erix/integration

Watch

Fork 0

generated from erix/meta

[FEATURE] Unify real serial and PS/2 CLI input and visual acceptance #5

New issue

Open

opened 2026-09-12 07:56:24 +02:00 by erikinkinen · 0 comments

erikinkinen commented

2026-09-12 07:56:24 +02:00

Owner

Problem and motivation

Direct test launch or guest-script injection does not prove users can operate tools through terminal input. CLI tests need reusable transport-independent intent with exact session, visual and lifecycle evidence.

Proposed behavior and scope

Consolidate input helpers behind a versioned backend API, implement serial and emulated PS/2 key/mouse paths, exact transcripts, layout-aware text and vtty selection, and migrate primary CLI acceptance while retaining justified protocol fixtures. Cover independent and mirrored terminal modes.

This issue records planned work; its unchecked criteria are not implementation proof. The normative basis is Phase 6 and AC1–AC24.

Authority, security and reliability

Send input only through selected UART/PTY or emulated device ingress; never inject into the shell/trusted endpoint or write terminal state directly. Bind observations to one live TTY/session, release held keys and owned processes on failure, and prevent ordinary input from impersonating approval.

Apply the priority order: security, reliability, then performance. Keep suspected vulnerabilities in the repository’s restricted SECURITY.md reporting channel.

Acceptance criteria

Inventory current serial/physical helpers, guest-script injection, direct
orchestration launch and output oracles; separate genuine CLI tests from low-level
protocol/kernel fixtures before migrating them.
Define a versioned input-backend interface for capabilities,
connect/select-session, send text, press/release keys, modifiers/chords, synchronization and
teardown; keep scenario intent independent of transport.
Implement serial input over an explicitly selected UART/PTY route, including
encoding, line endings, fragmented escapes, partial writes, reconnect policy and bounded
backpressure without bypassing seriald/ttyd.
Implement PS/2 keyboard input through the emulated device path, including scan
codes, make/break, modifiers, repeat, arrow/delete and secure attention; do not inject
directly into the shell or trusted-input endpoint.
Make unsupported backend capabilities explicit and reject them before a test
starts; document how a future USB/HID or other backend plugs in without changing every
scenario or inventing synthetic trusted input.
Bind commands and observations to one exact TTY/session per run. For independent
terminals, PS/2 completion must use its framebuffer/session output, not unrelated serial log
stamps; never send a command through both backends and accept whichever output happens to
arrive.
Implement transcript expectations for exact output, status, prompt, cursor/redraw,
timeout and completion, with structured failure context; screenshots/framebuffer state must
corroborate visual assertions where needed.
Add fake-backend unit tests for partial input, key-up cleanup, malformed escapes,
stuck modifiers, cancellation and stale sessions; hard-bound helper/QEMU lifetimes and retain
original status on observation failure.
Add real serial and PS/2 VM tests for editing/history, pipelines, redirection,
Ctrl-C, foreground/background jobs and y/n plus Enter consent; prove ordinary input cannot
impersonate trusted approval or another TTY.
Migrate CLI/tool acceptance scenarios to the shared real-input API, including
boot-tool, sha2-tool, help, man, extop and self-host build commands; preserve existing
assertions and record every renamed/retired case mapping.
Keep low-level non-CLI protocol/negative fixtures when needed, but do not count
directly launched test scripts or hidden rootd orchestration as primary evidence that a user
can operate a CLI tool.
Run backend coverage in CI for serial-only, framebuffer/PS2-only, independent dual
and explicitly mirrored modes; preserve existing hard/stall limits and exact
source/image/session evidence.
Remove superseded one-off CLI input adapters after migration, document authoring a
new backend/scenario, and add a coverage gate preventing new CLI acceptance tests from
silently bypassing the primary input harness.
Make physical text injection layout-aware while keeping explicit raw key/scan-code
fixtures available; run US/Finnish punctuation, modifier and trusted-input cases under the
actual boot preference. Serial sends text bytes directly and must not be translated a second
time as keyboard scan codes. Record layout and key sequences; use independent expected vectors
rather than the production keyboard translator as its own test oracle.
Extend the physical backend with PS/2 mouse movement and explicit left/middle/right
press/release actions, preserving packet boundaries and validated device ingress; never
substitute host clipboard or direct guest terminal-state writes for mouse acceptance evidence.
Add explicit Ctrl+Alt+Fn selection and target-vtty expectations, including
held/released modifiers, invalid targets and switching during output or prompts; observe the
selected framebuffer vtty rather than a serial sibling.
Add reproducible visual/text assertions for hidden/revealed cursor, selection and
pasted text, plus early boot-logo screenshots tied to exact image/asset hashes. Preserve
bounded observation and input teardown on failures.

