docs(ptt): land Baseline Candidate v0.9.3 — capability-based desktop PTT
Applies the gen2 desktop-PTT review summary
(`gen2/chanora-desktop-ptt-review-summary-v0.9.2.md`) to our doc set
with the owner rulings PTT-OPEN-001 through PTT-OPEN-006 resolved as
accepted decisions DEC-023 through DEC-028:
* DEC-023 Windows Global PTT P0 / MVP
* DEC-024 macOS Global PTT P0 / MVP with permission UX
* DEC-025 Linux officially-tested env: GNOME on Wayland only
* DEC-026 Mouse side buttons supported (Win + macOS; Linux portal)
* DEC-027 PTT diagnostics: capability + availability only, no
raw key codes ever
* DEC-028 Missed-key-up watchdog: P0
Requirements (SysRS / SRS) and architecture (SysDes / SAD / SDD)
gain the desktop-PTT ID set the gen2 summary describes:
SysRS-296..302 -> SysDes-142..148
-> SRS-195..203
-> SAD-071..079
-> SDD-081..092
ID totals advance from 295 / 141 / 194 / 70 / 80 to 302 / 148 / 203
/ 79 / 92. The strict layered sourcing rule (`SRS -> SysDes` only,
`SAD -> SRS` only, `SDD -> SAD` only) is preserved; the
`tools/validate_docs.py` validator reports zero undefined refs and
zero direct-layer-rule violations.
New document:
* `docs/architecture/desktop-ptt-architecture.md` — capability
ladder (L0Focused, L1GlobalShortcut, L2GlobalHoldToTalk,
L3GlobalWithMouseButtons, L4DeviceAware reserved), Windows /
macOS / Linux strategies, privacy rule, audio-gate rule,
missed-key-up watchdog, release-readiness evidence requirement,
traceability summary.
Doc addenda (Baseline Candidate 0.9.3):
* `privacy/privacy-policy.md` — no raw key history, capability-
dependent Global PTT, UI reflects actual runtime capability
* `security/threat-model.md` — THREAT-PTT-001..006
* `security/diagnostic-redaction-audit-report.md` —
REDACT-PTT-001..006 banned field list enforced by `PttSanitizer`
* `release/platform-release-policy.md` — per-platform evidence
fields, no over-claim on untested Linux compositors
* `release/release-readiness-go-nogo-record.md` — RR-PTT-001..008
release-readiness items
* `verification/swe4-unit-verification-plan.md` —
SWE4-UV-035..039
* `verification/swe5-software-integration-verification-plan.md` —
SWE5-IV-015
* `verification/swe6-software-verification-plan.md` — SWE6-SV-017
* `verification/sys4-system-integration-verification-plan.md` —
SYS4-SIV-016
* `governance/traceability-matrix.md` — full PTT trace rows +
verification map
* `governance/decision-impact-assessment.md` — DEC-023..028
impact matrix
* `governance/product-decision-register.md` v0.9.9 entry
recording DEC-023..028 in the decision table and the status
table at §7
* `governance/document-index.md` — adds
`desktop-ptt-architecture.md` to the controlled set
* `architecture/proof-of-concept-plan.md` —
PoC-PTT-001..005 platform items
* `references/external-references.md` — Windows Raw Input,
macOS event-tap, Linux GlobalShortcuts portal references
* Both validation reports
(`baseline-candidate-validation-report.md`,
`repo-format-validation-report.md`) bumped to v0.9.3 with the
new ID totals (302 / 148 / 203 / 79 / 92).
README §"Desktop Push-to-Talk" added between Architecture Overview
and Repository Layout: capability levels, per-platform strategy,
privacy posture, missed-key-up watchdog.
Tooling:
* `tools/validate_docs.py` copied from the gen2 zip into the
repo tree (was previously available only inside the zip).
Reports zero undefined refs, zero direct-layer-rule violations,
English-only CJK check passes. The 35 "old package-style
filename" hits are pre-existing and identical to the gen2
baseline (they live in `path-migration-map.md` and config-ID
headers of governance docs and are intentional per the path
migration policy).
* `.gitignore` adds `/gen2/` so the externally-provided review
package does not enter the repo.
No code changes in this commit; B (the implementation split into
`transmit_active` / `capture_active`, `PttCapabilityLevel`
reporting, `PttSanitizer` diagnostics rule, and the UI capability
badge) follows in a separate commit.
This commit is contained in:
EdisonJwa
@@ -0,0 +1,180 @@
|
||||
# Desktop Push-to-Talk Architecture
|
||||
|
||||
| Field | Value |
|
||||
|---|---|
|
||||
| Document type | Architecture |
|
||||
| Version | 0.9.3 |
|
||||
| Status | Baseline Candidate |
|
||||
| Language | English |
|
||||
| Product | Chanora |
|
||||
| Date | 2026-05-15 |
|
||||
|
||||
Owner-resolved review questions from `gen2/chanora-desktop-ptt-review-summary-v0.9.2.md` are recorded as DEC-023 through DEC-028 in `docs/governance/product-decision-register.md`.
|
||||
|
||||
---
|
||||
|
||||
## 1. Purpose
|
||||
|
||||
Desktop Push-to-Talk (PTT) is the operation by which a user holds a bound keyboard key or mouse button to enable voice transmission and releases it to disable transmission. This document fixes the architecture so the product can describe, implement, verify, and release desktop PTT honestly — every capability claim made to the user is auditable against a live runtime measurement.
|
||||
|
||||
The previous architecture treated PTT as a single global behaviour. That over-promised on platforms where the operating system, the user-granted permission set, the display server, or the compositor does not permit unconditional global key capture. This document replaces that with a capability-based model.
|
||||
|
||||
## 2. Architectural Decisions
|
||||
|
||||
| ID | Decision | Source |
|
||||
|---|---|---|
|
||||
| DEC-023 | Windows Global PTT is **P0 / MVP**. | Owner ruling 2026-05-15 |
|
||||
| DEC-024 | macOS Global PTT is **P0 / MVP** with explicit permission UX flow. | Owner ruling 2026-05-15 |
|
||||
| DEC-025 | The officially-tested Linux environment for the first public release is **GNOME on Wayland** (only). | Owner ruling 2026-05-15 |
|
||||
| DEC-026 | Mouse side buttons are **supported** in the first desktop PTT release on Windows and macOS; Linux support follows whatever the GlobalShortcuts portal exposes. | Owner ruling 2026-05-15 |
|
||||
| DEC-027 | The diagnostic export carries **capability and availability state only** — no raw key codes, scan codes, or virtual-key values ever leave the device. | Owner ruling 2026-05-15 |
|
||||
| DEC-028 | The **missed-key-up watchdog is P0**: the audio engine shall self-release `transmit_active` if the OS suppresses a key-up event. | Owner ruling 2026-05-15 |
|
||||
|
||||
## 3. Capability Ladder
|
||||
|
||||
| Level | Name | Meaning |
|
||||
|---|---|---|
|
||||
| `L0Focused` | Focused PTT | PTT works only while the Chanora window has input focus. Mandatory on every desktop platform per SysRS-296. |
|
||||
| `L1GlobalShortcut` | Global shortcut activation | The OS recognises a global accelerator and notifies the application, but hold-to-talk semantics may be approximated rather than guaranteed. |
|
||||
| `L2GlobalHoldToTalk` | Global hold-to-talk | Press and release events are delivered while the application is not focused. The common Windows / macOS / GNOME-Wayland-portal MVP target. |
|
||||
| `L3GlobalWithMouseButtons` | Global hold-to-talk plus mouse buttons | Includes mouse side buttons (Mouse4 / Mouse5). |
|
||||
| `L4DeviceAware` | Device-aware PTT | Backend can distinguish specific input devices. **Reserved.** No MVP implementation produces `L4DeviceAware`. |
|
||||
|
||||
The reported capability shall match runtime behaviour. A backend that *could* deliver `L2GlobalHoldToTalk` but lacks the user-granted permission shall report `L0Focused` until permission is granted.
