SouveraineOS/docs/tasks/README.md

# SouveraineOS — task files

Single-session-sized work units. Each file is self-contained: the goal, the
context a fresh session needs, the acceptance check, and where it connects.
Pick one, open a session, finish it. Don't pull in neighbours unless they're a
hard prerequisite.

**This index says what is left, not what happened.** History lives in the task
file. Closed work lives in [`archive/`](archive/README.md) with its full record
— nothing is deleted.

## Start here

Four that are cheap relative to what they unblock:

- **46 camera** — the drivers and CAMSS are already in our kernel; blueline's
  DT has no camera node at all. A same-sensor reference (Pocophone F1) sits in
  our own tree. Plausibly one session to a first frame.
- **31 dial contents** — the component and the squeeze that opens it are live;
  its entries are still a hand-written QML list. Wiring them to the verb tables
  is what stops a third capability enumeration existing.
- **19 settings health readout** — three separate tasks (08f, 42, 34) all owe
  their surfacing to this one page.
- **44 fingerprint** — the TrustZone wall is down and the TA protocol is
  recovered; the next check is whether a finger raises an edge, with a direct
  instrument in hand.

## Live — built, one check outstanding

| # | Task | What's left |
|---|------|-------------|
| 60 | [Multitasking is a place, not a transition](60-the-multitasking-view.md) | One-owner carry, measured card geometry, velocity-seeded spring, tray, Home, and the strand repro are on glass. What remains is a real split-zone card check; the inert 1.22 overshoot clamp is a TASK-53 compositor defect. |
| 53 | [viewtop audit: what it left open](53-viewtop-audit-open.md) | The original ten and cold-boot follow-ups are fixed. Firefox's 504/540 mismatch and the false touch-frame storm are source-fixed and pushed (`3431223`, `41f07b1`), awaiting package/glass proof. Open: overshoot clamp, persistent control connection, popup hit testing, and transparent-layer fallthrough. |
| 43 | [viewtop: the Souveraine compositor](43-viewtop-compositor.md) | Runs on the phone. Next lane is the ext-session-lock admission gate. The two-client lock handoff is the thing not to get wrong. |
| 29 | [SouveraineOS Updater](29-souveraine-updater.md) | Ships and installs by `pacman -Syu`. **Read-only on device** until something runs a polkit agent — that is the shell's job. Also owns TASK-42's layer 2. |

## In progress

| # | Task | What's left |
|---|------|-------------|
| 79 | [Project state: what became true, and what stopped being true](79-project-state.md) | First slice runs 2026-08-18 — `project-state/` holds W33 and W34 evidence, a carry-forward `state.json`, and a report where every finding traces to its rows. Left: which model holds the analyst (Fable reasons past any budget on this brief), a cadence decision, and whether the machine-written store belongs in this repo. |
| 77 | [The lens: a human-first garden over a git vault](77-lens-garden.md) | r18 is signed, indexed and package-owned on x86_64. Source is r19; package it next. AArch64 has a workflow path, not build/install/runtime proof. |
| 65 | [A stalled subconscious wedges the surface](65-subconscious-stall-wedges-the-surface.md) | Reproduced and measured, not diagnosed. The reply commits and `PrimaryComplete` fires, then the N+1 pass stalls at round 3 of 10 with a fully idle runtime — and because it runs inside `run_turn`, the SSE stream never closes and Surfaces spins forever. Lead is the `todo` tool. Needs a backtrace; the stream-lifetime coupling is a fix in its own right. |
| 63 | [The second body: SouveraineOS on the iPhone 7](63-d10-second-body.md) | **The shell is on the glass 2026-08-09** — viewtop, sessiond and `qs -c souveraine` all run on a T8010 with no GPU, drawn by llvmpipe, over one USB cable. Hoolock is the bootloader and nothing else. The build half of this is TASK-64. |
| 62 | [Full USB KVM](62-full-usb-kvm.md) | GUD + HID + NCM + smoo and the signed package path are green. Still open: install and cable/glass acceptance; real Session Authority gates (peer identity, probe lease, step-up, D-Bus enforcement); cold-boot SSH-over-NCM proof. Type-C/TCPM host negotiation remains TASK-58. |
| 08 | [Device state manager / power profiles](08-device-state-manager.md) | Largest task; sub-divide before starting. (e) lease missing, (f) **surfaced 2026-07-31** — health, evidence and the decision trail render on the Device page; last-seen and grip still absent from `device_state`. (g) confidence gates need a decision before code. |
| 16 | [culver: messenger + contacts](16-culver-messenger-contacts.md) | A/B/D landed. C (contact card) builds and awaits phone acceptance. F is the folded-in TASK-01. |
| 19 | [First-party Settings control center](19-settings-control-center.md) | State-machine + source-health readout **built 2026-07-31**, unverified on glass. 34 and 42's layer 3 still surface here. |
| 31 | [The radial dial](31-radial-dial.md) | Component, gestures and squeeze invocation are live. **Entries are still a list in `DialHost.qml`** — they must come from the verb tables. |
| 30 | [Agent reach: verb tables](30-agent-reach-verb-tables.md) | sessiond has describe + refusal codes + intent. Dock, apps, shell and settings do not. One session per surface. |
| 42 | [Build outcomes are invisible](42-build-outcomes-are-invisible.md) | Layer 1 built (`tools/ci-status.sh` + push hook). Layer 2 is TASK-29's, layer 3 is TASK-19's. Pin-rot prevention unbuilt. |
| 02 | [Lockscreen-as-Rust-system](02-lockscreen-rust-system.md) | sessiond's fallback should render the glance, not a second PIN pad. Stopgap shipped 07-17. |
| 14 | [Overview → phone app grid](14-overview-appgrid.md) | Paged app grid replacing the desktop workspace pane; Auxo-style running cards; unconditional Home path. |
| 49 | [Bearer selection and DNS](49-bearer-selection-as-device-state.md) | Machine evidence, settle window, `PreferLink`, tunnel-underlay pinning, readout, and the first two hardware checks landed. Open: split DNS through resolved, wifi/LTE transition, and honest deaf-tunnel proof. |

