373 lines
14 KiB
JSON
373 lines
14 KiB
JSON
{
|
|
"schema_version": 1,
|
|
"phase": "0.9B",
|
|
"date": "2026-07-18",
|
|
"scope": "offline_bounded_observer_feasibility_audit_only",
|
|
"status": "BLOCKED",
|
|
"decision": [
|
|
"OBSERVER_STARTUP_OR_EXIT_ABI_UNPROVEN",
|
|
"NO_PROVEN_NON_PERSISTENT_OUTPUT_CHANNEL"
|
|
],
|
|
"baseline_commit": "833874f4196825765e2dfaa28327daea73919d01",
|
|
"branch": "codex/chimera-gfx-phase09b-observer",
|
|
"authorization": {
|
|
"authorized": false,
|
|
"transfer_authorized": false,
|
|
"execution_authorized": false,
|
|
"installation_authorized": false,
|
|
"lifecycle_authorized": false,
|
|
"autoload_authorized": false,
|
|
"backup_creation_authorized": false,
|
|
"automatic_retry": false
|
|
},
|
|
"canonical_state_preserved": {
|
|
"historical_phase08_status": "READ_ONLY_PREFLIGHT_BLOCKED",
|
|
"phase09a_status": "DESIGN_ONLY",
|
|
"firmware_runtime_behavior": "UNPROVEN",
|
|
"stock_hashes": "reference_only",
|
|
"payload_manager_backup": "HARD_BLOCKER",
|
|
"device_contact_performed": false,
|
|
"device_transfer_performed": false,
|
|
"device_execution_performed": false
|
|
},
|
|
"permanent_denylist_binding": {
|
|
"sha256": "4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63",
|
|
"status": "BLOCKED",
|
|
"permanent": true,
|
|
"execution_eligible": false
|
|
},
|
|
"source_commits": {
|
|
"hardened_elfldr": "197623058f509eddde18868dafcb92fdcac66464",
|
|
"controlled_payload_manager": "e23d94ff91233aa770e2342800c1467875bdef44",
|
|
"elfldr_public_base": "699e8bcff03e91e8d6ca6eba281af25c5a58d8c2",
|
|
"payload_manager_public_base": "cfbc70f30f419b09bf2b52283f7409e2d3117ee1",
|
|
"ps5_payload_sdk_v0_41": "d2e2e585740362976a39fdd5ccf390f199a7bc37",
|
|
"lifecycle_probe_source": "fe08300339a13f899fb78ea404ada381a5cba87c"
|
|
},
|
|
"source_tree_status": {
|
|
"hardened_elfldr": "clean",
|
|
"controlled_payload_manager": "clean",
|
|
"elfldr_public_base": "clean",
|
|
"payload_manager_public_base": "clean",
|
|
"ps5_payload_sdk_v0_41": "clean"
|
|
},
|
|
"source_evidence": [
|
|
{
|
|
"component": "hardened_elfldr_controlled_route",
|
|
"path": "../chimera-elfldr/socksrv.c",
|
|
"sha256": "d642ced3e9b4a296dd15e355050ebe956f53a6dfdaa6ac10109cd067a3bba3d7",
|
|
"lines": ["129-145", "289-365"],
|
|
"finding": "The controlled route passes stdio=-1 to elfldr_spawn and sends only a fixed loader-generated exit message."
|
|
},
|
|
{
|
|
"component": "hardened_elfldr_entry_and_stdio",
|
|
"path": "../chimera-elfldr/elfldr.c",
|
|
"sha256": "9949f8e4037984d10f1f5aa498e4665593d1fac8a33614d7f2141349839bb803",
|
|
"lines": ["273-415", "450-545", "643-759"],
|
|
"finding": "The loader places payload_args_t in RDI and a saved RIP on the stack; stdio duplication occurs only when stdio>0. The loader also performs process and kernel mutations before entry."
