226 lines
14 KiB
Markdown
226 lines
14 KiB
Markdown
# Roadmap and gates
|
|
|
|
Progress is gate-based. A later phase may be designed and compiled offline,
|
|
but no hardware behavior may be transferred or executed before its gate.
|
|
|
|
## Phase 0 — research and non-rendering implementation (offline complete)
|
|
|
|
- [x] Standalone repository boundary
|
|
- [x] Primary-source research snapshot and upstream pins
|
|
- [x] Threat model, ABI evidence table, and unknowns register
|
|
- [x] Versioned context, capability, resource, present-model, and cleanup API
|
|
- [x] Deterministic non-rendering mock and fail-closed PS5 backend
|
|
- [x] Compilable RetroArch and SDL2 adapter interfaces
|
|
- [x] Host unit/integration tests and static safety audit
|
|
- [x] Checksummed SDK bootstrap and pinned container recipe
|
|
- [x] Read-only capability manifest and compile-only probe
|
|
- [x] SPDX SBOM and artifact-manifest schema/tooling
|
|
- [x] Independent final review record (`docs/reviews/phase0-final-2026-07-17.md`)
|
|
- [x] Exact 9.60 discovery-only offline build authorization and runtime audit
|
|
- [x] Identify SDK v0.41 pre-main kernelwrite execution blocker
|
|
- [x] Phase-0.5 stock CRT, compiler, linker, loader-contract, and transitive
|
|
object audit
|
|
- [x] Permanent artifact denylist and fail-closed Payload Manager policy gate
|
|
- [x] Block minimal startup construction because safe loader return is unproven
|
|
- [x] Phase-0.6 exact installed Payload Manager/elfldr identity and source audit
|
|
- [x] Controlled runtime profile and fail-closed exact-firmware/hash/budget gate
|
|
- [x] Stop lifecycle-probe construction on persistent and unbounded effects
|
|
- [x] Phase-0.7 hardened elfldr with bounded ptrace, complete restoration,
|
|
cleanup, watchdog, and receiver-side hash/denylist enforcement
|
|
- [x] Phase-0.7 controlled Payload Manager with same-FD hash-to-stream,
|
|
loopback-only versioned transport, and atomic non-autoload upload
|
|
- [x] Phase-0.7 exact 9.60 lifecycle probe, double clean cross-build, linker
|
|
map, disassembly, complete callgraphs, and machine proof matrix
|
|
- [x] Hash-bound installation-review and rollback preparation without console
|
|
contact
|
|
- [x] Phase-0.9D existing-stack endpoint, flag, path, readback, and recovery
|
|
audit; no PS5-to-host file route found
|
|
- [x] Phase-0.9E bounded bootstrap provenance search and opaque candidate audit
|
|
- [x] Phase-0.9E-R official release/tag/source/sender audit; local backup
|
|
classified `LOCAL_BACKUP_NOT_CORRELATED`
|
|
- [x] Phase-0.9E-R2 inner, SIECAF, community, browser, and exact MediaFire
|
|
correlation; local backup classified `LOCAL_BACKUP_UNCORRELATED`
|
|
- [ ] Exact-used Y2JB/other host package and port-9020 listener provenance
|
|
- [ ] Independent host-to-memory, output, restart, and live-file contracts
|
|
- [ ] Phase-0.9F offline rescue-payload design gate opened
|
|
- [x] Two exact, separately approved Phase-1.0D one-shot executions recorded;
|
|
C1 proven and RUN-B D-stage unclassified
|
|
- [x] Phase-1.0E inherited-stdout result channel built, host-tested and audited
|
|
and exercised once with exact authorization; D00-D02 proven, incomplete
|
|
before D03, authorization consumed
|
|
- [x] Phase-1.0F I00-I14 startup-interval artifact built reproducibly and
|
|
audited offline; no transfer, execution or result reception authorized
|
|
- [x] Phase-1.0G manifest-only one-shot host runner prepared and fake-socket
|
|
tested; durable pre-connect attempt receipt, no device authorization
|
|
- [x] One exact Phase-1.0G run consumed; D00-D02/I00-I03 and deterministic
|
|
no-argument/no-menu exit proven, no retry or device write
|
|
- [x] Phase-1.0H minimal `-v` startup-argument correction built twice and
|
|
audited offline; exact artifact remains device-ineligible
|
|
- [x] One exact Phase-1.0H run consumed; I04/SDL/VideoOut/buffer registration
|
|
proven, first flip submit `-1`, no retry
|
|
- [x] Phase-1.0I offline source/map/disassembly postmortem; exact submit tuple
|
|
proven, write operation and submit errno remain unobserved
|
|
|
|
Exit evidence: host tests pass, safe PS5 targets compile, generated files are
|
|
current, no deploy target exists, Git is clean, private origin is synchronized,
|
|
and no secrets or unreviewed binary artifacts are tracked.