## Blocked or gated

| # | Task | Blocked by |
|---|------|------------|
| 15 | [Idle coordinator](15-idle-coordinator.md) | Freezing `app.slice` would freeze sessiond, shell and secrets. Needs slice separation first (measured 07-25). |
| 28 | [Handover on upgrade](28-upgrade-handover.md) | TASK-27's packaging. Also owns TASK-13's outstanding cold-boot handshake check. |
| 25 | [One repo, all packages](25-one-repo-all-packages.md) | Parked 07-25 — four blockers before `repo-add --sign`. See TASK-27. |
| 40 | [Inference tiering for the sensors](40-inference-tiering-sensors.md) | Nothing — **it is the gate.** P1 applied to sensord/grip/dial; gates the grip raw stream and TASK-31's IPC. Decisions first, then small code. |

## Open

| # | Task | What's left |
|---|------|-------------|
| 78 | [The claude login belongs to souveraine, not to `claude`](78-claude-login-owned-by-souveraine.md) | Scoped 2026-08-18, nothing built. Headless PKCE `souveraine login` (flow verified), a souveraine-owned credential file outside the phone/laptop sync, and a Panel notice when no login can speak. Full Providers subsection in the Panel is a later expansion. |
|---|------|-------------|
| 74 | [LibrePods: an admitted accessory](74-librepods-as-an-admitted-accessory.md) | **Scoped 2026-08-13.** AirPods protocol stays in LibrePods; sessiond must admit/audit presentation events and Quickshell projects the card. First gate: capture a redacted case-open fixture — connection is not proof of opening. |
| 73 | [One spine, two skins: the self-dashboard](73-self-dashboard.md) | Designed 2026-08-11, nothing built. RedFlag Desktop (Tauri, public) + house Gatehouse (wry + QML glance, lens skeleton), spine is agent-side pacman closure resolution that retires souveraine-updater's `pkexec --noconfirm`. Name and home-repo decisions are Casey's. |
| 71 | [QmlMobileScanner as a components app candidate](71-qml-mobile-scanner-candidate.md) | Recon 2026-08-11, verdict owed. GPL-3.0 Qt Quick scanner+writer (zxing-cpp/QZXing/zint, SQLite history). Compatible inside AGPL; camera gate is TASK-46; ffmpeg backend needs a freedreno check; fontawesome-qml likely **not** needed (no FontLoader in the tree — unverified). |
| 68 | [Shared household state: tasks first](68-shared-household-state.md) | Canonical plan landed 2026-08-10. First slice is an admitted local task trail + materialized QML app/sidebar view; Culver is the Personal-class client, not the authority. |
| 67 | [The caching landed blind, and compaction drifted](67-caching-landed-blind-and-compaction-drift.md) | Prompt caching is measured and per-turn usage now persists through `assistant_with_usage`; context occupancy reaches both TUI and Panel. Still open: render the provider cache split, regression-test a stable second-round read, settle the wide-tool-round breakpoint trade, and record the live subconscious strategy decision. |
| 64 | [One SouveraineOS build for the iPhone](64-one-iphone-build.md) | Scoped 2026-08-10, not started. `linux-pauli` is not a repository, reaches the phone by `scp`, and CI has never built it. The display work that day is worth more than its code: the raster is **derived, not guessed** — 888×1845 @ 60 off `adp_mipi_regs` — and `aperture_remove_all_conflicting_devices()` is the correct handoff. ADP still shows nothing with everything else correct; the `adp16` kernel is staged and has never booted. |
| 59 | [Her face on the glass: a Live2D presence](59-her-face-on-the-glass.md) | **Phase 1 passed on hardware 2026-08-05: ~58 fps, rig verified drawing (`painted_px` 23.6k/24k), 283 MB WebKit RSS.** Scoped from a Live2D board-girl found in a cloned blog. The reference streams its chat over **SSE terminated by `[DONE]`** — the contract souveraine's server already speaks, so the integration is accidentally done. Base layer is **wry**, not the Chromium already on the phone; the first deliverable is a measured frame rate for the Cubism runtime in WebKit on freedreno, and if that fails the task stops there. Replaces ani-avatar's 2.5 GB of sprite states with one rig. Reference rig ships as the working placeholder and gets edited toward Annie — it just stays out of any public repo. Summoned by app launch and/or the radial dial, not always-on. |