|
||||
|
||||
## 4. Component Allocation
|
||||
|
||||
```
|
||||
+------------------------------------+
|
||||
| Flutter Voice UI |
|
||||
| PTT binding-capture sheet |
|
||||
| VoiceBar PttCapabilityBadge |
|
||||
+---------------+--------------------+
|
||||
|
|
||||
| set_binding(...)
|
||||
| events_stream() -> BridgeEvent::PttCapability
|
||||
v
|
||||
+---------------+--------------------+
|
||||
| chanora_bridge |
|
||||
| typed DTOs, no key data crosses |
|
||||
+---------------+--------------------+
|
||||
|
|
||||
v
|
||||
+------------------------------------+
|
||||
| chanora_core |
|
||||
| PttController |
|
||||
| owns Box<dyn DesktopPttBackend>|
|
||||
| owns Arc<AudioTransmitGate> |
|
||||
| publishes PttCapabilityLevel |
|
||||
| MissedKeyUpWatchdog (tokio task) |
|
||||
+---------------+--------------------+
|
||||
|
|
||||
v
|
||||
+------------------------------------+
|
||||
| chanora_audio |
|
||||
| DesktopPttBackend trait |
|
||||
| WindowsRawInputBackend |
|
||||
| WindowsHookBackend |
|
||||
| MacOSEventTapBackend |
|
||||
| LinuxGnomeWaylandBackend |
|
||||
| FocusedPttBackend |
|
||||
| AudioTransmitGate |
|
||||
| capture_active / transmit_active |
|
||||
+------------------------------------+
|
||||
|
|
||||
v
|
||||
+------------------------------------+
|
||||
| chanora_diagnostics |
|
||||
| RedactingLogLayer |
|
||||
| PttSanitizer (drops banned keys) |
|
||||
+------------------------------------+
|
||||
```
|
||||
|
||||
The audio engine reads `transmit_active` once per outbound Opus frame. No code path other than `AudioTransmitGate::set` flips the value.
|
||||
|
||||
## 5. Per-Platform Strategy
|
||||
|
||||
### 5.1 Windows
|
||||
|
||||
Three-level ladder evaluated once at audio-engine start:
|
||||
|
||||
1. **`WindowsRawInputBackend`** — preferred. Uses `RegisterRawInputDevices` with `RIDEV_INPUTSINK` to receive keyboard and mouse events even when Chanora is not focused. Runs a message-only window on its own OS thread so the WndProc is non-blocking. Reports `L2GlobalHoldToTalk` (keyboard) or `L3GlobalWithMouseButtons` (when a mouse side button is bound).
|
||||
2. **`WindowsHookBackend`** — fallback. Installs `WH_KEYBOARD_LL` and `WH_MOUSE_LL` hooks on its own thread. Used when Raw Input registration fails (some constrained environments). Reports `L2GlobalHoldToTalk` / `L3GlobalWithMouseButtons`.
|
||||
3. **`FocusedPttBackend`** — final fallback. Reports `L0Focused`.
|
||||
|
||||
The chosen rung is fixed for the lifetime of the audio engine; restart of the engine re-evaluates the ladder.
|
||||
|
||||
### 5.2 macOS
|
||||
|
||||
Two-level ladder with explicit permission gating:
|
||||
|
||||
1. **`MacOSEventTapBackend`** — preferred when Input Monitoring (or Accessibility, depending on macOS version) permission is `Granted`. Creates a `CGEventTap` on the main run loop, filtered to keyboard and mouse-button events. Reports `L2GlobalHoldToTalk` / `L3GlobalWithMouseButtons`.
|
||||
2. **`FocusedPttBackend`** — fallback when permission is `Denied`, `Undetermined`, or revoked at runtime. Reports `L0Focused`.
|
||||
|
||||
The audio engine starts immediately on user request; the permission state is queried in parallel and the capability level is upgraded asynchronously through `BridgeEvent::PttCapability` if the user grants the permission. This avoids blocking voice functionality on a permission prompt.
|
||||
|
||||
### 5.3 Linux
|
||||
|
||||
Two-level ladder restricted to the officially-tested environment per DEC-025:
|
||||
|
||||
1. **`LinuxGnomeWaylandBackend`** — used when `XDG_SESSION_TYPE=wayland` and the desktop environment is GNOME, **and** the `org.freedesktop.portal.GlobalShortcuts` D-Bus interface is reachable. Calls `CreateSession`, `BindShortcuts` (delegates binding capture to the portal's own dialog), and listens for `Activated` / `Deactivated` signals. Reports `L2GlobalHoldToTalk`; mouse-button support follows whatever the portal exposes for the current session.
|
||||
2. **`FocusedPttBackend`** — fallback on any other Linux environment (X11, sway, KDE, untested compositor, missing portal). Reports `L0Focused`.
|
||||
|
||||
Per DEC-025 the application does **not** claim Global PTT support on an untested Linux environment. The UI capability badge explicitly notes "Focused PTT — untested compositor for Global PTT" when the user runs Chanora outside GNOME-on-Wayland.
|
||||
|
||||
## 6. Privacy Rule
|
||||
|
||||
Per SysRS-302 and SRS-202:
|
||||
|
||||
- Raw key codes, scan codes, virtual-key values, keysyms, and key-press timing sequences shall not be logged, persisted, or included in any user-initiated diagnostic export.
|
||||
- The `PttSanitizer` log-sink decorator enforces this at write time by inspecting field names and dropping records whose field names match a banned list (`key_code`, `scan_code`, `virtual_key`, `vk`, `keysym`, `keysym_string`, `key_sequence`). The check is structural — it does not rely on a content scan.
|
||||
- The diagnostic export shall name only the capability level (`PttCapabilityLevel::as_str()`), the backend identifier (a fixed `&'static str` per implementation), and the bound input class (`"keyboard"`, `"mouse-side-button"`).
