[FEATURE] Complete independent consoles, vttys, TUI, keyboard layouts, mouse and boot logo #1

New issue

Open

opened 2026-09-12 07:56:25 +02:00 by erikinkinen · 0 comments

erikinkinen commented 2026-09-12 07:56:25 +02:00

Owner

Copy link

Problem and motivation

The final user environment needs predictable framebuffer initialization, independent terminals and usable interactive tools. Multiple live vttys, layout-correct Unicode text, scoped selection/paste and a preserved authenticated logo must work through real input paths.

Proposed behavior and scope

Implement one-time configurable framebuffer clear, independent default TTYs, session-mediated TUI/extop behavior, US/Finnish keyboard translation, safe vtty switching, initially hidden mouse pointer and primary selection/paste. Deterministically convert and display the existing signed logo with Linux/guest packaging parity.

This issue records planned work; its unchecked criteria are not implementation proof. The normative basis is Phase 6 and AC1–AC24.

Authority, security and reliability

Bind display, input, focus, selection and retained text to exact session generations. Protect trusted chrome/consent, cancel prompts on switch, retire stale input and grants, and keep unsigned preferences separate from signed policies/code. Ordinary clients receive neither raw framebuffer nor global clipboard access.

Apply the priority order: security, reliability, then performance. Keep suspected vulnerabilities in the repository’s restricted SECURITY.md reporting channel.

