifests/schema/safety/denylist/secrets/immutable/checksums | `PASS` — all dedicated validators and regression guards |
|
|
| `git diff --check` | `PASS` — no output |
|
|
|
|
The committed version of this document must contain no pending result.
|
|
|
|
## Decision
|
|
|
|
The only permitted positive classification required every foundational
|
|
contract to be proven. Five independent blocker families remain. The exact
|
|
decision is:
|
|
|
|
`BLOCKED_MULTIPLE_FOUNDATIONAL_CONTRACTS`
|
|
|
|
No automatic Phase 0.9D transition is permitted. Reconsideration requires new
|
|
public, commit-bound evidence; it does not authorize an experimental target
|
|
run to discover the missing contracts.
|