docs: keep USB authority and hardware acceptance open
This commit is contained in:
Fimeg
parent
4aa61d735c
commit
b1a9efcc63
2 changed files with 71 additions and 6 deletions
|
|
@ -1,9 +1,14 @@
|
|||
# TASK 62 — full USB KVM: the phone becomes the glass and the hands
|
||||
|
||||
**Status: built on ArchDev, not installed on the phone.** Opened 2026-08-07.
|
||||
**Status: software and package pipeline green; phone install, cable acceptance,
|
||||
and authority enforcement remain open.** Opened 2026-08-07. Souveraine Gitea
|
||||
run 1237 built the receiver; Pixel3Arch run 1243 built, signed and published
|
||||
the full device archive. This is not a completed task until the landing order
|
||||
and the authority section below are accepted on hardware.
|
||||
|
||||
This task owns the one-cable composite from mode request through rollback and
|
||||
the first hardware acceptance. It does not own phone-as-host power; TASK-58
|
||||
does.
|
||||
the first hardware acceptance. It does not own phone-as-host power or Type-C
|
||||
negotiation; TASK-58 does, and remains open.
|
||||
|
||||
## Contract
|
||||
|
||||
|
|
@ -29,11 +34,11 @@ the system D-Bus mechanism.
|
|||
| Layer | Canonical path | State |
|
||||
|---|---|---|
|
||||
| Receiver + display + HID | `souveraine/src/bin/souveraine-usb-kvm.rs` | built ARM64 |
|
||||
| Session authority | `souveraine/src/sessiond/{protocol,device_state,server}.rs` | `usb` + `set_usb_mode`, including `kvm` |
|
||||
| Session authority | `souveraine/src/sessiond/{protocol,device_state,server}.rs` | route + audit built; authorization is **not finished** |
|
||||
| Human surface | `souveraine/surfaces/quickshell/` | nested Power Options; HID and KVM are live leaves when advertised |
|
||||
| Souveraine package | `souveraine/packaging/arch/PKGBUILD.prebuilt` | receiver included on aarch64 |
|
||||
| Gadget mechanism | `usb-signaller/` | full composite, readiness gates, rollback, user-owned HID/GUD lane |
|
||||
| Device packages | `Pixel3Arch/pkgs/{usb-signaller,smoo}` | recipes written; not published/installed |
|
||||
| Device packages | `Pixel3Arch/pkgs/{usb-signaller,smoo,blueline-usb-gadget}` | published through Gitea; not installed from the new archive |
|
||||
|
||||
The separate local `souveraine-usb` repo is a safety copy from the first
|
||||
layout attempt, not a source of record. Do not build another package from it.
|
||||
|
|
@ -54,11 +59,71 @@ layout attempt, not a source of record. Do not build another package from it.
|
|||
this private build. Do not publish its binary into a public archive until that
|
||||
is resolved.
|
||||
|
||||
## Not finished — Session Authority
|
||||
|
||||
Routing a request through sessiond is not the same thing as making sessiond the
|
||||
sole authority. Today the shape is correct but the gate is incomplete:
|
||||
|
||||
- `usb` is an ambient, read-only projection and can stay that way;
|
||||
- `set_usb_mode` is named and audited, but currently admits every supported
|
||||
device-role mode;
|
||||
- `attached_identity` and `probe_owner` are stable fields whose values are
|
||||
still `null` — federation and the probe lease registry do not feed them yet;
|
||||
- the held-power surface is intentionally available while locked, so HID/KVM
|
||||
changes currently have no credential or known-peer gate;
|
||||
- usb-signaller's system D-Bus method can still be called around sessiond by
|
||||
another locally permitted process. The authority is advisory until mutation
|
||||
is restricted to the attested/sessiond path.
|
||||
|
||||
The intended rule is not "the agent cannot operate USB." The agent owns device
|
||||
operation. A known federated peer may receive a scoped policy that allows the
|
||||
agent to compose the port without repeatedly asking. An unknown peer, a new
|
||||
export, or physical-access posture needs user step-up; `charging_only` remains
|
||||
an always-available safe contraction. Add these operations to
|
||||
`TRUST-BOUNDARY-MATRIX.md`, emit `not_permitted`/`refused_by_state` from real
|
||||
checks, and close the direct D-Bus bypass before calling the authority seam
|
||||
finished.