|
||||
|
||||
## 7. Audio Gate Rule
|
||||
|
||||
Per SRS-201:
|
||||
|
||||
- `capture_active: AtomicBool` is set by the audio engine on input-stream lifecycle transitions (stream opened or closed) and by the platform input-permission state. The PTT subsystem does not write `capture_active`.
|
||||
- `transmit_active: AtomicBool` lives inside `AudioTransmitGate`. The Opus encoder feed reads it once per outbound frame; the gate is the only mutator path.
|
||||
- A muted self-input (per `set_input_muted`) forces `transmit_active` to false regardless of the PTT subsystem's wish; this preserves the existing self-mute semantics.
|
||||
|
||||
## 8. Missed-Key-Up Watchdog
|
||||
|
||||
Per SRS-203 / DEC-028:
|
||||
|
||||
- The audio engine spawns one `MissedKeyUpWatchdog` task per audio session.
|
||||
- It subscribes to `AudioTransmitGate`'s `watch::Receiver<bool>` and notes the timestamp of each `false -> true` transition.
|
||||
- On each `true -> false` transition it clears the timestamp.
|
||||
- If a `true` lifetime exceeds the configured ceiling (default 30 s, owner-tunable through a future setting), the watchdog calls `AudioTransmitGate::set(false)` and emits a sanitised diagnostic line naming only the capability level and backend identifier.
|
||||
|
||||
## 9. Release Readiness
|
||||
|
||||
Per SysDes-148 and the release-readiness record:
|
||||
|
||||
- Every release artefact carries a per-platform capability-evidence row listing the detected `PttCapabilityLevel`, the active backend identifier, and whether the Focused fallback was exercised during verification.
|
||||
- Release notes shall mirror that evidence and shall not over-claim Global PTT support.
|
||||
|
||||
## 10. Traceability
|
||||
|
||||
```
|
||||
SysRS-296..302
|
||||
-> SysDes-142..148
|
||||
-> SRS-195..203
|
||||
-> SAD-071..079
|
||||
-> SDD-081..092
|
||||
```
|
||||
|
||||
Verification coverage:
|
||||
|
||||
```
|
||||
SDD-081..092 -> SWE4-UV-035..039
|
||||
SAD-071..079 + SDD-081..092 -> SWE5-IV-015
|
||||
SRS-195..203 -> SWE6-SV-017
|
||||
SysDes-142..148 -> SYS4-SIV-016
|
||||
```
|
||||
|
||||
## 11. Change History
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.3 | 2026-05-15 | Initial baseline-candidate architecture for capability-based desktop Push-to-Talk. Codifies the owner rulings for PTT-OPEN-001 through PTT-OPEN-006 as DEC-023 through DEC-028. |
|
||||
@@ -49,3 +49,18 @@ A PoC is not product code unless explicitly promoted.
|
||||
| 0.1.0 | 2026-05-14 | Initial proof-of-concept plan. |
|
||||
| 0.2.0 | 2026-05-14 | Recorded PoC outcomes: 5 PASS, 1 PARTIAL PASS (mobile half of audio still open). Added Status column. Spike directories live under `poc/`; see `poc/README.md` and `docs/governance/poc-results-summary.md`. |
|
||||
| 0.3.0 | 2026-05-14 | Audio PoC promoted from PARTIAL PASS to PASS after `poc/audio-capture-playback-android-spike` verified the mobile half on a physical Android device. All six PoC plan entries are now PASS. iOS is explicitly deferred per DEC-011.1 and remains an open follow-up but is no longer a PoC-plan gap. |
|
||||
|
||||
|
||||
## Desktop Push-to-Talk PoC Items (Baseline Candidate 0.9.3)
|
||||
|
||||
| PoC ID | Purpose | Owner | Acceptance |
|
||||
|---|---|---|---|
|
||||
| PoC-PTT-001 | Confirm `WindowsRawInputBackend` registers under `RIDEV_INPUTSINK` and forwards key + mouse-button events while Chanora is not focused. | Windows Platform Owner | Live press-release sequence toggles `transmit_active` on a Windows 10/11 reference host with another window focused. |
|
||||
| PoC-PTT-002 | Confirm `MacOSEventTapBackend` works under granted Input Monitoring permission and degrades to `L0Focused` under denied permission. | macOS Platform Owner | Live measurement on a macOS reference host both before and after granting Input Monitoring; permission revocation degrades capability without crashing. |
|
||||
| PoC-PTT-003 | Confirm `LinuxGnomeWaylandBackend` binds a shortcut via the GlobalShortcuts portal and receives `Activated` / `Deactivated` signals on a GNOME-on-Wayland reference host. | Linux Platform Owner | Portal dialog accepts a binding; press-release sequence toggles `transmit_active` outside the Chanora window. |
|
||||
| PoC-PTT-004 | Confirm `PttSanitizer` drops records with banned key field names. | Diagnostics Owner | Unit test passes; manual diagnostic export inspection on a host with PTT bound to a real key shows zero raw key data. |
|
||||
| PoC-PTT-005 | Confirm `MissedKeyUpWatchdog` clears `transmit_active` after the configured timeout. | Audio Owner | Unit test passes with tokio time paused; integration test on a Windows host where the OS suppresses the key-up event clears within the timeout. |
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.3 | 2026-05-15 | Added desktop-PTT PoC items PoC-PTT-001..005 covering Windows Raw Input, macOS Event Tap (permission states), Linux GlobalShortcuts portal, diagnostics sanitizer, and missed-key-up watchdog. |
|
||||
|
||||
@@ -1274,12 +1274,94 @@ Communication evidence is maintained through change history and baseline approva
|
||||
- Source SRS: SRS-185 through SRS-194
|
||||
- Verification method: Review, Inspection
|
||||
|
||||
**SAD-071**: The software architecture shall isolate desktop PTT into a `DesktopPttBackend` trait owned by the audio subsystem, with the active implementation selected at runtime by a `platform_input::select` factory. Only the factory and the audio engine know which implementation is active; the rest of the application sees only the trait surface and the published capability level.
|
||||
|
||||
- Status: Baseline Candidate
|
||||
- Type: Software Architecture Item
|
||||
- Stage: P0 / MVP
|
||||
- Allocated to: Audio, Platform Input
|
||||
- Source SRS: SRS-195
|
||||
- Verification method: Architecture Review, Unit Test
|
||||
|
||||
**SAD-072**: The Windows PTT backend shall be a three-level ladder (`WindowsRawInputBackend` -> `WindowsHookBackend` -> `FocusedPttBackend`). The ladder is evaluated once at audio-engine start; the chosen rung is fixed for the lifetime of that engine and is reported as the backend identifier.
|
||||
|
||||
- Status: Baseline Candidate
|
||||
- Type: Software Architecture Item
|
||||
- Stage: P0 / MVP
|
||||
- Allocated to: Audio (Windows)
|
||||
- Source SRS: SRS-197
|
||||
- Verification method: Platform Test (Windows), Architecture Review
|
||||
|
||||
**SAD-073**: The macOS PTT backend shall be a two-level ladder (`MacOSEventTapBackend` -> `FocusedPttBackend`) with explicit permission state surfaced through `PttCapabilityLevel`. The permission query shall not block the audio-engine start path; an undecided permission shall resolve to `L0` and may upgrade asynchronously when the user grants the permission.
