Phase 0.9E bootstrap provenance

Date: 2026-07-18

Status: BOOTSTRAP_IMPLEMENTATION_MISSING

This is an offline inventory. No internet operation, package installation, target build, device request, transfer, execution, or PS5 connection occurred. Y2JB was used only as a filename/search hint.

Search boundary

The search was limited to:

this chimera-gfx tree and its existing work/upstream trees;
the existing chimera-elfldr and chimera-ps5-payload-manager siblings;
exact-name checks in the user Downloads directory and supplied Codex attachments;
existing repository manifests, scripts, audit records, and ignored local Phase-0.6/0.7 evidence.

No other sibling project exists in the dated project directory. No BD-J SDK, WebKit exploit tree, Y2JB source tree, 9020-loader tree, or external-autoloader tree is present under the allowed source roots.

Candidate archive

~/Downloads/Y2JB-Autoloader-403-1240.zip exactly matches the candidate recorded by Phase 0.6:

size: 504159435;
SHA-256: 805e3f87f0c371223619ffc7d3a7b3c0d41a1fae8a8b1171d9e2f162659e8291;
ZIP integrity: valid central directory and CRC;
entries: four directories plus PS5/EXPORT/BACKUP/202606102126_00/archive.dat;
no ZIP comment and no source/version manifest.

The inner object has:

size: 504365056;
SHA-256: 6439834e8856d45b6d6fe699b74c35ca6985a199ea8ecf3e398c018d37be2d55;
leading bytes: SIECAF;
measured byte entropy: 7.999987 bits/byte;
zero literal matches for Y2JB, y2jb, 9020, elfldr, autoload, <html, .wasm, or ELF magic.

The container is not a standard nested archive and no acceptable local parser or source definition exists. It was not decrypted, unpacked through proprietary tooling, or treated as source. Its filename and equal hash prove only that this is the same local backup candidate as Phase 0.6. They do not prove that it is deployed, that its opaque content is Y2JB, or that it is the package currently used on the PS5.

Artifact inventory

Logical artifact	Size	SHA-256	Provenance	Use evidence
Y2JB-named outer ZIP	504159435	`805e3f87...659e8291`	`POSSIBLE`	historical local candidate only
inner `archive.dat`	504365056	`6439834e...37be2d55`	`UNKNOWN`	opaque `SIECAF` object
hardened `elfldr-ps5.elf`	397000	`63e81098...400b561`	`REFERENCE_ONLY` for this device chain	exact local Phase-0.7 build; manifest says not transferred/executed
hardened elfldr map	142905	`2ea5ff73...813124f`	`REFERENCE_ONLY`	local build evidence
embedded bootstrap map	143081	`ec4ae17a...5b3323`	`REFERENCE_ONLY`	source/build design only; intermediate ELF absent
embedded socket-service map	145072	`bf74db6e...5447c1`	`REFERENCE_ONLY`	source/build design only; intermediate ELF absent
hardened elfldr `Makefile`	1902	`3df93b48...783384`	`REFERENCE_ONLY`	exact commit-bound build source
hardened elfldr `README.md`	2821	`372aeb28...1eadb`	`REFERENCE_ONLY`	describes, but does not implement, port 9020
hardened elfldr `main.c`	2473	`876389a2...2b4d1`	`REFERENCE_ONLY`	exact post-9020 bootstrap source
hardened elfldr `bootstrap.c`	2081	`5a8072ec...45381`	`REFERENCE_ONLY`	exact embedded-stage source
hardened elfldr `socksrv.c`	11556	`d642ced3...ba3d7`	`REFERENCE_ONLY`	exact port-9021 source, not port 9020
public elfldr v0.23 asset	397000	`092d16ee...703e8`	`REFERENCE_ONLY`	historical public release identity
controlled Manager ELF	99560	`8fecf824...e5e5b1`	`REFERENCE_ONLY`	exact offline build, explicitly not installed

Full hashes and source/build fields are in manifests/runtime/phase-0.9e-bootstrap-provenance.json.

Confidence decision

No artifact is classified EXACT_USED or STRONG_MATCH.

The Y2JB-named ZIP is POSSIBLE: exact local identity, no deployed-use identity.
The opaque inner container is UNKNOWN.
elfldr/Manager binaries and source are REFERENCE_ONLY for the external pre-elfldr bootstrap question.
public URLs in the elfldr README are architectural references only. No public upstream was silently substituted for the used implementation.

Therefore:

actual_bootstrap_package_available=false;
actual_bootstrap_identity=null;
bootstrap_provenance=POSSIBLE;
exact used artifact set: empty.

Missing exact objects

The minimum missing evidence is:

the actual Y2JB/exploit host directory or exported package with readable HTML, JavaScript, WebAssembly, payload data, configuration, cache/service worker, manifest, and version identity;
the port-9020 listener source or exact binary plus a source/release or reproducible build match;
its build script and linker input;
the exact host sender/client and configuration used by the operator;
the external autoloader source/configuration, if one exists;
non-secret operator evidence binding those exact hashes to the current firmware-9.60 workflow.

4.9 KiB Raw Blame History