SouveraineOS/STATE.md

SouveraineOS — cross-repo state

Souveraine is an OS, an agent substrate, and the name of an agent. Ani + Aster = Annie (primary consciousness + subconscious = composite). Hard constraint everywhere: no GNOME or KDE library dependencies.

This repo is the root: cross-repo docs, decisions, session dumps, and the canonical PAF device spine. Component repos hold code and a pointer back here; they do not keep a second living architecture. Update this file when component state moves; it is the resume anchor.

Shell-surface migration checklist: SHELL-SURFACES.md. Walk it before any substrate cutover (ii → souveraine, later souveraine → viewtop). The subconscious three-tier surface was stranded for over a week by the ii → souveraine move for want of exactly this list; nine device packages went stale the same way for the same reason. The packages are now cured (2026-07-30): Pixel3Arch packages.yml publishes all 14 into the edge archive, so pacman -Sl souveraine-aarch64 is the manifest. The surface gap (a souveraine overlay host for the subconscious views) is still open.

Last updated: 2026-08-15 (the charge lane and the machined handoff; see below).

2026-08-15 — charge becomes a sensor source; machined is handed over

Two lanes:

Laptop → viewtop is real, and recorded. The earlier "no laptop cutover scheduled" answer was wrong; Casey corrected it and the plan is now in STATE as three commits (a46d9cb, 6d19ce5, b45d776): the laptop moves to viewtop as the genuine test bed, via a login-time session choice (viewtop | hyprland). The chooser must be phone-shaped (touch-first, thumb-sized); mechanism undecided — SDDM session choice is the fallback if nothing phone-shaped exists, but the search should start phone-shaped, not at SDDM.

Charge evidence moved into the sensor enum, structurally. The r506 build had ChargeEvidence — a sysfs-reading, conclusion-computing struct probed by sessiond itself on the clock. The review found it violating the machine's own rule four times (side door note_charge, the authority probing, the driver interpreting, nothing leaving tick()), and its justifying comment cited bearer, another instance of the same divergence. The correction is committed in r507: SensorSource::Charge + SensorValue::Charge on the wire, reported by souveraine-sensord (30-second change-driven poll; the 5-second sysfs probe is gone from sessiond's clock), entered through sensor_input like every other source, with EvidenceSeen/SourceHealth/last-seen from the gate for free and conclude_charge() on the machine as its one decision. CI and PKGBUILD now ship sensord on x86_64 too — the laptop has a battery, and a machine without the reporter has no charge evidence at all. Ruling and bearer audit: docs/DEVICE-STATE-MACHINE.md §4.

Machined. Annie's handoff: machined's packaged unit was fixed (/usr/lib ExecStart on both devices; backup at /var/backups/souveraine-machined.service.20260815; the phone's backup is gone). Neither device has restarted machined onto the packaged unit yet — that restart is deliberate here, the signer handoff. scratchpad/ HANDOFF-open-questions.md (the "4/6" list) was not found on laptop, phone, or vanguard; its contents arrived pasted in-message instead.

2026-08-09 — fingerprint: the protocol is recovered

fpctzappfingerprint is not stripped, so its dispatch tables resolve to real function names. Eight targets; 10 is sensor, 11 is bio and bio carries the whole enrol/identify/enumerate/delete lifecycle. Recovered statically from the vendor image on disk — no device, no Android, no Frida. Tables and wire format: Pixel3Arch/docs/fpc-ta-protocol.md.

TASK-44's remaining question — does a finger raise an edge — now has a direct instrument instead of a correlational one: target 10 command 1 is fpc_ta_check_finger_lost. tools/fp-finger.py, also at ~/fp-finger.py on the phone. It needs a human finger; that is the only reason it has not run.

Storage is confined to targets 2 and 12, so targets 10 and 11 cannot block on a listener — the enrol lifecycle runs in RAM today, with persistence deferred. Keep target 2, target 12's remove path and target 5 (production test) off the daily driver: a parked TZ blocks every QSEECOM caller until reboot.

Five fingerprint tools that existed only on the phone since 2026-08-01 are now in Pixel3Arch/tools/.

Separate strand, same session: the SDM845 boot-chain exploit trio is evaluated in Pixel3Arch/docs/secure-world-references.md. blueline's hyp is Google-signed rather than QTI-signed, so EL2 is reachable per-boot over USB but never persistently.