|
||||
|
||||
- Status: Baseline Candidate
|
||||
- Type: Software Architecture Item
|
||||
- Stage: P0 / MVP
|
||||
- Allocated to: Audio (macOS)
|
||||
- Source SRS: SRS-198
|
||||
- Verification method: Platform Test (macOS), Architecture Review
|
||||
|
||||
**SAD-074**: The Linux PTT backend shall be a two-level ladder (`LinuxGnomeWaylandBackend` using the freedesktop `org.freedesktop.portal.GlobalShortcuts` interface, -> `FocusedPttBackend`). Untested display servers, untested compositors, and missing D-Bus access shall all resolve to `L0`.
|
||||
|
||||
- Status: Baseline Candidate
|
||||
- Type: Software Architecture Item
|
||||
- Stage: P0 / MVP
|
||||
- Allocated to: Audio (Linux)
|
||||
- Source SRS: SRS-199
|
||||
- Verification method: Platform Test (Linux, GNOME Wayland), Architecture Review
|
||||
|
||||
**SAD-075**: The audio engine shall expose `AudioTransmitGate`, a thin object that owns the `transmit_active` AtomicBool and exposes `set` and `load` operations only. The Opus encoder feed shall consult `AudioTransmitGate::load()` once per outbound frame; no other code path may flip `transmit_active`.
|
||||
|
||||
- Status: Baseline Candidate
|
||||
- Type: Software Architecture Item
|
||||
- Stage: P0 / MVP
|
||||
- Allocated to: Audio
|
||||
- Source SRS: SRS-201
|
||||
- Verification method: Unit Test, Audio Test
|
||||
|
||||
**SAD-076**: The bridge shall expose PTT events through the existing `BridgeEvent` stream, adding a `BridgeEvent::PttCapability { level, backend_id }` variant. The bridge shall never carry raw key codes or scan codes across the FFI boundary; the trait surface and the event shape together enforce SRS-202 at the architectural layer.
|
||||
|
||||
- Status: Baseline Candidate
|
||||
- Type: Software Architecture Item
|
||||
- Stage: P0 / MVP
|
||||
- Allocated to: Bridge, Audio, Diagnostics
|
||||
- Source SRS: SRS-202
|
||||
- Verification method: Architecture Review, Privacy Review
|
||||
|
||||
**SAD-077**: The diagnostics subsystem shall add a `PttSanitizer` decorator over the `RedactingLogLayer` log sink. The decorator shall scan each record's field set for the well-known names `key_code`, `scan_code`, `virtual_key`, `vk`, `keysym`, `keysym_string`, `key_sequence` and drop the record before it reaches storage.
|
||||
|
||||
- Status: Baseline Candidate
|
||||
- Type: Software Architecture Item
|
||||
- Stage: P0 / MVP
|
||||
- Allocated to: Diagnostics
|
||||
- Source SRS: SRS-202
|
||||
- Verification method: Unit Test, Privacy Review
|
||||
|
||||
**SAD-078**: The Flutter UI shall consume `BridgeEvent::PttCapability` and render a small capability badge in the Voice Bar. When the capability resolves to `L0` on a platform that the user reasonably expected to support Global PTT (for example Windows or macOS with the relevant permission undecided), the UI shall render an explanation row pointing to the corresponding fix (run-as-administrator path, permission grant path, environment-not-supported note).
|
||||
|
||||
- Status: Baseline Candidate
|
||||
- Type: Software Architecture Item
|
||||
- Stage: P0 / MVP
|
||||
- Allocated to: Flutter UI
|
||||
- Source SRS: SRS-196, SRS-198
|
||||
- Verification method: UI Review, User Acceptance Test
|
||||
|
||||
**SAD-079**: The audio engine shall own the missed-key-up watchdog as a single tokio task that subscribes to `transmit_active` transitions through a `tokio::sync::watch` channel; on a configured timeout (default 30 s, owner-tunable) without a release event, the task shall clear `transmit_active` and emit a sanitised diagnostic record.
|
||||
|
||||
- Status: Baseline Candidate
|
||||
- Type: Software Architecture Item
|
||||
- Stage: P0 / MVP
|
||||
- Allocated to: Audio
|
||||
- Source SRS: SRS-203
|
||||
- Verification method: Unit Test, Integration Test
|
||||
|
||||
## 27. Updated SRS-to-SAD Coverage Matrix
|
||||
|
||||
| SRS Range | SAD Coverage |
|
||||
|---|---|
|
||||
| SRS-001 through SRS-184 | Covered by inherited SAD baseline `SAD-001` through `SAD-060` |
|
||||
| SRS-185 through SRS-194 | Covered by `SAD-061` through `SAD-070` |
|
||||
| SRS-195 through SRS-203 | Covered by `SAD-071` through `SAD-079` |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.1 Update
|
||||
@@ -1294,3 +1376,10 @@ Communication evidence is maintained through change history and baseline approva
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.2 | 2026-05-14 | Corrected Apple App Store Connect upload gate effective date and preserved layer-specific traceability. |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.3 Update
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.3 | 2026-05-15 | Added desktop PTT software-architecture items SAD-071 through SAD-079: backend isolation behind `DesktopPttBackend` trait, Windows three-rung ladder, macOS two-rung permission-aware ladder, Linux GNOME-Wayland portal ladder, `AudioTransmitGate` object, sanitised `BridgeEvent::PttCapability`, `PttSanitizer` log-sink decorator, UI capability badge with platform-specific explanation, missed-key-up watchdog task. Strict layered sourcing preserved (`SAD -> SRS` only). |
|
||||
|
||||
@@ -1005,12 +1005,121 @@ The registry supports consistency between architecture, detailed design, impleme
|
||||
- Source SAD: SAD-069, SAD-070
|
||||
- Verification method: Privacy Review, Security Audit
|
||||
|
||||
**SDD-081**: `DesktopPttBackend` shall be a Rust trait in `chanora_audio::ptt` exposing `fn capability(&self) -> PttCapabilityLevel`, `fn backend_id(&self) -> &'static str`, `fn start(&mut self, gate: Arc<AudioTransmitGate>, binding: PttBinding) -> Result<(), PttError>`, `fn stop(&mut self)`, and `fn rebind(&mut self, binding: PttBinding) -> Result<(), PttError>`. Implementations shall be Send and stop on Drop.
|
||||
|
||||
- Status: Draft
|
||||
- Type: Software Detailed Design Item
|
||||
- Stage: P0 / MVP
|
||||
- Software unit: `DesktopPttBackend`
|
||||
- Source SAD: SAD-071
|
||||
- Verification method: Unit Test, Inspection
|
||||
|
||||
**SDD-082**: `PttCapabilityLevel` shall be a plain Rust enum (`L0Focused`, `L1GlobalShortcut`, `L2GlobalHoldToTalk`, `L3GlobalWithMouseButtons`, `L4DeviceAware`) with a public `as_str(&self) -> &'static str` mapping for diagnostics. `L4DeviceAware` is reserved and shall not be produced by any MVP implementation.
