TASK-26: correct the sensor claim; the machine absorbs the scripts
Wrong on two counts before. The sensors are not in question - SLPI bring-up was solved 2026-07-10 and the 07-13 SUID sweep found accel/gyro (BMI160), mag (LIS2MDL), pressure (BMP380), ambient_light/proximity (TMD2725) and sensor_temperature; only amd lacks a SUID. A failed monitor-sensor accelerometer claim was contention with blueline-autorotate, not absence. And the target is not to make the scripts clients of the state machine. The machine absorbs them: proximity-while-locked, the DT2W gate and rotation are device state reactions by definition. Three scripts, two of them reading the same proximity signal, are three state machines with no forensic log and no coordination - which is why they land together, not one at a time. Adds the 07-25 SLPI/hexagonrpcd outage as the concrete argument that evidence-source health is itself device state.
This commit is contained in:
Fimeg
parent
7cb55401e6
commit
49332838d3
1 changed files with 101 additions and 56 deletions
|
|
@ -1,8 +1,9 @@
|
|||
# TASK 26 — Sensor evidence, and a single authority over it
|
||||
# TASK 26 — Sensor evidence and reactions belong to the state machine
|
||||
|
||||
**Status:** open — carved 2026-07-25 after finding the device state machine
|
||||
is not "observational", it is **blind**, and that a second authority is
|
||||
already acting on the signal it was built to arbitrate.
|
||||
is not "observational", it is **blind**, while a scatter of standalone
|
||||
`/usr/bin` shell scripts each hold their own sensor claim and act on their
|
||||
own authority.
|
||||
|
||||
**Blocks:** TASK-08(a) idle tiers, TASK-15 idle coordinator. Both are
|
||||
efferent — they give the machine actuators. Neither supplies it afferents,
|
||||
|
|
@ -10,8 +11,7 @@ and both read as though something already does.
|
|||
|
||||
## The finding
|
||||
|
||||
`souveraine-sessiond` is running, package-owned, and answering IPC. Its
|
||||
state machine is live:
|
||||
`souveraine-sessiond` is running, package-owned, and answering IPC:
|
||||
|
||||
{"device_state":"active","display_active":true,"locked":false,
|
||||
"observed":false,"observed_confidence":0.0,"phase":"released",
|
||||
|
|
@ -21,81 +21,126 @@ state machine is live:
|
|||
`observed_confidence` is **0.0 and structurally cannot move**, and the
|
||||
forensic buffer **cannot fill**. `src/sessiond/protocol.rs` defines
|
||||
`Request::SensorInput(SensorInput)` for proximity / accelerometer / light /
|
||||
touch, and **nothing in any repo ever sends one.** The only match for
|
||||
`SensorInput` outside sessiond itself is
|
||||
`surfaces/quickshell/services/SessionAudit.qml:logSensorInput()` — a logging
|
||||
helper with no callers. `SessiondBridge.qml` implements only the lock
|
||||
handoff (`shell_ready` / `locked_ack`), not evidence.
|
||||
touch, and **nothing in any repo ever sends one.** The only match outside
|
||||
sessiond is `surfaces/quickshell/services/SessionAudit.qml:logSensorInput()`
|
||||
— a logging helper with no callers. `SessiondBridge.qml` implements only the
|
||||
lock handoff (`shell_ready` / `locked_ack`), not evidence.
|
||||
|
||||
The DUMP's "still observational — it logs, it drives nothing" undersells
|
||||
this. It logs nothing either. It has no inputs.
|
||||
|
||||
## The second authority
|
||||
## The sensors are not the problem — they were brought up long ago
|
||||
|
||||
Proximity evidence **does** exist on the device and is **already being acted
|
||||
on** — by a shell script:
|
||||
**SLPI bring-up is SOLVED (2026-07-10) and the sensor set is wide.** The
|
||||
bounded SUID sweep of 2026-07-13 (`Pixel3Arch/PAF/slpi.md`) found working
|
||||
SUIDs for:
|
||||
|
||||
pid 981 /bin/sh /usr/bin/blueline-proximity-lock
|
||||
pid 1227 monitor-sensor --proximity
|
||||
| sensor | part |
|
||||
|---|---|
|
||||
| `accel` / `gyro` | BMI160 |
|
||||
| `mag` | LIS2MDL |
|
||||
| `pressure` | BMP380 |
|
||||
| `ambient_light` / `proximity` | TMD2725 |
|
||||
| `sensor_temperature` | LIS2MDL |
|
||||
|
||||
`blueline-proximity-lock` blanks the panel when proximity is blocked while
|
||||
the lockscreen is up. It is unowned by any package (`pacman -Qo` → "No
|
||||
package owns"), one of the 5,624 unowned files in package territory
|
||||
(TASK-25). It reaches its own conclusion from proximity and acts on the
|
||||
display, with no reference to sessiond's state machine.
