SouveraineOS/STATE.md

SouveraineOS — cross-repo state

Souveraine is an OS, an agent substrate, and the name of an agent. Ani + Aster = Annie (primary consciousness + subconscious = composite). Hard constraint everywhere: no GNOME or KDE library dependencies.

This repo is the umbrella: cross-repo docs, decisions, session dumps, and this state file. Component repos keep their own repo-local PAF/ docs; what crosses repo boundaries lives here. Update this file when component state moves; it is the resume anchor.

Shell-surface migration checklist: SHELL-SURFACES.md. Walk it before any substrate cutover (ii → souveraine, later souveraine → viewtop). The subconscious three-tier surface was stranded for over a week by the ii → souveraine move for want of exactly this list; nine device packages went stale the same way for the same reason. The packages are now cured (2026-07-30): Pixel3Arch packages.yml publishes all 14 into the edge archive, so pacman -Sl souveraine-aarch64 is the manifest. The surface gap (a souveraine overlay host for the subconscious views) is still open.

Last updated: 2026-07-30 (every device package now publishes via CI; phone updates via pacman; flashing retired).

DEPLOYMENT — the phone updates with pacman. Do not flash.

As of 2026-07-24 the Pixel 3 is a normal Arch box: pacman -Syu from the Gitea repo. That includes the kernel. The phone is Casey's daily driver — a reprovision costs him his live system — so reaching for fastboot is a regression, not a fallback.

• Repo: [souveraine-aarch64] → the rolling edge release of Fimeg/souveraine, SigLevel = Required DatabaseRequired. Wiring lives in Pixel3Arch/rootfs-overlay/ so a reprovision cannot lose it again (it was configured live once and vanished at the next flash).
• Kernel: installs like any package. pocketboot boots /boot/vmlinuz-blueline via extlinux on Arch_root (XBOOTLDR type GUID); the pacman hook 95-blueline-extlinux.hook → blueline-promote-boot copies the versioned kernel + initramfs onto those generic names. boot_a is stale — it still carries pmos_root_uuid and no root=, so it is NOT what boots the system. Flashing it changes nothing.
• Packaged and delivered by pacman -Syu: souveraine, -secrets, -machined, -sessiond (aarch64 only — the laptop hits lock-screen errors with sessiond), upower-souveraine. Nothing belongs in /usr/local/bin any more.
• The kernel is NOT yet in that list (corrected 2026-07-25). It was pacman -U'd by hand; kernel.yml has never once passed and kernel-latest has never been published. Three blockers precede repo-add --sign — see TASK-25. Parked by Casey 2026-07-25.
• 5,624 files under /usr /etc /opt /boot are still owned by nothing — the same disease, not yet colliding. One of them, blueline-proximity-lock, is a running second authority over proximity (resolved 2026-07-25 — it reports to sessiond and decides nothing; packaging is TASK-27). Inventory + the conflict-computation recipe: TASK-25.

Real reasons to flash, and only these: the boot chain itself is broken (pocketboot/extlinux/initramfs unbootable), partitioning changes, or a deliberate from-scratch reprovision. A new kernel is not one of them.

NEVER build on the phone. archdev (casey@10.10.20.123) cross-compiles everything, including meson+cargo projects — see Pixel3Arch/pkgs/squeekboard/build-cross.sh for the pattern. binfmt for aarch64 is registered on the Proxmox host with the F flag, so the unprivileged archdev container can execute aarch64 binaries.

Full design + traps: docs/tasks/25-one-repo-all-packages.md.

Component repos

souveraine (~/Projects/souveraine)

Branch experimental/session-trust-phase1 @ c96f95b.

• Verified on archdev 2026-07-16: 295+8 tests, clippy -D warnings. Fresh aarch64 cross build of c96f95b VERIFIED GREEN (cross_rc=0, both binaries ELF aarch64) — artifacts staged at ~/.cache/souveraine-ci-target/aarch64-unknown-linux-gnu/release/ (souveraine + souveraine-machined); build tree ~/builds/machined-verify/Souveraine. This is the artifact for the phone federation test; the previous staged one was 116562a (pre-memory sync) — superseded.