Acceptance criteria

• Add strictly boolean [features].fbcon_clear, default true, to runtime/build
  configuration, schema, parser, feature identity and documentation; reject malformed values and
  test omission, true and false.
• Apply the option to early and userspace framebuffer initialization. Clear once
  before the first console output when enabled; when disabled neither initializer may erase
  existing content merely because it starts.
• Carry validated framebuffer identity/geometry and an early-clear completion record
  through the trusted handoff; if early fbcon already cleared the screen, user fbcon adopts it
  without another clear. Do not treat arbitrary descriptive startup bytes as proof of a trusted
  completed clear.
• Preserve pixel format/stride/padding, cursor and output continuity; replace
  conflicting unconditional release/early clears and test that late initialization never erases
  valid early logs. Normal explicit TUI clearing remains separate from this initialization-only
  build option.
• Add unit and framebuffer VM coverage for early-only, user-only, both and neither
  console with clear enabled/disabled; assert exact clear count, final pixels and handoff
  failure behavior, not just a serial READY marker.
• Set tty_mirror = false in both canonical dev/release images; align
  sample/extended defaults with independent terminals and retain explicit mirrored fixtures so
  the optional feature remains tested.
• Validate both enabled paths create distinct shells/sessions with separate
  input/output/cwd/history/foreground jobs/consent and adequate declared capacity; single-path
  and no-TTY configurations still work without extra grants.
• Preserve frozen integration#6 timing comparisons as their original cohort, then measure the
  new dual-shell default separately using integration#5 session-bound observations. Do not attribute a
  policy/workload change to a kernel speedup or relax the carried limits; report each terminal's
  full startup/command evidence.
• Specify/version improved fbcond TUI operations: absolute/relative cursor position,
  visible cursor, erase regions, colors/attributes, rectangular cell updates, scrolling regions,
  viewport/resize and frame completion.
• Implement bounded validated rendering batches/dirty regions, geometry/capacity
  checks and deterministic malformed-request behavior without granting raw framebuffer memory or
  global-screen ownership to clients.
• Expose TUI through session-scoped tty mediation backed by fbcond, with clear
  renderer versus terminal ownership. Keep trusted powerbox chrome protected; ordinary clients
  cannot draw over it or steal focus/consent input.
• Implement serial-terminal equivalents or advertised graceful fallbacks over the
  same session-level interface; define supported capabilities explicitly rather than claiming
  compatibility with every ncurses extension.
• Extend the shared terminal parser with required cursor/erase/color and
  alternate-screen behavior, including extop's existing home/full-erase needs; test split escape
  sequences, unsupported controls and dimensions.
• Port extop to the new TUI interface with efficient frame updates,
  resize/navigation, screen restoration and interrupt/exit cleanup; retain its exact
  process-inspection/control authorities and never add broad console caps.
• Implement trusted-prompt suspension/restoration during a TUI session, ensuring
  modal input is not consumed by extop and no previous trusted text or stale ordinary frame is
  replayed after focus/session changes.
• Add parser/renderer unit tests and serial/PS2 visual VMs for cursor, erase, colors,
  scrolling, resize, extop refresh/quit/Ctrl-C, independent TTYs, prompt interruption and
  complete session/capability cleanup.
• Profile full versus partial redraw, IPC count and extop input-to- frame latency;
  fix measured bottlenecks without skipping visible completion, and update IPC/Rust API man
  pages, tool manuals and operator documentation.
• Define keyboard-layout ownership over layout-independent physical key events;
  retain driver/inputd raw identity and implement text translation at ttyd or a reviewed shared
  pure layout layer. Provide signed, clean-room en_US and fi_FI mappings with modifiers,
  Caps Lock, AltGr, punctuation, Unicode and Finnish dead-key behavior. Keep physical identity,
  navigation and control chords distinguishable from text.
• Initialize the keyboard text translator from bootloader#1's validated boot preference,
  default en_US; preserve consistent layout behavior for every physical keyboard
  client/session without double-translating serial input. Initially select layout at boot; later
  runtime layout changes require their own state-transition contract, not reinterpretation of
  buffered input.
• Add a git-ignored local build override selecting fi_FI and include it explicitly
  in image identity/test receipts. Keep canonical dev/release, extended profiles and clean CI
  defaulting to en_US; explicit CI layout fixtures test Finnish without allowing a developer
  override to leak into publication.
• Preserve secure-attention key identity and trusted consent fences; preference
  changes must not synthesize approval, reinterpret buffered keys or let ordinary layout
  processing consume trusted y/n plus Enter. Document which chords are physical and which text
  is layout-selected and display prompts consistently with those rules.
• Add unit/real-input VM tests for both layouts, default/invalid preference fallback,
  local override isolation, modifier/dead-key release, repeated input, Unicode editor/delete
  behavior and trusted consent. Test both independent terminals and verify serial byte input
  remains unchanged.
• Document keyboard selection and preference editing in boot-tool help/man,
  image/build docs and the technical manual, explicitly identifying unsigned convenience data
  versus signed security policy and code.
• Replace single-byte-only text emission with checked UTF-8 sequences and
  backpressure-safe atomic character delivery; define dead-key composition, unsupported
  combinations, modifier release and pending-state reset on focus/ session/consent changes. Test
  interrupted multi-byte delivery cannot corrupt commands, leak pending text to another TTY or
  reinterpret it as trusted input.
• Define multiple framebuffer vttys as distinct live terminal/session generations
  with their own shell, screen/scrollback, cursor, editing/history, cwd, foreground jobs and
  input state. Keep virtual-terminal records separate from the existing two physical
  framebuffer/serial console bindings.
• Specify signed resource/count and creation/retirement policy for configured vttys,
  with at least two exercised in acceptance. Allocate/reuse only explicitly authorized session
  resources; an Fn ordinal cannot create processes or grant launch authority. Test exhaustion
  and safe focus fallback when a shell/vtty exits, without imposing an incidental fixed table
  limit.
• Implement physical Ctrl+Alt+Fn switching directly to the configured framebuffer
  vtty identified by Fn. Admit this exact authenticated gesture without a separate manual
  secure-attention step, independently of keyboard layout; preserve existing trusted controls
  and reject nonexistent/stale targets.
• Switch display and ordinary input focus atomically by exact live session
  generation; keep events bound to their receipt-time destination and handle held
  modifiers/releases without injecting them into the wrong vtty. Independent serial focus
  remains unchanged; test explicit mirrored mode too.
• Cancel a pending trusted prompt when switching away, retaining the existing
  cancellation/cleanup contract; never transfer approval state to the destination. Restore
  ordinary content only after renderer acknowledgement and preserve fresh-input fences if a
  later prompt is created.
• Retain inactive-vtty output in its own bounded terminal state and restore
  screen/cursor/selection on activation; handle resize, scrolling and extop alternate-screen
  updates without exposing another vtty or trusted chrome.
• Add unit and physical-keyboard VMs for direct Fn switching, repeated switching,
  background output, exit/recreation, stale IDs, modifiers, both layouts, serial isolation and
  prompt cancellation. Profile switching/memory use and record the multi-vtty workload
  separately from frozen startup comparisons.
• Implement a framebuffer mouse pointer that starts hidden and becomes visible only
  on the first authenticated nonzero movement, not button-only, resize or focus events. Define
  per-seat visibility across vtty switches; distinguish this pointer from the shell's text
  caret.
• Validate signed deltas, button transitions, geometry and coordinate arithmetic;
  clip cursor drawing to the viewport and restore underlying pixels correctly during movement,
  redraw, scrolling, resize and vtty changes.
• Implement left-button press/drag/release text selection and visible highlighting
  from the owning vtty's ordinary text model, including wrapped lines, Unicode/cell boundaries
  and scrollback. Bind selection to session and content revision; define updates while output
  changes during a drag.
• Use conventional primary selection: completing a left-button selection copies its
  text, and middle-button press pastes it. Keep selection bytes scoped to the owning
  terminal/session by default; cross-vtty transfer requires explicit user-directed
  source/destination and realm policy, never a global clipboard or arbitrary screen-reading
  capability.
• Deliver middle-button paste through the exact destination's ordinary input path
  with backpressure-safe ordering and no duplicate bytes. Define
  bracketed-paste/multiline/control-byte behavior so shell paste does not silently execute
  embedded newlines; require normal explicit submission. Do not apply keyboard layout
  translation to already selected UTF-8 text.
• Exclude trusted chrome, consent input and other vttys from selection. Mouse
  selection/paste cannot approve, edit or queue answers to a trusted prompt; reject untrusted
  escape-sequence clipboard access and keep the host/serial terminal clipboard separate. Retire
  retained text on owner teardown/reuse.
• Add independent unit and real PS/2 mouse/keyboard tests for initial hiding,
  button-only packets, first movement, bounds, pixel restoration, selection during
  redraw/scroll/resize, Unicode, middle paste, backpressure, vtty isolation and prompt races;
  prove cleanup and zero unintended authority.
• Use boot-logo
  source as the
  original boot-logo source, recording its exact digest and asset provenance. It is currently a
  1024×1024 RGBA PNG. Preserve its artwork/transparency; define deterministic
  preprocessing/scaling rather than generating a new logo.
• Convert the source at build time into a simple, versioned, bounded bitmap payload
  with explicit dimensions/pixel/alpha format; package it as an optional signed non-executable
  boot.img section. Keep general PNG decoding out of the bootloader unless a separately
  justified design requires it.
• In the bootloader, draw the available authenticated bitmap at the screen's bottom
  center using validated GOP geometry. Preserve aspect ratio, alpha blend against the existing
  background and define deterministic fitting/ margins for small resolutions; never stretch or
  draw outside the viewport.
• Fully validate pixel length, width/height/stride, format, arithmetic, alpha and
  destination bounds before drawing; test RGBA/BGRA, padding, clipping and overflow
  independently. Image data grants no framebuffer mapping authority.
• Integrate drawing after the configured one-time clear, in both dev and release
  paths, independent of early text-log enablement. Preserve the clear-completion handoff so
  later early/user console initialization does not immediately erase the logo; define temporary
  text/logo placement and normal console takeover without hiding required readiness/error
  output.
• Boot normally without the optional logo or a usable framebuffer. Define safe
  cosmetic-error handling for an authenticated but malformed bitmap; container/signature failure
  still follows the existing fail-closed policy. Release temporary logo buffers/module authority
  once no consumer needs them.
• Add Linux and in-EriX asset-conversion/package parity tests and put conversion
  inputs/tools in the integration#8/integration#9 build closure; the final guest-built images must not depend on an
  unrecorded host-side bitmap conversion.
• Add bounded visual VM tests for logo present/absent, dev/release, clear true/false,
  early console on/off, both pixel formats and small/normal geometries; assert bottom-center
  placement/transparency and unchanged text. Test signed-logo tampering rejection and document
  the asset/format/build options in boot-tool man pages, canonical docs and the technical
  manual.

