77 lines
3.3 KiB
Markdown
77 lines
3.3 KiB
Markdown
# ADR 0005: Owner-controlled LixelGO/iPhone observation
|
|
|
|
- Status: accepted
|
|
- Date: 2026-07-16
|
|
- Supersedes: only the unavailable-phone assumption in ADR 0001
|
|
|
|
## Context
|
|
|
|
ADR 0001 correctly described the original stand: no phone and no LixelGO were
|
|
available, so they could not be dependencies or test oracles. An
|
|
owner-controlled iPhone with LixelGO is now available for a new, evidence-only
|
|
experiment. The previous no-phone results remain valid historical evidence.
|
|
|
|
An ordinary third client on the mesh Wi-Fi cannot normally observe unicast
|
|
traffic between the iPhone and K1. Apple's native Remote Virtual Interface path
|
|
requires `rvictl`, which is installed by full Xcode and is absent from the
|
|
current Mac. Installing full Xcode solely for the first capture is unnecessary.
|
|
|
|
## Decision
|
|
|
|
The XGRIDS plugin may use a pinned, isolated `pymobiledevice3` lab environment
|
|
to read the iPhone `pcapd` service over a trusted USB connection. This mirrors
|
|
the iPhone IP stack while the phone remains connected to K1 over Wi-Fi. It is a
|
|
lab subprocess, not a root Mission Core dependency.
|
|
|
|
The experiment is evidence-only:
|
|
|
|
- no TLS interception or MITM certificate;
|
|
- no app automation;
|
|
- no new BLE or MQTT write;
|
|
- no router, firmware, device-file, or application mutation;
|
|
- no camera or command semantic claim until bounded decode and a controlled
|
|
physical correlation are both present.
|
|
|
|
Network capture does not include BLE HCI. Bluetooth capture is a separate gate
|
|
that requires Apple's diagnostic logging profile, explicit operator approval,
|
|
and removal of that profile after the experiment.
|
|
|
|
All captures are sensitive, mode `0600`, bounded in duration, stored under
|
|
ignored `sessions/`, hashed, and represented in Git/Ops only by redacted facts.
|
|
No device ID, credential, SSID, router metadata, or raw packet payload enters
|
|
normal Git history.
|
|
|
|
## Entry gate
|
|
|
|
LixelGO/iPhone observation starts only after ADR 0004's post-refactor physical
|
|
regression succeeds on exact firmware `3.0.2` and direct-LAN:
|
|
|
|
1. operator attestation;
|
|
2. prepare the receiver;
|
|
3. physical double-click start;
|
|
4. first real point frame and pose through the new normalizer/viewer path;
|
|
5. raw evidence finalization;
|
|
6. operator-confirmed physical stop;
|
|
7. verification that Mission Core emitted no K1 application command.
|
|
|
|
## Consequences
|
|
|
|
Full Xcode, `rvictl`, Wireshark, and system/Homebrew changes are not required for
|
|
the first IP capture. TLS or proprietary encryption may remain opaque; endpoint,
|
|
port, size, timing, interface, process, and plaintext local protocol evidence are
|
|
still useful. Any discovered state-changing contract requires a new profile
|
|
revision and its own acceptance gate before implementation.
|
|
|
|
## Outcome recorded on 2026-07-16
|
|
|
|
Lab 002 completed the bounded observation. It found a plaintext local MQTT data
|
|
and control plane plus two RTSP/H.264 camera preview endpoints. Owner-operated
|
|
LixelGO start and stop were correlated with bounded protobuf action values `1`
|
|
and `2`, device success responses, physical K1 transitions and start/stop of the
|
|
high-rate streams. No LixelGO WAN flow was observed in either principal window.
|
|
|
|
This outcome updates descriptive evidence only. Mission Core still emits no
|
|
modeling request: private header/settings construction, save-complete semantics,
|
|
timeouts and rollback remain unresolved. See
|
|
`docs/lab/002_LIXELGO_IPHONE_LOCAL_PROTOCOL_20260716.redacted.md`.
|