2026-08-04 — on the phone, verified

Installed and running: souveraine-viewtop 0.1.0.r76.gf25c2b2, souveraine 0.1.r333.g6b67512.

viewtop's packaging hole is closed, and it was the important one. pkgs/souveraine-viewtop/PKGBUILD had existed since the hand-scp era and appeared in none of packages.yml's build lists, so nothing ever built it — the device ran a hand-made package while main moved ahead. viewtop's own CI (ci.yml) has one job, check, and never publishes, so a green run there still says nothing about what shipped. That is the same ambiguity the retired public branch had in souveraine, one repo over, and it is only half closed: packages.yml now builds it, but a viewtop commit still does not trigger a rebuild. Someone must dispatch packages.yml or touch pkgs/**.

Also: this Gitea requires sign-in instance-wide, so no anonymous clone of a first-party repo works, public or not. viewtop is the only PKGBUILD whose source= points at our own Gitea — every other one fetches from github, gitlab, codeberg or freedesktop — which is why nothing had hit this before.

Four defects fixed, each measured on the glass:

• Per-window capture was unreachable. viewtop served the standard ext-image-copy-capture toplevel path and quickshell never used it: quickshell holds wlr toplevel handles (the protocol with activate and close, the only one that can carry a dock), an ext capture source is named by an ext_foreign_toplevel_handle_v1, and nothing correlates them. It refused client-side — Capture source set to non captureable object — and the compositor was never asked. Every overview card and dock preview was a transparent box. Fixed by serving hyprland_toplevel_export_v1, which takes the wlr handle directly; given both, quickshell picks it. Both paths end in the same copy_window_into. See crates/compositor/src/toplevel_export.rs for the expiry condition — if quickshell grows the standard path, the global drops with no renderer change.
• Titles were empty. publish_toplevel ran at map, on focus change and on maximize/fullscreen but never on commit, and clients set their title after mapping. Everything read "Window", the QML fallback.
• Borders differed between two tiled windows from one width and one code path: the frame was a filled slab drawn behind the window, relying on the client to cover its middle. Now four edge rects.
• Screen capture came back vertically flipped — a top-anchored bar landed on the bottom edge. GlesMapping::flipped() really is hardcoded true, so the old row-reversal looked right; it was one inversion too many.

The accelerometer claim is dropped (TASK-15 question 1, answered and closed). Measured, idle, one flag apart: iio-sensor-proxy 15.3% → 1.1%, total sensor cost 17.2% → 2.6% of a core, 47.9 → 45.9 °C. Claiming the accelerometer is what makes iio-sensor-proxy poll continuously; monitor-sensor itself was 0.8% and sensord 0.1% — the subprocess was never the cost. This is not "accel is unwanted": a subprocess holding a continuous claim is the wrong way to get it, and TASK-36's SLPI batching is the right one. Restore the source only together with that. Consequence for TASK-08(g): observed_confidence loses accel's +0.3 once the source ages out, so there is one fewer input for confidence to gate.

Open, and the next session should start here

• The shell is still keyed to Hyprland's instance signature. Persistent.qml reads HYPRLAND_INSTANCE_SIGNATURE, which is unset under viewtop, so isNewHyprlandInstance compares "" to "" and is permanently false. It gates LockScreen.qml:145 (lock.launchOnStartup — so lock-on-startup never fires), LockScreen.qml:289, services/Idle.qml:59 and ii-base/services/Idle.qml:21. viewtop's single-instance mechanic is the control socket's clear_stale, but that is a mutex, not an identity — there is no per-start value to compare. Fix is two-sided: viewtop exposes an instance id on {"op":"state"}, the shell reads that instead of the env var.
• Captured card content is streaky / wrong-surface. Frames arrive (hasContent=true, correct size) but the contents are not right.
• viewtop security audit not started. SECURITY-AUDIT.md already carries the standing principles P1–P7, the watch list, "Three ungated boundaries in the compositor, found 2026-08-03", and the long-arc process-isolation goal — note it never uses the word "viewtop", it says "the compositor", so absence of the word is not absence of coverage. Scope, deliverable, and what "RedFlag" refers to are still unanswered.
• SouveraineOS working tree is dirty: 08, 15 and README modified, 54/55/56 untracked. TASK-15's accel measurement is written in but uncommitted.

DEPLOYMENT — the phone updates with pacman. Do not flash.

As of 2026-07-24 the Pixel 3 is a normal Arch box: pacman -Syu from the Gitea repo. That includes the kernel. The phone is Casey's daily driver — a reprovision costs him his live system — so reaching for fastboot is a regression, not a fallback.

