file task 76: nothing owns provisioning
Five souveraine files own no package across the two live devices, and /etc/systemd/system/souveraine-machined.service shadows the packaged signer unit on both — measured, not inferred. Retires the Phase C deploy checklist: CLAUDE.md banned its build step on 2026-07-24, START-HERE §5 bans its deploy step.
This commit is contained in:
Fimeg
parent
b45d7766aa
commit
6e2f3f80ab
3 changed files with 144 additions and 7 deletions
|
|
@ -151,14 +151,29 @@ gap or heartbeat proves flaky in practice.
|
|||
|
||||
## Deploy checklist (phone, when reachable)
|
||||
|
||||
1. On-device build: `cargo build --release --features sessiond --bin
|
||||
**Superseded 2026-08-15 — steps 1–3 below are the pre-packaging route and three
|
||||
of them are now banned. Kept as the record of how Phase C first reached the
|
||||
phone; do not follow them.** The current route:
|
||||
|
||||
1. `pacman -Syu` on the phone. sessiond, its unit and (since TASK-76) its PAM
|
||||
file are all package-owned.
|
||||
2. Cold boot, and step 4 below is still the expected sequence.
|
||||
|
||||
The original, and why each step retired:
|
||||
|
||||
1. ~~On-device build: `cargo build --release --features sessiond --bin
|
||||
souveraine-sessiond` in `~/build/souveraine` (nice 15, -j 3), install to
|
||||
`/usr/local/bin`.
|
||||
2. Sync Pixel3Arch rootfs-overlay bits: `/etc/pam.d/souveraine-sessiond`,
|
||||
`/etc/systemd/user/souveraine-sessiond.service`; `systemctl --user
|
||||
daemon-reload`.
|
||||
3. Deploy hyprland.lua (restore flag + hook line) and `deploy.sh --phone`
|
||||
for the shell (bridge + LockScreen patch).
|
||||
`/usr/local/bin`.~~ Banned 2026-07-24 — `souveraine/CLAUDE.md`: binaries
|
||||
hand-copied to `/usr/local/bin` are owned by no package and silently never
|
||||
update; sessiond sat five days behind and its state machine never ran.
|
||||
archdev cross-compiles, CI packages, pacman delivers.
|
||||
2. ~~Sync Pixel3Arch rootfs-overlay bits.~~ The overlay reaches a device only
|
||||
on flash and the phone does not flash (TASK-28). Both files are packaged
|
||||
now: the unit from `PKGBUILD.prebuilt`, the PAM file added 2026-08-15.
|
||||
The overlay copies are a shadowing hazard, not a delivery route (TASK-76).
|
||||
3. ~~`deploy.sh --phone` for the shell.~~ `START-HERE.md` §5: never. TASK-25
|
||||
demoted it to a recovery instrument for an explicitly quiesced target,
|
||||
after it killed a live conversation mid-use.
|
||||
4. Cold boot. Expected: splash → sessiond PIN surface (spartan) → shell lock
|
||||
replaces it seamlessly once quickshell is up. `journalctl --user -u
|
||||
souveraine-sessiond` shows acquire → handoff → locked_ack.
|
||||
|
|
|
|||
121
docs/tasks/76-provisioning-by-package.md
Normal file
121
docs/tasks/76-provisioning-by-package.md
Normal file
|
|
@ -0,0 +1,121 @@
|
|||
# TASK 76 — Provisioning belongs to a package, per device, per arch
|
||||
|
||||
**Status:** scoped 2026-08-15, measured on both devices, not started.
|
||||
**Size:** one session for the audit fixes, a second for the provision packages.
|
||||
|
||||
Every souveraine binary ships as a package. Nothing that *activates* those
|
||||
binaries does. Five system files on the two live devices are owned by no
|
||||
package, and one of them shadows a packaged unit on both machines at once.
