SouveraineOS/STATE.md

SouveraineOS — cross-repo state

Souveraine is an OS, an agent substrate, and the name of an agent. Ani + Aster = Annie (primary consciousness + subconscious = composite). Hard constraint everywhere: no GNOME or KDE library dependencies.

This repo is the umbrella: cross-repo docs, decisions, session dumps, and this state file. Component repos keep their own repo-local PAF/ docs; what crosses repo boundaries lives here. Update this file when component state moves; it is the resume anchor.

Last updated: 2026-07-21 (deprecated Chatty/libcmatrix/qtpim, cleaned refs).

Component repos

souveraine (~/Projects/souveraine)

Branch experimental/session-trust-phase1 @ c96f95b.

• Verified on archdev 2026-07-16: 295+8 tests, clippy -D warnings. Fresh aarch64 cross build of c96f95b VERIFIED GREEN (cross_rc=0, both binaries ELF aarch64) — artifacts staged at ~/.cache/souveraine-ci-target/aarch64-unknown-linux-gnu/release/ (souveraine + souveraine-machined); build tree ~/builds/machined-verify/Souveraine. This is the artifact for the phone federation test; the previous staged one was 116562a (pre-memory sync) — superseded.

NEXT SESSION (Casey's stated order, 2026-07-16 evening)

1. Souveraine phone-side test — DONE, PASSED (2026-07-16 late). Both machines on b4dc39e (laptop x86_64 + phone aarch64), agents speaking on glm-5.2. Machine identities split (laptop 6344f24e… ▽●△△ lineage via --migrate-from; phone 69bf24d7… ▽■◑★ fresh). memory sync ran on both sides via the agents' own tool: two instance/* branches on the Gitea remote, laptop's fetch surfaced the phone's branch. Phone Souveraine wrote system/instances.md unprompted after reading the briefing. Root cause of the mute-agent detour: agent-level provider: claude + empty key hitting Anthropic's OpenAI-compat 401 — fixed; plus the silent-turn-death and reasoning_content fixes (33068d6/b4dc39e). Every manual gap-fill from the test is recorded in docs/provisioning-gaps.md — that file is design input for the commission ceremony. Merge policy (FEDERATION.md step 3) remains the next transport build step. Phone hard-reset once mid-chat (no pstore configured — gap §5); phone memfs remains source of truth.
2. Auxo tray + contacts. Auxo-style multitasking tray under the dock — design first (talks only so far). Contacts: RESOLVED 2026-07-16 — the store is the user's address book, user-owned, Annie has a capability over it (Android runtime-permission model, not Annie's brain). Chatty/libcmatrix/qtpim all deprecated 2026-07-21 — Matrix surface now lives in souveraine's sensorium; contacts backend TBD (new approach needed). RCS: investigated, options in docs/messaging-rcs.md. Long-arc default stays Matrix-first + SMS fallback. No code touched.

• Federation memory transport, first two steps landed (8cfa992, a62379a): memfs_commit presence signal on the bus after every memfs mutation (replaces the unconsumed memory_* events), and memory sync — per-instance branch push/fetch against the memfs origin remote. Merge policy / auto-fetch is next (FEDERATION.md sequencing step 3).
• Instance awareness, live half landed (8e540c7): device_announce carries hosted_agents, registry records it, souveraine peers shows hosts. Durable memfs system/instances.md log still to come.
• Shell UX round 2026-07-16 (c96f95b, deployed to phone): drag-to-combine fixed (ghost was anchored — never generated drop events; stacks were only ever creatable via the pre-drag-only menu), rail rides atop squeekboard (measured via hyprctl layers) with swipe-down = keyboard-then-dock dismissal (dockSuppressed), overview dead-space tap dismisses, DockConfig has the real pins/stacks editor, pulseDockReveal restored. Touch verification on device is Casey's. IDEA PARKED: Auxo-style multitasking tray under the dock (talks only, nothing built).
• Session Trust Phase 1 is live on phone + laptop under qs -c souveraine: sessionctl arbiter, first-party lock/nav (pill retired), SessionEvents logind ingress + delay inhibitor, StepUpAuth, break-glass, hash-chained audit. Freshly green — the last five commits of Jul 14 were runtime fixes; see docs/DUMP-session-trust-2026-07-14.md.
• System tier landed 2026-07-16 (5039163 + 116562a, unbuilt-as-yet): souveraine-machined owns the machine seed at /var/lib/souveraine/seed-id as the souveraine system user, serves pubkey/sign over a group-gated socket (domain-separated signatures, SO_PEERCRED-logged). All server consumers resolve machine identity through MachineSigner (machined-first, loud legacy fallback, never generates); federation envelopes now signed domain-separated. Provisioning: sudo souveraine machine init --fresh|--migrate-from + system unit; wired into the PKGBUILD (sysusers + hardened unit). Deployment to phone/laptop waits on a built artifact (edge builds only on public). Known leftover: souveraine-secrets still reads the legacy seed dir — it needs a machined key-derivation op, not sign; migrate-from copies rather than moves precisely so it keeps working meanwhile.
• Doctrine decided 2026-07-16 (session-manager/lockscreen conversation): boot gate ≠ session lock. Auto-login as casey is transitional; target is system tier from boot (machine identity, enrollment, modem, boot-gate surface) with the user's world credential-gated (homed-shaped, credential-unlocks-storage). The lockscreen as built is the session lock (compositor-owned, correct); the gate below it does not exist yet. Disk encryption on the phone: not yet (deferred during modem bring-up).
• Federation design of record: docs/FEDERATION.md in THIS repo (2026-07-16 rewrite of souveraine's old local-only sketch, moved here because souveraine/docs is gitignored): identity/transport implemented + cited; three named gaps (shared memfs sourcing, memfs_commit firehose signal, instance awareness) roughed with sequencing; install-time agent instantiation is a parked FLAG — design the commission ceremony before building any installer.
• souveraine-secrets: org.freedesktop.secrets daemon behind the secrets feature, rooted in SeedId (no gnome-keyring/KWallet). Intended consumers: souveraine-player, culver, keyring-core (libsecret clients).
• CI note: branch builds ride PR #1 on LAN Gitea (AGit — head moves only on refs/for/primary pushes). no-ai-attribution fails on the PR range due to two OLD commits (a7e909d, bc6ee12) carrying Opus co-author trailers — fixing means history rewrite, Casey's call, pending.
• Design docs for the shell live HERE in docs/, not in the repo tree (moved Jul 15; deletion committed 0f50a3e).