• Repo: [souveraine-aarch64] → the rolling edge release of Fimeg/souveraine, SigLevel = Required DatabaseRequired. Wiring lives in Pixel3Arch/rootfs-overlay/ so a reprovision cannot lose it again (it was configured live once and vanished at the next flash).
• Kernel: installs like any package. pocketboot boots /boot/vmlinuz-blueline via extlinux on Arch_root (XBOOTLDR type GUID); the pacman hook 95-blueline-extlinux.hook → blueline-promote-boot copies the versioned kernel + initramfs onto those generic names. boot_a is stale — it still carries pmos_root_uuid and no root=, so it is NOT what boots the system. Flashing it changes nothing.
• Packaged and delivered by pacman -Syu: souveraine, -secrets, -machined, -sessiond, upower-souveraine. Nothing belongs in /usr/local/bin any more. (-sessiond was marked "aarch64 only" on 07-24 because a partial install — no unit, no PAM, no hook — hit lock-screen errors on the laptop; corrected in HANDOFF-2026-08-09-power-authority.md §4. Sessiond now runs on both: laptop enabled 2026-08-15 from the hyprland.start hook, recovery steps in ~/sessiond-failed-recovery.md.) First observed on the laptop 2026-08-15: the machine's own idle policy is now live here too — screen dims on inactivity, taps restore. Keep or change is an open question; it is new behavior on this box, not a regression.
• The laptop's compositor plan is viewtop. Stated by Casey 2026-08-15: basic viewtop functionality already works; the laptop is wanted as the real test bed for future viewtop updates. Chosen approach (Casey, 2026-08-15): a login-time session choice — viewtop and Hyprland both offered at login, so a broken viewtop update costs one wrong login and never the box. The chooser mechanism is undecided (SDDM is one candidate among others) and should be phone-shaped: the same session selection will need to work on the phone, touch-first. Not yet scheduled; no cutover work has begun.
• The kernel is NOT yet in that list (corrected 2026-07-25). It was pacman -U'd by hand; kernel.yml has never once passed and kernel-latest has never been published. Three blockers precede repo-add --sign — see TASK-25. Parked by Casey 2026-07-25.
• 5,624 files under /usr /etc /opt /boot are still owned by nothing — the same disease, not yet colliding. One of them, blueline-proximity-lock, is a running second authority over proximity (resolved 2026-07-25 — it reports to sessiond and decides nothing; packaging is TASK-27). Inventory + the conflict-computation recipe: TASK-25.

Real reasons to flash, and only these: the boot chain itself is broken (pocketboot/extlinux/initramfs unbootable), partitioning changes, or a deliberate from-scratch reprovision. A new kernel is not one of them.

NEVER build on the phone. archdev (casey@10.10.20.123) cross-compiles everything, including meson+cargo projects — see Pixel3Arch/pkgs/squeekboard/build-cross.sh for the pattern. binfmt for aarch64 is registered on the Proxmox host with the F flag, so the unprivileged archdev container can execute aarch64 binaries.

Full design + traps: docs/tasks/25-one-repo-all-packages.md.

Component repos

souveraine (~/Projects/souveraine)

Branch experimental/session-trust-phase1 @ c96f95b.

• Verified on archdev 2026-07-16: 295+8 tests, clippy -D warnings. Fresh aarch64 cross build of c96f95b VERIFIED GREEN (cross_rc=0, both binaries ELF aarch64) — artifacts staged at ~/.cache/souveraine-ci-target/aarch64-unknown-linux-gnu/release/ (souveraine + souveraine-machined); build tree ~/builds/machined-verify/Souveraine. This is the artifact for the phone federation test; the previous staged one was 116562a (pre-memory sync) — superseded.

souveraine-viewtop (~/Projects/souveraine-viewtop)

main @ 458a354, CI green on all six gates 2026-08-02. 7918 lines, 150 tests.

• Touch is served, and unexercised on hardware. Origin carries provenance from the event source: a finger reports sessiond's input + sensor_input, an agent tap reports neither and still reaches the seat identically (§13). Otherwise observed_confidence climbs in an empty room. This is what the uinput bridge structurally cannot do — see docs/TOUCH-AND-EVIDENCE.md.
• Before this the seat had no touch capability at all, on a device whose only input is the panel, and smithay/backend_libinput had been enabled and unused.
• Next lane: KMS on device (TASK-43 has the resume steps and the risks). It will show clients on black — shell-host is thirteen lines, so nothing paints chrome. sensor_health.touch is unknown on the phone and flips to live on the first real finger; that is the cheap proof needing no pixels.
• No touch-capable client is installed. kitty is touch-blind; want extra/weston (weston-simple-touch) and extra/wev.

