# K1 private installer and onboard package boundary R2

The owner narrowed the acceptance scope to the current K1 and a transferable
installer for supported onboard hosts. A second scanner and other firmware
versions are explicitly deferred. The reviewed application material may travel
with this private installer; it is not committed to source or made public.

## Evidence and decision

ADR 0012 and the retained LixelGO static/wire analysis distinguish the embedded
application value from each scanner's live vendor ID and serial. A per-device
packet dump is not part of the reviewed connection flow. We nevertheless claim
only the currently accepted scanner/FW 3.0.2, not untested fleet-wide support.
The current XGRIDS release notes also identify a communication-protocol change
at 3.0.2 paired with LixelGO 1.2.0; compatibility remains version-scoped.

Autonomy here means installation on Ubuntu 24.04 amd64 without a Mac, Keychain,
typed key or new capture. The private K1 package supplies the same reviewed
material; its installer encrypts that material using the destination host's
systemd credential facility. Normal Ubuntu repositories may be needed for OS
dependencies. This is not an air-gapped distribution of Ubuntu itself.

## Implementation

Node 0.8.0 no longer owns the K1 Python runtime, Linux wheel bundle, service,
polkit rule or credential importer. These moved to the optional
`mission-core-xgrids-k1` package owned under `plugins/xgrids-k1/packaging`.
Its dependencies and Debian migration metadata are explicit. Existing runtime,
journal, identity and encrypted-credential paths are retained. Removal preserves
durable state; package transitions keep the existing idle/safe-worker gate.

The code-only package is 0.1.0; the prepared private edition is 0.1.0+private.1.
Private material enters the engineering builder through memory/stdin and is
present only in a root-owned 0600 package member. The `.deb` itself is a private
0600 artifact, not an encrypted distributable. Public provenance records only
profile identity, material presence and hashes of public files. The installed
worker uses the encrypted systemd credential, never the package member as a
plaintext runtime fallback. Identical reinstall is idempotent; a different
existing credential requires explicit rotation. No raw value reaches argv,
environment, browser state, Ops or source files.

The onboard source payload now has an executable 85-module allowlist instead
of copying every one of 459 Python modules. Changed imports fail packaging
until reviewed. The Core/LAB factory moved into `composition.py` with identical
AST; neither its behavior nor the device dialogue changed. Laboratory public
exports became lazy so importing one historical migration predicate does not
load laboratory runners and downstream compute jobs. Existing export names and
resolved objects are retained.

## Validation before private release

- 138 installer, isolated-payload, application-authority, Node bridge, session,
  laboratory and composition checks passed. The synthetic installer checks
  encryption invocation, reinstall, refusal to rotate, invalid inputs,
  permissions, symlinks, private/public payload separation and no overwrite.
- 775 additional plugin runtime, acquisition lifecycle, restart rehydration and
  laboratory API checks passed, with no errors, failures or skips.
- Ruff and whitespace checks passed for changed runtime/new packaging modules.
- Node TypeScript, production UI and Go binary/package build passed. No second
  backend or Docker workload was started.
- The isolated runtime test uses the declared source payload and verifies all
  loaded K1/Core modules originate there. It reads idle state and closes the
  runtime; no BLE discovery, provisioning, MQTT, START/STOP or hardware test is
  performed. The local Mac lacks optional aiortc; full Node media import is a
  Linux installation acceptance, not a result claimed by this test.

Exact release hashes, installed package versions, credential readiness and
hardware acceptance are recorded after the private build and board update.

## Remaining architecture scope

This is a separately installable onboard package, not completion of the entire
plugin migration. Local Core still uses an in-process runtime and a statically
composed frontend. The facade still needs internal decomposition, and some
shared session/viewer code remains a declared plugin dependency. No other Rerun
profile, camera producer or recovery state transition was changed here.
Hardware acceptance uses the UI with cache cleared before every test, as
requested. A second scanner, new firmware or different host platform is not
accepted by packaging and software regression alone.

Vendor reference: https://www.xgrids.com/intl/support/download?page=K1