For each implementation slice, retain actual formatting, strict Clippy, unit/doctest and warning-denied build results for all altered Rust repositories and valid configurations. Add relevant runtime VM coverage, monitor older unit/VM regressions in exact-head CI, and update canonical component documents and affected technical-manual/API material. Every authored code file must remain below 1,000 physical lines, with meaningful inline documentation and missing_docs enforcement in Rust crates.

Alternatives and tradeoffs

A serial log cannot prove the selected framebuffer vtty rendered a result. Keep capability differences explicit, use independent physical-layout expectations, and corroborate visual behavior with exact image/session-bound frames.

Tracking and rollout

Dependencies: integration#1

Dependencies identify required contracts and closure gates; preparatory inventory/design can proceed in parallel under one owner per edited file. Link bounded implementation issues and their PRs here before claiming acceptance. Use feature/posix-compat, regular signed commits in the canonical contribution format, and WIP PRs linked to the exact coherent component graph. All cross-repository Cargo/catalog selections and CI helpers use full 40-character lowercase commit hashes, including transitive dependencies; do not substitute branch, tag or implicit HEAD selection.

Close criteria only with their own reviewed deliverables and validation evidence. Pending, skipped, cancelled, failed or predecessor-only results remain distinct. Keep main images unchanged until explicit promotion direction; technical completion does not authorize merges, release tags or publication.

