Repository navigation
SSAP: typed policy, Session CPCD and bounded updates - #20
Open
sanchuanhehe wants to merge 402 commits into
Open
sanchuanhehe wants to merge 402 commits into
sanchuanhehe wants to merge 402 commits into
Conversation
This was referenced Oct 19, 2026
sanchuanhehe
changed the title
Keep configuration inputs, real controller outcomes, Session queue waits and SDK/process timestamps distinct. Partial failed-run diagnostics do not relax original workload or finalization gates. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
…edgments Reuse one Native command caller, per-controller budget, lease authority and original cross-process Deadline. Keep ReadLinkMeasurement separate from the explicit management mutation and report requested octets rather than an effective MTU. Migrate unpublished Rust/C/Python command ABI callers, retire query-only symbols and pin matching kernel sources. Actual CLI/private-bus counterexamples, 415 Rust checks, 84 dynamic binding checks and strict clippy passed; hardware effects remain unqualified. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
…gates Reuse the existing Managed command and two-radio workload. Keep four real command acknowledgments separate from effective payload length and peer delivery; preserve failures and reject incomplete or unrequested scope. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Align Native result validation and independent capture checks with the SDK110 E reply. Require its original little-endian handle without exposing it as an effective payload value. Keep malformed, empty and foreign replies rejected; synchronize reference and exact kernel CI pins. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Migrate the real socket-gate caller to all 103 retired entries and 309 checks after d8/d9 retirement. Explicitly reject the historical 101-entry receipt; keep original failed VM evidence and all kernel assertions. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
…nt limits Keep Native Managed ownership, physical command obligations and original deadline distinct from effective link parameters and peer delivery. Record the SDK110 handle reply and the separate decision for any automatic initialization. Generic architecture only;no private experiment or qualification export. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
…p boundaries Reuse the existing C/Python SDK clients and bounded stdin receipt path. Record the actual thirty-second loop budget,approval API returns and frontend cleanup without renewing timers or claiming daemon/kernel/peer completion. Require exact identity,unchanged budget and decision association;keep full workload and wire/finalization gates. Exercise actual normal and thirty-second expiry paths via the existing private D-Bus fixture. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
…tages Keep client loop budgets separate from server lifetimes and physical obligations. Require measured USB boundaries before assigning queue or RX latency causes. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Distinguish class service from physical credit and wire priority. Retain PB ownership, independent cursors, original submit authorization and separate formal and hardware qualification scopes. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Use one Native address setup before the existing pre-daemon Grant gate, after untouched Setup checks. Preserve existing broadcast parameters and lifecycle verdicts; reject mixed modes and other ports. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Keep full-pool unfinished-PDU and original deadline checks while using bounded existing peer priming for the reported geometry. Validate original buffer replies, exact source packet budgets and late completions; no stale live-root fallback. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Document the K98 state-first early/final admission contract, preserve expiry on live authorized bindings, and distinguish Session failure from Binding retirement. Keep historical fixed buffer assumptions scoped to their original records. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Document the separate scopes of image inputs, ROM RAM transfer and HCC model reports. Do not substitute them for executing-image, cold-power or production-identity qualification. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Document model-specific service package matching and precise build/ELF provenance. Keep application delivery, snapshot collection and conditional credit replay as separate checks with explicit negative-control targets. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Require fresh observation and authorization after runtime address reinitialization, preserving physical cleanup obligations and failure evidence. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Move private bundle inputs out of the global firmware path;generate independent profiles,verify model and five-file closure on every attach,and bind actual guest input observations without claiming upload or execution identity. Migrate VM preparation,permission and runtime-only checks,evidence readers,tests and source-only CI. Keep mixed physical runs disabled until their complete flow is qualified. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com> (cherry picked from commit 580c49061380e8cd0072c451f6283ee57a721b8d)
