3.2 KiB
Phase-0.7 offline build evidence — 2026-07-17
- Public SDK: v0.41,
d2e2e585740362976a39fdd5ccf390f199a7bc37 - Firmware build gate: exact
9.60 - Host validation: MSVC 19.50
/W4 /WX; Clang 18 warnings-as-errors/clang-tidy/format; GCC 15 ASan/UBSan - Fuzz fallback: 100,000 deterministic ASan/UBSan inputs for both controlled header and verified metadata
- Cross-build: all three targets with warnings-as-errors
- Reproducibility: two clean byte-identical builds per ELF
- Console actions: none
The complete machine evidence is
manifests/runtime/phase-0.7-offline-audit.json. Full ignored reports and
artifacts are packaged below outputs/phase07/.
Exact outputs
| Artifact | SHA-256 | Size | Undefined imports | DT_NEEDED |
|---|---|---|---|---|
| hardened elfldr | 63e810982471eb40cae3a20aa9df9a0a02892f420e429874fae4e99aa400b561 |
397000 | none | libSceLibcInternal.sprx, libSceNet.sprx, libkernel_web.sprx |
| controlled Payload Manager | 8fecf8241a46246eddbd21e8bb4d875f5d76f1f4f4c6a11384df1f131aa5e5b1 |
99560 | none | libSceLibcInternal.sprx, libSceNet.sprx, libkernel_web.sprx |
| lifecycle probe | bfb4a5cc768e162fe4c2fddf41c3978e152722918a39085277fd172cb95a7182 |
112680 | _exit, sceKernelSendNotificationRequest |
libSceLibcInternal.sprx, libkernel_web.sprx |
The lifecycle project's called functions are exactly one
sceKernelSendNotificationRequest followed by _exit. The normal SDK startup
is statically included and reaches __patch_init before main; that fact is
proven from source, linker map, disassembly, and the 499-edge lifecycle
callgraph rather than inferred from imports. The hardened loader audit records
1032 call edges and the controlled manager records 478.
The lifecycle linker map also contains stock-SDK __dlopen, __dlsym,
sceKernelLoadStartModule, and sceKernelStopUnloadModule symbols. Direct
static reachability proves the rtld initialization path but cannot resolve all
116 indirect lifecycle edges. The audit therefore records linked symbols,
direct _start reachability where symbolization permits it, and every
unresolved indirect edge separately. No graphics/display-sensitive symbol is
linked in any of the three audited ELFs.
Final offline tests
- Chimera GFX Windows host build: MSVC
/W4 /WX, 16/16 CTest passed. - Hardened elfldr: MSVC 1/1; Clang 18 plus clang-tidy 1/1; GCC 15 ASan/UBSan 1/1; 100,000-input sanitizer fuzz pass.
- Controlled Payload Manager: MSVC 1/1; Clang 18 plus clang-tidy 2/2; GCC 15 ASan/UBSan 2/2; 100,000-input sanitizer fuzz pass.
- All three PS5 cross-builds passed warnings-as-errors and reproduced the exact hashes and sizes above.
- Negative lifecycle firmware
9.50configure failed before creating a build graph. - Controlled-manager build without exact hash/size/artifact ID failed.
- Static execution-policy refusal suite, manifest schemas, Phase-0.5/0.6 historical gates, Phase-0.7 proof matrix, safety audit, and secret scans passed.
The local Clang installation does not contain the optional
libclang_rt.asan/libFuzzer runtime archives. Clang warnings and clang-tidy
therefore run without sanitizers; GCC supplies the ASan/UBSan and deterministic
fuzz coverage. This is a host-tool packaging limitation, not a target
compiler, linker, or ABI blocker.