|
||||
|
||||
## Measured 2026-08-15
|
||||
|
||||
`pacman -Qo` across the laptop (souveraine r506) and the phone (r503):
|
||||
|
||||
```
|
||||
phone /etc/pam.d/souveraine-sessiond Jul 16 21:17 UNOWNED
|
||||
phone /etc/systemd/system/souveraine-machined.service Jul 16 12:36 UNOWNED
|
||||
phone /etc/systemd/system/souveraine-splash.service Jul 17 08:23 UNOWNED
|
||||
phone /etc/systemd/user/souveraine-shell.service Jul 17 07:49 UNOWNED
|
||||
laptop /etc/systemd/system/souveraine-machined.service UNOWNED
|
||||
```
|
||||
|
||||
All five were hand-placed inside one 20-hour window on 2026-07-16/17 — the
|
||||
Phase C session in `session-authority-boot-order.md` — and none has been
|
||||
touched since.
|
||||
|
||||
**The shadow is live on both devices.** `systemctl show souveraine-machined -p
|
||||
FragmentPath` returns `/etc/systemd/system/souveraine-machined.service` on the
|
||||
laptop *and* the phone. `/etc/systemd/system` outranks `/usr/lib/systemd/system`,
|
||||
so the packaged copy — which both machines carry and `pacman -Qo` attributes to
|
||||
`souveraine` — is inert. machined is the Ed25519 identity signer; every
|
||||
capability token in the system descends from the unit systemd is not reading.
|
||||
|
||||
Nothing misbehaves today: the laptop's two copies are byte-identical. That is
|
||||
what makes it dangerous. The first packaged change to that unit — the tmpfiles
|
||||
socket ACL `provisioning-gaps.md` §6 still owes, ordering, hardening — lands in
|
||||
a file nothing loads, and `-Syu` reports success.
|
||||
|
||||
**Activation is unpackaged too.** The sessiond unit ships correctly from
|
||||
`PKGBUILD.prebuilt:51` to `/usr/lib/systemd/user/` on both arches, and on both
|
||||
devices it is `disabled` and `active` — started by a hand-written line in a
|
||||
file that lives in no repo:
|
||||
|
||||
```
|
||||
laptop ~/.config/hypr/hyprland/execs.lua:19 systemctl --user start souveraine-sessiond.service
|
||||
phone ~/.config/hypr/hyprland.lua:420 systemctl --user reset-failed …; systemctl --user restart souveraine-sessiond.service
|
||||
```
|
||||
|
||||
Two devices, two different invocations, versioned nowhere. Reinstall either
|
||||
machine and its proprioception does not come up.
|
||||
|
||||
The unit's `[Install] WantedBy=graphical-session.target` is vestigial and
|
||||
actively harmful: the designed path is an explicit start after
|
||||
`WAYLAND_DISPLAY` reaches the user manager (the unit says so in its own
|
||||
comment), and `systemctl --user enable --now` is precisely the mid-session
|
||||
start that locks the screen with no lock surface. The section that looks
|
||||
correct to systemd convention is the one that black-screens the machine.
|
||||
|
||||
## The pattern already runs on the phone
|
||||
|
||||
`blueline-edge-sense 0.2.0-2` owns:
|
||||
|
||||
```
|
||||
/usr/lib/systemd/user/souveraine-sessiond.service.wants/blueline-edge-sense.service
|
||||
```
|
||||
|
||||
A device-specific, arch-specific package declaring activation against a
|
||||
souveraine unit — package-owned, no enable step, no hand edit, in place since
|
||||
2026-07-29. That is the shape. It needs no invention, only application.
|
||||
|
||||
## What is missing
|
||||
|
||||
1. **The four unowned files get a package.** PAM has a rail already —
|
||||
`PKGBUILD.prebuilt:15` carries `backup=('etc/pam.d/souveraine-stepup')` and
|
||||
installs it at `:103`; `souveraine-sessiond`'s PAM file simply never got
|
||||
added. `souveraine-machined.service` is already packaged to
|
||||
`/usr/lib/systemd/system/`; the `/etc/` copies are what must go, and
|
||||
removing a file no package owns needs Casey's hand, not a hook.
|
||||
2. **A `souveraine-provision-<device>` package per device.** Owns the `.wants`
|
||||
symlinks that replace both lua lines, plus device-scoped config. `blueline`
|
||||
and the laptop are the two that exist; the arch split falls out of the
|
||||
package's own `arch=()`.
|
||||
3. **Delete the vestigial `[Install]` section**, or make it correct. Two
|
||||
activation paths where one black-screens the device is not a choice a
|
||||
reader should be offered.