NEXT SESSION (Casey's stated order, 2026-07-16 evening)

1. Souveraine phone-side test — DONE, PASSED (2026-07-16 late). Both machines on b4dc39e (laptop x86_64 + phone aarch64), agents speaking on glm-5.2. Machine identities split (laptop 6344f24e… ▽●△△ lineage via --migrate-from; phone 69bf24d7… ▽■◑★ fresh). memory sync ran on both sides via the agents' own tool: two instance/* branches on the Gitea remote, laptop's fetch surfaced the phone's branch. Phone Souveraine wrote system/instances.md unprompted after reading the briefing. Root cause of the mute-agent detour: agent-level provider: claude + empty key hitting Anthropic's OpenAI-compat 401 — fixed; plus the silent-turn-death and reasoning_content fixes (33068d6/b4dc39e). Every manual gap-fill from the test is recorded in docs/provisioning-gaps.md — that file is design input for the commission ceremony. Merge policy (FEDERATION.md step 3) remains the next transport build step. Phone hard-reset once mid-chat (no pstore configured — gap §5); phone memfs remains source of truth.
2. Auxo tray + contacts. Auxo-style multitasking tray under the dock — design first (talks only so far). Contacts: RESOLVED 2026-07-16 — the store is the user's address book, user-owned, Annie has a capability over it (Android runtime-permission model, not Annie's brain). Chatty/libcmatrix/qtpim all deprecated 2026-07-21 — Matrix surface now lives in souveraine's sensorium; contacts backend TBD (new approach needed). RCS: investigated, options in docs/messaging-rcs.md. Long-arc default stays Matrix-first + SMS fallback. No code touched.

• Federation memory transport, first two steps landed (8cfa992, a62379a): memfs_commit presence signal on the bus after every memfs mutation (replaces the unconsumed memory_* events), and memory sync — per-instance branch push/fetch against the memfs origin remote. Merge policy / auto-fetch is next (FEDERATION.md sequencing step 3).
• Instance awareness, live half landed (8e540c7): device_announce carries hosted_agents, registry records it, souveraine peers shows hosts. Durable memfs system/instances.md log still to come.
• Shell UX round 2026-07-16 (c96f95b, deployed to phone): drag-to-combine fixed (ghost was anchored — never generated drop events; stacks were only ever creatable via the pre-drag-only menu), rail rides atop squeekboard (measured via hyprctl layers) with swipe-down = keyboard-then-dock dismissal (dockSuppressed), overview dead-space tap dismisses, DockConfig has the real pins/stacks editor, pulseDockReveal restored. Touch verification on device is Casey's. IDEA PARKED: Auxo-style multitasking tray under the dock (talks only, nothing built).
• Session Trust Phase 1 is live on phone + laptop under qs -c souveraine: sessionctl arbiter, first-party lock/nav (pill retired), SessionEvents logind ingress + delay inhibitor, StepUpAuth, break-glass, hash-chained audit. Freshly green — the last five commits of Jul 14 were runtime fixes; see docs/DUMP-session-trust-2026-07-14.md.
• System tier landed 2026-07-16 (5039163 + 116562a, unbuilt-as-yet): souveraine-machined owns the machine seed at /var/lib/souveraine/seed-id as the souveraine system user, serves pubkey/sign over a group-gated socket (domain-separated signatures, SO_PEERCRED-logged). All server consumers resolve machine identity through MachineSigner (machined-first, loud legacy fallback, never generates); federation envelopes now signed domain-separated. Provisioning: sudo souveraine machine init --fresh|--migrate-from + system unit; wired into the PKGBUILD (sysusers + hardened unit). Deployment to phone/laptop waits on a built artifact (edge builds only on public). Known leftover: souveraine-secrets still reads the legacy seed dir — it needs a machined key-derivation op, not sign; migrate-from copies rather than moves precisely so it keeps working meanwhile.
• Doctrine decided 2026-07-16 (session-manager/lockscreen conversation): boot gate ≠ session lock. Auto-login as casey is transitional; target is system tier from boot (machine identity, enrollment, modem, boot-gate surface) with the user's world credential-gated (homed-shaped, credential-unlocks-storage). The lockscreen as built is the session lock (compositor-owned, correct); the gate below it does not exist yet. Disk encryption on the phone: not yet (deferred during modem bring-up).
• Federation design of record: docs/FEDERATION.md in THIS repo (2026-07-16 rewrite of souveraine's old local-only sketch, moved here because souveraine/docs is gitignored): identity/transport implemented + cited; three named gaps (shared memfs sourcing, memfs_commit firehose signal, instance awareness) roughed with sequencing; install-time agent instantiation is a parked FLAG — design the commission ceremony before building any installer.
• souveraine-secrets: org.freedesktop.secrets daemon behind the secrets feature, rooted in SeedId (no gnome-keyring/KWallet). Intended consumers: souveraine-player, culver, keyring-core (libsecret clients).
• CI note: branch builds ride PR #1 on LAN Gitea (AGit — head moves only on refs/for/primary pushes). no-ai-attribution fails on the PR range due to two OLD commits (a7e909d, bc6ee12) carrying Opus co-author trailers — fixing means history rewrite, Casey's call, pending.
• Design docs for the shell live HERE in docs/, not in the repo tree (moved Jul 15; deletion committed 0f50a3e).