For each implementation slice, retain actual formatting, strict Clippy, unit/doctest and warning-denied build results for all altered Rust repositories and valid configurations. Add relevant runtime VM coverage, monitor older unit/VM regressions in exact-head CI, and update canonical component documents and affected technical-manual/API material. Every authored code file must remain below 1,000 physical lines, with meaningful inline documentation and missing_docs enforcement in Rust crates.

Alternatives and tradeoffs

Different dual-shell/vtty workloads need separately recorded timing cohorts; they cannot be presented as kernel speedups or relax carried limits. Reuse raw physical event identity and pure layout/rendering semantics, preserving explicit mirrored fixtures and serial byte behavior.

Coherent realm image service prerequisites — 18 September 2026: Signed 8adf42e3a3014f583f7e16f32345bfa0d93b315f selects the original shared wire/startup dependency graph. Direct Rust implementation bytes are unchanged. All 10 default, all-feature and separate production development/release configurations pass 248/250/251/252 unit tests per configuration, strict host/native Clippy and freestanding linking with fatal linker warnings. Formatting, private-item rustdoc and Markdown pass, with zero warnings. Original push/PR CI is under observation. Matching catalog adoption and real consumer VMs remain requirements; complete realm and full in-guest build acceptance remain open.

Original coherent realm source CI acceptance — 18 September 2026: Signed 8adf42e3a3014f583f7e16f32345bfa0d93b315f passes CI 69 and CI 68. All four terminal logs are complete (120,912 bytes), with zero final warnings. This closes the original CI observation recorded above. Coherent catalog publication, actual consumer VMs and full guest-build acceptance remain separate open requirements.