|
|
|
|
## Phase 1 — controlled presentation experiments
|
|
|
|
Gate: explicit artifact-specific hardware authorization plus all controls in
|
|
`SAFETY.md` and `docs/phase1/`.
|
|
|
|
Offline preparation:
|
|
|
|
- [x] Minimal SDL2 CPU-framebuffer/VideoOut clear design
|
|
- [x] Pinned SDL build with reviewed video-only overlay
|
|
- [x] Fail-closed compile target and artifact-manifest workflow
|
|
- [x] Firmware/ABI checklist and cleanup/rollback plan
|
|
- [ ] Proven bounded flip wait or safe process supervisor
|
|
- [x] Exact firmware supplied for an offline discovery build (`9.60`)
|
|
- [x] Bounded hardened lifecycle prepared offline with only the explicit
|
|
removable controlled-artifact write budget (Phase 0.7)
|
|
- [ ] Hardened runtime separately approved, installed, and hash-verified
|
|
- [ ] Successful separately approved discovery probe
|
|
- [ ] Artifact-specific VideoOut execution approval
|
|
|
|
After those gates, perform one CPU-filled frame through the existing SDL
|
|
VideoOut route. Only then may a separate GNM resource/synchronization proof be
|
|
designed, with every ABI reviewed independently. Embedded shaders remain an
|
|
evidence and licensing question, not an implementation assumption.
|
|
|
|
## Phase 2 — native 2D blitter
|
|
|
|
Texture upload, fullscreen primitive, nearest/bilinear sampling, aspect and
|
|
integer scaling, overlays, buffering, and fences. Each feature requires a mock
|
|
contract and bounded-failure test first.
|
|
|
|
## Phase 3 — RetroArch adapter
|
|
|
|
- [x] Phase-1.0A real PS5 headless frontend with static deterministic smoke core
|
|
- [x] Phase-1.0A SDL2/RGUI software profile linked offline
|
|
- [x] Host ASan/UBSan smoke-core integration and static target audit
|
|
- [x] Phase-1.0D CRT canary reached visible C1 on firmware 9.60
|
|
- [x] Phase-1.0D early diagnostic produced one unreadable notification;
|
|
exact stage and graphics progress remain unproven
|
|
- [x] Phase-1.0E machine-readable result-channel candidate prepared offline
|
|
- [x] Separately authorized one-shot Phase-1.0E result-channel device test;
|
|
D02 platform result `0`, EOF before D03, no retry/reconnect
|
|
- [x] Phase-1.0F stream-only D02-to-D03 interval diagnostic prepared offline;
|
|
exact artifact is device-ineligible pending separate future review
|
|
- [x] Phase-1.0G fail-closed one-shot runner prepared offline; tracked manifest
|
|
and approval template are inactive and contain no target
|
|
- [x] Phase-1.0G result identifies the pre-SDL configuration exit before I04;
|
|
follow-up artifact requires a new offline design and exact permission
|
|
- [x] Phase-1.0H startup wrapper now models argc 2 without content/menu/config;
|
|
H runner requires exact dual authorization and currently grants none
|
|
- [x] Phase-1.0H runtime reached SDL VideoOut but failed its first flip submit;
|
|
visible presentation, runloop and cleanup remain unproven
|
|
- [x] Phase-1.0I bounds the E118 candidates and records the frame-zero
|
|
inconsistency without claiming a root cause or authorizing a retest
|
|
- [x] Phase-1.0M removes the source-bound playlist `mkdir` while preserving
|
|
the global write firewall and reproducible artifact audit
|
|
- [x] Phase-1.0N binds the M artifact to an inactive one-shot runner contract
|
|
