Skip to content

feat(sensors): track supervised source builds and strict QMI validation - #76

Merged
ooaklee merged 17 commits into
mainfrom
x/native-sensors-unversioned-qmi-validator
Oct 22, 2026
Merged

feat(sensors): track supervised source builds and strict QMI validation#76
ooaklee merged 17 commits into
mainfrom
x/native-sensors-unversioned-qmi-validator

Conversation

@ooaklee

@ooaklee ooaklee commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

Summary

  • Add authenticated, source-only sensor build foundations for the pinned OE QMI, SSC and desktop proxy composition.
  • Separate supervised networked dependency preparation from offline native ARM64 compilation, with exact local Docker transport and mount identity.
  • Validate complete output, licence, ELF provider and loader evidence before durable no-replace publication; retain failed and partial work.
  • Accept legitimate unversioned private QMI imports without widening the versioned SSC ABI, and add JSON prose-checker regressions.
  • Integrate current main dependencies and workflows, and document these changes in the 0.6.0 changelog entry and ADR041–ADR046.
  • Include the separately reviewed source-preparation feature from #77: opt-in HTTPS repository/ref selection for camera or IPTSD, with exact peeled-commit pinning and unchanged component validation. This is source acquisition, not a generic installer.

Scope and limitations

The sensor path remains experimental internal foundations only. The shipped catalogue and public build help remain unchanged; a separate experimental, build-only catalogue is required. No sensor installer, service activation, distribution-library replacement, physical sensor support or new kernel functionality is provided.

The separate userspace source prepare <camera|iptsd> --experimental command acquires a fresh detached checkout and source-selection receipt. It does not add sensor, compute, audio or generic repository installers, grant installation authority, or change the existing component validators. Its dry-run performs no network or filesystem changes.

The fresh normal native producer and durable local publication gate passed on 22 October 2026 for the exact draft head, as recorded below. The earlier failed native attempt remains failed; replaying its saved archive does not retroactively make that producer or publication successful. Deployment and rollback policy, physical identity, sensor roles, axes, calibration and desktop behaviour remain unqualified.

Ready for required GitHub review. The fresh native producer/publication qualification is complete. Squash merge is authorised only after the required approval and final-head CI pass; this does not enable sensors or authorise a release. Merge and the proposed v0.6.0-rc.1 tag also remain subject to final-head CI and the repository's required approving review. Updating the branch or changelog, or merging #77 into this draft branch, does not complete those gates or publish a release.

Validation

Earlier sensor integration

The local current-main integration at 329af03156a03e22c93278a979100eb8c2afecaa includes the dependency and workflow updates from main at 1dfeb29c34dbfbc70b5d8b423500b163c59e8537. It preserves all other source bytes from the reviewed sensor branch.

Recorded host checks on that integration, using Go 1.26.4:

  • Full repository race suite: 3,936 passing test/subtest results, 69 recorded opt-in, platform or tool-dependent skips, and no failures.
  • Sensor-focused race suite: 1,229 passing results, 26 recorded skips, and no failures.
  • Explicit replay of the unchanged saved native archive through the strict consumer: one pass, no skips or failures.
  • Formatting, module integrity and go vet ./...: passed.
  • Linux ARM64 Go test and CLI cross-compiles: passed; these binaries were not executed and are not native producer evidence.

On changelog commit 668e2be03f8a80b46bdcb8716df050e8d72bd78d, the host quality race tests and whitespace checks pass. Only the changelog differs from that tested integration.

GitHub CI on that earlier head passed on 21 October 2026:

These historical results do not replace checks on the new combined head or native qualification.

Source-selection stack and current draft head

On 22 October 2026, #77 was squash-merged into this draft branch as 73aafd72beb05c89e18e0b1e1fccb9874ef1d9d9. Its parent is 668e2be03f8a80b46bdcb8716df050e8d72bd78d, and its tree exactly matches the tested feature head 425a3d8de6a0ec6c09ef14e3369e9331ec36a29c.

