SSAP: typed policy, Session CPCD and bounded updates

.github/workflows/ci.yml

@@ -142,7 +142,7 @@ jobs:
         with:
           repository: OpenSparklink/linux
           # Update this pin together with intentional kernel UAPI changes.
-          ref: 2fc210af68ee3bce0eed3553117d8be635dfdd15
+          ref: fb31bb43240e1a370e886f9fd2acf0b899619386
           path: .kernel-uapi
           sparse-checkout: |
             include/uapi/linux/sparklink_ioctl.h
@@ -188,7 +188,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           repository: OpenSparklink/linux
-          ref: 2fc210af68ee3bce0eed3553117d8be635dfdd15
+          ref: fb31bb43240e1a370e886f9fd2acf0b899619386
           path: .kernel-containment
           sparse-checkout: |
             net/sparklink

.github/workflows/codec-fuzz.yml

@@ -29,7 +29,7 @@ jobs:
           repository: OpenSparklink/linux
           # Review/bump with changes to these production codecs or the harness.
           # This is an explicit source pin; it does not silently follow a branch.
-          ref: 400bd6812608935e2845d6d2b80ec58e7a6a6415
+          ref: c39a1765fc6036da0a635a755cbd2022de4f0b28
           path: kernel
           sparse-checkout: |
             drivers/sparklink/ws73/wire.c

.github/workflows/tooling.yml

@@ -52,18 +52,106 @@ jobs:
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           repository: OpenSparklink/linux
-          ref: c41fd4e698ef6d86cd921fa677269b5c62102bb0
+          ref: fb31bb43240e1a370e886f9fd2acf0b899619386
           path: .kernel-tools
           sparse-checkout: |
             tools/testing/selftests/sparklink
             include/uapi/linux
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.12'
+      - name: Prepare fixed compiler before bounded codec tests
+        run: |
+          rustup toolchain install 1.96.1 --profile minimal
+          rustc +1.96.1 -vV
       - name: Run existing tooling tests, including rejection controls
         env:
           SPARKLINK_KERNEL_SOURCE: ${{ github.workspace }}/.kernel-tools
+          RUSTUP_TOOLCHAIN: '1.96.1'
         run: python3 -m unittest discover -s tools/tests -v
+      - name: Check out exact WS73 receive function selftest sources
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          repository: OpenSparklink/linux
+          # Exact query/RX functions; existing UAPI/SDK pins stay independent.
+          ref: 883b9c0c19ef7d37f40f6b4b057cd7ca83cde160
+          path: .kernel-rx-functions
+          sparse-checkout-cone-mode: false
+          sparse-checkout: |
+            drivers/sparklink/ws73/usb.c
+            drivers/sparklink/ws73/wire.c
+            drivers/sparklink/ws73/wire.h
+            drivers/usb/core/message.c
+            tools/testing/selftests/sparklink/run_connection_tx.py
+            tools/testing/selftests/sparklink/usb_source_paths.py
+            tools/testing/selftests/sparklink/run_ws73_runtime_rx.py
+            tools/testing/selftests/sparklink/run_ws73_hcc_memory.py
+            tools/testing/selftests/sparklink/ws73-runtime-rx
+      - name: Run actual RX functions with detector and mutation controls (no USB)
+        working-directory: .kernel-rx-functions
+        env:
+          CC: clang
+        run: |
+          clang --version
+          python3 tools/testing/selftests/sparklink/run_ws73_runtime_rx.py --output "$RUNNER_TEMP/ws73-runtime-rx.json" --artifacts "$RUNNER_TEMP/ws73-runtime-rx-artifacts"
+      - name: Run actual fixed HCC query and exact-response helper (no USB)
+        working-directory: .kernel-rx-functions
+        env:
+          CC: clang
+        run: python3 tools/testing/selftests/sparklink/run_ws73_hcc_memory.py --output "$RUNNER_TEMP/ws73-hcc-memory.json" --artifacts "$RUNNER_TEMP/ws73-hcc-memory-artifacts"
+      - name: Retain bounded HCC function evidence, including failures
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: ws73-hcc-memory-offline-functions
+          if-no-files-found: error
+          retention-days: 14
+          path: |
+            ${{ runner.temp }}/ws73-hcc-memory.json
+            ${{ runner.temp }}/ws73-hcc-memory-artifacts/
+      - name: Retain bounded function evidence, including failures
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: ws73-runtime-rx-offline-functions
+          if-no-files-found: error
+          retention-days: 14
+          path: |
+            ${{ runner.temp }}/ws73-runtime-rx.json
+            ${{ runner.temp }}/ws73-runtime-rx-artifacts/
+
+  ws73-input-profiles:
+    name: WS73 per-device input production functions (no hardware)
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - name: Check out the exact profile and boot production sources
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          repository: OpenSparklink/linux
+          # New file-input dependency;existing ABI/RX pins retain their scopes.
+          ref: 1e0667dd7b075c1340ca2fa5304e556327611dbe
+          path: .kernel-input-profiles
+          sparse-checkout: |
+            drivers/sparklink/ws73
+            tools/testing/selftests/sparklink
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: '3.12'
+      - name: Install host fixture dependencies
+        run: sudo apt-get update && sudo apt-get install -y clang libssl-dev
+      - name: Run actual codec and boot failure boundaries
+        working-directory: .kernel-input-profiles
+        env:
+          ASAN_OPTIONS: detect_leaks=1:abort_on_error=1
+          UBSAN_OPTIONS: halt_on_error=1
+        run: |
+          clang -std=c11 -Wall -Wextra -Werror -fsanitize=address,undefined -fno-omit-frame-pointer tools/testing/selftests/sparklink/ws73_fw_profile_test.c drivers/sparklink/ws73/fw_profile.c -o /tmp/ws73-fw-profile-test
+          /tmp/ws73-fw-profile-test
+          python3 tools/testing/selftests/sparklink/run_ws73_fw_profile.py
 