Project the existing source-bound tooling without adding new behavior or reassigning historical qualification. No private SDK, VM, captures or qualification records are published. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Project the existing source-bound tooling without adding new behavior or reassigning historical qualification. No private SDK, VM, captures or qualification records are published. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Project the existing source-bound runner and lifecycle checks, including their already-retired duplicate input test. No new runtime behavior or qualification transfer. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Fix stale generated summaries after the source-only tooling projection. Preserve the public record set, selected historical qualification and all fail-closed checks. The initial CI failures remain evidence; this is not new hardware qualification. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Keep the runtime config bitmask separate from actual prior ROM upload evidence. Reenumeration creates a new instance; warm adoption cannot inherit a later controlled upload, and neither proves executing-image identity. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Require per-completion pairing and censored boundaries instead of assuming a target bulk-IN waits throughout a source-to-peer interval. Keep NOCP timing candidates separate from lifetime and ticket attribution. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Reuse the five-file profile provisioner with ordered per-leaf SDK110 and board provenance. Reject ambiguous homogeneous aliases, swapped routes, changed files and malformed v2 upload observations before attach. Keep legacy homogeneous evidence decoding and warm MISSING distinct from ROM upload. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Describe the per-leaf development API and v2 evidence representation without claiming mixed hardware or cold-ROM qualification. The homogeneous CLI remains explicit. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Install Rust1.96.1 before the tooling test step and select it explicitly. Keep the original30second compile limit and production codec assertions;retain bounded stdout/stderr when compilation times out,with a fail-closed reporting negative control. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
…qualification Read back all 35 issues and existing child relations. Remove contradictory missing-method-scenario text from U3 and duplicate business chronology from K19, retaining the original acceptance clauses and historical failures. Keep U1/U21 closed within their audited scope; other issues remain open. Synchronize the existing plan, capability boundary and goal maintenance state. Production code, qualification records and selected artifacts are unchanged. No new hardware or formal qualification is claimed. Validation: 69 qualification/document integrity tests in each worktree, documentation examples/inventory and strict HTML with HTML audit. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
…very limits Keep method delivery unqualified and all retained failures intact. Record the production BSLE sequencer selftest covering each configuration-send timeout after CLOSE, with the rejected ignored-error mutation. I/O, time and peer fixtures do not prove actual USB drain or firmware recovery. Synchronize the existing plan, capability boundary and goal batch with the source-only K15 update. No production driver or qualification record changes; all natural-recovery and remaining delivery gates stay open. Validation: 69 qualification/document checks per worktree, examples, inventory, strict HTML and HTML audit. Original selected qualification, material records and unrelated dirty source preserved. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Read back 35 issue bodies and seven existing child relationships. Consolidate U3, K17 and K19 without changing original acceptance. Keep U1/U21 scoped closures and all outstanding recovery conditions. Preserve qualification records and resume the existing feature plan. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Reuse the existing command barrier, original deadline and supervisor for C/Python method commands. Preserve WRITE receipt schemas and distinguish method command admission from a response or peer delivery. Validate actual SDK RPC routing, arguments and deadlines on the finite private bus; retain boundary/error/unreleased-barrier checks and typed receipt negative controls. No new Engine or hardware qualification. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
…ates Record actual SDK/private-bus and typed admission checks separately from real peer delivery. Keep the shared Engine and original deadline contract, retain prior startup failures and all original acceptance conditions. Synchronize U22, canonical batch, plan, capabilities and active goal. No new hardware/formal qualification or issue closure. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Extend the existing method scenario to contract v2 with rejected and accepted command callbacks, original SDK admission and deadlines, paired USB commands and a bounded complete command-window inventory. Retain v1 request proof identity and all original request/withdrawal checks. Reject unattributed method opcodes and mixed/upgraded proof versions. Exercise actual executor/corroborator with explicit finite I/O/packet fixtures; no hardware, firmware recovery or formal qualification claimed. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Synchronize canonical source/offline scope and U22 without granting real method delivery, recovery or formal qualification. Preserve v1 identity, original failures, active full goal and all acceptance conditions. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
