SouveraineOS/STATE.md

SouveraineOS — cross-repo state

Souveraine is an OS, an agent substrate, and the name of an agent. Ani + Aster = Annie (primary consciousness + subconscious = composite). Hard constraint everywhere: no GNOME or KDE library dependencies.

This repo is the umbrella: cross-repo docs, decisions, session dumps, and this state file. Component repos keep their own repo-local PAF/ docs; what crosses repo boundaries lives here. Update this file when component state moves; it is the resume anchor.

Last updated: 2026-07-16 (evening — system tier / machined).

Component repos

souveraine (~/Projects/souveraine)

Branch experimental/session-trust-phase1 @ 8e540c7.

• Verified on archdev 2026-07-16: 295+8 tests, clippy -D warnings, aarch64 cross build (both souveraine and souveraine-machined ELF aarch64).
• Federation memory transport, first two steps landed (8cfa992, a62379a): memfs_commit presence signal on the bus after every memfs mutation (replaces the unconsumed memory_* events), and memory sync — per-instance branch push/fetch against the memfs origin remote. Merge policy / auto-fetch is next (FEDERATION.md sequencing step 3).
• Instance awareness, live half landed (8e540c7): device_announce carries hosted_agents, registry records it, souveraine peers shows hosts. Durable memfs system/instances.md log still to come.
• Session Trust Phase 1 is live on phone + laptop under qs -c souveraine: sessionctl arbiter, first-party lock/nav (pill retired), SessionEvents logind ingress + delay inhibitor, StepUpAuth, break-glass, hash-chained audit. Freshly green — the last five commits of Jul 14 were runtime fixes; see docs/DUMP-session-trust-2026-07-14.md.
• System tier landed 2026-07-16 (5039163 + 116562a, unbuilt-as-yet): souveraine-machined owns the machine seed at /var/lib/souveraine/seed-id as the souveraine system user, serves pubkey/sign over a group-gated socket (domain-separated signatures, SO_PEERCRED-logged). All server consumers resolve machine identity through MachineSigner (machined-first, loud legacy fallback, never generates); federation envelopes now signed domain-separated. Provisioning: sudo souveraine machine init --fresh|--migrate-from + system unit; wired into the PKGBUILD (sysusers + hardened unit). Deployment to phone/laptop waits on a built artifact (edge builds only on public). Known leftover: souveraine-secrets still reads the legacy seed dir — it needs a machined key-derivation op, not sign; migrate-from copies rather than moves precisely so it keeps working meanwhile.
• Doctrine decided 2026-07-16 (session-manager/lockscreen conversation): boot gate ≠ session lock. Auto-login as casey is transitional; target is system tier from boot (machine identity, enrollment, modem, boot-gate surface) with the user's world credential-gated (homed-shaped, credential-unlocks-storage). The lockscreen as built is the session lock (compositor-owned, correct); the gate below it does not exist yet. Disk encryption on the phone: not yet (deferred during modem bring-up).
• Federation design of record: docs/FEDERATION.md in THIS repo (2026-07-16 rewrite of souveraine's old local-only sketch, moved here because souveraine/docs is gitignored): identity/transport implemented + cited; three named gaps (shared memfs sourcing, memfs_commit firehose signal, instance awareness) roughed with sequencing; install-time agent instantiation is a parked FLAG — design the commission ceremony before building any installer.
• souveraine-secrets: org.freedesktop.secrets daemon behind the secrets feature, rooted in SeedId (no gnome-keyring/KWallet). Committed, not yet build-verified. Intended consumers: Chatty/libcmatrix via libsecret, and keyring-core.
• CI note: branch builds ride PR #1 on LAN Gitea (AGit — head moves only on refs/for/primary pushes). no-ai-attribution fails on the PR range due to two OLD commits (a7e909d, bc6ee12) carrying Opus co-author trailers — fixing means history rewrite, Casey's call, pending.
• Design docs for the shell live HERE in docs/, not in the repo tree (moved Jul 15; deletion committed 0f50a3e).