Tracking and rollout

Runtime consumer dependency alignment — 15 September 2026

Signed 2dfdbb8f4547086ae88615a83e0cebfd2e095fd4 aligns the existing dependency selections with the original signed runtime graph. This checkpoint changes Cargo selections and the roadmap; this repository's Rust implementation files are unchanged. Formatting, strict Clippy, private rustdoc and canonical documentation checks pass without warnings. Default/all-feature development/release tests pass 248 default / 252 all-feature tests. Independent production configurations also pass strict host/native Clippy and native builds: ttyd-runtime: 248 development / 248 release tests, ttyd-runtime-seeded-interrupt: 251 development / 251 release tests, ttyd-runtime-seeded-wait-interrupt: 250 development / 250 release tests. There are 10 supported native builds in total. Push/review CI 66/67 passes with complete classified logs and no final warnings. The product catalog, product VM acceptance and guest build remain pending. Review: #3.

Dependencies: integration#1, bootloader#1

Dependencies identify required contracts and closure gates; preparatory inventory/design can proceed in parallel under one owner per edited file. Link bounded implementation issues and their PRs here before claiming acceptance. Use feature/posix-compat, regular signed commits in the canonical contribution format, and WIP PRs linked to the exact coherent component graph. All cross-repository Cargo/catalog selections and CI helpers use full 40-character lowercase commit hashes, including transitive dependencies; do not substitute branch, tag or implicit HEAD selection.

Close criteria only with their own reviewed deliverables and validation evidence. Pending, skipped, cancelled, failed or predecessor-only results remain distinct. Keep main images unchanged until explicit promotion direction; technical completion does not authorize merges, release tags or publication.

Coherent dependency checkpoint — 20 September 2026: signed/pushed commit 318b302f576ed4818e21435a27d96d5cdf144241 aligns original shared dependency pins with the explicit installer-rights contract. Only the manifest and roadmap change; local implementation, APIs and authority policy are unchanged. Four strict 248/252-unit configurations, four native builds with the maintained linker layout, host/native Clippy, formatting, private rustdoc and dependency checks pass without warnings. Original CI 70/71 passes with four complete hashed logs (120,904 bytes), zero warning candidates.

Full catalog equality and actual consumer-image validation remain required under Integration regression 68. The broader work remains tracked by phase completion, including native external Rust/LLVM/runtime rebuilding and both complete EriX-in-EriX generations. This dependency checkpoint does not close full lifecycle, frame or self-hosting acceptance.

Acknowledged terminal service dependencies — 21 September 2026: signed ce05f76f11f02612a0ad062868021f4e100daff1 selects the original shared libraries for repeated terminal observation, exact acknowledgement and final CPU measurements under Kernel design 20. All 4 strict 248/252-test selected development/release feature configurations, warning-denied host/native builds with the maintained linker layout, host/native Clippy, private rustdoc, applicable doctests, formatting and dependency/Markdown checks pass. All authored code remains below 1,000 lines. Original CI 72, 73 passes; complete hashed logs total 120,984 bytes with zero warning candidates. Full service CPU/profiler VM acceptance and guest builds remain open in Phase 6 completion.

