Qualified ordinary-init controller host preparation

Evidence class: source and host tests only, 2026-10-02 local time (October 3 UTC). Worktree /home/jadams/tmp/k230-mainline-system-trial, branch mainline-drm-system-trial, base 99068255a82383463681fcdd8e6115e15f06e4ee. Own only the new controller, its new test file and this evidence directory. No build slot, board reservation, serial access, candidate boot or touch was performed by this worker. Task 5b.5 and physical ordinary-init/touch remain UNVERIFIED; the coordinator owns planning, integration and board work.

The selected host-built bundle is /nix/store/5yqilsfyj35jzrcqjjqilkr6sd47qlms-k230-mainline-drm-trial-boot-files. Its exact kernel/system/DTB/initrd identities and successful matching inspector are recorded in SD1 clock build proof. The coordinator reports no-clock-ignore minimal restart/protected-normal recovery. Ordinary init must additionally wait for returned label/root-mount diagnostics and protected restoration. A root-marker parser failure is not proof of a hardware stall or usable ordinary root.

Source boundary and interface

The independent init/touch audit (35f1fbbc301e52fb764f7bfd79ab0ebfcbd82874) reads the actual selected initrd, systemd 261.2 init/units, prepare-root/activation and executable paths. Kernel boot without rdinit= executes the initramfs /init; the sole matching init=<system>/init selects the closure for normal root activation/switch-root. Neither init nor prepare-root is manually executed by this controller. Candidate sw/bin/python3 is absent; candidate reports use shell builtins and the checked exact system’s tools. The existing Python identity helper runs only on protected normal preflight/postflight.

The new controller imports the existing shell controller’s immutable bundle/manifest/normal-report preparation, protected normal helper, private serial log/session, load-range/count/CRC, printed bootargs and locking helpers. It leaves the existing rdinit protocols and schemas unchanged. It adds exactly these volatile first-comparison controls:

fsck.mode=skip systemd.mask=k230-root-growth.service systemd.mask=register-nix-paths.service

Source grounds them as excluding the initrd fsck unit’s unbounded checker, explicit root-growth resize and registration service’s persistent profile replacement. Fresh normal preflight requires /nix-path-registration absent (including a dangling symlink). Both masked services must report LoadState masked on the candidate. Exact complete printed bootargs must match: no rdinit, PATH, clock-ignore, boot debug, rescue override or persistent environment save is added. This is a qualified first ordinary boot. Writable activation and ext4 mounting can update mutable root/runtime state; unmasked production acceptance and a graphical mainline shell are not proved.

The operator explicitly selects three phases:

• begin verifies fresh normal identities/services/eight hashes and registered staged closure, records root source/type/UUID/label, performs exact protected U-Boot loads/counts/CRCs and volatile args, then waits at most 180 seconds for a fresh 7.3-rc5 banner, autologin and root prompt before sending reports. Reports require UID 0, selected current/booted system/kernel/PID1, fresh boot ID, active serial getty, sole init/exact guards, ext4 NIXOS_SD root at the observed /dev/mmcblk1p2 with rw, unchanged UUID/profile/eight hashes, and absent registration marker. It persists mode-0600 state and leaves candidate running for an explicitly reserved operator/finger interaction.
• touch requires --real-touch and a fresh same-boot identity/profile/root/ control/hash report before one read-only Goodix capture. It leaves candidate running. No contact is recorded as an unproved interaction; a known completed capture allows a separate guarded finish even if interaction was unproved.
• finish rechecks all those identities against private state, requests exactly one selected systemctl reboot, requires a complete fresh RC-zero receipt, then passively waits up to 180 seconds for SPL, 6.6.36, login and root prompt. Protected postflight requires a fresh normal ID, original profile/system/ kernel/init, three active services and eight hashes. A successful ordinary boot can be finished without performing touch; it does not then prove touch.

Reports use separate complete begin/end/field tokens, RC fields and a fresh prompt; generated identity lines are 720–1,385 bytes. Split serial reads and rolling-buffer rollover are tested. Echoes, stale/wrong tokens, duplicate, malformed, missing or nonzero reports stop input. Arbitrary kernel printk interleaving is not stripped or repaired. Reboot acknowledgement is allowed without a subsequent candidate prompt; fresh recovery bytes in that same read are retained. All received valid identity stages survive a later failure. Unknown completion invalidates resumable state and preserves a recovery-required private result, with no Ctrl-C, guessed exit, reboot retry or automatic reset. A busy board lock opens no serial and preserves previously ready state. Deadlines bound observation; they do not provide autonomous hardware recovery.