|
||||
|
||||
- Status: Draft
|
||||
- Type: Software Detailed Design Item
|
||||
- Stage: P0 / MVP
|
||||
- Software unit: `PttCapabilityLevel`
|
||||
- Source SAD: SAD-071
|
||||
- Verification method: Unit Test
|
||||
|
||||
**SDD-083**: `WindowsRawInputBackend` shall use the `RegisterRawInputDevices` Win32 API targeting `HID_USAGE_PAGE_GENERIC` keyboard and mouse usages, run a dedicated message-only window on its own OS thread, and forward only sanitised binding-match results to the `AudioTransmitGate`. Raw `RAWINPUT` payloads shall never cross the backend boundary.
|
||||
|
||||
- Status: Draft
|
||||
- Type: Software Detailed Design Item
|
||||
- Stage: P0 / MVP
|
||||
- Software unit: `WindowsRawInputBackend`
|
||||
- Source SAD: SAD-072
|
||||
- Verification method: Platform Test (Windows), Unit Test
|
||||
|
||||
**SDD-084**: `WindowsHookBackend` shall be used only when Raw Input registration fails. It installs `WH_KEYBOARD_LL` and `WH_MOUSE_LL` hooks on its dedicated thread; the hook callbacks compare against the active binding and call `AudioTransmitGate::set` only, never logging key data. The hook is uninstalled on Drop.
|
||||
|
||||
- Status: Draft
|
||||
- Type: Software Detailed Design Item
|
||||
- Stage: P0 / MVP
|
||||
- Software unit: `WindowsHookBackend`
|
||||
- Source SAD: SAD-072
|
||||
- Verification method: Platform Test (Windows), Unit Test
|
||||
|
||||
**SDD-085**: `MacOSEventTapBackend` shall create a `CGEventTap` filtered to keyboard and mouse-button events, attached to the main run loop with an explicit retain. The tap callback shall consult the active binding and call `AudioTransmitGate::set` only. The backend shall expose `permission_state() -> Granted | Denied | Undetermined` via `IOHIDCheckAccess` (or the macOS-version-appropriate equivalent) and shall return `PttCapabilityLevel::L0Focused` when permission is not Granted.
|
||||
|
||||
- Status: Draft
|
||||
- Type: Software Detailed Design Item
|
||||
- Stage: P0 / MVP
|
||||
- Software unit: `MacOSEventTapBackend`
|
||||
- Source SAD: SAD-073
|
||||
- Verification method: Platform Test (macOS), User Acceptance Test
|
||||
|
||||
**SDD-086**: `LinuxGnomeWaylandBackend` shall call `CreateSession`, `BindShortcuts`, and listen for `Activated` / `Deactivated` signals on the freedesktop `org.freedesktop.portal.GlobalShortcuts` D-Bus interface. Binding capture shall use the portal's own configuration dialog; Chanora itself does not read raw key events. Missing D-Bus or missing portal interface resolves to `PttCapabilityLevel::L0Focused`.
|
||||
|
||||
- Status: Draft
|
||||
- Type: Software Detailed Design Item
|
||||
- Stage: P0 / MVP
|
||||
- Software unit: `LinuxGnomeWaylandBackend`
|
||||
- Source SAD: SAD-074
|
||||
- Verification method: Platform Test (Linux, GNOME Wayland), Unit Test
|
||||
|
||||
**SDD-087**: `FocusedPttBackend` shall integrate with Flutter's keyboard / pointer event stream via the existing `Listener` widget path and the bridge `set_ptt` command. Reports `PttCapabilityLevel::L0Focused` and `backend_id = "focused"`.
|
||||
|
||||
- Status: Draft
|
||||
- Type: Software Detailed Design Item
|
||||
- Stage: P0 / MVP
|
||||
- Software unit: `FocusedPttBackend`
|
||||
- Source SAD: SAD-071, SAD-072, SAD-073, SAD-074
|
||||
- Verification method: Unit Test, UI Review
|
||||
|
||||
**SDD-088**: `PttController` shall sit in `chanora_core::ptt` and own a `Box<dyn DesktopPttBackend>`, a clone of `AudioTransmitGate`, a `watch::Sender<PttCapabilityLevel>` for live publication to the bridge, and a `tokio::sync::Mutex` over the active `PttBinding`. Public surface: `set_binding`, `current_capability`, `subscribe_capability`.
|
||||
|
||||
- Status: Draft
|
||||
- Type: Software Detailed Design Item
|
||||
- Stage: P0 / MVP
|
||||
- Software unit: `PttController`
|
||||
- Source SAD: SAD-071, SAD-076
|
||||
- Verification method: Unit Test, Integration Test
|
||||
|
||||
**SDD-089**: `AudioTransmitGate` shall be `Arc<AudioTransmitGate>` wrapping a `tokio::sync::watch::Sender<bool>` and an internal `AtomicBool`. `set(v)` updates both atomically; `load()` reads the atomic; `subscribe()` hands out a `watch::Receiver` for the missed-key-up watchdog task.
|
||||
|
||||
- Status: Draft
|
||||
- Type: Software Detailed Design Item
|
||||
- Stage: P0 / MVP
|
||||
- Software unit: `AudioTransmitGate`
|
||||
- Source SAD: SAD-075
|
||||
- Verification method: Unit Test
|
||||
|
||||
**SDD-090**: `PttSanitizer` shall implement `tracing_subscriber::Layer` and decorate the existing `RedactingLogLayer`. Records whose field names match the SDD-077 banned list shall be dropped before `on_event` reaches the wrapped sink. The implementation shall be allocation-free on the success path (the typical "no banned field" case).
|
||||
|
||||
- Status: Draft
|
||||
- Type: Software Detailed Design Item
|
||||
- Stage: P0 / MVP
|
||||
- Software unit: `PttSanitizer`
|
||||
- Source SAD: SAD-077
|
||||
- Verification method: Unit Test, Privacy Review
|
||||
|
||||
**SDD-091**: `PttCapabilityBadge` shall be a Flutter widget rendered inside the Voice Bar, subscribed to the FRB stream of `BridgeEvent::PttCapability`. The widget shall map each enum value to a short user-facing label and shall render an info icon that opens a per-platform explanation sheet when the resolved capability is `L0Focused`.
|
||||
|
||||
- Status: Draft
|
||||
- Type: Software Detailed Design Item
|
||||
- Stage: P0 / MVP
|
||||
- Software unit: `PttCapabilityBadge`
|
||||
- Source SAD: SAD-078
|
||||
- Verification method: UI Review, User Acceptance Test
|
||||
|
||||
**SDD-092**: `MissedKeyUpWatchdog` shall be a tokio task spawned by the audio engine that holds the `watch::Receiver<bool>` from `AudioTransmitGate::subscribe()`. On each transition from `false` to `true` the task records the timestamp; on each `true -> false` transition the task clears the timestamp. If the transition timeline shows `true` for longer than the configured timeout the task calls `AudioTransmitGate::set(false)` and emits a sanitised diagnostic record.
