chimera-gfx-Public/docs/retroarch/phase-1.0g-one-shot-runner.md

Phase 1.0G offline one-shot runner

Phase 1.0G prepares only the host-side policy boundary for a possible later single run of the unchanged Phase-1.0F interval diagnostic. It did not connect to a PS5, transfer or execute an artifact, or receive device output. The tracked manifest and approval template are deliberately inactive.

Bound identity

• runner repository: chimera-retroarch
• runner commit: 55e873df12f4dd099c082d4a26b225644b8e0567
• target source commit: 0eaf68d6de4dc9757d85cc7ad5c714b1d151c8f8
• artifact: retroarch_ps5_interval_diag.elf
• size: 1845152
• SHA-256: e8bfc01c61bfb14b5814280a6e5442f1a5ad05ace5439d1c09e7e5ee00cd0055
• protocol: CHD10F01, version 1, fixed 64-byte frames

The target source and artifact are unchanged from Phase 1.0F. No ELF, map, device address or active approval is tracked here.

Fail-closed order

For any future separately authorized attempt, the runner must perform these steps in order:

1. reject an existing trace;
2. read and hash the active manifest, local approval and actual ELF;
3. require the exact artifact, firmware, F protocol, target and limits;
4. require all four positive permissions: connection, transfer, execution and result reception;
5. reject installation, autoload, device write, retry, reconnect, resume and automatic reboot;
6. derive a filesystem-safe unique run identifier;
7. exclusively create and fsync a consumed-attempt receipt before opening a socket;
8. only then allow one connect, one complete send, one write-half-close and one bounded receive;
9. exclusively create the local result trace without overwrite.

The durable pre-connect receipt intentionally consumes the attempt if the host crashes after authorization but before or during transport. Reusing the same run identifier is rejected. There is no automatic recovery, retry or reconnect.

Current state

protocol_activation_authorized=false, the run identifier and tracked target are null, artifact eligibility is false and every authorization is false. The runner cannot be activated by a command-line protocol switch. A later device action would need a new exact permission and an untracked, reviewed local approval record; this document grants none.

Fake-socket tests prove only host policy and parser behavior. They are not PS5, firmware, SDL, VideoOut, rendering, exit or cleanup evidence. Existing SDK CRT effects and the unproven D02-to-D03 runtime interval remain unchanged.