From b3e631ff450258100524e2a48d44d2aa70a47e40 Mon Sep 17 00:00:00 2001 From: Craig Jennings Date: Sun, 12 Jul 2026 09:14:47 -0500 Subject: chore(specs): flip net and bt doctor expansions to IMPLEMENTED All v1 phases of both specs shipped on dotfiles main in the 2026-07-11 build run (net: 21ca3ff, d73eba6, c9f8604, be15a81, 12e3e76; bt: d19fdca, f05a9b4, d7d859f), fake-verified green. The live halves stay on the VM live-verification task and the manual-testing checklist. vNext items from both specs are now logged as [#D] tasks. --- docs/specs/2026-07-11-bt-doctor-expansion-spec.org | 13 +++++++------ docs/specs/2026-07-11-net-doctor-expansion-spec.org | 13 +++++++------ 2 files changed, 14 insertions(+), 12 deletions(-) (limited to 'docs') diff --git a/docs/specs/2026-07-11-bt-doctor-expansion-spec.org b/docs/specs/2026-07-11-bt-doctor-expansion-spec.org index b255b71..6fcc6ed 100644 --- a/docs/specs/2026-07-11-bt-doctor-expansion-spec.org +++ b/docs/specs/2026-07-11-bt-doctor-expansion-spec.org @@ -4,10 +4,11 @@ #+TODO: TODO | DONE #+TODO: DRAFT READY DOING | IMPLEMENTED SUPERSEDED CANCELLED -* DOING Bt Doctor Expansion +* IMPLEMENTED Bt Doctor Expansion :PROPERTIES: :ID: 3d4d61c4-e5df-44e9-b8e0-40b31452c3f7 :END: +- [2026-07-12 Sun @ 09:12 -0500] IMPLEMENTED — all v1 phases shipped on dotfiles main: Phase 0 read-only probes (=d19fdca=), Phase 1 firmware-hint Guide verdict (=f05a9b4=), Phase 2 persistent-power verdict + fix through the shared panelkit privilege model (=d7d859f=). 287 bt tests + 65 suites green against the fake harness. The live half (real reboot persistence) is handed off to the "Manual testing and validation" checklist in =todo.org= — findings there come back as bugs, not spec work. vNext items logged to =todo.org=. - [2026-07-11 Sat @ 02:30 -0500] DOING — decomposed into build tasks (spec-response Phase 6); parent task in =todo.org= bound by =:SPEC_ID:=. Phases 0-1 (the two read-only probes + the firmware-hint Guide verdict) are buildable now and =:solo:=; Phase 2 (the persistent fix) is gated on the shared cross-panel privilege model. - [2026-07-11 Sat @ 02:00 -0500] READY — third skeptical re-review returned Ready with caveats, no blocking findings; all round-2 resolutions verified against the engine. Caveat accepted: Phase 2 (the persistent fix) depends on the shared cross-panel privilege model, which doesn't exist yet; Phase 0 (both read-only probes) and Phase 1 (the firmware-hint Guide) are buildable today. - [2026-07-11 Sat @ 01:45 -0500] DRAFT — round-2 review + response. A skeptical re-review caught a real blocker: the AutoEnable default is =true=, not =false= (verified, bluez 5.87), so round 1's "dead every boot on absent config" premise was backwards and would fire a false positive on healthy machines. Corrected — the fault fires only on explicit AutoEnable=false / disabled service / TLP. Also folded three non-blocking corrections (the =code= key is additive-not-existing; the INI-setter is real Phase 2 work; the sequencing caveat now actually in Risks). Findings =[8/8]=, decisions =[3/3]=. Awaiting a third re-review. @@ -19,7 +20,7 @@ | Field | Value | |----------+-----------------------------------------------------------------------------------| -| Status | doing | +| Status | implemented | |----------+-----------------------------------------------------------------------------------| | Owner | Craig Jennings | |----------+-----------------------------------------------------------------------------------| @@ -175,16 +176,16 @@ Disposition: accepted. Added the sequencing caveat to Risks, naming Phase 0 (the Each phase leaves the tree green and independently useful, as the existing bt phases did. -** TODO Phase 0 — the two read-only probes +** DONE