|
||||
4. **`rootfs-overlay/etc/systemd/user/souveraine-sessiond.service` in
|
||||
Pixel3Arch is a loaded gun.** Verified *not* on the phone — there is no
|
||||
`/etc/systemd/user/souveraine-sessiond.service` and `FragmentPath` is the
|
||||
packaged one. If a flash ever lands it, it shadows every future package
|
||||
update of that unit permanently. Same question for
|
||||
`rootfs-overlay/etc/pam.d/souveraine-sessiond`.
|
||||
5. **`session-authority-boot-order.md`'s deploy checklist is stale and
|
||||
harmful.** Its §1 still says build on-device and install to
|
||||
`/usr/local/bin`, which `souveraine/CLAUDE.md` banned on 2026-07-24. Fix in
|
||||
place; do not delete the doc.
|
||||
|
||||
## Acceptance
|
||||
|
||||
- `pacman -Qo` returns an owner for every `souveraine-*` file under
|
||||
`/etc/pam.d`, `/etc/systemd`, and `/usr/lib/systemd` on both devices.
|
||||
- `systemctl show souveraine-machined -p FragmentPath` returns the
|
||||
`/usr/lib/systemd/system/` path on both devices.
|
||||
- Neither `hyprland.lua` nor `execs.lua` mentions sessiond; both devices still
|
||||
come up with sessiond active after a cold boot, and the lock surface is the
|
||||
shell's, not the fallback PIN.
|
||||
- A fresh install of either device brings up sessiond with no hand-editing.
|
||||
|
||||
## Connects to
|
||||
|
||||
`docs/provisioning-gaps.md` §4 named this requirement on 2026-07-16 —
|
||||
*"installed by packaging, enabled at commission"* — for `souveraine-server`.
|
||||
The packaging half landed everywhere; the commission half is the node ceremony
|
||||
`FEDERATION.md` still parks, and this task is its first concrete piece.
|
||||
|
||||
TASK-25 (one repo, all packages) and TASK-27 (overlay is not a package) own the
|
||||
*delivery* rails; TASK-28 owns authority moving mid-upgrade. This is neither —
|
||||
it is who owns activation at commission time, which has had no task file. If a
|
||||
future session decides it belongs inside 27, fold it there rather than leaving
|
||||
two.
|
||||
|
||||
`SESSION-AUTHORITY-DOCTRINE` §11 (one authority) is the reason the machined
|
||||
shadow matters: two copies of the signer's unit is two answers to who signs.
|
||||
|
|
@ -100,6 +100,7 @@ Four that are cheap relative to what they unblock:
|
|||
| 23 | [culver locked-notification nudge](23-culver-locked-notification-nudge.md) | Needs `SyncBurst()` + an IdleCoordinator schedule (TASK-15). |
|
||||
| 24 | [Keyboard layout rethink](24-keyboard-layout-rethink.md) | Superseded by TASK-17's reference-led Daily/Terminal Squeekboard layouts. Retained as design evidence; do not resume its Stevia patch plan. |
|
||||
| 27 | [Gitea pipeline audit](27-gitea-pipeline-audit.md) | The fixes. Overlay is not a package; no `primary` branch; poisoned build sysroot. |
|
||||
| 76 | [Provisioning belongs to a package](76-provisioning-by-package.md) | Five hand-placed files own no package on the two live devices, and `/etc/systemd/system/souveraine-machined.service` shadows the packaged signer unit on **both**. Activation is two unversioned lua lines. `blueline-edge-sense` already ships the correct `.wants` pattern. |
|
||||
| 32 | [Pill and keyboard as owned apps](32-pill-and-osk-as-apps.md) | Keyboard now has one runtime/package owner and no dual-OSK provisioning; glass proof remains. Pill ownership and package-owned shell delivery remain open. |
|
||||
| 33 | [Battery belongs to the state machine](33-battery-as-device-state.md) | Last raw feed going straight to the glass. The charge ceiling is writable today. |
|
||||
| 37 | ["Back" as a first-class verb](37-navigation-back-verb.md) | Our `Gestures.qml` is already the compositor half; `can_go_back` is the dial's enabled/reason. |
|
||||
|
|
|
|||
Loading…
Reference in a new issue