|
||||
Only `amd` (activity-motion-detect) lacks a SUID. `iio-sensor-proxy` has run
|
||||
always-on from boot since 2026-07-20 via `blueline-sensors-enable.service`
|
||||
(`After=blueline-hexagonrpcd-sdsp.service`), replacing the old on-demand
|
||||
start/stop. PAF README: *"Proximity (TMD2725) and accelerometer both live."*
|
||||
|
||||
That is two authorities over one signal — the shape
|
||||
So the protocol's four evidence sources are all backed by real hardware that
|
||||
already works. **There is nothing to bring up here.** The work is entirely
|
||||
about who owns the evidence and who acts on it.
|
||||
|
||||
## The real shape of the problem: it is scattered into scripts
|
||||
|
||||
Each consumer is an independent standalone shell script in `/usr/bin`, owned
|
||||
by no package, holding its own `monitor-sensor` claim and reaching its own
|
||||
conclusion:
|
||||
|
||||
| script | sensor | acts on |
|
||||
|---|---|---|
|
||||
| `blueline-proximity-lock` | proximity | blanks panel when locked |
|
||||
| `blueline-screen-toggle` | proximity | DT2W wake gate |
|
||||
| `blueline-autorotate` | accelerometer | screen rotation |
|
||||
|
||||
These are not merely "unpackaged" (TASK-25) — they are **parallel
|
||||
authorities over device state**, which is the thing
|
||||
`SESSION-AUTHORITY-DOCTRINE.md` exists to forbid, and the same collision
|
||||
called out for `org.freedesktop.secrets` vs gnome-keyring on 2026-07-24.
|
||||
|
||||
**They must not become "clients" of the state machine. The state machine
|
||||
absorbs them.** Proximity-while-locked, the DT2W gate, and rotation are all
|
||||
*device state reactions* — they are the machine's job by definition. A shell
|
||||
script that independently decides to blank the panel is a second state
|
||||
machine with no forensic log, no confidence model, and no coordination with
|
||||
the first.
|
||||
|
||||
This is also why they must land together rather than one at a time: two of
|
||||
them read the *same* proximity signal and can reach opposite conclusions, and
|
||||
splitting the work leaves that contradiction in place for longer.
|
||||
|
||||
## Why this must precede TASK-08(a) / TASK-15
|
||||
|
||||
TASK-19's rule is that every control is a view over the owning service — no
|
||||
success-shaped switches. A control over `observed_confidence` today would be
|
||||
a view over a constant. Wiring actuators to a machine with no afferents
|
||||
manufactures exactly the lie TASK-19 forbids: settings whose backing state
|
||||
is always the default, which will *look* correct in the UI and be inert.
|
||||
manufactures exactly the lie TASK-19 forbids: settings that *look* correct in
|
||||
the UI and are inert.
|
||||
|
||||
**Sensors before actuators.** This task is the precondition, not a parallel
|
||||
track.
|
||||
**Sensors before actuators.** This is the precondition, not a parallel track.
|
||||
|
||||
## Shape
|
||||
## The evidence path silently dies — and nothing notices
|
||||
|
||||
1. **An evidence producer.** Something must call `SensorInput`. Proximity is
|
||||
available today via iio-sensor-proxy (`monitor-sensor --proximity`), which
|
||||
is what `blueline-proximity-lock` already consumes. Decide the owner:
|
||||
sessiond subscribing to iio-sensor-proxy over D-Bus directly is the
|
||||
straight line (it already owns lock state, and TASK-15 notes the
|
||||
coordinator likely *is* sessiond), versus the shell relaying — but the
|
||||
shell is the wrong owner for evidence that must survive shell death, which
|
||||
is the whole reason sessiond exists.
|
||||
2. **Retire the competing authority.** `blueline-proximity-lock` either
|
||||
becomes a client of the state machine or its behaviour moves into it. It
|
||||
must not keep deciding on its own. Its actual behaviour is worth
|
||||
preserving — the locked-screen proximity blank is a real feature, and
|
||||
`blueline-screen-toggle`'s DT2W proximity gate is a related second
|
||||
consumer; check that one too.
