chimera-gfx-Public/docs/runtime/phase-0.9c-capability-closure.md

Phase 0.9C capability closure

Status: NO TARGET CAPABILITY CLOSED.

“Host evidence” below means a deterministic model or source validator. It is not PS5 evidence. implementation allowed and execution allowed are false for every capability because the startup/exit, output, firmware-source, and side-effect gates fail before target implementation.

Closure matrix

Capability	Source evidence	Host evidence	Target evidence	Implement allowed	Execute allowed	Remaining blocker
runtime self-identity	future protocol binds observer version and artifact SHA-256	framing validates both	absent	false	false	no target artifact or runtime self-binding
firmware source 1	SDK kernel_get_fw_version, crt/kernel.c:148-170	protocol binds raw value	absent	false	false	depends on prohibited runtime and is not independent system identity
firmware source 2	export-stub name only, no accepted signature/semantics	missing/conflict tests fail closed	absent	false	false	independent accepted source absent
mount query	SDK samples/mntinfo and libc wrapper	unsupported can be represented	absent	false	false	ABI, completeness, runtime behavior and effects unproven
metadata	controlled manager no-follow pattern	result framing can represent error	absent	false	false	target metadata/no-follow semantics and effects unproven
object ID	manager compares st_dev/st_ino	completeness rules modeled	absent	false	false	stable target identity and race contract unproven
size	manager compares exact st_size	checked result length modeled	absent	false	false	current object and stable-read evidence absent
SHA-256	bounded same-FD manager implementation	checksum corruption is rejected	absent	false	false	target read effects, current paths and stable object absent
processes	SDK samples/ps partial snapshot	unsupported result modeled	absent	false	false	complete ABI, bounds and semantics absent
services	no complete source/API mapping	unsupported result modeled	absent	false	false	service inventory and ownership semantics absent
listeners	no accepted snapshot/owner API	unsupported result modeled	absent	false	false	listener API, ownership and side effects absent
autoload/startup/retry	stock manager readers/HTTP are incomplete or side-effecting	missing source remains blocked	absent	false	false	complete authoritative sources and safe collector absent
rollback objects	Phase 0.8R/0.9A evidence contract only	no false promotion in validators	absent	false	false	current exact backups absent; manager backup is hard blocker
monotonic time	hardened loader uses CLOCK_MONOTONIC	deadline expiry is rejected	absent in observer ABI	false	false	loader exposes no clock callback; freestanding callable ABI absent
startup	SDK and hardened loader callgraphs	startup classifications validated	absent	false	false	normal CRT writes; freestanding dependency closure incomplete
output	current route proven send-only; D1 host contract defined	4096-byte framing and negative tests	absent	false	false	no caller-owned target buffer/copy-out/manager delivery
normal exit	loader has wait/reap; status discarded	no safe exit terminal modeled	absent	false	false	return/exit semantics and teardown unproven
error exit	CRT error/longjmp/trap and loader reap reviewed	observer error cannot equal empty success	absent	false	false	partial unwind, status and cleanup unproven
timeout	loader SIGTERM/SIGKILL watchdog reviewed	timeout record is rejected	absent	false	false	kill/timeout is not an admissible safe exit
cleanup	pre-detach cleanup state exists; post-detach relies on process lifetime	failed/incomplete cleanup rejected	absent	false	false	mappings, FDs, buffers, loader and manager cleanup not jointly proven
recovery independence	Phase 0.9A contract	blocker preserved	absent	false	false	recovery executor and exact rollback objects unproven

Firmware-source closure

Current source 1 reads a process-parameter field associated with libSceLibcInternal; its own comment says it is chosen because some payloads modify the kernel-reported value. That makes it useful source evidence, but not an independent second current device identity.

The SDK stubs contain sceKernelGetProsperoSystemSwVersion, but a stub exports only a name/NID surface. The repository has no reviewed public prototype, result layout, return semantics, side-effect contract, or firmware-9.60 observation. It is not callable evidence and is not source 2.

A future source 2 must:

1. be official/reproducible public platform evidence or a separately reviewed locally obtained runtime value;
2. have exact function/data ABI and side-effect evidence;
3. identify the current system, not the observer's compiled SDK requirement;
4. produce an exact raw value under the same deadline;
5. be independent of source 1's data origin;
6. bind source identity, raw result, nonce, request ID, observer artifact hash and deadline into the result record; and
7. fail closed if absent, ambiguous, stale, or conflicting.

The host protocol returns BLOCKED_FIRMWARE_SOURCE_2_ABSENT for absence and BLOCKED_FIRMWARE_CONFLICT for disagreement. It never normalizes a conflict away or prefers one source.

Cross-gate closure

The following dependencies form one conjunctive gate:

kernelwrite-free usable startup
  + proven stack/relocation/BSS/TLS closure
  + callable bounded observation primitives
  + two bound firmware sources
  + bounded transient output
  + normal/error/deadline exit without kill
  + complete cleanup and unambiguous status
  + bounded accepted observation effects
  = target implementation may be reconsidered

Every term is required. A passing host protocol cannot compensate for a missing exit ABI. A proven read algorithm cannot compensate for an absent output channel. Two firmware strings cannot compensate for an unreviewed ABI or stale execution binding.

Decision

Closed for host design:

• startup graph classifications are explicit;
• the freestanding missing dependencies are explicit;
• D1 framing is fixed at 4096 bytes and fails closed;
• stale, duplicate, incomplete, corrupt, timed-out and conflicting records are rejected; and
• every capability has an explicit blocker.

Not closed for target implementation:

• all 21 capabilities in the matrix.

The capability result contributes to BLOCKED_MULTIPLE_FOUNDATIONAL_CONTRACTS.