| 58 | [Host power: the SMB2 OTG boost](58-host-power-smb2-boost.md) | Host data works; the boost isn't. The SMB2 5 V boost exists in silicon and mainline's `qcom-smbx-charger` never registers it. Investigation first (which tree builds the running kernel, does smb2 touch the boost, does `qcom_pmic_typec` bind pmi8998), then vbus-supply + regulator + typec. Unlocks host-mode power, power-bank mode, and the Pi without a wall wart. |
| 57 | [The Pi dock head](57-pi-dock-head.md) | Phone stays a gadget; the Pi 4 drives the monitor + dock. NCM link is default, Venus encoder is present, compositor capture landed — the unproven seams are `zwlr_screencopy` vs our own capture IPC, and the Pi's own bring-up ("major malfunctions TBD"). Four phases: Pi bring-up, static chain, real capture + udev trigger, input injection. |
| 56 | [The island, and the bar's honest face](56-island-and-the-bars-honest-face.md) | Bar clears a region for sprawling notification banners, agent-controlled (Part A: design questions). Part B is buildable now: drop the LTE suffix, tap-to-cycle the carrier name (Fido → Casey → Fimeg), and a network-type indicator that shows the live connection instead of a wifi glyph that never reflects cellular. |
| 52 | [Atmosphere](52-atmosphere.md) | Attention as a compositor capability — the fifteen-technique vocabulary. Two are **already landed** (`expose` is negative space, `pose` is gravity wells), and `compile_custom_pixel_shader` + `PixelShaderElement` are already in our smithay, so most of the rest needs no new machinery. Build the attention model and one clock **first**; fifteen uncoordinated animators is §1's blind actors in the render path. |
| 50 | [Her hand on the glass](50-agent-hand-on-the-glass.md) | Every scene intent reaches the compositor now **except touch** — so she can move, scale, dim and close a window and cannot press anything inside one. The receiving end is built (`Origin::Agent`, the disjoint slot namespace, the evidence predicate); nothing calls it, so she still reaches touch through uinput, which is the exact conflation `input.rs` exists to prevent. Also owns the inverse mapping `pose` owes the hit test. |
| 51 | [viewtop to daily driver](51-viewtop-to-daily-driver.md) | The punch list between *runs* and *stable*, all of it found by using the phone: windows stack with nothing to tell them apart, screen capture is written and unmerged (so no UI change can be verified), volume buttons are recognised and dropped, and five named holes that are one decision each. |
| 48 | [Shell dies on any reload that owes a lock](48-lock-surface-reload-fatal.md) | **Unblocked.** Viewtop's lock admission/restore and two-client handoff now exist. The QML root still lacks the reload identity its children carry; the locked reload acceptance has not been rerun. |
| 47 | [Auto-brightness: anchors, none of it built](47-auto-brightness-anchors.md) | §12 reads as settled and has **zero** code behind its actuation half — no brightness `Action`, no anchors, `grep anchor src/` is empty. The evidence half (lux in, health tracked) is live. |
| 46 | [Camera](46-camera-imx363.md) | Front proven 2026-07-29; rear IMX363 wired, answered at **0x1a**, rotation-corrected — all shipped in `linux-blueline` r162 on edge. Userspace stack shipped as `blueline-camera` 1-1. Left: exposure/gain controls and a fresh acceptance pass on glass. |
| 44 | [Fingerprint (FPC1020)](44-fingerprint-fpc1020.md) | TrustZone wall down 2026-08-01; TA protocol recovered 2026-08-09 (`Pixel3Arch/docs/fpc-ta-protocol.md`). Sensor arms with the line idle-low. Open: does a finger raise an edge — direct instrument exists (`fpc_ta_check_finger_lost`). |
| 45 | [Haptics (CS40L20)](45-haptics-cs40l20.md) | **First: which chip actually drives the motor** — `pmi8998_haptics` is what the dial's detents use today. Then port `cs40l2x` from Kirisakura; firmware blobs are committed. |