|
||||
|
||||
- Status: Draft
|
||||
- Type: Software Detailed Design Item
|
||||
- Stage: P0 / MVP
|
||||
- Software unit: `MissedKeyUpWatchdog`
|
||||
- Source SAD: SAD-079
|
||||
- Verification method: Unit Test, Integration Test
|
||||
|
||||
## 11. Updated SAD-to-SDD Coverage Matrix
|
||||
|
||||
| SAD Range | SDD Coverage |
|
||||
|---|---|
|
||||
| SAD-001 through SAD-060 | Covered by inherited SDD baseline `SDD-001` through `SDD-070` |
|
||||
| SAD-061 through SAD-070 | Covered by `SDD-071` through `SDD-080` |
|
||||
| SAD-071 through SAD-079 | Covered by `SDD-081` through `SDD-092` |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.1 Update
|
||||
@@ -1025,3 +1134,10 @@ The registry supports consistency between architecture, detailed design, impleme
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.2 | 2026-05-14 | Corrected Apple App Store Connect upload gate effective date and preserved layer-specific traceability. |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.3 Update
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.3 | 2026-05-15 | Added desktop PTT detailed design SDD-081 through SDD-092: `DesktopPttBackend` trait, `PttCapabilityLevel` enum, Windows Raw-Input + low-level-hook + Focused implementations, macOS event-tap + Focused implementations, Linux GNOME-Wayland portal + Focused implementations, `PttController`, `AudioTransmitGate`, `PttSanitizer` layer, `PttCapabilityBadge` widget, `MissedKeyUpWatchdog` task. Strict sourcing (`SDD -> SAD` only) preserved. |
|
||||
|
||||
@@ -2768,14 +2768,99 @@ This SysDes version covers all known SysRS requirements from `SysRS-001` through
|
||||
- ASPICE SYS.3 alignment: Architecture constraints, communication
|
||||
- Allocated SysRS: SysRS-295
|
||||
|
||||
**SysDes-142**: The desktop Push-to-Talk subsystem shall be allocated to a dedicated **Platform PTT Backend** layer that is selected at runtime per operating system, display server, and granted permission set, with the **Rust Core PTT State Machine** owning the authoritative `transmit_active` flag and the Flutter Voice UI owning the binding-capture UX.
|
||||
|
||||
- Status: Baseline Candidate
|
||||
- Type: Subsystem Allocation
|
||||
- Stage: P0 / MVP
|
||||
- Allocated to: Platform Input, Rust Core, Flutter UI, Audio Engine
|
||||
- Downstream artifact: SRS, SAD, SDD, Verification
|
||||
- Verification method: Architecture Review, Platform Test
|
||||
- Verification owner: Software Architect
|
||||
- ASPICE SYS.3 alignment: Element decomposition, interface definition
|
||||
- Allocated SysRS: SysRS-296, SysRS-297
|
||||
|
||||
**SysDes-143**: The platform PTT backend layer shall report a typed `PttCapabilityLevel` (`L0` Focused, `L1` Global-shortcut-activation, `L2` Global-hold-to-talk, `L3` Global-with-mouse-buttons, `L4` Device-aware) to the Rust Core, and the Rust Core shall publish the same value to the Flutter UI through the bridge event stream so capability advertising matches actual runtime behaviour.
|
||||
|
||||
- Status: Baseline Candidate
|
||||
- Type: Cross-Subsystem Interface
|
||||
- Stage: P0 / MVP
|
||||
- Allocated to: Platform Input, Rust Core, Flutter UI, Bridge
|
||||
- Downstream artifact: SRS, SAD, SDD, Verification
|
||||
- Verification method: Integration Test, Architecture Review
|
||||
- Verification owner: Software Architect
|
||||
- ASPICE SYS.3 alignment: Interface definition, consistency
|
||||
- Allocated SysRS: SysRS-298
|
||||
|
||||
**SysDes-144**: The audio capture pipeline shall expose two distinct atomic states: `capture_active` (the input stream is open and frames flow into the encoder feeder) and `transmit_active` (the encoder is producing outbound Opus frames and the protocol layer is forwarding them). The PTT subsystem shall drive `transmit_active` only; `capture_active` shall follow the audio engine lifecycle and the platform input-permission state independently.
|
||||
|
||||
- Status: Baseline Candidate
|
||||
- Type: Subsystem Interface
|
||||
- Stage: P0 / MVP
|
||||
- Allocated to: Audio Engine, Rust Core
|
||||
- Downstream artifact: SRS, SAD, SDD, Verification
|
||||
- Verification method: Audio Test, Integration Test
|
||||
- Verification owner: Audio Owner + Software Architect
|
||||
- ASPICE SYS.3 alignment: Element behaviour, interface definition
|
||||
- Allocated SysRS: SysRS-296
|
||||
|
||||
**SysDes-145**: The Windows desktop backend shall be allocated to a Raw-Input-first implementation with a low-level-hook fallback and a Focused-PTT terminal fallback. The macOS desktop backend shall be allocated to a permission-aware Global PTT implementation with a Focused-PTT terminal fallback. The Linux desktop backend shall be allocated to a GNOME-on-Wayland portal-based implementation (the officially-tested compositor) with a Focused-PTT terminal fallback on every other Linux environment.
|
||||
|
||||
- Status: Baseline Candidate
|
||||
- Type: Platform Allocation
|
||||
- Stage: P0 / MVP
|
||||
- Allocated to: Platform Input
|
||||
- Downstream artifact: SRS, SAD, SDD, Verification
|
||||
- Verification method: Platform Test (Win/macOS/Linux), Architecture Review
|
||||
- Verification owner: Software Architect + Platform Owners
|
||||
- ASPICE SYS.3 alignment: Element decomposition, platform mapping
|
||||
- Allocated SysRS: SysRS-299, SysRS-300, SysRS-301
|
||||
|
||||
**SysDes-146**: A **diagnostics sanitizer** shall sit between the platform PTT backend and the application log sink. The sanitizer shall reject any record carrying raw key codes, scan codes, virtual-key values, or key-press timing sequences before the record reaches the in-memory log sink, the platform sink (logcat / fmt / etc.), or the user-initiated diagnostic export pipeline.
|
||||
|
||||
- Status: Baseline Candidate
|
||||
- Type: Cross-Cutting Constraint
|
||||
- Stage: P0 / MVP
|
||||
- Allocated to: Diagnostics, Platform Input
|
||||
- Downstream artifact: SRS, SAD, SDD, Verification
|
||||
- Verification method: Privacy Review, Diagnostic Inspection, Unit Test
|
||||
- Verification owner: Security / Privacy Reviewer
|
||||
- ASPICE SYS.3 alignment: Architecture constraints, safety / security
|
||||
- Allocated SysRS: SysRS-302
|
||||
|
||||
**SysDes-147**: The Flutter Voice UI shall surface the active PTT capability level and the active backend identifier as user-facing status (capability badge, fallback notice) so the user understands when a Global PTT binding cannot be honoured and a Focused-PTT fallback is in effect.
