2.1 KiB
ADR-0011: Phase-0.7 hardened controlled runtime
- Status: accepted for offline deployment preparation
- Date: 2026-07-17
- Decision:
READY_FOR_HARDENED_RUNTIME_DEPLOYMENT
Context
Phase 0.6 identified exact upstream loader and Payload Manager versions but found unbounded ptrace completion, incomplete credential restoration, missing reaping/watchdog behavior, and a path-based unhashed launch route. Those findings were implementation inputs, not permanent platform blockers.
Jens explicitly confirmed exact firmware 9.60. Independent device attestation
is therefore not a Phase-0.7 blocker. The controlled upload below
/data/pldmgr/payloads/chimera-controlled is an allowed, removable
application write and is not a firmware write.
Decision
Use private GPL-3.0 hardening forks based on:
- elfldr
699e8bcff03e91e8d6ca6eba281af25c5a58d8c2; - Payload Manager
cfbc70f30f419b09bf2b52283f7409e2d3117ee1; - PS5 Payload SDK
d2e2e585740362976a39fdd5ccf390f199a7bc37.
The controlled route is a versioned loopback-only protocol with exact firmware, artifact ID, size, SHA-256, timeout, and no-retry metadata. elfldr rehashes received bytes, enforces the permanent denylist, applies bounded ptrace steps and cleanup, and reaps the child through a two-second watchdog. The controlled manager is compiled for one exact lifecycle artifact and opens, hashes, rewinds, and streams one no-follow file descriptor.
The lifecycle probe uses normal SDK v0.41 startup, performs one
sceKernelSendNotificationRequest, and calls _exit; it does not return
through payload_terminate.
Consequences
The three ELFs are eligible for a later, separately authorized hardened
runtime installation. This decision does not authorize installation,
transfer, or execution. The previously blocked SHA-256
4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63
remains permanently denied.
Normal SDK startup still reaches documented process-local patch and runtime initialization. The existing elfldr bootstrap still enables volatile QA flags. Both facts are explicit expected runtime effects; neither is silently claimed kernelwrite-free.