| 41 | [Producers must be attested](41-attested-producers.md) | Design first. Demonstrated live 07-28 — a squeeze and a dial-open both accepted from an SSH shell. |
| 36 | [CHRE nanoapp host for the SLPI](36-chre-nanoapp-host.md) | Three methods to add; method table recovered 07-27. No longer on grip's critical path — wanted for DozeDeep detection and `elmyra_haptics_control`. |
| 34 | [SLPI FastRPC session wedge](34-slpi-bringup-sequencing.md) | Re-diagnose. The real symptom: a DSP session survives its host daemon's death and only a cold boot clears it. **No longer blocks grip.** |
| 03 | [Boot timing: splash → lock](03-boot-timing-splash-to-lock.md) | The EBUSY handoff race is the last timing bug. Splash text killed, holder added. |
| 07 | [WCD9340 mic](07-mic-wcd9340-slim-tx.md) | Functional and in daily STT use. One defect: the permanent sysclk + MICB2 power pin. Kernel branch `mic-race-fix`. |
| 09 | [Suspend-resume FTS calibration race](09-suspend-resume-fts.md) | Kernel-side real fix; interim fix shipped. Cold-boot only. |
| 12 | [Face auth as a capability factor](12-gaze-reference-face-auth.md) | Per-target. Phone needs front-camera bring-up — **that is TASK-46's IMX355 half.** |
| 17 | [Squeekboard + dictation polish](17-keyboard-squeekboard-dictation.md) | Sole OSK installed at pkgrel 4. Pkgrel 5 adds Daily's visible mode key and chooser for the separate five-row Terminal board; CI, install, repeated reopen, mic-state, and side-panel focus proof remain. Native completion follows. |
| 18 | [Selection/highlight action menu](18-selection-menu.md) | Component first, fluid before functional. **Read Aloud is unblocked** — TTS is live. |
| 20 | [Player: video + agent control](20-player-video-agent.md) | Video, snapshot, manifest. Preserve the music path. |
| 21 | [Reboot-to-Android confirmation](21-reboot-android-confirmation.md) | Scoped 07-22. A one-tap irreversible slot flip still sits bare in app search. |
| 23 | [culver locked-notification nudge](23-culver-locked-notification-nudge.md) | Needs `SyncBurst()` + an IdleCoordinator schedule (TASK-15). |
| 27 | [Gitea pipeline audit](27-gitea-pipeline-audit.md) | The fixes. Overlay is not a package; no `primary` branch; poisoned build sysroot. |
| 76 | [Provisioning belongs to a package](76-provisioning-by-package.md) | The viewtop-owned session edge and legal wrapper targets landed. Still open: package-owned QuickShell content, commission-time activation on each device, removal of `/etc` and user-unit shadows, and fresh-install proof. |
| 32 | [Pill and keyboard as owned apps](32-pill-and-osk-as-apps.md) | Keyboard now has one runtime/package owner and no dual-OSK provisioning; glass proof remains. Pill ownership and package-owned shell delivery remain open. |
| 33 | [Battery belongs to the state machine](33-battery-as-device-state.md) | Charge now enters as `SensorSource::Charge` through sensord and sessiond interprets it. Open: UPower supplier-walk threshold write support and the step-up-gated charge policy. |
| 37 | ["Back" as a first-class verb](37-navigation-back-verb.md) | Our `Gestures.qml` is already the compositor half; `can_go_back` is the dial's enabled/reason. |
| 39 | [Audio levels as tracked state](39-audio-levels-as-state.md) | Open policy: roles, defaults, lock tiers, and state-driven profile intent. WirePlumber persistence works; do not add a second writer. |

## Conventions

- **Repo of record:** `~/Projects/souveraine` (substrate + QML shell),
  `~/Projects/Pixel3Arch` (phone rootfs/overlays/kernel),
  `~/Projects/SouveraineOS/docs` (this tree).
- **Builds:** on archdev (`10.10.20.123`, ssh key `~/.ssh/ani`). Never the
  laptop (93% disk).
- **Phone:** ssh aliases `pixel` / `pixel-root` at `172.16.42.1`. COLD boots
  only — a warm reboot poisons TZ/remoteproc.
- **CI:** `SouveraineOS/tools/ci-status.sh <repo>` reads outcomes from the
  Gitea API. The runner journal is not a status source.
- **Commits:** no Co-Authored-By, no Claude attribution, terse sysadmin prose,
  no caveats in public messages.