## Problem and motivation The final user environment needs predictable framebuffer initialization, independent terminals and usable interactive tools. Multiple live vttys, layout-correct Unicode text, scoped selection/paste and a preserved authenticated logo must work through real input paths. ## Proposed behavior and scope Implement one-time configurable framebuffer clear, independent default TTYs, session-mediated TUI/extop behavior, US/Finnish keyboard translation, safe vtty switching, initially hidden mouse pointer and primary selection/paste. Deterministically convert and display the existing signed logo with Linux/guest packaging parity. This issue records planned work; its unchecked criteria are not implementation proof. The normative basis is [Phase 6 and AC1–AC24](https://git.erikinkinen.fi/erix/docs/src/branch/main/phases/6.md). ## Authority, security and reliability Bind display, input, focus, selection and retained text to exact session generations. Protect trusted chrome/consent, cancel prompts on switch, retire stale input and grants, and keep unsigned preferences separate from signed policies/code. Ordinary clients receive neither raw framebuffer nor global clipboard access. Apply the priority order: security, reliability, then performance. Keep suspected vulnerabilities in the repository’s restricted SECURITY.md reporting channel. ## Acceptance criteria - [ ] Add strictly boolean `[features].fbcon_clear`, default `true`, to runtime/build configuration, schema, parser, feature identity and documentation; reject malformed values and test omission, true and false. - [ ] Apply the option to early and userspace framebuffer initialization. Clear once before the first console output when enabled; when disabled neither initializer may erase existing content merely because it starts. - [ ] Carry validated framebuffer identity/geometry and an early-clear completion record through the trusted handoff; if early fbcon already cleared the screen, user fbcon adopts it without another clear. Do not treat arbitrary descriptive startup bytes as proof of a trusted completed clear. - [ ] Preserve pixel format/stride/padding, cursor and output continuity; replace conflicting unconditional release/early clears and test that late initialization never erases valid early logs. Normal explicit TUI clearing remains separate from this initialization-only build option. - [ ] Add unit and framebuffer VM coverage for early-only, user-only, both and neither console with clear enabled/disabled; assert exact clear count, final pixels and handoff failure behavior, not just a serial READY marker. - [ ] Set `tty_mirror = false` in both canonical dev/release images; align sample/extended defaults with independent terminals and retain explicit mirrored fixtures so the optional feature remains tested. - [ ] Validate both enabled paths create distinct shells/sessions with separate input/output/cwd/history/foreground jobs/consent and adequate declared capacity; single-path and no-TTY configurations still work without extra grants. - [ ] Preserve frozen [integration#6](https://git.erikinkinen.fi/erix/integration/issues/6) timing comparisons as their original cohort, then measure the new dual-shell default separately using [integration#5](https://git.erikinkinen.fi/erix/integration/issues/5) session-bound observations. Do not attribute a policy/workload change to a kernel speedup or relax the carried limits; report each terminal's full startup/command evidence. - [ ] Specify/version improved fbcond TUI operations: absolute/relative cursor position, visible cursor, erase regions, colors/attributes, rectangular cell updates, scrolling regions, viewport/resize and frame completion. - [ ] Implement bounded validated rendering batches/dirty regions, geometry/capacity checks and deterministic malformed-request behavior without granting raw framebuffer memory or global-screen ownership to clients. - [ ] Expose TUI through session-scoped tty mediation backed by fbcond, with clear renderer versus terminal ownership. Keep trusted powerbox chrome protected; ordinary clients cannot draw over it or steal focus/consent input. - [ ] Implement serial-terminal equivalents or advertised graceful fallbacks over the same session-level interface; define supported capabilities explicitly rather than claiming compatibility with every ncurses extension. - [ ] Extend the shared terminal parser with required cursor/erase/color and alternate-screen behavior, including extop's existing home/full-erase needs; test split escape sequences, unsupported controls and dimensions. - [ ] Port extop to the new TUI interface with efficient frame updates, resize/navigation, screen restoration and interrupt/exit cleanup; retain its exact process-inspection/control authorities and never add broad console caps. - [ ] Implement trusted-prompt suspension/restoration during a TUI session, ensuring modal input is not consumed by extop and no previous trusted text or stale ordinary frame is replayed after focus/session changes. - [ ] Add parser/renderer unit tests and serial/PS2 visual VMs for cursor, erase, colors, scrolling, resize, extop refresh/quit/Ctrl-C, independent TTYs, prompt interruption and complete session/capability cleanup. - [ ] Profile full versus partial redraw, IPC count and extop input-to- frame latency; fix measured bottlenecks without skipping visible completion, and update IPC/Rust API man pages, tool manuals and operator documentation. - [ ] Define keyboard-layout ownership over layout-independent physical key events; retain driver/inputd raw identity and implement text translation at ttyd or a reviewed shared pure layout layer. Provide signed, clean-room `en_US` and `fi_FI` mappings with modifiers, Caps Lock, AltGr, punctuation, Unicode and Finnish dead-key behavior. Keep physical identity, navigation and control chords distinguishable from text. - [ ] Initialize the keyboard text translator from [bootloader#1](https://git.erikinkinen.fi/erix/bootloader/issues/1)'s validated boot preference, default `en_US`; preserve consistent layout behavior for every physical keyboard client/session without double-translating serial input. Initially select layout at boot; later runtime layout changes require their own state-transition contract, not reinterpretation of buffered input. - [ ] Add a git-ignored local build override selecting `fi_FI` and include it explicitly in image identity/test receipts. Keep canonical dev/release, extended profiles and clean CI defaulting to `en_US`; explicit CI layout fixtures test Finnish without allowing a developer override to leak into publication. - [ ] Preserve secure-attention key identity and trusted consent fences; preference changes must not synthesize approval, reinterpret buffered keys or let ordinary layout processing consume trusted y/n plus Enter. Document which chords are physical and which text is layout-selected and display prompts consistently with those