|
||||
|
||||
- Status: Baseline Candidate
|
||||
- Type: User-Facing Behaviour Allocation
|
||||
- Stage: P0 / MVP
|
||||
- Allocated to: Flutter UI
|
||||
- Downstream artifact: SRS, SAD, SDD, Verification
|
||||
- Verification method: User Acceptance Test, UI Review
|
||||
- Verification owner: UX Owner
|
||||
- ASPICE SYS.3 alignment: Element behaviour
|
||||
- Allocated SysRS: SysRS-298
|
||||
|
||||
**SysDes-148**: The release verification record shall carry per-platform PTT capability evidence (detected `PttCapabilityLevel`, active backend identifier, fallback exercised yes/no) before any release artefact may claim Global PTT support. Release notes shall mirror the actual capability per platform and shall not over-claim.
|
||||
|
||||
- Status: Baseline Candidate
|
||||
- Type: Release Constraint
|
||||
- Stage: P0 / MVP
|
||||
- Allocated to: Release / Operations, Verification
|
||||
- Downstream artifact: Release Readiness Record, Verification
|
||||
- Verification method: Release Inspection, Architecture Review
|
||||
- Verification owner: Release Manager
|
||||
- ASPICE SYS.3 alignment: Architecture constraints
|
||||
- Allocated SysRS: SysRS-298
|
||||
|
||||
## 17. Updated SysRS Coverage Statement
|
||||
|
||||
This SysDes version covers all known SysRS requirements from `SysRS-001` through `SysRS-295`.
|
||||
This SysDes version covers all known SysRS requirements from `SysRS-001` through `SysRS-302`.
|
||||
|
||||
| SysRS Range | SysDes Coverage |
|
||||
|---|---|
|
||||
| SysRS-001 through SysRS-285 | Covered by inherited SysDes baseline `SysDes-001` through `SysDes-132` |
|
||||
| SysRS-286 through SysRS-295 | Covered by `SysDes-133` through `SysDes-141` |
|
||||
| SysRS-296 through SysRS-302 | Covered by `SysDes-142` through `SysDes-148` |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.1 Update
|
||||
@@ -2790,3 +2875,10 @@ This SysDes version covers all known SysRS requirements from `SysRS-001` through
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.2 | 2026-05-14 | Corrected Apple App Store Connect upload gate effective date and separated release build SDK compliance from iOS runtime deployment target. |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.3 Update
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.3 | 2026-05-15 | Added desktop PTT subsystem allocation SysDes-142 through SysDes-148: Platform PTT Backend layer, typed `PttCapabilityLevel` cross-interface, audio-pipeline split into `capture_active` and `transmit_active`, per-OS backend allocation (Windows Raw-Input ladder, macOS permission-aware, Linux GNOME-Wayland portal), diagnostics sanitizer for raw key events, UI capability badge, release-record evidence requirement. |
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
# Cfg Baseline Candidate Validation Report
|
||||
|
||||
**Document type:** Configuration / Validation Report
|
||||
**Version:** 0.9.2
|
||||
**Version:** 0.9.3
|
||||
**Status:** Baseline Candidate
|
||||
**Language:** English
|
||||
**Product:** Chanora
|
||||
@@ -10,24 +10,24 @@
|
||||
## 1. Package
|
||||
|
||||
```text
|
||||
chanora-docs-repo-format-v0.9.2.zip
|
||||
chanora-docs-repo-format-v0.9.3
|
||||
```
|
||||
|
||||
## 2. File Count
|
||||
|
||||
| Type | Count |
|
||||
|---|---:|
|
||||
| Markdown files | 36 |
|
||||
| Markdown files | 37 (added `docs/architecture/desktop-ptt-architecture.md`) |
|
||||
|
||||
## 3. Defined ID Counts
|
||||
|
||||
| ID family | Defined IDs |
|
||||
|---|---:|
|
||||
| SysRS | 295 |
|
||||
| SysDes | 141 |
|
||||
| SRS | 194 |
|
||||
| SAD | 70 |
|
||||
| SDD | 80 |
|
||||
| SysRS | 302 |
|
||||
| SysDes | 148 |
|
||||
| SRS | 203 |
|
||||
| SAD | 79 |
|
||||
| SDD | 92 |
|
||||
|
||||
## 4. Undefined Reference Check
|
||||
|
||||
@@ -54,7 +54,9 @@ chanora-docs-repo-format-v0.9.2.zip
|
||||
|
||||
| Check | Result |
|
||||
|---|---:|
|
||||
| CJK characters found | 0 |
|
||||
| CJK characters in en-only doc set | 0 |
|
||||
|
||||
(Localised user-facing strings in `apps/chanora_flutter/lib/l10n/app_zh.arb` are out of scope of this report per DEC-015.)
|
||||
|
||||
## 7. Apple Gate Coverage Check
|
||||
|
||||
@@ -66,8 +68,24 @@ chanora-docs-repo-format-v0.9.2.zip
|
||||
| Internal Alpha / local development distinction | Captured in Platform Release Policy |
|
||||
| TestFlight / App Store upload distinction | Captured in Platform Release Policy |
|
||||
|
||||
## 8. Change History
|
||||
## 8. Desktop Push-to-Talk Coverage Check
|
||||
|
||||
| Item | Coverage |
|
||||
|---|---|
|
||||
| Focused PTT mandatory on Win / macOS / Linux | SysRS-296 -> SysDes-142, SysDes-144 -> SRS-201 -> SAD-075 -> SDD-089 |
|
||||
| Global PTT capability-dependent | SysRS-297 -> SysDes-142 -> SRS-195 -> SAD-071 -> SDD-081 |
|
||||
| Capability exposed to UI + release record | SysRS-298 -> SysDes-143/147/148 -> SRS-196 -> SAD-076/078 -> SDD-082/088/091 |
|
||||
| Windows ladder | SysRS-299 -> SysDes-145 -> SRS-197 -> SAD-072 -> SDD-083/084 |
|
||||
| macOS permission-aware | SysRS-300 -> SysDes-145 -> SRS-198 -> SAD-073 -> SDD-085 |
|
||||
| Linux GNOME-Wayland portal | SysRS-301 -> SysDes-145 -> SRS-199 -> SAD-074 -> SDD-086 |
|
||||
| No raw key history in diagnostics | SysRS-302 -> SysDes-146 -> SRS-202 -> SAD-077 -> SDD-090 |
|
||||
| Mouse side buttons (DEC-026) | SRS-200 -> SAD-072/073/074 -> SDD-083/085/086 |
|
||||
| Missed-key-up watchdog (DEC-028) | SRS-203 -> SAD-079 -> SDD-092 |
|
||||
| Owner-resolved review questions PTT-OPEN-001..006 | DEC-023..028 in `product-decision-register.md` |
|
||||
|
||||
## 9. Change History
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.2 | 2026-05-14 | Validation report for Apple App Store Connect upload SDK gate correction, full file update, and coverage check. |
|
||||
| 0.9.3 | 2026-05-15 | Validation report for desktop Push-to-Talk update: added 7 SysRS / 7 SysDes / 9 SRS / 9 SAD / 12 SDD entries, added `desktop-ptt-architecture.md`, recorded six new owner decisions DEC-023..028; ID totals advance to 302 / 148 / 203 / 79 / 92; direct-layer rule and undefined-reference counts remain zero. |
|
||||
|
||||
@@ -77,3 +77,21 @@ This document records how key unresolved product and architecture decisions affe
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.2 | 2026-05-14 | Corrected Apple App Store Connect upload gate to 2026-04-28 and checked full-package naming, references, and coverage. |
|
||||
|
||||
|
||||
## Desktop Push-to-Talk Decision Impact Addendum (Baseline Candidate 0.9.3)
|
||||
|
||||
The owner rulings recorded as DEC-023 through DEC-028 on 2026-05-15 affect the documents below. If any of those decisions are revisited the documents listed must be re-validated for consistency.
