1.8 KiB
ADR-0009: Block unproven minimal startup and permanently deny legacy ELF
Status: accepted Date: 2026-07-17
Context
SDK v0.41's stock crt1.o performs prohibited kernel credential and
syscall-bound writes before project main. Phase 0.5 tested whether omitting
the CRT could support a deterministic freestanding entry. Compiler and linker
evidence proves omission is mechanically possible, but no exact pinned loader
caller is locally available to prove stack, argument ownership, safe return,
post-return cleanup, crash handling, or pre-entry process changes.
The already-built firmware-9.60 capability probe has SHA-256
4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63
and must remain permanently blocked.
Decision
Do not create a minimal-startup source or PS5 ELF while the caller contract is
unproven. Keep CHIMERA_GFX_BUILD_PS5_MINIMAL_STARTUP as an unconditional
configure-time failure with the evidence blocker stated in its message.
Require every artifact manifest to state execution_eligible explicitly. New
manifests default to false. Maintain a permanent SHA-256 denylist and a
fail-closed policy tool that refuses false eligibility, malformed records,
changed bytes, or a denylist match. Passing this static layer does not grant
execution authority.
Consequences
- no Phase-0.5 PS5 ELF, linker map, artifact disassembly, or artifact hash exists;
- stock CRT evidence remains available for review without making a safe-runtime claim;
- the legacy firmware-9.60 ELF cannot become eligible through a later manifest edit or approval record;
- a Payload Manager can consume the JSON policy tool, but the manager's own implementation remains outside this repository and cannot be claimed reviewed here;
- work may continue through mock/software backends or a separately scoped Linux-on-PS5 backend.