|
|
},
|
|
{
|
|
"component": "hardened_elfldr_log",
|
|
"path": "../chimera-elfldr/log.h",
|
|
"sha256": "cf1a85e7b047fbd4164b48241896fd955d384efc7e475a54fb24a62f53d2029e",
|
|
"lines": ["1-49"],
|
|
"finding": "Logging targets stdout and klog; neither is a proven controlled observer response channel."
|
|
},
|
|
{
|
|
"component": "controlled_payload_manager_transport",
|
|
"path": "../chimera-ps5-payload-manager/src/verified_launcher.c",
|
|
"sha256": "066100ca4917c7acc560e2e85666ca136cd7ccfd9094417377048f41106dd56e",
|
|
"lines": ["31-116", "119-185"],
|
|
"finding": "The verified transport opens and hashes read-only, sends a header and bytes, then closes without receiving a payload result."
|
|
},
|
|
{
|
|
"component": "controlled_payload_manager_loopback_adapter",
|
|
"path": "../chimera-ps5-payload-manager/src/ps5_launcher.c",
|
|
"sha256": "29c1a5fd01784a59e88b3698940f120cb03020071bc2b7d74a1da1a51524ef59",
|
|
"lines": ["18-70"],
|
|
"finding": "The adapter provides connect, send_all and close_socket only; no receive callback exists."
|
|
},
|
|
{
|
|
"component": "controlled_payload_manager_service",
|
|
"path": "../chimera-ps5-payload-manager/src/controlled_manager.c",
|
|
"sha256": "042b55b2cece32effed636529249fd18061a2fe3c5e70c7f755f2817cfb84b99",
|
|
"lines": ["208-235", "243-365"],
|
|
"finding": "The manager is a persistent listener and its upload/delete paths mutate files; it is not an admissible observer output collector."
|
|
},
|
|
{
|
|
"component": "sdk_crt_startup",
|
|
"path": "work/upstream/sdk/crt/crt.c",
|
|
"sha256": "3875f4739ec40b33f1f4967a1acbb585a527d2c281a360153e1f69c8b945932a",
|
|
"lines": ["48-80", "150-220"],
|
|
"finding": "Normal _start invokes runtime initialization and __patch_init before main; its terminate path depends on runtime symbol resolution or returning to a hijacked process."
|
|
},
|
|
{
|
|
"component": "sdk_crt_patch",
|
|
"path": "work/upstream/sdk/crt/patch.c",
|
|
"sha256": "4f76a677bba54f4641e1cf2755768c29afb7464a35b2f21e85db2aa2785eceac",
|
|
"lines": ["25-50", "58-101"],
|
|
"finding": "__patch_init writes syscall boundaries, credential capabilities and attributes."
|
|
},
|
|
{
|
|
"component": "sdk_crt_object_set",
|
|
"path": "work/upstream/sdk/crt/Makefile",
|
|
"sha256": "6a62f777f32ab05cbe7bff81c00cfd6639ba8bf440aba611a40ff0b62732568b",
|
|
"lines": ["19-26", "50-54"],
|
|
"finding": "crt1.o transitively contains crt, syscall, klog, kernel, rtld, mdbg and patch objects."
|
|
},
|
|
{
|
|
"component": "sdk_compiler_wrapper",
|
|
"path": "work/upstream/sdk/host/bin/prospero-clang",
|
|
"sha256": "0cf49ae43d6110a7606c0ee4d702fc4b5d5e1c3ae9a722945a48b80294e295ba",
|
|
"lines": ["25-47", "69-84"],
|
|
"finding": "The wrapper adds crt1.o unless -nostartfiles is present and removes default libraries for -nodefaultlibs."
|
|
},
|
|
{
|
|
"component": "sdk_linker_script",
|
|
"path": "work/upstream/sdk/host/elf_x86_64.x",
|
|
"sha256": "169b80d01da601ef96bbc584986608dec1d9c01397eae81eccd4e1a66b0a6c6a",
|
|
"finding": "The script defines image, init/fini and BSS boundaries but does not prove loader cleanup after a custom entry returns."