  • Only the 18-file source-selection feature was replayed; unrelated alpha kernel and upgrade history was excluded. Sensor authority, recipes, catalogue, build manager and installation policy remain unchanged.
  • Full combined host race suite: 4,021 passing test/subtest events, 58 passing packages, 67 explicit opt-in/platform/tool-dependent skips and no failures. These counts overlap earlier runs and must not be added together.
  • Vet, module integrity, formatting, whitespace checks, six CGO-disabled release-target CLI compilations and the source-stamped builder: passed. Cross-compiled binaries were not executed.
  • Actual OpenCode GLM 5.1 review supports this feature-only integration. This is supporting code review, not a GitHub approving review or native sensor proof.
  • All six executable jobs on feat(userspace): prepare pinned experimental source checkouts #77's exact head passed: PR CLI, push CLI, PR IPTSD and push IPTSD. Release-publication jobs were skipped.
  • Fresh CI on the resulting draft head 73aafd72beb05c89e18e0b1e1fccb9874ef1d9d9 passed: PR CLI, push CLI, PR IPTSD and push IPTSD. All six executable jobs succeeded; both release-publication jobs were correctly skipped. CI alone did not complete native qualification. The fresh producer/publication result is recorded below; the approving-review gate remains open.

Fresh normal native producer and local publication — 22 October 2026

Qualified the software producer/publication contract at Lexr commit 73aafd72beb05c89e18e0b1e1fccb9874ef1d9d9 using the pinned OE source commit 649cc875d08c04ce33bc8afc2a0ff7a22ce362e0. The dedicated CLI was built from that exact Lexr source; it was not represented as the published alpha or latest release.

  • Disk capacity was checked before execution. Host reserves and the unchanged dependency/source volume guards passed. No cleanup, resize, reset or restart was performed.
  • One fresh normal userspace build sensors invocation used the experimental build-only catalogue and two jobs. Build ID: a92802bc699a29896a046b64.
  • Fresh dependency, initialisation and native ARM64 source containers all reached distinct, verified exit-zero terminal states, with no OOM or timeout. This was a new producer, not only replay of a saved archive or host fixtures.
  • The unchanged validators accepted source identity, licences, all five AArch64 ELF products, private QMI/SSC provider and loader evidence, and the complete closed output roster.
  • Durable no-replace local filesystem publication completed: 16 regular products, three library aliases and a verified receipt; no staging directory or unexpected output member remained. Receipt SHA256: d552277dcaf66d07faea0803be786a89f7d950411c2b22c5709d3f7d67bacbb5.
  • All seven native software fixture targets passed: mount matrix, orientation, SSC drivers, IIO buffer, acquisition, sysfs writes and sensor selection. These are software fixtures, not physical sensor tests.
  • The newly produced archive was independently hashed and replayed through the unchanged strict consumer: one pass, no skips or failures. Archive SHA256: 3eba709791fa4ac33dfaa27202eb3a8032956fae832a44c50fb3bfaefef5ddf6.
  • Fresh targeted host race tests on the same head passed: 1,622 test/subtest events across five packages, with 28 explicit opt-in/platform/tool-dependent skips and no failures. Counts overlap other suites and are not additive.
  • Complete retained diagnostic streams were reviewed. Missing manual-page aliases and tool/Meson deprecations remain documented follow-up debt; no emitted compiler, linker or loader failure was found. Observed dependency/tool versions are recorded, not claimed to be a locked reproducible snapshot. The native build did not use sanitizers.
  • Existing build/container/image/volume identities and selected immutable metadata, plus all tracked source-worktree states, were preserved. This is not a bytewise backup claim for active volumes. No Surface operation was performed.
  • Actual OpenCode GLM 5.1 evidence review and independent root/peer checks support this narrowly scoped qualification. They do not substitute for the repository's required approving GitHub review.

Earlier failed producer evidence remains failed and retained; this fresh success does not rewrite it. The changelog and ADRs preserve their earlier qualification status; this dated result records the new evidence without rewriting historical decisions. The shipped catalogue/build-help boundaries, lack of sensor installation or activation, and unqualified deployment/rollback, physical identity, roles, axes, calibration and desktop behaviour are unchanged. No release artifact was uploaded by this local publication check.

Before ready for merge/release

  • Integrate the current main dependency and workflow updates locally and complete the recorded host checks.
  • Add the 0.6.0 unreleased changelog entry with explicit source-only qualification limits.
  • Review and squash the isolated source-selection feature into this draft branch, retaining the existing sensor boundaries.
  • Verify fresh GitHub CI on the exact resulting draft head.
  • Run a fresh normal native producer through the repaired path, verifying terminal state, complete outputs and durable local publication on the exact draft head.
  • Complete the repository's required approving review.

