# LixelGO / iPhone observation runbook

This runbook prepares the Mac without full Xcode and defines the first bounded,
read-only capture. The accepted decision is ADR 0005. Do not start the iPhone
experiment until the exact-profile physical regression in ADR 0004 passes.

## Current Mac baseline

- macOS 26.5.1, Apple Silicon;
- Xcode Command Line Tools 16.4 are present;
- full Xcode and `rvictl` are absent;
- built-in `tcpdump` and `uv` are present;
- Wireshark/tshark are not required for capture;
- the isolated lab uses Python 3.12 and `pymobiledevice3==9.36.0`.

## Preparation

```bash
uv sync --project plugins/xgrids-k1/lab/iphone-capture --frozen
uv run --project plugins/xgrids-k1/lab/iphone-capture --frozen \
  pymobiledevice3 version
```

Expected version: `9.36.0`.

Connect one unlocked iPhone using a data cable, approve the Mac accessory prompt,
and tap **Trust This Computer**. Do not paste a UDID into Terminal or notes.

```bash
uv run --project plugins/xgrids-k1/lab/iphone-capture --frozen \
  python plugins/xgrids-k1/lab/iphone-capture/preflight.py
```

## First smoke without K1

After the iPhone preflight succeeds, run a 10-second idle capture only after the
current source milestone is committed or with an explicitly recorded dirty-tree
fingerprint:

```bash
uv run --project plugins/xgrids-k1/lab/iphone-capture --frozen \
  python plugins/xgrids-k1/lab/iphone-capture/capture.py \
  --duration 10
```

The tool retains the original metadata-bearing `PCAPNG` and creates a compatible
classic `PCAP`. Validate the latter with built-in `tcpdump`:

```bash
tcpdump -nn -r sessions/iphone-k1-observation/<session>/captures/iphone-network.pcap -c 1
```

After the capture and operator timeline are both closed, seal the complete
session without rewriting the capture manifest:

```bash
uv run python plugins/xgrids-k1/lab/iphone-capture/session_integrity.py \
  sessions/iphone-k1-observation/<session>
```

The derived private inventory verifies all manifest hashes and also hashes the
late operator-event artifact when it exists.

## Full baseline sequence

1. Complete the ADR 0004 physical K1 regression without LixelGO.
2. Close unrelated iPhone apps and pause unrelated network activity.
3. Keep the iPhone on the K1/shared Wi-Fi while USB remains connected to Mac.
4. Start a bounded 60–180 second network capture.
5. Perform one predefined LixelGO action at a recorded monotonic offset.
6. Stop and retain the raw capture; analyze only offline.
7. Record endpoints, ports, sizes, timing and correlation before interpreting a
   payload as a command, image, or model frame.

The first baseline does not install the Bluetooth logging profile. BLE/HCI is a
separate operator-approved experiment.