Phase 0 — the two read-only probes Pure engine, no repair changes. The dmesg firmware-hint reader (no-adapter branch) and the boot-enablement reader (AutoEnable / service-enabled / TLP), both reporting into the =diagnose()= report dict. That dict feeds both views: the human summary (the default) and =--json= (=cli.py:113-116=); =format_doctor_human= (=cli.py:94=) renders the new evidence. There is no separate =bt diag= subcommand. Fakes: a canned journal buffer with each vendor's signature, and injected main.conf / =systemctl is-enabled= / tlp.conf states. -** TODO Phase 1 — the firmware-hint verdict (Guide, no privilege dependency) +** DONE Phase 1 — the firmware-hint verdict (Guide, no privilege dependency) =diagnose= emits =no-adapter-firmware= (naming the blob, Reboot-tail Guide) when the signature matches. No auto-fix — this verdict is a Guide, so it needs no privilege model and lands independently of the shared cross-panel code. The run-time privilege resolution is a Phase 2 prerequisite, not this phase. -** TODO Phase 2 — the persistent-power verdict and its fix (gated on the shared privilege model) +** DONE Phase 2 — the persistent-power verdict and its fix (gated on the shared privilege model) =powered-off-persistent= distinct from =powered-off=; the persistent fix (set AutoEnable / enable service / tlp) registers Privileged/Confirm through =priv.py= (which is one verb today), plus the INI/list setters above. =bt doctor --fix= applies it under the Confirm floor; the plain power-on path is unchanged. Hard ordering gate: this phase must not land before the shared cross-panel run-time privilege model exists — shipping a Privileged fix before the Confirm floor would let =--fix= edit root config via passwordless sudo ungated, the exact outcome the model forbids. -** TODO Phase 3 — flip this spec to IMPLEMENTED +** DONE Phase 3 — flip this spec to IMPLEMENTED And log the vNext items (stale-bond signature, connection-parameter hints, bt-audio-profile expansion) to =todo.org=. * Acceptance criteria diff --git a/docs/specs/2026-07-11-net-doctor-expansion-spec.org b/docs/specs/2026-07-11-net-doctor-expansion-spec.org index 0666dfe..2727702 100644 --- a/docs/specs/2026-07-11-net-doctor-expansion-spec.org +++ b/docs/specs/2026-07-11-net-doctor-expansion-spec.org @@ -4,10 +4,11 @@ #+TODO: TODO | DONE #+TODO: DRAFT READY DOING | IMPLEMENTED SUPERSEDED CANCELLED -* DOING Net Doctor Expansion +* IMPLEMENTED Net Doctor Expansion :PROPERTIES: :ID: ce29b103-ed9d-4f56-bf8c-9ed8fe680ff3 :END: +- [2026-07-12 Sun @ 09:12 -0500] IMPLEMENTED — all v1 phases shipped on dotfiles main: Phase 0 read-only control-plane probe (=21ca3ff=), Phase 1 control-plane verdicts through the shared panelkit privilege model (=d73eba6=, =c9f8604=, =be15a81=), Phase 2 sharpened auth verdict (=12e3e76=). 813 net tests + 65 suites green against the fake harness. The privileged-fix live halves (real masked-NM/rival/keyfile states, real WPA3/hidden profiles) are handed off to the VM scenario harness (archsetup =a364c1e=) and the "Manual testing and validation" checklist in =todo.org= — findings there come back as bugs, not spec work. vNext items logged to =todo.org=. - [2026-07-11 Sat @ 02:30 -0500] DOING — decomposed into build tasks (spec-response Phase 6); parent task in =todo.org= bound by =:SPEC_ID:=. Phase 0 (read-only control-plane probe) is buildable now and =:solo:=; Phases 1-2 are gated on the shared cross-panel privilege model. The systemic connection-name redaction gap is a separate filed task. - [2026-07-11 Sat @ 02:00 -0500] READY — third skeptical re-review returned Ready with caveats, no blocking findings; all round-2 resolutions verified against the engine. Caveat accepted: Phases 1-2 depend on