Installation and physical sensor qualification remain prerequisites to enabling a shipped sensor workflow, regardless of eventual merging of these internal foundations.

Related tracking PRs

These are dependency and review references, not interchangeable trees or hardware-support claims:

ooaklee added 12 commits October 20, 2026 07:31
@ooaklee
feat(sensors): authenticate experimental source compositions
dbb7cc5 
Add build-only unqualified catalogue evidence and a compiled source authority for the published native QMI, SSC and proxy composition. Verify complete source bytes, modes and exact internal links, and stage captured bytes exclusively with directory identity refusal checks.

Record the proposed producer boundary in ADR041. This foundation does not add a shipped sensor entry, CLI build command, installer or hardware compatibility claim.

Signed-off-by: Leon Silcott <leon@boasi.io>
@ooaklee
feat(sensors): prepare supervised native dependency images
7bebb51 
Signed-off-by: Leon Silcott <leon@boasi.io>
@ooaklee
feat(sensors): validate offline source build artifacts
e55caf7 
Add authenticated readonly repository snapshots, fixed offline build recipes, strict development-artifact decoding and no-replace publication. Bind selected ELF tables and private provider identities to observed output bytes, with retained failure and post-rename state reporting.

Record ADR043 without rewriting the earlier decisions. These are internal components only: the supervised source controller, native build proof, CLI, installer and physical sensor qualification remain open.

Signed-off-by: Leon Silcott <leon@boasi.io>
@ooaklee
feat(sensors): supervise offline source build composition
4c4dda4
@ooaklee
fix(sensors): recognize owned Docker volume mode
6a1663b
@ooaklee
fix(sensors): bind direct ELF needs to loader evidence
b0c87fb
@ooaklee
fix(sensors): hand off private workspace parent last
cd79bc3
@ooaklee
fix(sensors): bind native builds to one local Docker transport
dcd0bfc 
Resolve local transport before dependency preparation while retaining the exact producer and its Prepared ownership. Separate host snapshot paths from the expected daemon mount coordinates, and independently validate both inspected mount records. Refuse rebinding or recovery against changed identities and retain historical evidence without claiming current termination.

Record the transport and namespace decision in ADR045 while preserving the existing source, lifecycle, resource and publication gates.
@ooaklee
fix(sensors): register the isolated builder account
092c1a0 
Create and verify the locked non-login build identity in the dependency image so private D-Bus fixtures can resolve UID 65532. Preserve the runtime-only home, fixed numeric identity and offline source isolation.

Require the observed account in toolchain provenance and verify it again before source work. Cover account collisions, lookup and command failures, incorrect identity fields and password-lock states with controlled fixtures.

Signed-off-by: Leon Silcott <leon@boasi.io>
@ooaklee
feat(userspace): prepare source-only sensor build delivery
40cc9cf 
Connect the typed sensor source controller to a private build-only catalogue selection. Preserve partial outcomes and reject misleading completion reports. Keep the shipped catalogue and public help unchanged pending native end-to-end qualification.

(cherry picked from commit c9590d17ae98af1896d5891210f32b39fd12b471)
@ooaklee
fix(sensors): initialise trace mode for loader observations
7a7c081 
Set LD_TRACE_LOADED_OBJECTS=1 only in the explicit loader child environment, preserving the private provider path and strict unnamed-row refusals.

Exercise the actual producer classifier and unchanged consumer with a shared 147-case corpus, including the retained rejected listing. Add bounded observer fixtures for environment isolation and failure propagation.

Host fixtures do not qualify a native build or physical sensors.
@ooaklee
fix(sensors): validate unversioned private QMI providers
ef91215 
Retain raw ELF symbol metadata and accept legitimate unversioned QMI imports only through the exact direct provider contract. Preserve SSC version requirements and refuse weak, hidden, unresolved and duplicate definitions.

Add serialized ELF regressions and an explicitly opted-in replay of saved native artifacts. Host validation does not qualify a new native build or physical sensors.