- [x] Phase-1.0O proves M reaches I04 and reproduces the VideoOut flip-submit
|
|
failure with result `-1` and saved errno `0`; authorization is consumed
|
|
- [x] Phase-1.0P proves the exact submit boundary and deterministic D12/D04
|
|
order while keeping the VideoOut ABI/root cause fail-closed
|
|
- [x] Phase-1.0Q finds only one PS5 VideoOut declaration lineage and blocks
|
|
parameter experiments for lack of independent public ABI evidence
|
|
- [x] Phase-1.0R proves SDL2main adds no app/display registration, binds direct
|
|
and manager launches to the same elfldr constructor, and blocks target
|
|
changes because the separate hbldr/shsrv context remains unproven
|
|
- [x] Phase-1.0S binds official hbldr/shsrv: it proves BigApp substitution but
|
|
blocks route reuse because deployed identity, firmware behavior and safe
|
|
bounded device operation remain unproven
|
|
- [x] Phase-1.0T proves the existing shsrv shell cannot provide exact deployed
|
|
identity, records unavoidable greeting effects, and designs an inactive
|
|
redacting metadata gate without a network client
|
|
- [x] Phase-1.0U performs the bounded local artifact inventory; no original
|
|
shsrv target, receipt or transfer log is found, so direct host hashing is
|
|
unavailable and global absence is not claimed
|
|
- [x] Phase-1.0V implements a bounded offline one-shot Telnet/sanitization
|
|
model with inactive approval and no network transport
|
|
- [x] Phase-1.0W self-reviews/remediates the collector and proves an inactive
|
|
dual-record client policy plus fake one-shot transport
|
|
- [x] Phase-1.0X implements offline-only injected transport orchestration,
|
|
consumed-attempt receipts and exclusive sanitized output; no real
|
|
connection is authorized
|
|
- [x] Phase-1.0Y audits prompt/Telnet/completion framing, identifies the raw
|
|
and libtelnet/NVT source families and models both offline; deployed
|
|
identity and exact completion stay unproven
|
|
- [x] Phase-1.0Z implements an offline passive, source-family-tolerant
|
|
LF-batch contract with deadline-only sealing, strict completeness and no
|
|
Telnet command emission or live transport
|
|
- [x] Phase-1.0AA integrates Z bytes, synthetic deadline and exclusive X
|
|
evidence through an exact built-in fake adapter only
|
|
- [x] Phase-1.0AB audits the exact local runtime and models receipt,
|
|
nonblocking connect, complete send, bounded receive, deadline and close;
|
|
hard scheduling and remote cleanup remain partial/unproven
|
|
- [x] Phase-1.0AC implements a dormant target-free adapter around an exact
|
|
built-in fake syscall facade; no socket import, address or activation
|
|
path exists
|
|
- [x] Phase-1.0AD defines an inactive numeric-target and activation-record
|
|
contract with exact launcher/payload/approval hashes and no live ability
|
|
- [x] Phase-1.0AE selects the nonpersistent official shsrv v0.7 lineage and
|
|
rejects v0.19 fake-app/remount behavior; target implementation is blocked
|
|
- [x] Phase-1.0AF implements an injected host-only BigApp lifecycle model with
|
|
bounded ticks, unique-child correlation and exhaustive failure cleanup
|
|
- [x] Phase-1.0AG implements a bytes-only bounded ELF64 admission contract;
|
|
the historical M bytes are absent and therefore not newly admitted
|
|
- [x] Phase-1.0AH bounds the loader/CRT relocation split and exact per-artifact