|
||||
|
||||
Sam's proposed privileged `smoo-host` D-Bus service is the host-side mirror of
|
||||
this boundary, not its replacement: smoo owns export mechanics; Session
|
||||
Authority owns whether this peer, export and moment are allowed.
|
||||
|
||||
## Management tether — one owner, hardware proof still owed
|
||||
|
||||
Live inspection on 2026-08-07 found and removed the last obsolete static
|
||||
owner:
|
||||
|
||||
- `usb-gadget-net.service` was disabled/inactive but still existed unowned in
|
||||
`/etc`, with an unowned `/usr/local/sbin/usb-gadget-net`; both were removed
|
||||
from the phone and the stale rootfs enable link was deleted;
|
||||
- usb-signaller is now the sole configfs gadget owner;
|
||||
- `blueline-usb-gadget 1.0.0-2` owns `40-usb0.network` and the one-shot stale
|
||||
interface flush, which ran successfully at boot;
|
||||
- commit `Pixel3Arch 8c9c50f` adds that previously hand-installed package to
|
||||
the Gitea publisher as `1.0.0-3`, so the fix no longer depends on this one
|
||||
phone remembering it.
|
||||
|
||||
The phone was in `charging_only` during inspection, so this is ownership and
|
||||
boot-graph proof, not a fresh SSH-over-NCM proof. Acceptance still requires a
|
||||
cold boot into developer mode with exactly one live `usb*` interface holding
|
||||
`172.16.42.1`, no competing link-down route, and a successful SSH connection
|
||||
over the cable.
|
||||
|
||||
## Separate and still open — Type-C/TCPM
|
||||
|
||||
The full KVM composite keeps the phone in USB device role; its green build says
|
||||
nothing about phone-as-host negotiation. TASK-58 owns the
|
||||
`qcom-pmic-typec-smb2` port, CC/TCPM negotiation, internal SMB2 OTG regulator
|
||||
and source VBUS. That work is expected to materially improve negotiation and
|
||||
unlock proper C-to-C host behaviour. Do not let successful gadget-mode
|
||||
acceptance close or demote it.
|
||||
|
||||
## Phone truth before landing
|
||||
|
||||
Measured at `10.10.30.213` on 2026-08-07:
|
||||
|
||||
- `usb-signaller 0.3.1-3`, `souveraine r379`, no `smoo` package;
|
||||
- `blueline-usb-gadget 1.0.0-2` installed; legacy static gadget removed;
|
||||
- live mode `charging_only`;
|
||||
- advertised modes: developer, tethering, charging-only, MTP and host;
|
||||
- data role `device`, charger online;
|
||||
|
|
|
|||
|
|
@ -38,7 +38,7 @@ Four that are cheap relative to what they unblock:
|
|||
|
||||
| # | Task | What's left |
|
||||
|---|------|-------------|
|
||||
| 62 | [Full USB KVM](62-full-usb-kvm.md) | GUD display-in + HID + NCM + smoo, transactional mode rollback, sessiond verbs and the nested power-sheet control all build. Package publication and the staged host/glass acceptance remain; the phone still runs usb-signaller pkgrel 3 and has no smoo. |
|
||||
| 62 | [Full USB KVM](62-full-usb-kvm.md) | GUD + HID + NCM + smoo and the signed package path are green. Still open: install and cable/glass acceptance; real Session Authority gates (peer identity, probe lease, step-up, D-Bus enforcement); cold-boot SSH-over-NCM proof. Type-C/TCPM host negotiation remains TASK-58. |
|
||||
| 08 | [Device state manager / power profiles](08-device-state-manager.md) | Largest task; sub-divide before starting. (e) lease missing, (f) **surfaced 2026-07-31** — health, evidence and the decision trail render on the Device page; last-seen and grip still absent from `device_state`. (g) confidence gates need a decision before code. |
|
||||
| 16 | [culver: messenger + contacts](16-culver-messenger-contacts.md) | A/B/D landed. C (contact card) builds and awaits phone acceptance. F is the folded-in TASK-01. |
|
||||
| 19 | [First-party Settings control center](19-settings-control-center.md) | State-machine + source-health readout **built 2026-07-31**, unverified on glass. 34 and 42's layer 3 still surface here. |
|
||||
|
|
|
|||
Loading…
Reference in a new issue