chimera-gfx-Public/docs/runtime/phase-0.7-hardening.md

Phase 0.7 hardened runtime — offline review

Decision: READY_FOR_HARDENED_RUNTIME_DEPLOYMENT.

This is an offline deployment-readiness decision. No PS5 connection, installation, transfer, or execution occurred.

Exact identities

Component	Base	Hardened source	ELF SHA-256	Size
elfldr	699e8bcff03e91e8d6ca6eba281af25c5a58d8c2	197623058f509eddde18868dafcb92fdcac66464	63e810982471eb40cae3a20aa9df9a0a02892f420e429874fae4e99aa400b561	397000
controlled Payload Manager	cfbc70f30f419b09bf2b52283f7409e2d3117ee1	e23d94ff91233aa770e2342800c1467875bdef44	8fecf8241a46246eddbd21e8bb4d875f5d76f1f4f4c6a11384df1f131aa5e5b1	99560
lifecycle probe	Chimera GFX	fe08300339a13f899fb78ea404ada381a5cba87c	bfb4a5cc768e162fe4c2fddf41c3978e152722918a39085277fd172cb95a7182	112680

All three pairs of clean builds are byte-identical. Complete disassembly, symbol tables, relocations, normalized linker maps, and call-edge inventories are in the ignored offline package under outputs/phase07/audit/; their hashes and the complete call-edge lists are committed in manifests/runtime/phase-0.7-offline-audit.json.

Lifecycle binary boundary

The only undefined imports are:

• _exit
• sceKernelSendNotificationRequest

The only DT_NEEDED modules are:

• libSceLibcInternal.sprx
• libkernel_web.sprx

There are no GNM, VideoOut, SDL, SceNet, socket, download, thread, retry, or autoload imports. The normal SDK startup object is statically present and reaches its documented __patch_init and rtld initialization before main; absence from imports is not used to hide that fact. The linker map also contains sceKernelLoadStartModule/sceKernelStopUnloadModule through the stock SDK rtld; its conditional module behavior is payload-process-local and supervised by the external watchdog, but remains unobserved on firmware 9.60. After one notification, main calls _exit, so the uncertain SDK main -> payload_terminate return branch is not taken.

Hardening closure

Phase-0.6 finding	Phase-0.7 implementation	Review
unbounded ptrace loop	monotonic one-second deadline plus 65,536 steps	SAFE offline logic
incomplete child credential restore	UID, jaildir, rootdir, caps, auth-ID all restored and checked	SAFE offline logic
restore failure continues	fail-closed kill and deadline-bounded reap; no detach	SAFE offline logic
scattered cleanup	one tracked cleanup state machine for breakpoint, mappings, fds, child	SAFE offline logic
breakpoint page stays RWX	original byte restored and page reset RX	SAFE source fact
detached runtime unbounded	2000 ms wait, SIGTERM grace, SIGKILL, reap	SAFE offline logic
ignored SIGCHLD/zombie risk	default SIGCHLD plus explicit reap	SAFE offline logic
path-based Manager load	one no-follow FD, fstat, hash, rewind, stream, post-check	SAFE offline logic
upload TOCTOU	exclusive temp, fsync, verify, atomic rename, inode check	SAFE offline logic
arbitrary controlled artifact	manager binary compiled for exact hash, size, and ID	SAFE offline configuration
sender-only hash	elfldr rehashes received bytes and checks denylist	SAFE offline logic

SAFE here means source, test, map, and disassembly evidence agree. It is not a hardware execution claim.

Remaining risks

• No on-device observation exists yet; loader/firmware behavior remains unverified at runtime.
• QA flags are an existing expected volatile loader bootstrap effect.
• Normal SDK startup performs known process-local credential/capability and syscall-bound writes before main.
• The controlled manager listens for the later operator workflow, but accepts only the compiled exact artifact identity; installation security and network exposure still require a separate review.
• Abrupt platform failure can bypass userland reporting, though OS process teardown should reclaim child mappings and descriptors.
• Rollback has only been prepared offline; its on-device paths and installed hashes must be captured before any replacement.

These are deployment/execution residual risks, not unresolved compiler, linker, or ABI blockers for preparing the hardened runtime.