the shared cross-panel run-time privilege model, which doesn't exist yet, so only Phase 0 (read-only detection) is buildable today. The redaction de-scope (parity + separate systemic task) is the one product call for Craig's eye. - [2026-07-11 Sat @ 01:45 -0500] DRAFT — round-2 review + response. A skeptical re-review caught two blockers the first round missed (one I introduced): the redaction "copy/--json surface" does not exist, and =rival-manager= as =needs-user-action= could never run its own fix. Both corrected — parity redaction + systemic gap filed separately; all three control-plane verdicts are =fixable=. Auth signal repointed at profile key-mgmt + scan security; masked-NM early-return path named. Findings =[9/9]=, decisions =[3/3]=. Awaiting a third re-review. @@ -19,7 +20,7 @@ | Field | Value | |----------+-----------------------------------------------------------------------------------| -| Status | doing | +| Status | implemented | |----------+-----------------------------------------------------------------------------------| | Owner | Craig Jennings | |----------+-----------------------------------------------------------------------------------| @@ -191,16 +192,16 @@ Disposition: accepted. The control-plane probe design now states the masked/fail Each phase leaves the tree green and independently useful, as the existing net phases did. -** TODO Phase 0 — the control-plane probe (read-only) +** DONE Phase 0 — the control-plane probe (read-only) Pure engine, no classifier changes. A probe module that reports rival-manager state, NM masked/failed/stopped, and active-profile keyfile permissions into the diag context. =net diag --json= shows the new signals. Fakes: injected =systemctl is-active/is-enabled= results and a temp system-connections tree. -** TODO Phase 1 — control-plane verdicts + the privilege model +** DONE Phase 1 — control-plane verdicts + the privilege model =classify= gains =rival-manager=, =nm-masked=, =keyfile-perms= (all =fixable=), ordered ahead of the generic not-running rule, with the masked/failed check reachable in the NM-down early-return path. The run-time privilege resolution lands (shared with the cross-panel task) and the three new fixes register as Privileged/Confirm through =priv.py='s =VERBS= table and =repair.py='s =ACTIONS= registry (=disable-rival=, =unmask-nm=, =chmod-keyfile=), each a narrowly-scoped verb. The new evidence keeps parity with existing redaction (MAC/IP via =scrub_text=); the systemic connection-name gap is a separate task, not this phase. =net doctor= names them; =net doctor --fix= applies them under the Confirm floor. Hard ordering gate: this phase must not land before the shared run-time privilege model exists — =priv.py= today is a bare =VERBS=+sudo dispatcher with no Confirm/Arm resolution (=priv.py:150=) and =_attempt= runs repairs ungated, so shipping the Privileged =fixable= verdicts first would let =net doctor --fix= silently disable =dhcpcd= via passwordless sudo, the exact outcome the model forbids. Phase 0 (read-only detection) has no such dependency and lands first; if the fault-naming is wanted before the privilege model, the verdicts can ship detection-only (no =--fix= action) as an interim slice. -** TODO Phase 2 — the sharpened auth verdict +** DONE Phase 2 — the sharpened auth verdict The auth-reason classifier; SAE and hidden-SSID become =fixable= profile-modify repairs; the rest get cause-named =needs-user-action= messages. Pairwise over (reason × profile-state). -** TODO Phase 3 — flip this spec to IMPLEMENTED +** DONE Phase 3 — flip this spec to IMPLEMENTED And log the vNext items (flaky/drops cluster, DoT/DNSSEC verdict, profile hygiene) to =todo.org=. * Acceptance criteria -- cgit v1.2.3