diff options
Diffstat (limited to 'todo.org')
| -rw-r--r-- | todo.org | 28 |
1 files changed, 28 insertions, 0 deletions
@@ -26,6 +26,34 @@ The net doctor's copyable report (=report.py=, =scrub_text=) scrubs only MAC/IP, Split out of the 2026-07-11 net-doctor-expansion spec review: that spec's new rival-manager/keyfile-perms verdicts keep parity with this pre-existing behavior rather than half-solve it. Fix shape: extend redaction to cover the connection name + keyfile basename across the copyable report and =--json= (one systemic pass, not per-verdict), with a redaction test. Engine-wide, so it wants one coherent change rather than being bolted onto the expansion work. +** TODO [#B] Net doctor expansion v1 — build the READY spec :feature:dotfiles:network: +:PROPERTIES: +:SPEC_ID: ce29b103-ed9d-4f56-bf8c-9ed8fe680ff3 +:END: +Build the [[file:docs/specs/2026-07-11-net-doctor-expansion-spec.org][net doctor expansion]] (DOING). Adds the control-plane cluster (rival-manager / nm-masked / keyfile-perms) and a sharper auth verdict to the shipped net doctor (=~/.dotfiles/net/=). Archsetup owns the dotfiles work end to end — edit, test, commit, and push in =~/.dotfiles=, then drop an inbox note. Phases 1-2 are gated on the shared cross-panel run-time privilege model, which doesn't exist yet; Phase 0 builds now. +*** TODO [#B] Phase 0 — control-plane probe (read-only) :solo: +Pure engine, no classifier change. A probe reporting rival-manager state (=systemctl is-active= on dhcpcd/networkd/iwd scoped to the diagnosed link, not merely "is networkd running"), NM masked/failed/stopped (=is-enabled=), and active-profile keyfile permissions (=stat= under =/etc/NetworkManager/system-connections=) into the diag context. =net diag --json= shows the new signals. Tests: injected =systemctl is-active/is-enabled= results + a temp system-connections tree; every probe bounded with a timeout. Verify: =net diag --json= against fakes + =make test= green. Solo — buildable and verifiable with fakes. +*** TODO [#C] Phase 1 — control-plane verdicts + privilege model +Blocked on the shared cross-panel run-time privilege model. =classify= gains =rival-manager=/=nm-masked=/=keyfile-perms= (all =fixable=), ordered ahead of the generic not-running rule, with the masked check reachable in the NM-down early-return path. Fixes register as =VERBS= + =ACTIONS= (=disable-rival=/=unmask-nm=/=chmod-keyfile=), each narrowly scoped. Hard gate: must not land before the Confirm floor exists, or =net doctor --fix= runs root ops via passwordless sudo ungated. Live verification needs a real rival/masked/bad-keyfile state (a VM or a deliberately-broken host), so not solo. +*** TODO [#C] Phase 2 — sharpened auth verdict +Auth-reason classifier reading profile key-mgmt (=manage.py=) + scanned SECURITY (=nmcli.py=): SAE / hidden / enterprise / generic. SAE and hidden become =fixable= profile-modify (Confirm-tier); the rest stay =needs-user-action= with a cause-named message. Pairwise over (reason × profile-state). The classify logic is agent-buildable with fakes; the live profile-modify fix needs a real WPA3/hidden network to verify, so that part is manual. +*** TODO [#C] Phase 3 — flip the net spec to IMPLEMENTED +On v1 completion: flip the spec's status heading to IMPLEMENTED (dated history line + mirror) and log the vNext items (flaky/drops cluster, DoT/DNSSEC verdict, profile hygiene) to todo.org. + +** TODO [#B] Bt doctor expansion v1 — build the READY spec :feature:dotfiles:bluetooth: +:PROPERTIES: +:SPEC_ID: 3d4d61c4-e5df-44e9-b8e0-40b31452c3f7 +:END: +Build the [[file:docs/specs/2026-07-11-bt-doctor-expansion-spec.org][bt doctor expansion]] (DOING). Adds a dmesg firmware-hint probe (names the missing blob on a no-adapter fault) and a boot-enablement probe (catches an adapter disabled at boot) to the shipped bt doctor (=~/.dotfiles/bluetooth/=). Phase 2 is gated on the shared cross-panel privilege model; Phases 0-1 build now. Archsetup owns the dotfiles work end to end. +*** TODO [#B] Phase 0 — the two read-only probes :solo: +Pure engine, no repair change. The dmesg firmware-hint reader (no-adapter branch, bounded =cmd.run(journalctl -k)= reusing the =doctor.py:84= precedent, per-vendor signature match) and the boot-enablement reader (AutoEnable from main.conf [Policy], =systemctl is-enabled=, TLP list). Both report into =diagnose()='s dict feeding the human summary + =--json=. Fault fires only on explicit AutoEnable=false / disabled service / TLP entry — bluez's default is true, so absent config is auto-enable-on and never a fault. Tests: canned journal buffer per vendor + injected main.conf/is-enabled/tlp states. Verify: fakes + =make test=. Solo. +*** TODO [#B] Phase 1 — firmware-hint Guide verdict :solo: +=diagnose= emits =no-adapter-firmware= (blob name in evidence, Reboot-tail Guide) on a signature match; falls back to the generic no-adapter otherwise. No auto-fix — a Guide, so no privilege dependency; lands independently of the shared model. The distinction rides existing =evidence=/=next_action= (no formatter change); an additive =schema.step= =code= key only if a machine identifier is wanted (locked test-contract ripple). Verify: fake journal fixtures + =make test=. Solo. +*** TODO [#C] Phase 2 — persistent-power verdict + fix +Blocked on the shared cross-panel privilege model. =powered-off-persistent= distinct from =powered-off=; the fix sets AutoEnable / enables the service / edits tlp, Privileged/Confirm. Needs an idempotent INI setter for main.conf ([Policy], preserve comments) and a list-edit for tlp.conf's =DEVICES_TO_DISABLE_ON_STARTUP= — real work, not argv one-liners. Hard gate: no Privileged fix before the Confirm floor. Persistence only proves out across a real reboot, so verification is manual. +*** TODO [#C] Phase 3 — flip the bt spec to IMPLEMENTED +On v1 completion: flip the spec's status heading to IMPLEMENTED (dated history line + mirror) and log the vNext items (stale-bond signature, connection-parameter hints, bt-audio-profile expansion) to todo.org. + ** TODO [#D] Maintenance console vNext :feature: Deferred from the [[file:docs/specs/2026-07-07-maintenance-console-spec.org][spec]] (v1 ships determinate remedies only): AI/workflow assistance on read-only metrics (the vLater tier — failed-unit diagnosis, journal-error fix suggestions, OOM investigation); SIGKILL escalation for TERM-survivors on the KILL lever; live streaming meters on evidence rows where a count could be a level. |