82 lines
4.7 KiB
Markdown
82 lines
4.7 KiB
Markdown
# K1 private installer and onboard package boundary R2
|
|
|
|
The owner narrowed the acceptance scope to the current K1 and a transferable
|
|
installer for supported onboard hosts. A second scanner and other firmware
|
|
versions are explicitly deferred. The reviewed application material may travel
|
|
with this private installer; it is not committed to source or made public.
|
|
|
|
## Evidence and decision
|
|
|
|
ADR 0012 and the retained LixelGO static/wire analysis distinguish the embedded
|
|
application value from each scanner's live vendor ID and serial. A per-device
|
|
packet dump is not part of the reviewed connection flow. We nevertheless claim
|
|
only the currently accepted scanner/FW 3.0.2, not untested fleet-wide support.
|
|
The current XGRIDS release notes also identify a communication-protocol change
|
|
at 3.0.2 paired with LixelGO 1.2.0; compatibility remains version-scoped.
|
|
|
|
Autonomy here means installation on Ubuntu 24.04 amd64 without a Mac, Keychain,
|
|
typed key or new capture. The private K1 package supplies the same reviewed
|
|
material; its installer encrypts that material using the destination host's
|
|
systemd credential facility. Normal Ubuntu repositories may be needed for OS
|
|
dependencies. This is not an air-gapped distribution of Ubuntu itself.
|
|
|
|
## Implementation
|
|
|
|
Node 0.8.0 no longer owns the K1 Python runtime, Linux wheel bundle, service,
|
|
polkit rule or credential importer. These moved to the optional
|
|
`mission-core-xgrids-k1` package owned under `plugins/xgrids-k1/packaging`.
|
|
Its dependencies and Debian migration metadata are explicit. Existing runtime,
|
|
journal, identity and encrypted-credential paths are retained. Removal preserves
|
|
durable state; package transitions keep the existing idle/safe-worker gate.
|
|
|
|
The code-only package is 0.1.0; the prepared private edition is 0.1.0+private.1.
|
|
Private material enters the engineering builder through memory/stdin and is
|
|
present only in a root-owned 0600 package member. The `.deb` itself is a private
|
|
0600 artifact, not an encrypted distributable. Public provenance records only
|
|
profile identity, material presence and hashes of public files. The installed
|
|
worker uses the encrypted systemd credential, never the package member as a
|
|
plaintext runtime fallback. Identical reinstall is idempotent; a different
|
|
existing credential requires explicit rotation. No raw value reaches argv,
|
|
environment, browser state, Ops or source files.
|
|
|
|
The onboard source payload now has an executable 85-module allowlist instead
|
|
of copying every one of 459 Python modules. Changed imports fail packaging
|
|
until reviewed. The Core/LAB factory moved into `composition.py` with identical
|
|
AST; neither its behavior nor the device dialogue changed. Laboratory public
|
|
exports became lazy so importing one historical migration predicate does not
|
|
load laboratory runners and downstream compute jobs. Existing export names and
|
|
resolved objects are retained.
|
|
|
|
## Validation before private release
|
|
|
|
- 138 installer, isolated-payload, application-authority, Node bridge, session,
|
|
laboratory and composition checks passed. The synthetic installer checks
|
|
encryption invocation, reinstall, refusal to rotate, invalid inputs,
|
|
permissions, symlinks, private/public payload separation and no overwrite.
|
|
- 775 additional plugin runtime, acquisition lifecycle, restart rehydration and
|
|
laboratory API checks passed, with no errors, failures or skips.
|
|
- Ruff and whitespace checks passed for changed runtime/new packaging modules.
|
|
- Node TypeScript, production UI and Go binary/package build passed. No second
|
|
backend or Docker workload was started.
|
|
- The isolated runtime test uses the declared source payload and verifies all
|
|
loaded K1/Core modules originate there. It reads idle state and closes the
|
|
runtime; no BLE discovery, provisioning, MQTT, START/STOP or hardware test is
|
|
performed. The local Mac lacks optional aiortc; full Node media import is a
|
|
Linux installation acceptance, not a result claimed by this test.
|
|
|
|
Exact release hashes, installed package versions, credential readiness and
|
|
hardware acceptance are recorded after the private build and board update.
|
|
|
|
## Remaining architecture scope
|
|
|
|
This is a separately installable onboard package, not completion of the entire
|
|
plugin migration. Local Core still uses an in-process runtime and a statically
|
|
composed frontend. The facade still needs internal decomposition, and some
|
|
shared session/viewer code remains a declared plugin dependency. No other Rerun
|
|
profile, camera producer or recovery state transition was changed here.
|
|
Hardware acceptance uses the UI with cache cleared before every test, as
|
|
requested. A second scanner, new firmware or different host platform is not
|
|
accepted by packaging and software regression alone.
|
|
|
|
Vendor reference: https://www.xgrids.com/intl/support/download?page=K1
|