|
|
},
|
|
{
|
|
"component": "installed_sdk_crt1",
|
|
"path": "work/toolchains/ps5-payload-sdk-v0.41/target/lib/crt1.o",
|
|
"size": 112256,
|
|
"sha256": "0e4c1e5e38f22026580e856238a53e75d9e112f99a34bfe5495a3a0ffac15238",
|
|
"finding": "Installed startup object identity recorded; it was not linked into a Phase-0.9B artifact."
|
|
},
|
|
{
|
|
"component": "lifecycle_probe_source",
|
|
"path": "samples/lifecycle_probe/main.c",
|
|
"sha256": "1ae7df1fe921ccab2a252f77975d3d441ef7725e34535b024580c0d4a242d766",
|
|
"finding": "The prior lifecycle probe uses the normal SDK runtime, a notification API and _exit; it is unchanged and is not an observer ABI proof."
|
|
}
|
|
],
|
|
"capability_matrix": [
|
|
{
|
|
"needed_fact": "firmware_source_1",
|
|
"local_api": "kernel_get_fw_version reads sdk_ps5_ver from libSceLibcInternal process parameters",
|
|
"source": "work/upstream/sdk/crt/kernel.c:148-171",
|
|
"evidence": "SOURCE_PRESENT_RUNTIME_UNPROVEN",
|
|
"implement": false
|
|
},
|
|
{
|
|
"needed_fact": "firmware_source_2",
|
|
"local_api": null,
|
|
"source": null,
|
|
"evidence": "UNPROVEN",
|
|
"implement": false
|
|
},
|
|
{
|
|
"needed_fact": "file_metadata",
|
|
"local_api": "open(O_RDONLY|O_NOFOLLOW|O_CLOEXEC), fstat, lstat, close",
|
|
"source": "../chimera-ps5-payload-manager/src/verified_launcher.c:76-115,174-184",
|
|
"evidence": "SOURCE_AND_HOST_TEST_EVIDENCE_ONLY",
|
|
"implement": false
|
|
},
|
|
{
|
|
"needed_fact": "object_identity",
|
|
"local_api": "st_dev, st_ino and st_size pre/post comparison",
|
|
"source": "../chimera-ps5-payload-manager/src/verified_launcher.c:26-29,87-101,174-176",
|
|
"evidence": "SOURCE_AND_HOST_TEST_EVIDENCE_ONLY",
|
|
"implement": false
|
|
},
|
|
{
|
|
"needed_fact": "sha256",
|
|
"local_api": "bounded SHA-256 over an already-open descriptor",
|
|
"source": "../chimera-ps5-payload-manager/src/verified_launcher.c:31-55 and src/sha256.c",
|
|
"evidence": "SOURCE_AND_HOST_TEST_EVIDENCE_ONLY",
|
|
"implement": false
|
|
},
|
|
{
|
|
"needed_fact": "mount_information",
|
|
"local_api": "getmntinfo/getfsstat sample",
|
|
"source": "work/upstream/sdk/samples/mntinfo/main.c and libc/getmntinfo.c",
|
|
"evidence": "SDK_SAMPLE_PRESENT_FIRMWARE_9_60_RUNTIME_UNPROVEN",
|
|
"implement": false
|
|
},
|
|
{
|
|
"needed_fact": "processes_services",
|
|
"local_api": "sysctl KERN_PROC snapshot sample; no complete service mapping",
|
|
"source": "work/upstream/sdk/samples/ps/main.c",
|
|
"evidence": "PARTIAL_SOURCE_PRESENT_RUNTIME_AND_SERVICE_SEMANTICS_UNPROVEN",
|
|
"implement": false
|
|
},
|
|
{
|
|
"needed_fact": "listeners",
|
|
"local_api": null,
|
|
"source": null,
|
|
"evidence": "UNPROVEN",
|
|
"implement": false
|
|
},
|
|
{
|
|
"needed_fact": "autoload_configuration",
|
|
"local_api": "stock config readers exist but paths are not current-device evidence and HTTP status routes mutate global state",