rules. - [ ] Add unit/real-input VM tests for both layouts, default/invalid preference fallback, local override isolation, modifier/dead-key release, repeated input, Unicode editor/delete behavior and trusted consent. Test both independent terminals and verify serial byte input remains unchanged. - [ ] Document keyboard selection and preference editing in boot-tool help/man, image/build docs and the technical manual, explicitly identifying unsigned convenience data versus signed security policy and code. - [ ] Replace single-byte-only text emission with checked UTF-8 sequences and backpressure-safe atomic character delivery; define dead-key composition, unsupported combinations, modifier release and pending-state reset on focus/ session/consent changes. Test interrupted multi-byte delivery cannot corrupt commands, leak pending text to another TTY or reinterpret it as trusted input. - [ ] Define multiple framebuffer vttys as distinct live terminal/session generations with their own shell, screen/scrollback, cursor, editing/history, cwd, foreground jobs and input state. Keep virtual-terminal records separate from the existing two physical framebuffer/serial console bindings. - [ ] Specify signed resource/count and creation/retirement policy for configured vttys, with at least two exercised in acceptance. Allocate/reuse only explicitly authorized session resources; an Fn ordinal cannot create processes or grant launch authority. Test exhaustion and safe focus fallback when a shell/vtty exits, without imposing an incidental fixed table limit. - [ ] Implement physical Ctrl+Alt+Fn switching directly to the configured framebuffer vtty identified by Fn. Admit this exact authenticated gesture without a separate manual secure-attention step, independently of keyboard layout; preserve existing trusted controls and reject nonexistent/stale targets. - [ ] Switch display and ordinary input focus atomically by exact live session generation; keep events bound to their receipt-time destination and handle held modifiers/releases without injecting them into the wrong vtty. Independent serial focus remains unchanged; test explicit mirrored mode too. - [ ] Cancel a pending trusted prompt when switching away, retaining the existing cancellation/cleanup contract; never transfer approval state to the destination. Restore ordinary content only after renderer acknowledgement and preserve fresh-input fences if a later prompt is created. - [ ] Retain inactive-vtty output in its own bounded terminal state and restore screen/cursor/selection on activation; handle resize, scrolling and extop alternate-screen updates without exposing another vtty or trusted chrome. - [ ] Add unit and physical-keyboard VMs for direct Fn switching, repeated switching, background output, exit/recreation, stale IDs, modifiers, both layouts, serial isolation and prompt cancellation. Profile switching/memory use and record the multi-vtty workload separately from frozen startup comparisons. - [ ] Implement a framebuffer mouse pointer that starts hidden and becomes visible only on the first authenticated nonzero movement, not button-only, resize or focus events. Define per-seat visibility across vtty switches; distinguish this pointer from the shell's text caret. - [ ] Validate signed deltas, button transitions, geometry and coordinate arithmetic; clip cursor drawing to the viewport and restore underlying pixels correctly during movement, redraw, scrolling, resize and vtty changes. - [ ] Implement left-button press/drag/release text selection and visible highlighting from the owning vtty's ordinary text model, including wrapped lines, Unicode/cell boundaries and scrollback. Bind selection to session and content revision; define updates while output changes during a drag. - [ ] Use conventional primary selection: completing a left-button selection copies its text, and middle-button press pastes it. Keep selection bytes scoped to the owning terminal/session by default; cross-vtty transfer requires explicit user-directed source/destination and realm policy, never a global clipboard or arbitrary screen-reading capability. - [ ] Deliver middle-button paste through the exact destination's ordinary input path with backpressure-safe ordering and no duplicate bytes. Define bracketed-paste/multiline/control-byte behavior so shell paste does not silently execute embedded newlines; require normal explicit submission. Do not apply keyboard layout translation to already selected UTF-8 text. - [ ] Exclude trusted chrome, consent input and other vttys from selection. Mouse selection/paste cannot approve, edit or queue answers to a trusted prompt; reject untrusted escape-sequence clipboard access and keep the host/serial terminal clipboard separate. Retire retained text on owner teardown/reuse. - [ ] Add independent unit and real PS/2 mouse/keyboard tests for initial hiding, button-only packets, first movement, bounds, pixel restoration, selection during redraw/scroll/resize, Unicode, middle paste, backpressure, vtty isolation and prompt races; prove cleanup and zero unintended authority. - [ ] Use [boot-logo source](https://git.erikinkinen.fi/erix/docs/src/branch/main/logo_transparent.png) as the original boot-logo source, recording its exact digest and asset provenance. It is currently a 1024×1024 RGBA PNG. Preserve its artwork/transparency; define deterministic preprocessing/scaling rather than generating a new logo. - [ ] Convert the source at build time into a simple, versioned, bounded bitmap payload with explicit dimensions/pixel/alpha format; package it as an optional signed non-executable boot.img section. Keep general PNG decoding out of the bootloader unless a separately justified design requires it. - [ ] In the bootloader, draw the available authenticated bitmap at the screen's bottom center using validated GOP geometry. Preserve aspect ratio, alpha blend against the existing background and define deterministic fitting/ margins for small resolutions; never stretch or draw outside the viewport. - [ ] Fully validate pixel length, width/height/stride, format, arithmetic, alpha and destination bounds before drawing; test RGBA/BGRA, padding, clipping and overflow independently. Image data grants no framebuffer mapping authority. - [ ] Integrate drawing after the configured one-time clear, in both dev and release paths, independent of early text-log enablement. Preserve the clear-completion handoff so later early/user console initialization does not immediately erase the logo; define temporary text/logo placement and normal console takeover without hiding required readiness/error output. - [ ] Boot normally without the optional logo or a usable framebuffer. Define safe cosmetic-error handling for an authenticated but malformed bitmap; container/signature failure still follows the existing fail-closed policy. Release temporary logo buffers/module authority once no consumer needs them. - [ ] Add Linux and in-EriX