## Problem and motivation Direct test launch or guest-script injection does not prove users can operate tools through terminal input. CLI tests need reusable transport-independent intent with exact session, visual and lifecycle evidence. ## Proposed behavior and scope Consolidate input helpers behind a versioned backend API, implement serial and emulated PS/2 key/mouse paths, exact transcripts, layout-aware text and vtty selection, and migrate primary CLI acceptance while retaining justified protocol fixtures. Cover independent and mirrored terminal modes. This issue records planned work; its unchecked criteria are not implementation proof. The normative basis is [Phase 6 and AC1–AC24](https://git.erikinkinen.fi/erix/docs/src/branch/main/phases/6.md). ## Authority, security and reliability Send input only through selected UART/PTY or emulated device ingress; never inject into the shell/trusted endpoint or write terminal state directly. Bind observations to one live TTY/session, release held keys and owned processes on failure, and prevent ordinary input from impersonating approval. Apply the priority order: security, reliability, then performance. Keep suspected vulnerabilities in the repository’s restricted SECURITY.md reporting channel. ## Acceptance criteria - [ ] Inventory current serial/physical helpers, guest-script injection, direct orchestration launch and output oracles; separate genuine CLI tests from low-level protocol/kernel fixtures before migrating them. - [ ] Define a versioned input-backend interface for capabilities, connect/select-session, send text, press/release keys, modifiers/chords, synchronization and teardown; keep scenario intent independent of transport. - [ ] Implement serial input over an explicitly selected UART/PTY route, including encoding, line endings, fragmented escapes, partial writes, reconnect policy and bounded backpressure without bypassing seriald/ttyd. - [ ] Implement PS/2 keyboard input through the emulated device path, including scan codes, make/break, modifiers, repeat, arrow/delete and secure attention; do not inject directly into the shell or trusted-input endpoint. - [ ] Make unsupported backend capabilities explicit and reject them before a test starts; document how a future USB/HID or other backend plugs in without changing every scenario or inventing synthetic trusted input. - [ ] Bind commands and observations to one exact TTY/session per run. For independent terminals, PS/2 completion must use its framebuffer/session output, not unrelated serial log stamps; never send a command through both backends and accept whichever output happens to arrive. - [ ] Implement transcript expectations for exact output, status, prompt, cursor/redraw, timeout and completion, with structured failure context; screenshots/framebuffer state must corroborate visual assertions where needed. - [ ] Add fake-backend unit tests for partial input, key-up cleanup, malformed escapes, stuck modifiers, cancellation and stale sessions; hard-bound helper/QEMU lifetimes and retain original status on observation failure. - [ ] Add real serial and PS/2 VM tests for editing/history, pipelines, redirection, Ctrl-C, foreground/background jobs and y/n plus Enter consent; prove ordinary input cannot impersonate trusted approval or another TTY. - [ ] Migrate CLI/tool acceptance scenarios to the shared real-input API, including boot-tool, sha2-tool, help, man, extop and self-host build commands; preserve existing assertions and record every renamed/retired case mapping. - [ ] Keep low-level non-CLI protocol/negative fixtures when needed, but do not count directly launched test scripts or hidden rootd orchestration as primary evidence that a user can operate a CLI tool. - [ ] Run backend coverage in CI for serial-only, framebuffer/PS2-only, independent dual and explicitly mirrored modes; preserve existing hard/stall limits and exact source/image/session evidence. - [ ] Remove superseded one-off CLI input adapters after migration, document authoring a new backend/scenario, and add a coverage gate preventing new CLI acceptance tests from silently bypassing the primary input harness. - [ ] Make physical text injection layout-aware while keeping explicit raw key/scan-code fixtures available; run US/Finnish punctuation, modifier and trusted-input cases under the actual boot preference. Serial sends text bytes directly and must not be translated a second time as keyboard scan codes. Record layout and key sequences; use independent expected vectors rather than the production keyboard translator as its own test oracle. - [ ] Extend the physical backend with PS/2 mouse movement and explicit left/middle/right press/release actions, preserving packet boundaries and validated device ingress; never substitute host clipboard or direct guest terminal-state writes for mouse acceptance evidence. - [ ] Add explicit Ctrl+Alt+Fn selection and target-vtty expectations, including held/released modifiers, invalid targets and switching during output or prompts; observe the selected framebuffer vtty rather than a serial sibling. - [ ] Add reproducible visual/text assertions for hidden/revealed cursor, selection and pasted text, plus early boot-logo screenshots tied to exact image/asset hashes. Preserve bounded observation and input teardown on failures. For each implementation slice, retain actual formatting, strict Clippy, unit/doctest and warning-denied build results for all altered Rust repositories and valid configurations. Add relevant runtime VM coverage, monitor older unit/VM regressions in exact-head CI, and update canonical component documents and affected technical-manual/API material. Every authored code file must remain below 1,000 physical lines, with meaningful inline documentation and missing_docs enforcement in Rust crates. ## Alternatives and tradeoffs A serial log cannot prove the selected framebuffer vtty rendered a result. Keep capability differences explicit, use independent physical-layout expectations, and corroborate visual behavior with exact image/session-bound frames. ## Tracking and rollout Dependencies: [integration#1](https://git.erikinkinen.fi/erix/integration/issues/1) Dependencies identify required contracts and closure gates; preparatory inventory/design can proceed in parallel under one owner per edited file. Link bounded implementation issues and their PRs here before claiming acceptance. Use `feature/posix-compat`, regular signed commits in the canonical contribution format, and WIP PRs linked to the exact coherent component graph. All cross-repository Cargo/catalog selections and CI helpers use full 40-character lowercase commit hashes, including transitive dependencies; do not substitute branch, tag or implicit HEAD selection. Close criteria only with their own reviewed deliverables and validation evidence. Pending, skipped, cancelled, failed or predecessor-only results remain distinct. Keep main images unchanged until explicit promotion direction; technical completion does not authorize merges, release tags or publication.

erikinkinen added the

labels

2026-09-12 07:56:24 +02:00

erikinkinen referenced this issue from erix/exsh

2026-09-12 07:56:29 +02:00

[FEATURE] Complete native shell/build utilities and provide help and offline manual pages #1

erikinkinen referenced this issue

2026-09-12 07:56:30 +02:00

[FEATURE] Demonstrate two complete generations of EriX built inside EriX #9

erikinkinen referenced this issue

2026-09-12 07:56:30 +02:00

[FEATURE] Close final security, documentation, CI and self-hosting acceptance #10

erikinkinen changed title from ~~[FEATURE] [P19] Unify real serial and PS/2 CLI input and visual acceptance~~ to [FEATURE] Unify real serial and PS/2 CLI input and visual acceptance

2026-09-12 08:02:02 +02:00

erikinkinen referenced this issue from erix/ttyd

2026-09-12 08:02:04 +02:00

[FEATURE] Complete independent consoles, vttys, TUI, keyboard layouts, mouse and boot logo #1

erikinkinen referenced this issue

2026-09-12 09:22:57 +02:00

[BUG] Release physical native-editor CI probe fails after the VM catalog passes #13

erikinkinen referenced this issue

2026-09-12 15:05:04 +02:00

[BUG] Positive console-progress host fixture expires before completion #25

erikinkinen referenced this issue

2026-09-12 18:14:02 +02:00