…lbacks Extend the existing QEMU observer with a timerless pinned-source profile. Record process-unique allocation identity, submit/cancel returns, callback entry before packet detachment handling and release entry. Preserve original I/O and deadlines. Bound output and reject invalid or incomplete metadata; pending obligations remain explicit, never a physical drain or recovery PASS. Keep the existing heartbeat profile and frozen artifacts unchanged. Add source, metadata and compiled logging-helper checks with explicit fixture boundaries. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Keep method v2 delivery and complete S0-S6 acceptance intact. Record the separate compiled observer, finite offline checks and no-device smoke without claiming hardware callbacks, root cause, recovery or new business delivery. Synchronize K15 source-only scope and leave all unfinished conditions open. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Preserve original QEMU/kernel/module preparation identity checks and all acceptance conditions. Record the no-USB boot recheck separately from hardware qualification; keep execution detail only in the authorized local evidence index. Continue method discovery and long-result work alongside startup audit. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Pass the caller deadline through identity checks, caller-scoped preflight, actor metadata and every discovery page. Reject expired pages and cache publication; keep the 96-page/80-entry limits and management-only policy. Update the unpublished D-Bus signature, CLI caller and independent signature check together. Reuse the existing Engine and cancellation scope. Validation: 37 targeted production/SDK/private-D-Bus tests and strict clippy; strict documentation build. Fixtures do not qualify Native concurrency, firmware, deployed permissions or hardware delivery. C/Python discovery wrappers and exact-artifact real method qualification remain pending. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Synchronize the single plan, generated qualification view and active goal from the existing persistent scope after the goal API returned no goal. Record the source/offline discovery batch and U22 readback; keep all original acceptance, selected hardware identities and failures unchanged. C/Python discovery, real method delivery and natural recovery remain open. Validation: 69 qualification/document integrity tests in each worktree, source inventory and examples; no qualification records or materials changed. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Route language clients through RemoteSsap::discover_until and the original executor/deadline. Return immutable result ownership without retaining a connection, lease or new remote cache. Local entry/trace reads never repeat the remote transaction. Bound metadata once in Rust for all language views. Keep management-only policy and existing Engine pagination budgets. Update generated header, Python exports, actual C/Python consumers and interface docs. Validation: actual cdylib/private-bus C/Python suite, 111 Python checks, 11 Rust SDK tests, 5 daemon discovery tests, production boundary negatives, strict clippy, regenerated C exports and strict HTML. No hardware/formal or deployed-policy qualification; VM discovery callers remain the next step. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Synchronize the unique plan, generated qualification view, active goal and U22 source-only readback. Retain original acceptance, hardware identities, failures and bounded metadata validation scope. C/Python bindings do not grant deployed permissions or real method delivery. Validation: 69 qualification/document integrity tests in both worktrees; source inventory and examples pass. Prior qualification records unchanged. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Add bounded method discovery to existing consumers using the original five-second deadline, explicit barrier and retained Connection. Check remote UUID/category/handle and export the full trace without claiming delivery. Validate actual consumers with 20 private-bus scenarios, exact RPC counts, negative outputs and unreleased barriers including original-clock exit checks. Fixtures are not VM/hardware qualification. Paired runner proof is pending. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Synchronize U22 source-only readback, unique plan, generated qualification view and active goal. Preserve original acceptance and accurate historical records. Consumer checks are finite private-bus fixtures; paired runner proof and exact-artifact hardware discovery remain required. Validation: 69 metadata/document tests in each worktree and inventory; no existing qualification records, materials or selected identity changed. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Reuse the existing SDK child supervisor before each method provider sequence. Version the finite gate as v3 and independently check method metadata, both original discovery pages, paired endpoint packets, terminal ordering and the complete discovery window. Keep v1/v2 qualification scope unchanged. Validate 115 relevant offline tests and strict locked HTML build. Explicit process and packet fixtures do not qualify devices, deployment or concurrency. No new hardware execution or formal proof; accurate-artifact delivery remains open. Retain initial fixture/import/guard failures in the local evidence index. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Record v3 source/offline coverage and exact issue readback without transferring historical hardware qualification. Keep original acceptance, startup causes, real discovery/method delivery, long results and lifetime work open. Canonical views and metadata checks pass; all existing qualification records, materials and selected evidence remain unchanged. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Record locked input preparation without transferring hardware qualification. Distinguish SDK runtime SLE disable from last-service board reset and delegated NearLink/OHOS layer cleanup. Keep actual CLOSE acknowledgment, firmware-side state clearing and natural recovery requirements open. K15 readback preserves its original acceptance; public material remains source/offline only. Both canonical trees pass 69 metadata/integrity checks. Existing qualification records, selected results, materials and original failures remain unchanged. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