Real touch boundary

Sysfs must identify exactly one Goodix Berlin Capacitive TouchScreen under /sys/devices/platform/soc/91408000.i2c/i2c-<n>/<n>-005d/input/input<n>. Virtual/uinput nodes, ambiguity and fixed event-number assumptions are rejected. The verified /dev/input/event<n> must be a character device. The fixed capture is timeout --signal=TERM --kill-after=2s 30s evtest <node>, writing only a fresh private /run/k230-mainline-touch-<token>.log. No grab, injection, framebuffer write or broad process kill occurs. Only known RC 0/124 permits one bounded file retrieval; unknown capture/retrieval receives no further input.

Pinned evtest 1.36 executable strings confirm the dashed SYN_REPORT format and typed ABS rows. Host parsing requires one contact with tracking-ID down, XY coordinates and changed positions in distinct completed SYN frames, release and final SYN. Separate stationary taps cannot substitute for a drag. Raw header/ranges/events remain in the protected serial log; structured result records counts and down/move/up/SYN facts. --real-touch declares operator intent; serial events alone do not prove physical provenance. The operator must deliberately tap/drag/release the glass during the capture, record timing and camera evidence separately, and inspect reported ranges before any coordinate-mapping claim. Mapping remains UNVERIFIED.

Host proof and operator commands

python3 -m unittest discover -s tests -p 'test_mainline_drm_*trial.py' -v
openspec validate the-board-runs-a-mainline-kernel --strict

Host test log records 118 passing tests (96 existing rdinit tests plus 22 new ordinary-init tests), including a complete begin/touch/finish flow using the real rolling serial pump, readiness beyond eight seconds, exact controls, stale/duplicate/split/truncated/nonzero markers, no premature probe, isolated actual sh reports, wrong boot/profile/hash/normal services, physical node selection, complete real-format frames, unknown capture/retrieval/no retry, normal-return timeout preserving candidate facts, and private state/board lock. All shell execution replaces proc/sys/run/boot/profile/registration paths and utilities with temporary fixtures; no host sysfs, mounts or debug state is used. Injected fixture events are host parser proof, never physical touch evidence. Final suite exit zero was observed by 2026-10-03T04:03:56Z (15.587 seconds). Python compilation, strict OpenSpec validation and staged whitespace checks also pass. The cached work-status scan runs at start and handoff. No task checkbox or canonical specification is changed.

After review, successful returned root diagnostics, staging and a fresh protected normal report, the sole board operator can use these commands. The directory must already exist with mode 0700; every log/result pathname must be new. State remains private and contains exact boot IDs; no runtime contents belong in committed evidence without deliberate sanitization.

python3 tools/mainline-drm-system-trial.py begin \
  --bundle /nix/store/5yqilsfyj35jzrcqjjqilkr6sd47qlms-k230-mainline-drm-trial-boot-files \
  --manifest "$HOME/tmp/k230-mainline-system-board/candidate-manifest.json" \
  --normal-report "$HOME/tmp/k230-mainline-system-board/normal-report.json" \
  --state "$HOME/tmp/k230-mainline-system-board/state.json" \
  --log "$HOME/tmp/k230-mainline-system-board/begin-uart.log" \
  --result "$HOME/tmp/k230-mainline-system-board/begin-result.json"
python3 tools/mainline-drm-system-trial.py touch --real-touch \
  --state "$HOME/tmp/k230-mainline-system-board/state.json" \
  --log "$HOME/tmp/k230-mainline-system-board/touch-uart.log" \
  --result "$HOME/tmp/k230-mainline-system-board/touch-result.json"
python3 tools/mainline-drm-system-trial.py finish \
  --state "$HOME/tmp/k230-mainline-system-board/state.json" \
  --log "$HOME/tmp/k230-mainline-system-board/finish-uart.log" \
  --result "$HOME/tmp/k230-mainline-system-board/finish-result.json"

Review/merge/push/deployment and physical qualified root/login, real-glass interaction and protected normal restoration remain with the coordinator. This host preparation cannot close task 5b.5 or establish unmasked acceptance.

The first physical ordinary-init attempt reached systemd/udev but timed out before root activation/login. Its result, curated excerpt and camera limits are recorded separately; no touch acceptance or task completion is inferred from it.