NEXT SESSION (Casey's stated order, 2026-07-16 evening)

1. Souveraine phone-side test — DONE, PASSED (2026-07-16 late). Both machines on b4dc39e (laptop x86_64 + phone aarch64), agents speaking on glm-5.2. Machine identities split (laptop 6344f24e… ▽●△△ lineage via --migrate-from; phone 69bf24d7… ▽■◑★ fresh). memory sync ran on both sides via the agents' own tool: two instance/* branches on the Gitea remote, laptop's fetch surfaced the phone's branch. Phone Souveraine wrote system/instances.md unprompted after reading the briefing. Root cause of the mute-agent detour: agent-level provider: claude + empty key hitting Anthropic's OpenAI-compat 401 — fixed; plus the silent-turn-death and reasoning_content fixes (33068d6/b4dc39e). Every manual gap-fill from the test is recorded in docs/provisioning-gaps.md — that file is design input for the commission ceremony. Merge policy (FEDERATION.md step 3) remains the next transport build step. Phone hard-reset once mid-chat (no pstore configured — gap §5); phone memfs remains source of truth.
2. Auxo tray + contacts. Auxo-style multitasking tray under the dock — design first (talks only so far). Contacts: RESOLVED 2026-07-16 — the store is the user's address book, user-owned, Annie has a capability over it (Android runtime-permission model, not Annie's brain). Chatty/libcmatrix/qtpim all deprecated 2026-07-21 — Matrix surface now lives in souveraine's sensorium; contacts backend TBD (new approach needed). RCS: investigated, options in docs/messaging-rcs.md. Long-arc default stays Matrix-first + SMS fallback. No code touched.

• Federation memory transport, first two steps landed (8cfa992, a62379a): memfs_commit presence signal on the bus after every memfs mutation (replaces the unconsumed memory_* events), and memory sync — per-instance branch push/fetch against the memfs origin remote. Merge policy / auto-fetch is next (FEDERATION.md sequencing step 3).
• Instance awareness, live half landed (8e540c7): device_announce carries hosted_agents, registry records it, souveraine peers shows hosts. Durable memfs system/instances.md log still to come.
• Shell UX round 2026-07-16 (c96f95b, deployed to phone): drag-to-combine fixed (ghost was anchored — never generated drop events; stacks were only ever creatable via the pre-drag-only menu), rail rides atop squeekboard (measured via hyprctl layers) with swipe-down = keyboard-then-dock dismissal (dockSuppressed), overview dead-space tap dismisses, DockConfig has the real pins/stacks editor, pulseDockReveal restored. Touch verification on device is Casey's. IDEA PARKED: Auxo-style multitasking tray under the dock (talks only, nothing built).
• Session Trust Phase 1 is live on phone + laptop under qs -c souveraine: sessionctl arbiter, first-party lock/nav (pill retired), SessionEvents logind ingress + delay inhibitor, StepUpAuth, break-glass, hash-chained audit. Freshly green — the last five commits of Jul 14 were runtime fixes; see docs/DUMP-session-trust-2026-07-14.md.
• System tier landed 2026-07-16 (5039163 + 116562a, unbuilt-as-yet): souveraine-machined owns the machine seed at /var/lib/souveraine/seed-id as the souveraine system user, serves pubkey/sign over a group-gated socket (domain-separated signatures, SO_PEERCRED-logged). All server consumers resolve machine identity through MachineSigner (machined-first, loud legacy fallback, never generates); federation envelopes now signed domain-separated. Provisioning: sudo souveraine machine init --fresh|--migrate-from + system unit; wired into the PKGBUILD (sysusers + hardened unit). Deployment to phone/laptop waits on a built artifact (edge builds only on public). Known leftover: souveraine-secrets still reads the legacy seed dir — it needs a machined key-derivation op, not sign; migrate-from copies rather than moves precisely so it keeps working meanwhile.
• Doctrine decided 2026-07-16 (session-manager/lockscreen conversation): boot gate ≠ session lock. Auto-login as casey is transitional; target is system tier from boot (machine identity, enrollment, modem, boot-gate surface) with the user's world credential-gated (homed-shaped, credential-unlocks-storage). The lockscreen as built is the session lock (compositor-owned, correct); the gate below it does not exist yet. Disk encryption on the phone: not yet (deferred during modem bring-up).
• Federation design of record: docs/FEDERATION.md in THIS repo (2026-07-16 rewrite of souveraine's old local-only sketch, moved here because souveraine/docs is gitignored): identity/transport implemented + cited; three named gaps (shared memfs sourcing, memfs_commit firehose signal, instance awareness) roughed with sequencing; install-time agent instantiation is a parked FLAG — design the commission ceremony before building any installer.
• souveraine-secrets: org.freedesktop.secrets daemon behind the secrets feature, rooted in SeedId (no gnome-keyring/KWallet). Intended consumers: souveraine-player, culver, keyring-core (libsecret clients).
• CI note: branch builds ride PR #1 on LAN Gitea (AGit — head moves only on refs/for/primary pushes). no-ai-attribution fails on the PR range due to two OLD commits (a7e909d, bc6ee12) carrying Opus co-author trailers — fixing means history rewrite, Casey's call, pending.
• Design docs for the shell live HERE in docs/, not in the repo tree (moved Jul 15; deletion committed 0f50a3e).

