Repository navigation
Conversation
|
Post-update hardware control evidence: OTA build |
|
Review scope note: the diff supplied to me was truncated after ~60k bytes (cut off partway through Finding — The new Since matrix/lab builds want "the exact signed artifact" they presumably don't set No other actionable correctness/security issues found in the reviewed portion (the new |
|
Reviewed the supplied diff (note: it was truncated at 60000 bytes, cutting off before One plausible flake in the portion I could review:
guard !runID.isEmpty, runID.count <= 80, !expected.isEmpty,
timeoutMs >= 250, timeoutMs <= 300_000,
settleMs >= 50, settleMs <= 5000,
focused
else { ... state = .failed; return false }If the app's window/app-activation focus notification lands even one runloop tick after the Everything else reviewed (build-and-sign.sh's new |
|
Reviewed the supplied diff (note: it was truncated after ~60KB, so One actionable finding in the portion reviewed:
Everything else I could see — the |
|
Correctness bug:
In guard !runID.isEmpty, runID.count <= 80, !expected.isEmpty,
timeoutMs >= 250, timeoutMs <= 300_000,
settleMs >= 50, settleMs <= 5000,
focused
else {
self.runID = runID
self.expected = expected
self.focused = focused
state = .failed
return false
}If if received == expected, pressedKeyCodes.isEmpty, activeModifiers == 0,
let lastEventAtNs, nowNs >= lastEventAtNs,
nowNs - lastEventAtNs >= settleNs
{
state = .passed
}can still trigger once Suggested fix: set Note: this diff is very large (Swift capture-jig core, Python/zsh lab scripts, ESP32/Pico firmware in C, etc.) and was truncated in the review context after ~60KB. I reviewed the visible portion in depth (Swift |
|
Reviewed the supplied diff (note: it was truncated after Within what I could see:
Everything else reviewed (checksum-pinned downloads in |
|
Reviewed the supplied diff (truncated at 60000 bytes out of a 144-file/~18.6k-line diff, so most of the new pico-hid-fixture C/ESP32 firmware and the HIDCaptureJig Swift package beyond
set -euo pipefail
...
if [[ -f "$plist" ]]; then
/usr/bin/sudo -n /bin/launchctl bootout system "$plist"
else
/usr/bin/sudo -n /bin/launchctl bootout system/com.keypath.kanata
fi
No other actionable correctness/security issues found in the portion of the diff reviewed (build-and-sign.sh's new |
|
Reviewed the supplied diff (truncated after 60000 bytes — Swift/C sources for the HID capture jig, pico-hid-fixture firmware, scenario-matrix runner, and keypath-lab changes beyond that point were not covered). 1. Peekaboo/mcporter download source changed orgs ( 2. 3. No other correctness/security issues found in the reviewed portion (the new |
Replace the per-task kernel limit with a bounded background inventory read. Preserve thresholds and refuse missing or stale measurements. Cover collection, timeout, expiry, and concurrent-query guards. Co-Authored-By: Codex <noreply@openai.com>
The fixture could only send a boot-keyboard report, so it could not press Mute, Volume or Play/Pause — the keys KeyPath's driverless session now reads as inputs. Both targets now describe a consumer-control report (ID 2) alongside the keyboard report. A script event line takes an optional ninth field, the consumer usage held; eight-field scripts are unchanged. Each event changes the keyboard state or the consumer state, never both, so it is exactly one USB report; the cycle must end with everything released, and an abort or unmount releases a held media key before the keyboard. The trace and the HTTP trace JSON carry the consumer usage. The client gains `compile-media`. Tests: four host core tests (press/release and trace, eight-field scripts never send consumer reports, unsafe consumer scripts refused, abort releases the media key first) and two client tests. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
|
Holding this open until malpern/vm-lab#4 is reviewed. Much of the lab tooling here has moved to vm-lab; once that lands, the plan is to split out what KeyPath itself still needs (fixture firmware/client, KeyPath-side scenarios) and close the rest. #1333's consumer-control support is already merged into this branch. 🤖 Generated with Claude Code |
What changed
Why
KeyPath needs repeatable end-to-end evidence that real installer/runtime builds correctly process physical keyboard input, including high-rate and resource-pressure regressions. Previous TextEdit and scheduler-only checks could not prove focus, exact output, or safe release. The new Jig and fixture preserve independent machine-readable evidence and fail closed when focus or host readiness is invalid.
Validation
Scripts/lab/pico-hid-fixture-tool test(host/core/client/runner/matrix plus ESP32-S3 QEMU smoke)4d1cb1cb54c4Pending physical acceptance
This remains a draft until the remaining person-dependent physical gates are complete. Real USB HID input cannot target a background app safely. Remaining gates are:
Excluded focus-, memory-, load-, and network-admission attempts are documented as harness admissions, not KeyPath outcomes.
Clean-VM resource admission correction
The capture Jig previously read kern.num_taskthreads as current thread inventory. That value is the per-process limit (4096 in the clean VM), which falsely blocked idle guests. The Jig now samples the live count through Apple's top reader off the UI thread, with a two-second timeout, one pending query, and a three-second freshness limit. Missing or stale inventory refuses arming; existing load thresholds are unchanged.
Validation: failing admission regression reproduced before the fix; all 37 Jig tests pass, including the production collector, timeout/failure/malformed output, pending-query exclusion, and stale-cache cases. The corrected Developer ID-signed Jig passed strict verification and its resource gate passed in the macOS 26 VM. Physical remap/restart validation remains in progress.