…ation Record SDK110 static call-path review and the unresolved resident-image and ROM behavior assumptions. Preserve existing qualification records and all original issue acceptance conditions. No driver or firmware changes. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
…nctions Exercise actual private-bus Provider, response encoding, fragments, reassembly and client decode across result boundaries. Reject overflow and retained-result use after withdrawal/deadline. Native context and scheduling remain fixtures. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Synchronize existing U#22, canonical qualification views and goal execution state. Keep prior hardware evidence immutable and long-result VM gates open. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Extend existing method runner with a 2045-byte independent result and explicit v4 evidence scope. Reuse shared bounded fragment and byte-prefix checks with actual two-way sequence receipts, original deadlines and physical TX counts. Retain historical v1-v3, discovery, short outcomes and no-response commands. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
…ence Archive prior v3 scope, synchronize U#22 and canonical plan/goal views, and require fresh artifact inputs before any v4 real-device qualification. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Record exact-input validation and isolated no-USB VM smoke separately from real peer delivery. Preserve historical evidence, original issue acceptance and active goal scope; document pre-CLOSE platform-query constraints. Validation: 69 qualification/document integrity checks per worktree. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Run the production exchange loop against explicit local socket pressure. Check pending response readiness, unblocking, original deadline and stop. The early-Ready production mutation is rejected; no Native or RF claim. Document negotiation admission separately from peer receipt. Validation: 76 Engine tests, strict Clippy, HTML, inventory and examples. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Keep v4 hardware delivery pending and retain exact artifact identities. Record local scheduling coverage and premature readiness negative control without upgrading Native, formal or device qualification. Validation: 69 qualification/document integrity checks per worktree. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Exercise production codec, fragment layout/reassembly and actual private-bus Provider for requests and commands at two physical MTUs. Check literal wire layout, full arguments, identity and original deadline; reject 2044 bytes. A production 32-byte truncation mutation fails. Native metadata/transport are explicit fixtures, not hardware qualification. Validation: 77 Engine tests and strict all-target Clippy. No user-facing contract change; current limits already documented. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Keep local Provider/codec composition separate from real method delivery. Retain exact prepared artifacts, original failures and complete goal scope. Public issue updates contain source/offline summary only. Validation: 69 qualification/document integrity checks per worktree. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
Exercise two production actors with explicit AF_UNIX transport and actual private-bus Provider registration. Requests and commands at short and maximum argument sizes cannot bypass the real Native admission query. Separate peer injection reaches the RX query and cannot invoke policy or Provider effects. A temporary admission-query removal is rejected. Preserve initial test and environment failures; no kernel, hardware or positive method qualification. Validation: 78 Engine tests, strict all-target/all-feature Clippy. Test-only change; no public API or documented contract change. Assisted-by: OpenAI Codex <noreply@openai.com> Signed-off-by: sanchuanhehe <wyihe5220@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add typed owner approval and Session-owned client configuration to the existing SSAP actor. Rust/C/Python/CLI use the same channel, actual security context and original deadline. Retire the passive receive API; a bounded receive transaction refuses existing configuration and verifies disable before returning. Owned notifications report software admission; indications report a peer protocol queue ACK, neither application processing.
Extend the existing VM runner with an explicit protected update-delivery gate requiring actual C/Python peer validation, an independent business reply, both directions and connection roles, sealed tool identities and paired USB evidence. No second Host or protocol Engine.
Validation on this new public head is pending. This source review is not a real-device, complete formal, reliable-delivery or release qualification. Strict configuration proof export remains unproved. Protected initialization error/retry handling, late/duplicate ACK attribution, persistent subscriptions, multi-application delivery, full lifecycle/permissions and natural recovery remain open. The public branch and separately retained development artifacts have distinct source identities; results do not transfer between them. Preserve original scope and gates; partial work closes no whole issue.