SILVER/NODEDC_MISSION_CORE
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

feat(k1): add offline control execution gate

Browse Source
This commit is contained in:
DCCONSTRUCTIONS
2026-07-18 14:14:30 +03:00
parent d7749208a7
commit ea811ff370
17 changed files with 916 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/adr/0009-device-plugin-observation-runtime-and-k1-extraction.md
+1 -1
View File
@@ -114,7 +114,7 @@ The operator project name is normalized and validated by the K1 contribution,
stored as display/catalog metadata and never used as a path component. This ADR
does not claim that it reaches the scanner: the inert application-control codec
has no publisher, and automatic K1 writes remain disabled pending reviewed
private application-authority loading and durable post-stop save evidence.
operator-owned Keychain execution-lease wiring and durable post-stop save evidence.
ADR 0011 subsequently places the action control plane behind a versioned
descriptor/handshake/health transport seam. Observation discovery and export
docs/adr/0012-device-bound-k1-command-authority.md
+16 -10
View File
@@ -77,24 +77,30 @@ captured special relation
## Current implementation boundary
`application_bootstrap.py` provides the bounded application authority type,
DeviceInfo response correlation/decoding and the exact non-executable ten-step
shadow plan. Its retained clean-cycle regression is 10/10 payloads and topic
order. `LiveModelingControlSafety` independently binds that DeviceInfo identity
to live status and creates non-executable START/STOP plans.
`application_bootstrap.py` provides DeviceInfo decoding, the exact ten-request
shadow plan and a five-batch response-barrier orchestrator. Its private retained
regression completes with 10/10 request payload/topic matches and correlated
required responses. `ModelingStatusRequest` remains non-blocking exactly where
the capture had no synchronous response. `application_authority.py` reads the
exact 36-byte authority only from a fixed macOS Keychain item and offers no
plaintext fallback. `LiveModelingControlSafety` independently binds DeviceInfo
identity to live status and creates non-executable START/STOP plans.
Public state contains only booleans, counts and wire metadata. Private identity,
authority and payload bytes stay out of repr/API output. Both shadow paths are
blocked by `vendor-writes-disabled` and `publisher-not-installed`; no MQTT
publisher or automatic retry path exists.
authority and payload bytes stay out of repr/API output.
`application_publish.py` defines reviewed one-shot envelopes plus a current
write-disabled publisher type. That type has no enable switch and raises before
its injected transport sink can be called. Both shadow paths remain blocked by
`vendor-writes-disabled` and `publisher-not-installed`; no MQTT publisher or
automatic retry path exists.
## Promotion gate
A future publisher requires separate review and an operator-present physical
acceptance:
1. load the private application authority through a reviewed local secret
mechanism;
1. provision the reviewed private authority into the fixed local Keychain item
and load it for one operator-owned execution lease;
2. confirm battery/storage and select one K1 over BLE;
3. run the exact response-gated bootstrap and attest activated FW 3.0.2;
4. confirm READY identity against DeviceInfo and review shadow metadata;