|
||||
3. **Audit the other sensors.** `accelerometer` is claimed but
|
||||
`monitor-sensor` reports *"Failed to claim accelerometer: NoReply"* —
|
||||
determine whether that is contention with the running script or genuinely
|
||||
absent. iio devices present are only `pmic@0:adc@3100` and
|
||||
`pmi8998-rradc` (PMIC analog), so accel/light provenance needs
|
||||
establishing before the protocol's four sources are assumed available.
|
||||
Do not design for evidence that does not exist.
|
||||
4. **Package whatever survives** — see TASK-25. An authority that lives in an
|
||||
unowned `/usr/bin` script cannot be reasoned about or updated.
|
||||
Live incident, 2026-07-25 06:04:33 (this is not hypothetical):
|
||||
|
||||
kernel: qcom_q6v5_pas 5c00000.remoteproc: fatal error received:
|
||||
err_qdi.c:456:EF:sensor_process:1:fatal_error.cc:22:CHRE
|
||||
fatal@platform_sensor_manager.cc:158
|
||||
remoteproc remoteproc2: crash detected in slpi / recovering slpi
|
||||
remoteproc remoteproc2: remote processor slpi is now up
|
||||
|
||||
SLPI recovered. But `blueline-hexagonrpcd-sdsp.service` took
|
||||
`Could not fetch next FastRPC message: Broken pipe` and
|
||||
**"Deactivated successfully"** — systemd read a clean exit and never
|
||||
restarted it. SLPI came back up; its HexagonFS daemon did not. Result:
|
||||
|
||||
iio-sensor-proxy: 'registry' sensor unavailable, is hexagonrpcd running?
|
||||
HasAccelerometer: false HasAmbientLight: false HasProximity: false
|
||||
|
||||
**Every sensor on the device was dead for hours** and nothing reported it.
|
||||
The scripts kept running against a proxy with nothing behind it — a standalone
|
||||
script consuming a dead sensor looks identical to one whose sensor is simply
|
||||
quiet.
|
||||
|
||||
Two consequences for this task:
|
||||
|
||||
1. **`blueline-hexagonrpcd-sdsp.service` needs a restart policy that survives
|
||||
SLPI crash-recovery** (SLPI recovers itself; its filesystem daemon must
|
||||
follow). That fix belongs in `Pixel3Arch/rootfs-overlay/`, **never only on
|
||||
the device** — a fix that lives only on the phone is erased by the next
|
||||
reprovision, which is the whole reason the pacman pipeline exists.
|
||||
2. **Evidence-source health is itself device state.** The machine must know
|
||||
its afferents are gone rather than quietly reporting steady state on
|
||||
absent input. "No evidence" and "evidence says nothing is happening" are
|
||||
different, and only one of them is safe to act on.
|
||||
|
||||
## Acceptance
|
||||
|
||||
- `observed_confidence` moves off 0.0 in response to a real physical event.
|
||||
- `forensic_log` returns entries with `count > 0` after that event.
|
||||
- Exactly one component acts on proximity; `pacman -Qo` names a package for
|
||||
it.
|
||||
- The locked-screen proximity blank still works (no regression).
|
||||
- Proximity-while-locked, the DT2W gate, and autorotate are all decided by
|
||||
the state machine; no standalone script holds a `monitor-sensor` claim.
|
||||
- `pacman -Qo` names a package for every surviving component.
|
||||
- Sensor-stack death is visible in device state, not silent.
|
||||
- No regression: locked-screen proximity blank, DT2W, and rotation all still
|
||||
work.
|
||||
|
||||
## Connects to
|
||||
|
||||
TASK-08 (device state manager — this feeds its tiers), TASK-15 (idle
|
||||
coordinator — same owner question), TASK-19 (why the ordering is not
|
||||
negotiable), TASK-25 (the script is unowned), and
|
||||
negotiable), TASK-25 (the scripts are unowned, and the restart fix must live
|
||||
in the overlay), `Pixel3Arch/PAF/slpi.md` (sensor island, SUID sweep, the
|
||||
CHRE fatal history), and
|
||||
`SouveraineOS/docs/SESSION-AUTHORITY-DOCTRINE.md`.
|
||||
|
|
|
|||
Loading…
Reference in a new issue