Files
NODEDC_MISSION_CORE/docs/audits/2026-09-07-k1-linux-route-contract-r7.md
T

5.4 KiB

Applied Wi-Fi and Linux control-path contract R7

The owner UI attempt on R6 confirmed K1 station Wi-Fi with an assigned private address. The network operation succeeded; its owned read-only control bootstrap then failed with TypeError. The terminal attempt is network_applied, side_effect_status=applied, stage=control-bootstrap-failed. This differs from the preceding pre-dispatch Bluetooth failure. A repeat provisioning write is not the appropriate next action.

Reproduced implementation defect

HostWifiAssociationProbe defines observe(interface_name, *, timeout_seconds). The real service _sample_host_path calls that positional interface contract. LinuxWifiAssociationProbe instead declared interface_name keyword-only. Consequently every real Linux service path observation raised TypeError before examining Ethernet/Wi-Fi or probing the K1 control endpoint. The earlier adapter test called observe by keyword and therefore missed this consumer boundary.

A new test invokes the actual service host-path and correlated TCP observation with the real Linux adapter and synthetic OS route/sysfs/TCP endpoints. Before the fix it reproduces TypeError at facade.py:_sample_host_path. The Linux adapter now accepts the existing protocol signature. Stable Ethernet reaches a single TCP probe without nmcli or host association; a route change across that probe still fails closed. The caller, route fingerprints, supervisor, Wi-Fi protocol, application authority and MQTT/Rerun profiles are unchanged.

Operator continuation and messages

The modal previously displayed read-only verification only for network_outcome_unknown, leaving an applied network without its prescribed next action. It now exposes Check K1 state whenever the backend permits that read-only action for the explicitly selected device, including an applied or restored configured network. No credentials are required and the existing verification contract remains fenced by runtime/mode/discovery/target. The ordinary check still submits one explicit provisioning intent; final Connect still only completes a currently verified dialog.

Messages in the modal use SettingsCard align=center. The canonical Design Guideline change is 5b882bc3d9b13a86e6c26111ef5ded687ea3a2fc, including registry, documentation and a catalog example. Centered cards omit an empty body and center their content on both axes; ordinary settings groups keep their existing start layout. No local CSS override, fixed height, new colors or decoration. Node packaging pins this exact DG source.

Validation and pending physical acceptance

The failing reproduction is retained privately. After the fix: 18 NodeBridge / package lifecycle checks passed, four applied-network bootstrap lifecycle checks passed, 23 focused frontend/architecture checks passed and 794 full Core frontend tests passed. Changed Linux/backend files pass Ruff. DG ui-react build, catalog typecheck and registry validation passed. Production package and installation results follow separately.

Node 0.8.5 and K1 0.1.4 are reserved for this source. The next owner UI test must clear browser cache, select K1 and use read-only Check K1 state to observe the already applied network. It must prove DeviceInfo/control readiness before claiming Bridge or live acceptance. Private screenshot, exact operation, UTC/monotonic manifest and hashed logs are retained under private/acceptance/k1-node085-20260907-core-ui. No agent CLI BLE/MQTT commands were sent. Publication of prior installation reports remains blocked by the earlier automatic review decision; no remote push workaround is used.

Prepared release

Source e6521e855ae2a4dc61dc8f96d4e5c616c4e75552 produced Node 0.8.5 (109814534 bytes, SHA256 c0acb0eb546fdbeb3e65802f6078971baedfd8a14c6f4183a34ec321523d26bb) and private K1 0.1.4+private.1 (318107606 bytes, SHA256 7b5c999c1df2a9227eb7e08d9dfaca8e26513c864072991d83638ae5c61f8745). Node provenance also pins DG 5b882bc. Core/Node TypeScript and production builds, Go packaging and the Node UI boundary test passed. The release is retained in private/releases/mission-core-node-k1-20260907-r7. Transfer checksums matched; APT simulation selected two upgrades and no removals.

The canonical Core is operational and serves the exact new index, SHA256 ab8f6a515715715b8842023729e1a22fbf2d524ca157a7e53f774e2fe081a8da. One Ubuntu GUI installer is awaiting owner sudo authentication. Installation, read-only DeviceInfo/control verification and live/recovery remain pending.

Installed readback

The GUI installer subsequently exited with code 0. Installed Node 0.8.5 and K1 0.1.4+private.1 both report source e6521e8; Node reports DG 5b882bc. Both services are active/running with zero restarts, started at 13:50:44 and 13:50:52 MSK. The preserved Fleet binding is fresh/available, with discovery generation 0 and both scan-ble and observe-configured-device-network permitted. This confirms retention of the applied-network recovery path across the update, without claiming a verified K1 control session.

Core 8000 is still the only integrated service and 8765 has no listener. The owner was invited to clear Chrome cache, explicitly discover/select K1 and use Check K1 state without re-entering Wi-Fi credentials. That read-only physical verification and live/recovery acceptance remain pending. Private manifest and hashes record installed state; Ops K1/Node progress was updated without changing the Node card's architectural baseline.