From 776b04184e2ed4cf1572f54df1339c57ae2abba3 Mon Sep 17 00:00:00 2001 From: Daniel Samson <12231216+daniel-samson@users.noreply.github.com> Date: Sat, 1 Aug 2026 07:20:39 +0100 Subject: [PATCH] =?UTF-8?q?docs:=20security=20track=20live=20state=20?= =?UTF-8?q?=E2=80=94=20P4b=20green=20at=20110?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/security-track-plan.md | 34 ++++++++++++++++++++++++++++++---- 1 file changed, 30 insertions(+), 4 deletions(-) diff --git a/docs/security-track-plan.md b/docs/security-track-plan.md index 58ca120..8d34a4c 100644 --- a/docs/security-track-plan.md +++ b/docs/security-track-plan.md @@ -36,10 +36,10 @@ plain `main` checkout always tells the truth about where the work is.** | | | |---|---| -| Working on | **P4b** — device-manager, power, usb-transfer onto `Define` | -| Branch carrying it | `feat/security-group-3` (local only — origin returned 503 at 06:1x, push pending) | +| Working on | **P4c** — harness subscriber lift + badge-scoped client ids | +| Branch carrying it | `feat/security-group-3` (pushed to origin) | | On `main` | Phase 0, PM, H1, P1, P2, P3 — groups 1 and 2 merged | -| Awaiting merge | P4a — lands with the group 3 merge | +| Awaiting merge | P4a, P4b — land with the group 3 merge | | Suite | 110 cases, all passing | | Last updated | 2026-08-01 | @@ -66,7 +66,7 @@ group boundary. bind attestation and every refusal it makes untouched (suite 109/109) - [x] **merge** group 2 → main, push - [x] **P4a** — clean protocols rebased onto `Define` (vfs, block, display, scanout, input; display's one overloaded request split per-operation and its field abuse ended, scanout's bogus 64-byte maximum deleted, directory EOF re-spelled as a nameless entry, input moved onto the service harness; new `protocol-conformance` case asks every reachable provider for `describe` and requires `-ENOSYS` for an undefined verb; suite 110/110) -- [ ] **P4b** — misfit protocols rebased (device-manager, power, usb-transfer) +- [x] **P4b** — misfit protocols rebased (device-manager, power, usb-transfer; every leading operation byte folded into the header, and with it the `device_id`/`device_token` that followed it — `Header.target` now carries the device in all three. device-manager's own `enumerate`/`subscribe` became the reserved verbs and its three `{status, reserved}` reply structs the envelope's `Status`; `ChildAdded` is one struct under two numbers, a call and an event, landing exactly on the 64-byte push floor. power's kinds became one declared event each, the input protocol's shape, so init reads *what happened* from the header; usb-transfer's control data stage moved to the packet tail in both directions, which made `Status.len` the transferred length and `actual_length` redundant. The two silent-breakage sites — init's byte-offset power parse and acpi's `message[0]` dispatch — are gone, the shutdown badge gate unchanged; three more rows in the conformance table. Suite 110/110) - [ ] **P4c** — harness subscriber lift + badge-scoped per-client integers - [ ] **merge** group 3 → main, push - [ ] **H2** — SMEP on every core @@ -413,6 +413,32 @@ re-layouts and raw-offset readers): USB storage/HID all exercise these wires); the conformance case now covers three more providers. Suite 110. +*Landed. Three judgment calls the plan left open, recorded because a reader of +the wire formats will want them:* + +- *`ChildAdded` is 48 bytes, not the 44 the "60 B" estimate assumed: three `u64`s + give the struct eight-byte alignment, so 41 bytes of content round up whatever + order the fields sit in. The packet is therefore **exactly** 64 — on the push + floor, not under it — which `Define` accepts and the module pins in a test. The + fields are ordered small-tail-last deliberately, so the slack the rounding pays + for is where the small ones live.* +- *power's events are declared **per kind** (`power_button`, `lid`, `ac`, + `battery`, `notify`), not one `event` with the kind in the payload. That is the + shape P4a gave input — "the class is the header's operation, so a subscriber + reads the kind from the packet rather than from a tag inside the payload" — and + it is what makes `Header.operation` carry information here at all. It also kept + every call site's spelling: `Protocol.Event` is re-exported as the protocol's + own `Event`, with the members it always had.* +- *the conformance case still checks two providers, and the three new rows report + as unbound. All three P4b contracts arrive with the device manager — it is the + first, it spawns the discovery service that binds the second, and the xHCI + driver that binds the third — so booting one means booting the driver tree, and + the fixture takes **one snapshot** of `/protocol`: a scenario whose bound set + depends on how far that tree got would make the case's own summary line a boot + race. The rows still earn their place — a future scenario that binds one gets it + checked with no edit here, and `/test/*` already holds the `open` grant for + `device-manager`.* + ## P4c — harness subscriber lift + badge scoping - `library/kernel/service.zig` grows the subscriber table, exit-