feat(lab): add isolated iPhone capture evidence

2026-07-16 19:43:41 +03:00
parent 63dd8c8790
commit 19ab973110
11 changed files with 2428 additions and 0 deletions
@@ -0,0 +1,76 @@
+# LixelGO / iPhone observation runbook
+
+This runbook prepares the Mac without full Xcode and defines the first bounded,
+read-only capture. The accepted decision is ADR 0005. Do not start the iPhone
+experiment until the exact-profile physical regression in ADR 0004 passes.
+
+## Current Mac baseline
+
+- macOS 26.5.1, Apple Silicon;
+- Xcode Command Line Tools 16.4 are present;
+- full Xcode and `rvictl` are absent;
+- built-in `tcpdump` and `uv` are present;
+- Wireshark/tshark are not required for capture;
+- the isolated lab uses Python 3.12 and `pymobiledevice3==9.36.0`.
+
+## Preparation
+
+```bash
+uv sync --project plugins/xgrids-k1/lab/iphone-capture --frozen
+uv run --project plugins/xgrids-k1/lab/iphone-capture --frozen \
+  pymobiledevice3 version
+```
+
+Expected version: `9.36.0`.
+
+Connect one unlocked iPhone using a data cable, approve the Mac accessory prompt,
+and tap **Trust This Computer**. Do not paste a UDID into Terminal or notes.
+
+```bash
+uv run --project plugins/xgrids-k1/lab/iphone-capture --frozen \
+  python plugins/xgrids-k1/lab/iphone-capture/preflight.py
+```
+
+## First smoke without K1
+
+After the iPhone preflight succeeds, run a 10-second idle capture only after the
+current source milestone is committed or with an explicitly recorded dirty-tree
+fingerprint:
+
+```bash
+uv run --project plugins/xgrids-k1/lab/iphone-capture --frozen \
+  python plugins/xgrids-k1/lab/iphone-capture/capture.py \
+  --duration 10
+```
+
+The tool retains the original metadata-bearing `PCAPNG` and creates a compatible
+classic `PCAP`. Validate the latter with built-in `tcpdump`:
+
+```bash
+tcpdump -nn -r sessions/iphone-k1-observation/<session>/captures/iphone-network.pcap -c 1
+```
+
+After the capture and operator timeline are both closed, seal the complete
+session without rewriting the capture manifest:
+
+```bash
+uv run python plugins/xgrids-k1/lab/iphone-capture/session_integrity.py \
+  sessions/iphone-k1-observation/<session>
+```
+
+The derived private inventory verifies all manifest hashes and also hashes the
+late operator-event artifact when it exists.
+
+## Full baseline sequence
+
+1. Complete the ADR 0004 physical K1 regression without LixelGO.
+2. Close unrelated iPhone apps and pause unrelated network activity.
+3. Keep the iPhone on the K1/shared Wi-Fi while USB remains connected to Mac.
+4. Start a bounded 60–180 second network capture.
+5. Perform one predefined LixelGO action at a recorded monotonic offset.
+6. Stop and retain the raw capture; analyze only offline.
+7. Record endpoints, ports, sizes, timing and correlation before interpreting a
+   payload as a command, image, or model frame.
+
+The first baseline does not install the Bluetooth logging profile. BLE/HCI is a
+separate operator-approved experiment.