9815185caa
Join the older storage and authority audits to the SAF principal contract. Passwd entries are not isolation while one human-owned process still executes every agent, and the existing souveraine account is machined's—not Souvie's.\n\nKeep the readiness task honest: its current health fields inventory paths, but do not yet prove admission or the UID handling a live turn.
5.4 KiB
Souveraine Rebuilt — component inventory
The wider answer to "what has Souveraine rebuilt or taken ownership of." The README family stays authority-binaries-only by design; this page is the full inventory, organized in tiers. It is also the seed for the eventual project reorganization: when repos get regrouped, they should land along these lines.
A component is listed when Souveraine carries its code — authored, forked with real divergence, or rebuilt against a platform it was never meant for. Consuming a stock upstream (NetworkManager, ModemManager, Hyprland) does not make the list; that is the homogenization doctrine working as intended.
Tier 0 — authority substrate (audited family)
The three secure daemons with their own pages and the audit ladder (P0–P4 in audit-status.md).
| Component | Language | Source | Page |
|---|---|---|---|
| souveraine-machined | Rust | souveraine/src/machined |
machined.md |
| souveraine-secrets | Rust | souveraine/src/secrets |
secrets.md |
| souveraine-sessiond | Rust | souveraine/src/sessiond |
sessiond.md |
Tier 1 — agent substrate
The souveraine binary itself — the consciousness runtime. One binary,
several load-bearing subsystems (souveraine/src/):
- server — turn engine and conversation seeding. Every conversation
entry point (TUI backend, HTTP API) passes through
seed_conversation_system_prompt; a session without it boots the agent amnesiac. - core/memory — memfs: the agent's git-backed memory with the tolerant-read / strict-write frontmatter contract.
- api + backend — HTTP surface and the local TUI backend, both clients of the same server core.
- tui / ui — the cockpit (chat, subconscious pane, settings).
- bridge — model access via the Bifrost gateway's
/v1/models; no hardcoded models (localProjects/Bifrostcheckout is currently empty; the gateway is consumed as a service). - harness / interface / cli — tool execution and the guarded CLI verbs
(
souveraine identity generatelives here, per the seeds-are- preconditions rule).
Security posture: everything runs as uid 1000 today — this tier is the
main beneficiary of per-agent UNIX accounts and worker processes (audit
P3) and of machined capability tokens once minted (P1). The living admission
and health contract is
../../../souveraine/saf/identity/02-agent-principal.md. The existing
souveraine Unix account is machine-tier only and must not be reused for
Souvie or as a pool account for all agents. When an agent-substrate subsystem
starts holding authority of its own, it graduates to a Tier-0-style page.
Tier 2 — boot and session surfaces
| Component | What it is | Source |
|---|---|---|
| souveraine-splash | Bare-metal DRM/KMS+GBM+EGL shader boot animation; holds the display until the session is ready. C, no compositor. | Pixel3Arch/bootsplash/main.c |
| splash-signal | The poke that fades the splash out for handoff. | Pixel3Arch/bootsplash/splash-signal.c |
| Souveraine Membrane (currently viewtop) | Device-local compositor at the glass: scene composition, physical input, and display-side disclosure enforcement from sessiond facts. Never session authority. | souveraine-viewtop |
| quickshell shell | The QML session surface: two-stage lock (glance / PIN), SessiondBridge heartbeat, session IPC (session.lock/inhibit/state/capabilities), lock-time redaction, Ai chat surface. |
souveraine/surfaces/quickshell |
| hypr overlays | Compositor policy that the handoff depends on (allow_session_lock_restore, lockdead_screen_delay), tracked, not hand-edited. |
Pixel3Arch/overlays/hypr |
The shell is deliberately not an authority: it is a client of sessiond.
The boot chain splash → sessiond → shell is documented in
session-authority-boot-order.md.
Tier 3 — rebuilt applications
Forks with real Souveraine divergence, carrying the identity layer into daily-driver apps:
| Component | Divergence | Source |
|---|---|---|
| DEPRECATED 2026-07-21. Identity layer: Person model, history schema v6, priority inbox. Superseded by souveraine's Matrix sensorium. | Fimeg/Chatty on Gitea, branch identity-layer |
|
| DEPRECATED 2026-07-21. E2EE verification fixes, edit/redaction/reply/reaction. No longer used. | Fimeg/libcmatrix on Gitea, branch sas-fixes |
|
| DEPRECATED 2026-07-21. QtContacts v6.12 beta. Contacts backend TBD with new approach. | Fimeg/qtpim on Gitea, branch dev |
These hold personal-tier data (Matrix credentials, contacts, message history). As the capability layer lands (audit P1/P2), they become clients of secrets/step-up rather than trusting the session bus.
Tier 4 — platform
Pixel3Arch — the board port itself: kernel packaging, firmware daemons,
rootfs overlays, power-button choreography. Canonical gap inventory lives
in that repo's docs/port-scope-gaps.md; it is the floor everything above
stands on, not a Souveraine component per se.
Reorganization note
When projects get regrouped into tiers for real, the test for each repo is: which tier's failure modes does it share? (Authority binaries fail closed; surfaces fail visible; applications fail recoverable; platform fails bricked.) A repo that spans tiers — souveraine holding both the substrate and the shell surface — is fine as long as the boundary inside it stays legible.