|
|
"source": "../chimera-ps5-payload-manager/src/config.c, src/autoload.c, src/http_server.c",
|
|
"evidence": "UNSAFE_OR_UNPROVEN",
|
|
"implement": false
|
|
},
|
|
{
|
|
"needed_fact": "output_channel",
|
|
"local_api": null,
|
|
"source": "../chimera-elfldr/socksrv.c:129-145,361-365; ../chimera-ps5-payload-manager/src/ps5_launcher.c:18-70",
|
|
"evidence": "PROVEN_ABSENT_ON_CONTROLLED_ROUTE",
|
|
"implement": false
|
|
},
|
|
{
|
|
"needed_fact": "monotonic_time_deadline",
|
|
"local_api": "clock_gettime(CLOCK_MONOTONIC) used by hardened loader watchdog",
|
|
"source": "../chimera-elfldr/ps5_controlled.c:26-59",
|
|
"evidence": "SOURCE_AND_HOST_TEST_EVIDENCE_ONLY",
|
|
"implement": false
|
|
},
|
|
{
|
|
"needed_fact": "process_exit",
|
|
"local_api": "normal CRT payload_terminate/payload_exit or custom entry return",
|
|
"source": "work/upstream/sdk/crt/crt.c:150-220; ../chimera-elfldr/elfldr.c:380-415",
|
|
"evidence": "OBSERVER_STARTUP_OR_EXIT_ABI_UNPROVEN",
|
|
"implement": false
|
|
}
|
|
],
|
|
"build_gate": {
|
|
"startup_and_exit_abi_proven": false,
|
|
"non_persistent_output_channel_proven": false,
|
|
"normal_sdk_crt_kernelwrite_free": false,
|
|
"custom_freestanding_cleanup_proven": false,
|
|
"observer_source_created": false,
|
|
"observer_target_declared": false,
|
|
"target_build_performed": false,
|
|
"double_clean_build_performed": false,
|
|
"reason": "BLOCKED_BEFORE_SOURCE_AND_BUILD"
|
|
},
|
|
"implementation": {
|
|
"observer_only": true,
|
|
"observer_logic_implemented": false,
|
|
"observations_implemented": [],
|
|
"unsupported_or_unproven": [
|
|
"observer_self_identity_at_runtime",
|
|
"firmware_source_1_at_runtime",
|
|
"firmware_source_2",
|
|
"mount_and_filesystem_information",
|
|
"live_object_metadata",
|
|
"live_sha256",
|
|
"rollback_object_metadata_and_sha256",
|
|
"processes_and_services",
|
|
"listeners",
|
|
"autoload_state",
|
|
"bounded_runtime_output",
|
|
"safe_process_exit"
|
|
],
|
|
"host_contract_model_only": "tests/phase09b_observer_model.py"
|
|
},
|
|
"artifact": {
|
|
"present": false,
|
|
"path": null,
|
|
"sha256": null,
|
|
"size": null,
|
|
"imports": [],
|
|
"undefined_symbols": [],
|
|
"dynamic_dependencies": [],
|
|
"network_functions": [],
|
|
"filesystem_reads": [],
|
|
"installation_eligible": false,
|
|
"lifecycle_eligible": false,
|
|
"autoload_eligible": false,
|
|
"execution_authorized": false,
|
|
"execution_eligible": false
|
|
},
|
|
"static_artifact_audit": {
|
|
"status": "NOT_PERFORMED_BLOCKED_BEFORE_BUILD",
|
|
"elf_headers": "NOT_APPLICABLE_NO_ARTIFACT",
|
|
"program_headers": "NOT_APPLICABLE_NO_ARTIFACT",
|
|
"section_headers": "NOT_APPLICABLE_NO_ARTIFACT",
|
|
"dynamic_dependencies": "NOT_APPLICABLE_NO_ARTIFACT",
|
|
"imports_and_undefined_symbols": "NOT_APPLICABLE_NO_ARTIFACT",
|
|
"exports": "NOT_APPLICABLE_NO_ARTIFACT",