Pixel3Arch (~/Projects/Pixel3Arch)

Implementation repo; this block is a 2026-07-16 deployment snapshot, not the current phone status. The living hardware record is PAF/ here in SouveraineOS.

• Audio now works: HiFi speaker/microphone, STT capture, and real two-way calls. The old SLIM failures and their fixes remain in PAF/audio.md as history.
• MMS: works end-to-end via the netsvcs APN (PAF/mms.md). Open: mmsd-tng has session-autostart via hyprland.lua but no systemd unit.
• USB: usb-signaller 0.3.1 built + staged; the RUNNING phone still uses usb-gadget-net (cutover severs the SSH link — do it with console fallback or at reprovision). Old gadget archived in archive/usb-gadget-net/.
• Untracked by design: pkgs/pulseaudio-q6/ (working clone; delta preserved in pkgs/pulseaudio-q6-overlay/), pkgs/*/pkg/ intermediates.
• Undecided: two full kernel worktrees kernel/linux-blueline-mic-order{,-g56} (~GBs, mic experiments, each has STATUS.md) — push branches to Gitea or drop.

Chatty + libcmatrix + qtpim (DEPRECATED 2026-07-21)

All three deprecated. Chatty/libcmatrix superseded by souveraine's built-in Matrix sensorium (--features matrix). qtpim contacts work stalled (sqlite backend never shipped). Historical docs retained: docs/chatty-matrix-features.md, docs/contacts-design.md, docs/qtpim-contacts-handoff.md. All repos pushed to Gitea (Fimeg/Chatty, Fimeg/libcmatrix, Fimeg/qtpim).

Decisions on record

• No GNOME/KDE library deps. EDS/libebook rejected for contacts.
• Fido MMS rides the netsvcs APN, patched into the carrier DB overlay.
• ETHOS-style guarantees are not runtime knobs; identity is a precondition (SeedId::load never generates).
• Chatty/libcmatrix/qtpim deprecated 2026-07-21. Matrix surface lives in souveraine's sensorium; contacts backend TBD.

docs/ map

• FEDERATION.md — federation design of record: identity tiers, signed transport, memfs sync roughing, instance awareness, install-time instantiation flag (moved from souveraine/docs 2026-07-16).
• SESSION-AUTHORITY-DOCTRINE.md — session/power/lock authority model (§5–8 verified implemented on phone, 2026-07-15).
• SESSION-TRUST-ARCHITECTURE.md, TRUST-BOUNDARY-MATRIX.md, INTERFACE-ARCHITECTURE.md, HOW-IT-WORKS.md, REFERENCE-EXTRACTION.md, SETTINGS-APP-PLAN.md, README.md — shell design set (moved from souveraine repo).
• DUMP-*.md — per-session bootstrap dumps; write one per working session that changes cross-repo state.
• session-trust-map.html — moved from ~/ on 2026-07-16.
• DUMP-pacman-pipeline-2026-07-24.md — the session that retired flashing: pacman pipeline, the eleven unowned binaries, and the traps found. Corrected 2026-07-25 — its charge-type conclusion was wrong (the N/A was read from the charger, not the battery); see the inline correction and TASK-08(b).
• DEPRECATED: qtpim-contacts-handoff.md, contacts-design.md, chatty-matrix-features.md — historical, superseded by Matrix sensorium.