Signed-off-by: Leon Silcott <leon@boasi.io>
This was referenced Oct 20, 2026
Merged
Merged
Merged
Merged
Closed
Merged
Merged
Closed
@ooaklee
docs(sensors): document the source build contracts
377d948 
Explain declarations, ownership and fixture boundaries throughout the experimental sensor source workflow. Use British English in comments and ADR prose without changing historical decisions.

Comment-free Go tokens, literals and compiler directives remain unchanged, as do the recorded loader fixtures and all source, provider and publication contracts.

Signed-off-by: Leon Silcott <leon@boasi.io>
@ooaklee
fix(quality): distinguish JSON schema keys from prose
88759cd 
Mask only valid JSON object-key tokens when checking British-English prose. Keep every value byte and source line coordinate, and reject malformed JSON. Preserve loader corpus keys and bytes instead of renaming the wire contract.

Add regressions for nested and escaped keys, string and array values, retained wording failures and malformed documents. The full host race suite, repository vet and saved-archive consumer replay pass; no native sensor build or hardware qualification was performed.

Signed-off-by: Leon Silcott <leon@boasi.io>
This was referenced Oct 20, 2026
Merged
Closed
@ooaklee

ooaklee commented Oct 20, 2026

Copy link
Copy Markdown
Owner Author

Two further source-only exports are now available for tracking alongside the existing draft stack:

Actual OpenCode reviewed the bounded publication plan and public text with no publication blocker. This was not a new build or hardware test. Both PRs remain draft; the Surface, accepted kernels, builds and volumes are unchanged. GLINK ownership work remains deferred. The pending fresh native sensor build still needs separate approval.

@ooaklee
chore(sensors): integrate current main dependencies
329af03 
Integrate the current main dependency and workflow updates without rewriting the native sensor source-build commits. Preserve the source authorities, loader corpus and deployment boundaries unchanged.

Validated with the host race suite, vet, explicit saved-archive consumer replay and Linux ARM64 Go cross-compilation. This does not qualify a fresh native producer, hosted workflows or physical sensors.
@ooaklee
docs(changelog): record 0.6.0 sensor build foundations
668e2be 
Document the experimental source-only sensor build and validation work, preserving the explicit native producer and hardware qualification limits.

Signed-off-by: Leon Silcott <leon@boasi.io>
@ooaklee ooaklee mentioned this pull request Oct 22, 2026
Merged
@ooaklee
feat(userspace): prepare pinned experimental source checkouts (#77)
73aafd7 
- require explicit experimental opt-in, canonical HTTPS source, a fully
  qualified ref and the expected full peeled commit;
- reject ref drift and retain component-specific validation before publishing
  a fresh detached checkout without replacing existing directories;
- isolate acquisition from repository execution policy and preserve bounded
  cancellation, failure evidence and truthful post-publication errors;
- document the preparation-only boundary in ADR046 and 0.6.0 Unreleased.

Validated with the full host race suite, vet, module integrity, formatting,
six release-target compilations and the source-stamped builder. Host checks
and source preparation do not qualify native sensor production or hardware.

Stack into the draft sensor branch only. Keep #76 draft with its fresh native
producer/publication and approving-review gates open; no deployment or release
authority is added.

Refs #76.
@ooaklee
ooaklee marked this pull request as ready for review October 22, 2026 11:17
@ooaklee
ooaklee merged commit 88ca624 into main Oct 22, 2026
8 checks passed
@ooaklee
ooaklee deleted the x/native-sensors-unversioned-qmi-validator branch October 22, 2026 12:03
@ooaklee ooaklee mentioned this pull request Oct 22, 2026
Merged
ooaklee added a commit that referenced this pull request Oct 22, 2026
@ooaklee
fix(release): retain published alpha compatibility on main (#78)
157e5d3 
- retain the published alpha's kernel packaging lifecycles, exact-path source
  snapshots, split payload roles, ordered Stubble inventories and explicit
  upgrade version selection alongside unchanged sensor/source-preparation work;
- add byte-pinned public kernel-manifest regressions across local, release and
  installer readers, retaining schema, checksum, ordering, syntax and size
  refusals without simulating package or hardware qualification;
- reconcile shared prose validation without masking editable JSON values,
  and preserve imported licence notices byte-for-byte;
- preserve the alpha changelog and original ADR decision bodies, resolving
  independent numbering through current ADR047/048 and immutable record links;
- record host compatibility checks and the exact scope of prior native sensor
  evidence without claiming a fresh combined native run or physical sensors.