|
|
DT_NEEDED inventory without mapping or loading anything
|
|
- [x] Phase-1.0AI models allocation, exact copy/BSS, RELATIVE application,
|
|
final permissions, sync, commit and full-region rollback
|
|
- [x] Phase-1.0AJ binds the v0.7 and hardened elfldr primitive sources,
|
|
rejects direct v0.7 loader reuse and records the remaining composition
|
|
and cleanup-ownership gaps
|
|
- [x] Phase-1.0AK models hybrid primitive composition, every temporary JIT
|
|
resource and fail-closed child termination after cleanup failure
|
|
- [x] Phase-1.0AL audits exact SDK `mdbg_copyin` partial-copy and credential
|
|
restoration semantics and blocks direct reuse
|
|
- [x] Phase-1.0AM models bounded exact-progress copying, independent all-field
|
|
restoration, child cleanup and compromised-service containment
|
|
- [x] Phase-1.0AN binds service fail-stop behavior and proves restart ownership,
|
|
`PT_IO` hard preemption and exact progress remain absent
|
|
- [x] Phase-1.0AO models one-shot worker preemption under an explicit supervisor
|
|
with no automatic restart, retry or real capability
|
|
- [x] Phase-1.0AP audits current official SDK/shsrv worker creation, termination,
|
|
identity and result-channel evidence; only creation is a source candidate
|
|
- [x] Phase-1.0AQ implements a fixed 128-byte worker-result record with
|
|
precommitted nonce, attempt, PID pair and monotonic generation
|
|
- [x] Phase-1.0AR models exclusive single-writer framing, every partial-read
|
|
split, deadline/EOF, overflow and containment without live transport
|
|
- [x] Phase-1.0AS audits public pipe/poll, rfork FD semantics, close ownership,
|
|
nonblocking reads and monotonic deadline evidence
|
|
- [x] Phase-1.0AT models RFFDG inheritance, exclusive pipe-end close order,
|
|
EINTR and one absolute deadline through fake operations only
|
|
- [x] Phase-1.0AU reassesses live channel feasibility: public primitive
|
|
signatures are complete, but official safe composition and runtime proof
|
|
remain absent
|
|
- [x] Phase-1.0AV defines a target-free launch-context A/B canary with identical
|
|
payload bytes, separate approvals and a distinct post-D04 terminal
|
|
- [x] Phase-1.0AW binds the exact canary source delta, v0.7 raw stdout candidate
|
|
and blocking launcher effects; no artifact is permitted
|
|
- [x] Phase-1.0AX implements byte-exact CHD10AV1/D14 framing and the cleanup
|
|
predicate for host tests only
|
|
- [x] Phase-1.0AY selects the exact inactive Phase-1.0N source base and requires
|
|
a separate worktree, preserving the current checkout
|
|
- [ ] Implement and host-test the AV source structure in that isolated worktree
|
|
without a target profile, cross-build or artifact
|
|
- [ ] First static emulator core with legally redistributable test content
|
|
- [ ] Dynamic core loading contract and implementation
|
|
|
|
Hardware-rendered libretro contexts remain disabled.
|
|
|
|
## Phase 4 — SDL2 accelerated renderer
|
|
|
|
Reusable SDL renderer backend and simple shaders, without replacing unrelated
|
|
native SDL platform facilities.
|
|
|
|
## Phase 5 — separately evaluated context expansion
|
|
|
|
Consider a broader hardware-render context or small OpenGL subset only after
|
|
the 2D path is stable. A full Vulkan or Mesa driver is explicitly not an early
|
|
goal.
|