Complete production readiness hardening - #1
Merged
Conversation
Move the compact protocol source of truth to docs/protocol/ and docs/hardware-validation/, and the optional WMI module to experimental/touchpad-wmi/ (space-free path). Research-only files (Frida capture scripts, RE landing page, Windows plan) are preserved on branch archive/research-2026-07 and removed from main. Fix all doc and source links; simplify the Reverse-engineering ignore rule.
HC-007: offline hash-verified wheelhouse install, supported rollback command, and a release-bundle script (SHA256SUMS + MANIFEST + minimal SBOM). HC-019: split CI into lint/test(72% branch-coverage floor)/security/shell/packaging jobs with SHA-pinned actions. HC-021: drop the unhardened D-Bus Exec= activation fallback. HC-022: mark the WMI module experimental and note the space-free build path. HC-023: replace the overbroad 'personally tested all' claim with a per-feature evidence table, correct repo URLs, and document the supported hardware matrix. The touchpad restore unit is now installed/enabled only when firmware writes are explicitly qualified (default off).
…y faults HC-002: command queue now exposes StuckCommandInfo/poisoned_duration; health reports hardware_queue_stuck and escalates to a nonzero restart after a bounded wedge so a hung EC call cannot leave a healthy-looking read-only service. HC-003: strict AC online decoder (0/1/None) plus debounced auto-switch that never transitions on an unknown AC read. HC-005: overall health aggregates fan fail-safe/pending-restore and controller fault states (failed/stop_timeout/cleanup_failed). HC-006: a failed apply+rollback latches power_recovery_required, blocks auto-switch/hooks, and is cleared only by a converging reconcile_power(). HC-008/009: supervisor reports STOP_TIMEOUT/CLEANUP_FAILED instead of a false STOPPED, refuses duplicate starts, and supports bounded restart policies. HC-012/013: ordered schema migrations with pre-migration backup, unknown-key reporting, and permission-proof backup recovery. HC-014: GPU adapter fails closed internally; any error (incl. restored) is a failure with structured partial on persist failure. HC-018: gesture runtime isolates per-report dispatch errors and backs off reconnects.
Touchpad firmware setting writes are now disabled by default behind touchpad_firmware_writes_qualified() (HONOR_TOUCHPAD_FIRMWARE_QUALIFIED=1, matching the installer flag). ApplyTouchpadSettings/SetTouchpadSetting return an unavailable result while unqualified; probe/encode/gesture-input remain available and the snapshot/probe expose firmware_writes_qualified so frontends can disable controls. The service registers a wedge-escalation callback: a hardware queue stuck past the deadline drops the bus name and exits nonzero so systemd restarts the unit (ExecStopPost restores fan auto; StartLimit bounds the loop), and the emergency fan-restore helper is SIGALRM-bounded under the unit's TimeoutStopSec.
…ngle frontend HC-004: polkit interactive deadline raised from 5s to a human-scale 60s with distinct denial/timeout/no-agent messages; client (90s), GUI (90s) and CLI (90s) deadlines now sit above the polkit deadline plus operation time. HC-015: worker/controller/state carry a structured UiError (code/message/retryable/fatal) instead of a bare string; the GUI renders polkit denials and fatal errors persistently with guidance, transient busy/timeout briefly, and stops reconnecting on a fatal API mismatch. HC-016: honorctl touchpad set/apply validation and profile-load errors now exit 2 (usage) instead of 70. HC-017: the GUI and tray share one per-user frontend lock with a GUI-priority handoff flag, so they no longer run concurrently; the standalone tray cleans up on aboutToQuit.
…tics, cleanup HC-011: an advisory inter-process flock (core.touchpad.touchpad_firmware_lock) serializes touchpad firmware access between the service and standalone honor-touchpadctl; the service holds it across apply/query (returning touchpad_busy/BUSY on contention) and the CLI takes it for write/support with a --force recovery override. The standalone write path is now also gated behind the HC-001 qualification flag, and missing-profile errors exit 2. HC-010: reload() documents and reports battery/touchpad as loaded_not_applied rather than implying hardware convergence. HC-020: the debug bundle gains bounded recovery context (queue-stuck command/duration, fan fail-safe/restore-pending, power-rollback outcome, controller restart counts, config unknown keys, AC observation, qualification flag). HC-025: validate_log_lines rejects bool; backend package docstring lists the real submodules; pytest-cov added to the dev extra.
…ministic teardown Post-implementation review fixes, all covered by the passing suite. Tray: the controller error signal (a structured UiError since HC-015) was connected to a str-typed handler that would raise at runtime; errors now route to a dedicated _on_error that extracts the message as a warning, while _notify keeps handling operation result strings. Supervisor: the HC-009 restart policy was added but never enabled, so a crashed refresh or auto-switch loop still died forever; enable restart for those two controllers (fan_curve keeps its own intentional fail-safe disable and is deliberately excluded). stop_all now cancels pending crash-restart backoffs so teardown is deterministic.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
archive/research-2026-07Why
The readiness review found end-to-end gaps where individual safeguards existed but were not connected through installation, D-Bus decoding, UI behavior, recovery persistence, or release packaging. These changes close those paths and make failures visible and recoverable.
Validation
0afcc0cproduced identical top-level and wheelhouse checksum manifestsRemaining external gates
Real hardware replay, suspend/resume, cold boot, and disposable-system install/rollback/uninstall validation remain release-environment checks and are not claimed by hosted CI.