Pixel3Arch (~/Projects/Pixel3Arch)

main @ 862202a. Repo == phone for deployed config as of 2026-07-16.

• Mic: hexagonrpcd now serves the ADSP audio PD (verified live — fluence/ECNS opens succeed at boot). Open blocker is the SLIM IRQ-read NACK loop (~1090 hits/boot); state in PAF/audio.md. Capture route moved to MultiMedia2.
• MMS: works end-to-end via the netsvcs APN (PAF/mms.md). Open: mmsd-tng has session-autostart via hyprland.lua but no systemd unit.
• USB: usb-signaller 0.3.1 built + staged; the RUNNING phone still uses usb-gadget-net (cutover severs the SSH link — do it with console fallback or at reprovision). Old gadget archived in archive/usb-gadget-net/.
• Untracked by design: pkgs/pulseaudio-q6/ (working clone; delta preserved in pkgs/pulseaudio-q6-overlay/), pkgs/*/pkg/ intermediates.
• Undecided: two full kernel worktrees kernel/linux-blueline-mic-order{,-g56} (~GBs, mic experiments, each has STATUS.md) — push branches to Gitea or drop.

Chatty + libcmatrix + qtpim (DEPRECATED 2026-07-21)

All three deprecated. Chatty/libcmatrix superseded by souveraine's built-in Matrix sensorium (--features matrix). qtpim contacts work stalled (sqlite backend never shipped). Historical docs retained: docs/chatty-matrix-features.md, docs/contacts-design.md, docs/qtpim-contacts-handoff.md. All repos pushed to Gitea (Fimeg/Chatty, Fimeg/libcmatrix, Fimeg/qtpim).

Decisions on record

• No GNOME/KDE library deps. EDS/libebook rejected for contacts.
• Fido MMS rides the netsvcs APN, patched into the carrier DB overlay.
• ETHOS-style guarantees are not runtime knobs; identity is a precondition (SeedId::load never generates).
• Chatty/libcmatrix/qtpim deprecated 2026-07-21. Matrix surface lives in souveraine's sensorium; contacts backend TBD.

docs/ map

• FEDERATION.md — federation design of record: identity tiers, signed transport, memfs sync roughing, instance awareness, install-time instantiation flag (moved from souveraine/docs 2026-07-16).
• SESSION-AUTHORITY-DOCTRINE.md — session/power/lock authority model (§5–8 verified implemented on phone, 2026-07-15).
• SESSION-TRUST-ARCHITECTURE.md, TRUST-BOUNDARY-MATRIX.md, INTERFACE-ARCHITECTURE.md, HOW-IT-WORKS.md, REFERENCE-EXTRACTION.md, SETTINGS-APP-PLAN.md, README.md — shell design set (moved from souveraine repo).
• DUMP-*.md — per-session bootstrap dumps; write one per working session that changes cross-repo state.
• session-trust-map.html — moved from ~/ on 2026-07-16.
• DUMP-pacman-pipeline-2026-07-24.md — the session that retired flashing: pacman pipeline, the eleven unowned binaries, and the traps found. Corrected 2026-07-25 — its charge-type conclusion was wrong (the N/A was read from the charger, not the battery); see the inline correction and TASK-08(b).
• DEPRECATED: qtpim-contacts-handoff.md, contacts-design.md, chatty-matrix-features.md — historical, superseded by Matrix sensorium.