asset-conversion/package parity tests and put conversion inputs/tools in the [integration#8](https://git.erikinkinen.fi/erix/integration/issues/8)/[integration#9](https://git.erikinkinen.fi/erix/integration/issues/9) build closure; the final guest-built images must not depend on an unrecorded host-side bitmap conversion. - [ ] Add bounded visual VM tests for logo present/absent, dev/release, clear true/false, early console on/off, both pixel formats and small/normal geometries; assert bottom-center placement/transparency and unchanged text. Test signed-logo tampering rejection and document the asset/format/build options in boot-tool man pages, canonical docs and the technical manual. For each implementation slice, retain actual formatting, strict Clippy, unit/doctest and warning-denied build results for all altered Rust repositories and valid configurations. Add relevant runtime VM coverage, monitor older unit/VM regressions in exact-head CI, and update canonical component documents and affected technical-manual/API material. Every authored code file must remain below 1,000 physical lines, with meaningful inline documentation and missing_docs enforcement in Rust crates. ## Alternatives and tradeoffs Different dual-shell/vtty workloads need separately recorded timing cohorts; they cannot be presented as kernel speedups or relax carried limits. Reuse raw physical event identity and pure layout/rendering semantics, preserving explicit mirrored fixtures and serial byte behavior. Coherent realm image service prerequisites — 18 September 2026: Signed `8adf42e3a3014f583f7e16f32345bfa0d93b315f` selects the original shared wire/startup dependency graph. Direct Rust implementation bytes are unchanged. All 10 default, all-feature and separate production development/release configurations pass 248/250/251/252 unit tests per configuration, strict host/native Clippy and freestanding linking with fatal linker warnings. Formatting, private-item rustdoc and Markdown pass, with zero warnings. Original push/PR CI is under observation. Matching catalog adoption and real consumer VMs remain requirements; complete realm and full in-guest build acceptance remain open. Original coherent realm source CI acceptance — 18 September 2026: Signed `8adf42e3a3014f583f7e16f32345bfa0d93b315f` passes [CI 69](https://git.erikinkinen.fi/erix/ttyd/actions/runs/69) and [CI 68](https://git.erikinkinen.fi/erix/ttyd/actions/runs/68). All four terminal logs are complete (120,912 bytes), with zero final warnings. This closes the original CI observation recorded above. Coherent catalog publication, actual consumer VMs and full guest-build acceptance remain separate open requirements. ## Tracking and rollout ### Runtime consumer dependency alignment — 15 September 2026 Signed `2dfdbb8f4547086ae88615a83e0cebfd2e095fd4` aligns the existing dependency selections with the original signed runtime graph. This checkpoint changes Cargo selections and the roadmap; this repository's Rust implementation files are unchanged. Formatting, strict Clippy, private rustdoc and canonical documentation checks pass without warnings. Default/all-feature development/release tests pass 248 default / 252 all-feature tests. Independent production configurations also pass strict host/native Clippy and native builds: `ttyd-runtime`: 248 development / 248 release tests, `ttyd-runtime-seeded-interrupt`: 251 development / 251 release tests, `ttyd-runtime-seeded-wait-interrupt`: 250 development / 250 release tests. There are 10 supported native builds in total. Push/review CI 66/67 passes with complete classified logs and no final warnings. The product catalog, product VM acceptance and guest build remain pending. Review: https://git.erikinkinen.fi/erix/ttyd/pulls/3. Dependencies: [integration#1](https://git.erikinkinen.fi/erix/integration/issues/1), [bootloader#1](https://git.erikinkinen.fi/erix/bootloader/issues/1) Dependencies identify required contracts and closure gates; preparatory inventory/design can proceed in parallel under one owner per edited file. Link bounded implementation issues and their PRs here before claiming acceptance. Use `feature/posix-compat`, regular signed commits in the canonical contribution format, and WIP PRs linked to the exact coherent component graph. All cross-repository Cargo/catalog selections and CI helpers use full 40-character lowercase commit hashes, including transitive dependencies; do not substitute branch, tag or implicit HEAD selection. Close criteria only with their own reviewed deliverables and validation evidence. Pending, skipped, cancelled, failed or predecessor-only results remain distinct. Keep main images unchanged until explicit promotion direction; technical completion does not authorize merges, release tags or publication. Coherent dependency checkpoint — 20 September 2026: signed/pushed commit [318b302f576ed4818e21435a27d96d5cdf144241](https://git.erikinkinen.fi/erix/ttyd/commit/318b302f576ed4818e21435a27d96d5cdf144241) aligns original shared dependency pins with the explicit installer-rights contract. Only the manifest and roadmap change; local implementation, APIs and authority policy are unchanged. Four strict 248/252-unit configurations, four native builds with the maintained linker layout, host/native Clippy, formatting, private rustdoc and dependency checks pass without warnings. Original CI 70/71 passes with four complete hashed logs (120,904 bytes), zero warning candidates. Full catalog equality and actual consumer-image validation remain required under [Integration regression 68](https://git.erikinkinen.fi/erix/integration/issues/68). The broader work remains tracked by [phase completion](https://git.erikinkinen.fi/erix/integration/issues/65), including native external Rust/LLVM/runtime rebuilding and both complete EriX-in-EriX generations. This dependency checkpoint does not close full lifecycle, frame or self-hosting acceptance. Acknowledged terminal service dependencies — 21 September 2026: signed [ce05f76f11f02612a0ad062868021f4e100daff1](https://git.erikinkinen.fi/erix/ttyd/commit/ce05f76f11f02612a0ad062868021f4e100daff1) selects the original shared libraries for repeated terminal observation, exact acknowledgement and final CPU measurements under [Kernel design 20](https://git.erikinkinen.fi/erix/kernel/issues/20). All 4 strict 248/252-test selected development/release feature configurations, warning-denied host/native builds with the maintained linker layout, host/native Clippy, private rustdoc, applicable doctests, formatting and dependency/Markdown checks pass. All authored code remains below 1,000 lines. Original CI [72](https://git.erikinkinen.fi/erix/ttyd/actions/runs/72), [73](https://git.erikinkinen.fi/erix/ttyd/actions/runs/73) passes; complete hashed logs total 120,984 bytes with zero warning candidates. Full service CPU/profiler VM acceptance and guest builds remain open in [Phase 6 completion](https://git.erikinkinen.fi/erix/integration/issues/65).