   application-sdk:
     name: Application SDK ABI and private-bus contracts (no hardware)
@@ -78,7 +166,7 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           repository: OpenSparklink/linux
-          ref: c41fd4e698ef6d86cd921fa677269b5c62102bb0
+          ref: fb31bb43240e1a370e886f9fd2acf0b899619386
           path: .kernel-tools
           sparse-checkout: |
             tools/testing/selftests/sparklink

bindings/python/sparklink/__init__.py

@@ -3,11 +3,17 @@
 Native management requires an explicit ``sparklink.native`` import and its
 independent library. No default Adapter, controller lease or local Host Engine.
 """
-from .ssap import SsapOperations, SsapAccess
-from .client import Client, Connection, ControllerId
-from .local_services import LocalProperty, LocalService, LocalServiceReceipt
+from .ssap_discovery import SsapDiscovery, SsapEntry
+from .ssap import SsapOperations, SsapAccess, MethodAccess
+from .client import Client, Connection, ControllerId, SsapUpdate
+from .ssap_subscription import (SsapSubscription, SsapSubscriptionInfo,
+                                SsapSubscriptionPacket, SsapSubscriptionBatch)
+from .local_services import LocalMethod, LocalProperty, LocalService, LocalServiceReceipt
 from .service_authorization import AuthorizationRequest, AuthorizationInfo
+from .service_provider import (ReadProvider, ReadProviderRequest, ReadProviderInfo,
+                               WriteProvider, WriteProviderRequest, WriteProviderInfo,
+                               MethodProvider, MethodProviderRequest, MethodProviderInfo)
 from .discovery import DiscoverySession, DiscoveryBatch, DiscoveryReport
 from .controller_events import ControllerEvents, ControllerEvent
 from .channel import channel_info, channel_tx_status, session_tx_status, channel_recv_security, channel_send_constrained, channel_prepare_tx
-__all__=["AuthorizationRequest","AuthorizationInfo","LocalProperty","LocalService","LocalServiceReceipt","DiscoverySession","DiscoveryBatch","DiscoveryReport","ControllerEvents","ControllerEvent","Client","Connection","ControllerId","SsapOperations","SsapAccess","channel_info","channel_tx_status","session_tx_status","channel_recv_security","channel_send_constrained","channel_prepare_tx"]
+__all__=["SsapDiscovery","SsapEntry","MethodAccess","LocalMethod","MethodProvider","MethodProviderRequest","MethodProviderInfo","WriteProvider","WriteProviderRequest","WriteProviderInfo","ReadProvider","ReadProviderRequest","ReadProviderInfo","SsapSubscription","SsapSubscriptionInfo","SsapSubscriptionPacket","SsapSubscriptionBatch","SsapUpdate","AuthorizationRequest","AuthorizationInfo","LocalProperty","LocalService","LocalServiceReceipt","DiscoverySession","DiscoveryBatch","DiscoveryReport","ControllerEvents","ControllerEvent","Client","Connection","ControllerId","SsapOperations","SsapAccess","channel_info","channel_tx_status","session_tx_status","channel_recv_security","channel_send_constrained","channel_prepare_tx"]