Phase 0.9B observer static audit

Status: NOT PERFORMED — BLOCKED BEFORE SOURCE AND BUILD.

This is a truthful negative audit record. No observer artifact exists, so no ELF property can be reported as passing. Absence of imports or strings is not used as a substitute for a reachable-code proof.

Build decision

The source audit stopped the target build because:

normal SDK startup reaches __patch_init() and performs prohibited writes;
a freestanding observer return/exit and cleanup contract remains unproven;
the hash-bound controlled route suppresses payload stdout/stderr; and
the controlled manager sends the ELF and closes without receiving observer output.

No observer source path or CMake target was added. The existing CHIMERA_GFX_BUILD_PS5_MINIMAL_STARTUP configure-time blocker remains intact.

Required artifact audit status

Audit	Status	Reason
SHA-256 and size	`NOT_APPLICABLE_NO_ARTIFACT`	no binary
source commit binding	`NOT_APPLICABLE_NO_ARTIFACT`	no target source
toolchain identity	`PARTIAL_OFFLINE_REFERENCE_ONLY`	SDK v0.41 pinned; no observer link
double clean build	`NOT_PERFORMED_BLOCKED_BEFORE_BUILD`	hard gates failed
ELF header	`NOT_APPLICABLE_NO_ARTIFACT`	no ELF
program headers	`NOT_APPLICABLE_NO_ARTIFACT`	no ELF
section headers	`NOT_APPLICABLE_NO_ARTIFACT`	no ELF
dynamic dependencies	`NOT_APPLICABLE_NO_ARTIFACT`	no ELF
imported/undefined symbols	`NOT_APPLICABLE_NO_ARTIFACT`	no ELF
exported symbols	`NOT_APPLICABLE_NO_ARTIFACT`	no ELF
relocations	`NOT_APPLICABLE_NO_ARTIFACT`	no ELF
linker map	`NOT_CREATED`	no link
reachable callgraph	`NOT_CREATED`	no code
disassembly	`NOT_CREATED`	no code
strings	`NOT_APPLICABLE_NO_ARTIFACT`	no ELF
denied capabilities	`NOT_APPLICABLE_NO_ARTIFACT`	no ELF
filesystem open flags	`NOT_APPLICABLE_NO_ARTIFACT`	no ELF
network functions	`NOT_APPLICABLE_NO_ARTIFACT`	no ELF
threads/loops	`NOT_APPLICABLE_NO_ARTIFACT`	no ELF
kernelwrites	`NOT_APPLICABLE_NO_ARTIFACT`	no ELF

The validator fails if a Phase-0.9B ELF, map, observer target, observer source directory, installation package or lifecycle package appears while the manifest remains blocked.

Transitive startup audit

Normal SDK link

The SDK compiler wrapper at commit d2e2e585740362976a39fdd5ccf390f199a7bc37 selects target/lib/crt1.o unless -nostartfiles is present. The CRT Makefile links:

crt.o, syscall.o, klog.o, nid.o, kernel.o, rtld.o, rtld_so.o, rtld_sprx.o, rtld_payload.o, rtld_dlfcn.o, mdbg.o, and patch.o.

The installed crt1.o is 112256 bytes with SHA-256 0e4c1e5e38f22026580e856238a53e75d9e112f99a34bfe5495a3a0ffac15238. It was inspected as source-bound evidence and was not linked into a new artifact.

Reachable sequence from normal _start:

_start
  -> clear BSS
  -> payload_init
     -> __crt_syscall_init
     -> __kernel_init
     -> __klog_init
     -> write __isthreaded
     -> __patch_init
        -> patch_kernel_ucred
           -> kernel_set_ucred_caps
           -> kernel_set_ucred_attrs
        -> patch_syscall_permissions
           -> kernel_copyin syscall low bound
           -> kernel_copyin syscall high bound
     -> __rtld_init
  -> payload_run
     -> constructors
     -> main
     -> destructors
  -> payload_terminate

Result: UNSAFE for the Phase-0.9B kernelwrite-free contract.

Custom entry

-nostartfiles -nodefaultlibs can remove crt1.o and default libraries. However, compile/link capability alone does not establish safe behavior. elfldr elfldr_prepare_exec() shows RDI=args, RIP=entry, and the old RIP stored on the adjusted stack. No source establishes the complete observer post-return cleanup, process-exit, crash, or resource-lifetime contract for a new bare entry. Result: UNPROVEN.

Output audit

Controlled elfldr call path:

controlled manager
  -> connect_loopback
  -> send_all(control header)
  -> send_all(ELF bytes)
  -> close_socket

elfldr controlled route
  -> payload_read_controlled
  -> payload_spawn
  -> elfldr_spawn(stdio = -1)
  -> no stdio duplication
  -> watchdog/reap
  -> fixed "Controlled payload exited" loader response

There is no manager receive callback and no payload-provided response body. Result: NO PROVEN NON-PERSISTENT OUTPUT CHANNEL.

Existing loader effects versus observer effects

The hardened loader performs ptrace, credential, mapping, socket-overlap, breakpoint, protection and cleanup operations before and around entry. Those are existing loader effects, not code introduced by an observer artifact. They are still relevant to the risk of a later execution and do not make the observer’s own startup kernelwrite-free.

Because no observer was built:

observer imports: none to report;
observer filesystem reads: none implemented;
observer network functions: none implemented;
observer threads or loops: none implemented;
observer prohibited capabilities: none implemented; and
absence of an artifact is not hardware-safety proof.

Reproducibility

Build 1 hash: null.

Build 2 hash: null.

Final artifact hash/size: null / null.

Result: NOT_PERFORMED_BLOCKED_BEFORE_BUILD, not REPRODUCIBILITY_PASSED.

5.2 KiB Raw Blame History Unescape Escape