[KernelPanicNT]

What

Implements sceSslEnableVerifyOption, sceSslDisableVerifyOption, sceSslSetMinSslVersion, sceSslSetAlpn and sceSslGetAlpnSelected on the connection records that sceSslCreateConnection already keeps.

Source of the behaviour. No console measurement is involved.

• Signatures: SharpProspero Http.cs L228-L258: (int sslConnectionId, uint option) for both verify-option calls, (int, SceSslVersion) for the minimum version, (int, const char* proto) for ALPN, and const char* sceSslGetAlpnSelected(int), which returns "which protocol the peer chose, or null if none was negotiated".
• Verify option bits 0x1, 0x4, 0x8, 0x10, 0x20 and 0x2000: L143-L159.
• Versions 0 (None) to 5 (Tls12): L41-L61.
• Model: since feat(libSceSsl): add the connection calls boykopovar/AnyPS5#5226, sceSslSetVerifyCallback records its callback on the connection and returns 0. These calls record their values the same way. Unknown and terminated connections are rejected by the same RequireConnection check the other connection calls use.

Changes:

• SslConnection gains the verify option mask (initially 0), the minimum version (initially 0) and the ALPN protocol list.
• sceSslEnableVerifyOption ORs the bits into the mask and sceSslDisableVerifyOption clears them. Option 0 is accepted and changes nothing. sceSslSetMinSslVersion stores a version from 0 to 5. sceSslSetAlpn copies the NUL-terminated wire-format list. All four return 0.
• sceSslGetAlpnSelected returns null for a known connection. sceSslConnect still throws, so no handshake runs and no protocol is ever negotiated.
• These cases throw std::invalid_argument because the console's error codes are unknown: an unknown connection, a connection whose context was terminated, option bits outside the six known ones, a version outside 0 to 5, and a null protocol list.
• guest_ssl covers enabling all known bits, disabling one bit twice, option 0, unknown bits for both calls, every version from 0 to 5 plus 6 and -1, GetAlpnSelected before and after SetAlpn, a null list, all five calls on an unknown connection, and calls after sceSslTerm.
• Technical debt: the libSceSsl entry that listed four of these as parameterless stubs is replaced by one entry for all five. It records the sources, that nothing reads the recorded values, that the default options are unknown, and the throwing cases. A shared "imports declared without parameters" line also listed sceSslEnableVerifyOption next to libSceJson2, libSceConvertKeycode and libSceNpSessionSignaling exports. It drops that function and moves to docs/dev/debt/libSceJson2.md, the first library it still names, under the same Functional section; libSceSsl.md keeps no empty section.

Still throwing: sceSslConnect, sceSslRead, sceSslWrite and sceSslClose. There is no TLS transport, so the recorded options affect nothing yet.

Progress: libSceSsl 12/28 → 17/28.

Tested

Head fb1051b352d840f0939545a4e272309ee778fa90, base a453108cf7768b71879b0e832d367a935c43440d.

• Linux (Ubuntu 22.04, GCC 12.3.0, Ninja, Release, BUILD_TESTING=ON, tests run under QEMU 8.2 user mode with -cpu EPYC-Rome because the build host lacks AVX2): guest_ssl_tests 5/5, guest_ssl_load_tests 5/5 passes.
• Negative control: keep the tests and replace only core/libs/prx/libSceSsl/Export.cpp with the base version: guest_ssl_tests fails with sceSslEnableVerifyOption not implemented; guest_ssl_load_tests still pass there, as expected for regression coverage. Restoring the PR source and rebuilding passes guest_ssl_tests 5/5, guest_ssl_load_tests 5/5.
• Windows: fork Build workflow pending; result added here when it finishes.
• Conventions checker and git diff --check pass. The Linux job of the Build workflow now targets the project's self-hosted runner, so it was not run on the fork; no title was run.

Duplicate and overlap check

• Open PRs: I checked the file lists of all 443 open PRs (the full REST file list for the 19 PRs whose list exceeds 100 files) and searched PR titles and bodies for the five function names. No open PR touches libSceSsl, GuestSsl.cpp, docs/dev/debt/libSceSsl.md or docs/dev/debt/libSceJson2.md, and none names these functions. feat(libSceJson2): implement sce::Json::String methods and npos boykopovar/AnyPS5#5439 changes libSceJson2 code but not its debt file.
• Merged and closed PRs naming these functions only declared them as parameterless exports (fix(exports): export the calls PPSA07411 imports boykopovar/AnyPS5#3773, feat(exports): export the calls PPSA01317 imports boykopovar/AnyPS5#4834) or declared the verification callback export next to them (fix(libSceSsl): add missing verification callback export boykopovar/AnyPS5#4078). None implemented them.
• My PR "feat(libSceSsl): read subject and issuer names of loaded CA certificates" edits the neighbouring stub lines in core/libs/prx/libSceSsl/Export.cpp and the neighbouring CA-load entry in docs/dev/debt/libSceSsl.md. A three-way merge of the two branches has one conflict block in each of those two files. Whichever PR merges second needs a trivial rebase. There is no functional dependency in either direction.
• The branch merges into current main without conflicts, including the libSceJson2 debt file that feat(libSceJson2): implement Object::Pair, Array::iterator copies and notifyError boykopovar/AnyPS5#5634 changed.

Checklist

• Based on current main; no other open PR implements the same functions
• One topic per PR; follow-ups go in a new PR
• No comments in code except technical debt
• Unimplemented paths throw (NotImplemented_nid_no_patch); silent stubs are listed under Silent stubs in their library's technical debt file
• No notes, investigation .md files or images added to the repository (attach them to this PR)
• New third-party code is a submodule built from source
• Generic behaviour, not specific to one title
• Depends on: none
• Unblocks: none
• GPUs tested: n/a
• AI-assisted: yes (Claude)

[github-actions]

Progress report (e34c479 → fb1051b)

📈 System libraries: 88.84% (+0.13%, +5 implemented functions)

✅ 5 implemented

Library	Name
libSceSsl	sceSslDisableVerifyOption
libSceSsl	sceSslEnableVerifyOption
libSceSsl	sceSslGetAlpnSelected
libSceSsl	sceSslSetAlpn
libSceSsl	sceSslSetMinSslVersion

[KernelPanicNT]

Withdrawn: open upstream PR boykopovar#5911 already implements the same functions.