|
|
"relocations": "NOT_APPLICABLE_NO_ARTIFACT",
|
|
"linker_map": "NOT_CREATED",
|
|
"callgraph": "NOT_CREATED",
|
|
"disassembly": "NOT_CREATED",
|
|
"strings": "NOT_APPLICABLE_NO_ARTIFACT",
|
|
"denied_capabilities": "NOT_APPLICABLE_NO_ARTIFACT",
|
|
"filesystem_open_flags": "NOT_APPLICABLE_NO_ARTIFACT",
|
|
"network": "NOT_APPLICABLE_NO_ARTIFACT",
|
|
"threads_and_loops": "NOT_APPLICABLE_NO_ARTIFACT",
|
|
"kernelwrites": "NOT_APPLICABLE_NO_ARTIFACT"
|
|
},
|
|
"reproducibility": {
|
|
"status": "NOT_PERFORMED_BLOCKED_BEFORE_BUILD",
|
|
"build_1_sha256": null,
|
|
"build_2_sha256": null,
|
|
"byte_identical": null,
|
|
"toolchain": {
|
|
"sdk_release": "v0.41",
|
|
"sdk_commit": "d2e2e585740362976a39fdd5ccf390f199a7bc37",
|
|
"installed_crt1_sha256": "0e4c1e5e38f22026580e856238a53e75d9e112f99a34bfe5495a3a0ffac15238",
|
|
"current_windows_wrapper_executable_available": false
|
|
}
|
|
},
|
|
"default_observation_plan": {
|
|
"schema_version": 1,
|
|
"plan_id": null,
|
|
"authorized": false,
|
|
"transfer_authorized": false,
|
|
"execution_authorized": false,
|
|
"installation_authorized": false,
|
|
"lifecycle_authorized": false,
|
|
"autoload_authorized": false,
|
|
"backup_creation_authorized": false,
|
|
"automatic_retry": false,
|
|
"device_address": null,
|
|
"device_identity": null,
|
|
"observer": {
|
|
"sha256": null,
|
|
"size": null,
|
|
"source_commit": null,
|
|
"toolchain_identity": null
|
|
},
|
|
"firmware_gate": null,
|
|
"allowed_observations": [],
|
|
"read_paths": [],
|
|
"output_channel": null,
|
|
"maximum_runtime_ms": null,
|
|
"maximum_execution_count": 0,
|
|
"expires_at": null,
|
|
"stop_criteria": []
|
|
},
|
|
"remaining_anti_brick_blockers": [
|
|
"two_current_firmware_sources_absent",
|
|
"current_live_paths_absent",
|
|
"current_live_object_identities_absent",
|
|
"current_live_sizes_and_sha256_absent",
|
|
"mount_and_filesystem_properties_absent",
|
|
"processes_and_services_absent",
|
|
"listeners_absent",
|
|
"autoload_state_absent",
|
|
"rollback_backups_absent",
|
|
"payload_manager_backup_hard_blocker",
|
|
"recovery_independence_unproven",
|
|
"power_loss_safe_switch_unproven",
|
|
"component_order_unproven",
|
|
"observer_startup_or_exit_abi_unproven",
|
|
"no_proven_non_persistent_output_channel"
|
|
],
|
|
"prohibited_actions": [
|
|
"connect_to_ps5",
|
|
"scan_ps5_ports",
|
|
"use_usb",
|
|
"transfer_observer",
|
|
"execute_observer_or_elf",
|
|
"install_or_replace_component",
|
|
"create_backup",
|
|
"change_configuration",
|
|
"activate_autoload_or_retry",
|
|
"reboot",
|
|
"start_stop_restart_or_signal_process_or_service",
|
|
"modify_hardened_elfldr_runtime",
|
|
"modify_controlled_payload_manager_runtime",
|
|
"modify_lifecycle_probe",
|
|
"build_observer_until_both_hard_gates_are_proven",
|
|
"start_graphics_sdl_retroarch_or_gnm_work"
|
|
]
|
|
}
|