erikinkinen added the

security

performance

phase-6

enhancement

labels 2026-09-12 07:56:25 +02:00

erikinkinen referenced this issue from erix/exsh 2026-09-12 07:56:29 +02:00

[FEATURE] Complete native shell/build utilities and provide help and offline manual pages #1

erikinkinen referenced this issue from erix/integration 2026-09-12 07:56:30 +02:00

[FEATURE] Demonstrate two complete generations of EriX built inside EriX #9

erikinkinen referenced this issue from erix/integration 2026-09-12 07:56:30 +02:00

[FEATURE] Close final security, documentation, CI and self-hosting acceptance #10

erikinkinen changed title from [FEATURE] [P21] Complete independent consoles, vttys, TUI, keyboard layouts, mouse and boot logo to [FEATURE] Complete independent consoles, vttys, TUI, keyboard layouts, mouse and boot logo 2026-09-12 08:02:04 +02:00

erikinkinen referenced this issue 2026-09-15 18:22:52 +02:00

WIP: Align signed runtime dependencies #3

erikinkinen referenced this issue from erix/integration 2026-09-19 11:36:52 +02:00

[FEATURE] Track Phase 6 POSIX compatibility and full EriX self-hosting #65

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

main

feature/posix-compat

feature/native-cli

No results found.

Labels

Clear labels

  

bug

Something is not working

  

ci

  

docs

  

duplicate

This issue or pull request already exists

  

enhancement

New feature

  

help wanted

Need some help

  

invalid

Something is wrong

  

performance

Measured performance profiling, bottleneck analysis, and regression budgets.

  

phase-6

Phase 6: POSIX compatibility, full EriX self-hosting, and its required audits and validation.

  

question

More information is needed

  

refactor

Code cleanup, removal of obsolete paths, and structural improvements preserving behavior.

  

security

  

wontfix

This won't be fixed

No labels

bug

ci

docs

duplicate

enhancement

help wanted

invalid

performance

phase-6

question

refactor

security

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

erix/ttyd#1

No description provided.