Pixel3Arch (~/Projects/Pixel3Arch)

main @ 862202a. Repo == phone for deployed config as of 2026-07-16.

• Mic: hexagonrpcd now serves the ADSP audio PD (verified live — fluence/ECNS opens succeed at boot). Open blocker is the SLIM IRQ-read NACK loop (~1090 hits/boot); state in PAF/audio.md. Capture route moved to MultiMedia2.
• MMS: works end-to-end via the netsvcs APN (PAF/mms.md). Open: mmsd-tng has session-autostart via hyprland.lua but no systemd unit; Chatty can't read the MMSC (daemon doesn't expose org.ofono.mms.ModemManager).
• USB: usb-signaller 0.3.1 built + staged; the RUNNING phone still uses usb-gadget-net (cutover severs the SSH link — do it with console fallback or at reprovision). Old gadget archived in archive/usb-gadget-net/.
• Untracked by design: pkgs/pulseaudio-q6/ (working clone; delta preserved in pkgs/pulseaudio-q6-overlay/), pkgs/*/pkg/ intermediates.
• Undecided: two full kernel worktrees kernel/linux-blueline-mic-order{,-g56} (~GBs, mic experiments, each has STATUS.md) — push branches to Gitea or drop.

Chatty (~/Projects/Chatty) + libcmatrix (~/Projects/libcmatrix)

Chatty branch identity-layer @ 1b94cf9; libcmatrix branch sas-fixes @ 0eb5f81. Both pushed to Gitea (Fimeg/Chatty, Fimeg/libcmatrix, remote name gitea) with full upstream history.

• Built and live-verified on the phone: history v6 (persons tables), ChattyPerson + identity API, Known/Unknown re-keyed (Matrix rooms no longer auto-Known), E.164 normalize, four SAS verification fixes (emoji verify completes).
• Design + build order: PAF-chatty-identity-layer.md in the Chatty repo. EDS was investigated and REJECTED (GNOME stack). Contacts backend is undecided pending qtpim work — see below.
• Phone runs hand-installed chatty/libchatty/libcmatrix binaries over pacman-owned files (stock backups: chatty.orig-pacman, libcmatrix.so.0u.orig-pacman). PKGBUILDs owed.

qtpim / contacts (~/Projects/qtpim, phone ~/Projects/qtpim)

Full state: docs/qtpim-contacts-handoff.md.

• qtpim dev (d03b5f6) built and installed on the phone at /usr (6.12-versioned libs on Qt 6.11.1, version check overridden; untracked — PKGBUILD owed). QML QtContacts module loads.
• Only the in-memory backend exists. qtcontacts-sqlite port stalled: it targets Sailfish's qtpim fork (IgnoreAccessConstraints). Three paths in the handoff; direction not chosen.

Decisions on record

• No GNOME/KDE library deps. EDS/libebook rejected for contacts.
• qtpim (upstream dev branch) is the contacts library direction.
• Fido MMS rides the netsvcs APN, patched into the carrier DB overlay.
• ETHOS-style guarantees are not runtime knobs; identity is a precondition (SeedId::load never generates).
• Contacts store under qtpim: undecided.

docs/ map

• FEDERATION.md — federation design of record: identity tiers, signed transport, memfs sync roughing, instance awareness, install-time instantiation flag (moved from souveraine/docs 2026-07-16).
• SESSION-AUTHORITY-DOCTRINE.md — session/power/lock authority model (§5–8 verified implemented on phone, 2026-07-15).
• SESSION-TRUST-ARCHITECTURE.md, TRUST-BOUNDARY-MATRIX.md, INTERFACE-ARCHITECTURE.md, HOW-IT-WORKS.md, REFERENCE-EXTRACTION.md, SETTINGS-APP-PLAN.md, README.md — shell design set (moved from souveraine repo).
• DUMP-*.md — per-session bootstrap dumps; write one per working session that changes cross-repo state.
• qtpim-contacts-handoff.md, session-trust-map.html — moved from ~/Projects and ~/ on 2026-07-16.