The exact PR head passed 4,658 host test/subtest results across 58 packages,
vet, strict documentation checks and all six CLI target builds. All six
executable branch/PR CI checks passed; tag-only release jobs were skipped.

The native sensor path remains experimental and build-only. Metadata-reader
fixtures do not establish package bytes, boot-image contents, installation
or hardware qualification. No Surface or existing build was changed.

Refs #76, #77.
ooaklee added a commit to ooaklee/linux-surface-pro-11-oe that referenced this pull request Oct 22, 2026
@ooaklee
feat(userspace): publish experimental native sensor sources (#72)
2be1f75 
- publish the pinned QMI, SSC and desktop sensor proxy composition in explicit
  source folders with original licences, inventories and checksum records;
- retain owned candidate admission, fallback and activation fixes with their
  ordinary, sanitized and inverse-control software evidence kept distinct;
- preserve the exact source composition authenticated by Lexr's experimental
  build-only producer and its durable local publication checks; and
- document the manual build boundary, retained diagnostics and outstanding
  service, package, privilege, rollback and physical-sensor qualification.

Source integrity and released Lexr rc.1 read-only authentication plans passed.
The prior normal native producer and archive replay cover these exact inputs;
they were not rerun for this merge. OE reports no automated CI on this head.

This is source-only publication, not an installable userspace release. It does
not replace distribution libraries, install or activate services, qualify
hardware, or add Windows runtime dependencies. Imported source and notices
retain their original bytes and authorship.

Refs #71, ooaklee/lexr.sh#76.
ooaklee added a commit to ooaklee/linux-surface-pro-11-oe that referenced this pull request Oct 22, 2026
@ooaklee
feat(userspace): publish experimental compute and CDSP sources (#73)
bd19c16 
- publish the unchanged native compute and CDSP capability source kits with
  complete manifests, checksums, executable modes and component notices;
- retain the checked sum/max API, intent launcher, link-only SDK worker and
  standalone Linux-UAPI capability utility with their offline fixtures;
- scope Git source-directory exceptions and byte-preserving attributes to
  the reviewed kits without exposing generated build or binary payloads; and
- distinguish accepted finite offline software evidence from live firmware
  queries, DSP execution, deployment and hardware qualification.

All 255 compute and 15 CDSP source files match the accepted kit rosters,
hashes, sizes and modes. Native qualification was not rerun for publication.
Inherited diagnostics and whitespace remain disclosed, not reformatted or
claimed resolved. OE reports no automated CI on this head.

This source-only change adds no kernel, firmware, service, install catalogue
or Lexr compute/CDSP adapter. It includes no Windows or proprietary runtime
payload. The genuine SDK-linked worker remains unexecuted; even help can run
active constructors, and a real capability query is not passive inventory.

Refs #72, ooaklee/lexr.sh#76.
ooaklee added a commit to ooaklee/linux-surface-pro-11-oe that referenced this pull request Oct 22, 2026
@ooaklee
docs(sensors): record qualified build-only producer boundary (#71)
6225e75 
- replay the isolated maintainer-build guidance onto the merged source-only
  publications without duplicating their source commits;
- separate the historical Lexr checkpoint from the dated native producer
  and durable local publication evidence now represented by rc.1;
- correct the proxy adapter status while keeping the experimental catalogue,
  installation, activation and physical qualification boundaries explicit; and
- preserve every source, inventory, licence and executable mode unchanged.

Documentation whitespace, relative links and shell syntax checks passed.
Released Lexr v0.6.0-rc.1 authenticated the unchanged source composition in
read-only build plans; its shipped catalogue still refused a sensor build.
No new native producer was run, and the manual recipe was not replayed.
OE reports no automated CI on this head.

This is documentation only, not an installable sensor release. Deployment,
service/package coexistence, privileges, rollback, explicit activation and
physical sensor qualification remain separate work. Existing builds and the
Surface are unchanged.

Refs #72, #73, ooaklee/lexr.sh#76.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ooaklee