SouveraineOS/docs/souveraine-components/INVENTORY.md

Souveraine Rebuilt — component inventory

The wider answer to "what has Souveraine rebuilt or taken ownership of." The README family stays authority-binaries-only by design; this page is the full inventory, organized in tiers. It is also the seed for the eventual project reorganization: when repos get regrouped, they should land along these lines.

A component is listed when Souveraine carries its code — authored, forked with real divergence, or rebuilt against a platform it was never meant for. Consuming a stock upstream (NetworkManager, ModemManager, Hyprland) does not make the list; that is the homogenization doctrine working as intended.

Tier 0 — authority substrate (audited family)

The three secure daemons with their own pages and the audit ladder (P0–P4 in audit-status.md).

Component	Language	Source	Page
souveraine-machined	Rust	souveraine/src/machined	machined.md
souveraine-secrets	Rust	souveraine/src/secrets	secrets.md
souveraine-sessiond	Rust	souveraine/src/sessiond	sessiond.md

Tier 1 — agent substrate

The souveraine binary itself — the consciousness runtime. One binary, several load-bearing subsystems (souveraine/src/):

• server — turn engine and conversation seeding. Every conversation entry point (TUI backend, HTTP API) passes through seed_conversation_system_prompt; a session without it boots the agent amnesiac.
• core/memory — memfs: the agent's git-backed memory with the tolerant-read / strict-write frontmatter contract.
• api + backend — HTTP surface and the local TUI backend, both clients of the same server core.
• tui / ui — the cockpit (chat, subconscious pane, settings).
• bridge — model access via the Bifrost gateway's /v1/models; no hardcoded models (local Projects/Bifrost checkout is currently empty; the gateway is consumed as a service).
• harness / interface / cli — tool execution and the guarded CLI verbs (souveraine identity generate lives here, per the seeds-are- preconditions rule).

Security posture: everything runs as uid 1000 today — this tier is the main beneficiary of per-agent UNIX accounts (audit P3) and of machined capability tokens once minted (P1). When an agent-substrate subsystem starts holding authority of its own, it graduates to a Tier-0-style page.

Tier 2 — boot and session surfaces

Component	What it is	Source
souveraine-splash	Bare-metal DRM/KMS+GBM+EGL shader boot animation; holds the display until the session is ready. C, no compositor.	Pixel3Arch/bootsplash/main.c
splash-signal	The poke that fades the splash out for handoff.	Pixel3Arch/bootsplash/splash-signal.c
quickshell shell	The QML session surface: two-stage lock (glance / PIN), SessiondBridge heartbeat, session IPC (session.lock/inhibit/state/capabilities), lock-time redaction, Ai chat surface.	souveraine/surfaces/quickshell
hypr overlays	Compositor policy that the handoff depends on (allow_session_lock_restore, lockdead_screen_delay), tracked, not hand-edited.	Pixel3Arch/overlays/hypr

The shell is deliberately not an authority: it is a client of sessiond. The boot chain splash → sessiond → shell is documented in session-authority-boot-order.md.

Tier 3 — rebuilt applications

Forks with real Souveraine divergence, carrying the identity layer into daily-driver apps:

Component	Divergence	Source
Chatty fork	DEPRECATED 2026-07-21. Identity layer: Person model, history schema v6, priority inbox. Superseded by souveraine's Matrix sensorium.	Fimeg/Chatty on Gitea, branch identity-layer
libcmatrix	DEPRECATED 2026-07-21. E2EE verification fixes, edit/redaction/reply/reaction. No longer used.	Fimeg/libcmatrix on Gitea, branch sas-fixes
qtpim	DEPRECATED 2026-07-21. QtContacts v6.12 beta. Contacts backend TBD with new approach.	Fimeg/qtpim on Gitea, branch dev

These hold personal-tier data (Matrix credentials, contacts, message history). As the capability layer lands (audit P1/P2), they become clients of secrets/step-up rather than trusting the session bus.

Tier 4 — platform

Pixel3Arch — the board port itself: kernel packaging, firmware daemons, rootfs overlays, power-button choreography. Canonical gap inventory lives in that repo's docs/port-scope-gaps.md; it is the floor everything above stands on, not a Souveraine component per se.

Reorganization note

When projects get regrouped into tiers for real, the test for each repo is: which tier's failure modes does it share? (Authority binaries fail closed; surfaces fail visible; applications fail recoverable; platform fails bricked.) A repo that spans tiers — souveraine holding both the substrate and the shell surface — is fine as long as the boundary inside it stays legible.