Pixel3Arch (~/Projects/Pixel3Arch)

main @ 862202a. Repo == phone for deployed config as of 2026-07-16.

• Mic: hexagonrpcd now serves the ADSP audio PD (verified live — fluence/ECNS opens succeed at boot). Open blocker is the SLIM IRQ-read NACK loop (~1090 hits/boot); state in PAF/audio.md. Capture route moved to MultiMedia2.
• MMS: works end-to-end via the netsvcs APN (PAF/mms.md). Open: mmsd-tng has session-autostart via hyprland.lua but no systemd unit.
• USB: usb-signaller 0.3.1 built + staged; the RUNNING phone still uses usb-gadget-net (cutover severs the SSH link — do it with console fallback or at reprovision). Old gadget archived in archive/usb-gadget-net/.
• Untracked by design: pkgs/pulseaudio-q6/ (working clone; delta preserved in pkgs/pulseaudio-q6-overlay/), pkgs/*/pkg/ intermediates.
• Undecided: two full kernel worktrees kernel/linux-blueline-mic-order{,-g56} (~GBs, mic experiments, each has STATUS.md) — push branches to Gitea or drop.

Chatty + libcmatrix + qtpim (DEPRECATED 2026-07-21)

All three deprecated. Chatty/libcmatrix superseded by souveraine's built-in Matrix sensorium (--features matrix). qtpim contacts work stalled (sqlite backend never shipped). Historical docs retained: docs/chatty-matrix-features.md, docs/contacts-design.md, docs/qtpim-contacts-handoff.md. All repos pushed to Gitea (Fimeg/Chatty, Fimeg/libcmatrix, Fimeg/qtpim).

Decisions on record

• No GNOME/KDE library deps. EDS/libebook rejected for contacts.
• Fido MMS rides the netsvcs APN, patched into the carrier DB overlay.
• ETHOS-style guarantees are not runtime knobs; identity is a precondition (SeedId::load never generates).
• Chatty/libcmatrix/qtpim deprecated 2026-07-21. Matrix surface lives in souveraine's sensorium; contacts backend TBD.

docs/ map

• FEDERATION.md — federation design of record: identity tiers, signed transport, memfs sync roughing, instance awareness, install-time instantiation flag (moved from souveraine/docs 2026-07-16).
• SESSION-AUTHORITY-DOCTRINE.md — session/power/lock authority model (§5–8 verified implemented on phone, 2026-07-15).
• SESSION-TRUST-ARCHITECTURE.md, TRUST-BOUNDARY-MATRIX.md, INTERFACE-ARCHITECTURE.md, HOW-IT-WORKS.md, REFERENCE-EXTRACTION.md, SETTINGS-APP-PLAN.md, README.md — shell design set (moved from souveraine repo).
• DUMP-*.md — per-session bootstrap dumps; write one per working session that changes cross-repo state.
• session-trust-map.html — moved from ~/ on 2026-07-16.
• DEPRECATED: qtpim-contacts-handoff.md, contacts-design.md, chatty-matrix-features.md — historical, superseded by Matrix sensorium.