Build deterministic physical HID fixture and capture lab - #1238
Build deterministic physical HID fixture and capture lab#1238malpern wants to merge 102 commits into
Conversation
|
Automated review of the supplied diff (note: the diff payload was truncated before reaching Findings from the visible portion (
Nothing else in the visible diff (the new |
|
Latest reliability update (commit 592c9aa):
Validation after merging current
Local review gate selected the enforced remote |
|
Review notes (based on the supplied diff, which was truncated after ~60000 bytes — the actual Findings from the visible portion:
No other correctness/security issues stood out in the visible Python/Swift/shell lab tooling (assert-runtime-state, assert-uninstalled-state, CaptureSession.swift, hid-capture-jig-client, etc.) — logic there looked internally consistent. |
|
Post-update hardware control evidence: OTA build |
|
Review scope note: the diff supplied to me was truncated after ~60k bytes (cut off partway through Finding — The new Since matrix/lab builds want "the exact signed artifact" they presumably don't set No other actionable correctness/security issues found in the reviewed portion (the new |
|
Reviewed the supplied diff (note: it was truncated at 60000 bytes, cutting off before One plausible flake in the portion I could review:
guard !runID.isEmpty, runID.count <= 80, !expected.isEmpty,
timeoutMs >= 250, timeoutMs <= 300_000,
settleMs >= 50, settleMs <= 5000,
focused
else { ... state = .failed; return false }If the app's window/app-activation focus notification lands even one runloop tick after the Everything else reviewed (build-and-sign.sh's new |
|
Reviewed the supplied diff (note: it was truncated after ~60KB, so One actionable finding in the portion reviewed:
Everything else I could see — the |
|
Correctness bug:
In guard !runID.isEmpty, runID.count <= 80, !expected.isEmpty,
timeoutMs >= 250, timeoutMs <= 300_000,
settleMs >= 50, settleMs <= 5000,
focused
else {
self.runID = runID
self.expected = expected
self.focused = focused
state = .failed
return false
}If if received == expected, pressedKeyCodes.isEmpty, activeModifiers == 0,
let lastEventAtNs, nowNs >= lastEventAtNs,
nowNs - lastEventAtNs >= settleNs
{
state = .passed
}can still trigger once Suggested fix: set Note: this diff is very large (Swift capture-jig core, Python/zsh lab scripts, ESP32/Pico firmware in C, etc.) and was truncated in the review context after ~60KB. I reviewed the visible portion in depth (Swift |
|
Reviewed the supplied diff (note: it was truncated after Within what I could see:
Everything else reviewed (checksum-pinned downloads in |
|
Reviewed the supplied diff (truncated at 60000 bytes out of a 144-file/~18.6k-line diff, so most of the new pico-hid-fixture C/ESP32 firmware and the HIDCaptureJig Swift package beyond
set -euo pipefail
...
if [[ -f "$plist" ]]; then
/usr/bin/sudo -n /bin/launchctl bootout system "$plist"
else
/usr/bin/sudo -n /bin/launchctl bootout system/com.keypath.kanata
fi
No other actionable correctness/security issues found in the portion of the diff reviewed (build-and-sign.sh's new |
|
Reviewed the supplied diff (truncated after 60000 bytes — Swift/C sources for the HID capture jig, pico-hid-fixture firmware, scenario-matrix runner, and keypath-lab changes beyond that point were not covered). 1. Peekaboo/mcporter download source changed orgs ( 2. 3. No other correctness/security issues found in the reviewed portion (the new |
1 participant
What changed
Why
KeyPath needs repeatable end-to-end evidence that real installer/runtime builds correctly process physical keyboard input, including high-rate and resource-pressure regressions. Previous TextEdit and scheduler-only checks could not prove focus, exact output, or safe release. The new Jig and fixture preserve independent machine-readable evidence and fail closed when focus or host readiness is invalid.
Validation
Scripts/lab/pico-hid-fixture-tool test(host/core/client/runner/matrix plus ESP32-S3 QEMU smoke)4d1cb1cb54c4Pending physical acceptance
This remains a draft until the remaining person-dependent physical gates are complete. Real USB HID input cannot target a background app safely. Remaining gates are:
Excluded focus-, memory-, load-, and network-admission attempts are documented as harness admissions, not KeyPath outcomes.