|
||||
|
||||
| Decision | Affects |
|
||||
|---|---|
|
||||
| DEC-023 Windows Global PTT P0 | `docs/architecture/desktop-ptt-architecture.md`, `docs/architecture/sad.md` SAD-072, `docs/architecture/sdd.md` SDD-083/084, `docs/requirements/srs.md` SRS-197, `docs/release/release-readiness-go-nogo-record.md` RR-PTT-001 |
|
||||
| DEC-024 macOS Global PTT P0 + permission UX | `docs/architecture/desktop-ptt-architecture.md`, `docs/architecture/sad.md` SAD-073, `docs/architecture/sdd.md` SDD-085, `docs/requirements/srs.md` SRS-198, `docs/release/release-readiness-go-nogo-record.md` RR-PTT-002/003 |
|
||||
| DEC-025 Linux GNOME-Wayland only | `docs/architecture/desktop-ptt-architecture.md`, `docs/architecture/sad.md` SAD-074, `docs/architecture/sdd.md` SDD-086, `docs/requirements/srs.md` SRS-199, `docs/release/platform-release-policy.md`, `docs/release/release-readiness-go-nogo-record.md` RR-PTT-004/005 |
|
||||
| DEC-026 Mouse side buttons | `docs/architecture/desktop-ptt-architecture.md`, `docs/requirements/srs.md` SRS-200, `docs/architecture/sad.md` SAD-072/073, `docs/architecture/sdd.md` SDD-083/085 |
|
||||
| DEC-027 PTT diagnostics privacy | `docs/privacy/privacy-policy.md`, `docs/security/diagnostic-redaction-audit-report.md`, `docs/security/threat-model.md`, `docs/requirements/srs.md` SRS-202, `docs/architecture/sad.md` SAD-077, `docs/architecture/sdd.md` SDD-090 |
|
||||
| DEC-028 Missed-key-up watchdog P0 | `docs/architecture/desktop-ptt-architecture.md`, `docs/requirements/srs.md` SRS-203, `docs/architecture/sad.md` SAD-079, `docs/architecture/sdd.md` SDD-092, `docs/release/release-readiness-go-nogo-record.md` RR-PTT-007 |
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.3 | 2026-05-15 | Recorded the desktop-PTT decision impacts for DEC-023..028. |
|
||||
|
||||
@@ -20,6 +20,7 @@ This document lists the normalized latest files included in the Chanora reposito
|
||||
| `docs/architecture/sad.md` | Baseline Candidate |
|
||||
| `docs/architecture/sdd.md` | Baseline Candidate |
|
||||
| `docs/architecture/sysdes.md` | Baseline Candidate |
|
||||
| `docs/architecture/desktop-ptt-architecture.md` | Baseline Candidate |
|
||||
| `docs/governance/baseline-approval-record.md` | Baseline Candidate |
|
||||
| `docs/governance/baseline-candidate-validation-report.md` | Baseline Candidate |
|
||||
| `docs/governance/decision-impact-assessment.md` | Baseline Candidate |
|
||||
@@ -84,3 +85,4 @@ SysDes -> SYS.4
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.2 | 2026-05-14 | Converted documentation package to repository-oriented docs folder structure and updated internal filename references. |
|
||||
| 0.9.3 | 2026-05-15 | Added `docs/architecture/desktop-ptt-architecture.md` to the controlled document set. |
|
||||
|
||||
@@ -52,6 +52,12 @@ A decision marked **Proposed / Owner Confirmation Required** is a recommended de
|
||||
| DEC-021 | Apple App Store submission SDK | Use Xcode 26 or later and the iOS 26 / iPadOS 26 SDK or later for App Store submission on or after 2026-04-28, unless Apple publishes a newer applicable requirement before upload | Accepted | iOS Owner + Release Manager | Controls App Store Connect upload eligibility and release pipeline. |
|
||||
| DEC-020 | License model | **Dual-licensed under Apache-2.0 OR MIT (recipient's choice)**, the standard Rust-ecosystem permissive license model. Accepted on 2026-05-14. Compatible with every direct dependency in the PoC tree (`tsclientlib` MIT-OR-Apache-2.0, `flutter_rust_bridge` MIT, `cpal` Apache-2.0, `rusqlite` MIT, `keyring` MIT-OR-Apache-2.0, etc.) and with the Flutter framework's BSD-3-Clause. The license texts ship as `LICENSE-APACHE` and `LICENSE-MIT` at the repository root; an aggregator `LICENSE` points to both. `NOTICE` enumerates current direct-dependency attributions. The full OSS legal review (transitive deps, license obligations, OSS notices) remains under DEC-012 and is still required before public release. | Accepted | Product Owner + Legal | Business and OSS compliance decision. No longer a public-release blocker by itself; legal review under DEC-012 is the remaining gate. |
|
||||
| DEC-022 | Canonical implementation directory layout | Accept the README's sketch as canonical: `apps/chanora_flutter/`, `core/chanora_core/`, `crates/chanora_protocol/`, `crates/chanora_audio/`, `crates/chanora_state/`, `crates/chanora_storage/`, `crates/chanora_diagnostics/`, `crates/chanora_bridge/`. Matches SAD §7.2 module decomposition | Accepted | Software Architect | Unblocks product-crate scaffolding; was not formalised by any prior doc. |
|
||||
| DEC-023 | Windows desktop Global PTT priority | **P0 in MVP.** Resolves PTT-OPEN-001 from `gen2/chanora-desktop-ptt-review-summary-v0.9.2.md`. The Windows backend ladder (Raw Input → low-level keyboard hook → Focused fallback) is mandatory for the first public release; release notes shall not claim Global PTT support on Windows until live measurement confirms a Global level from a non-fallback rung. | Accepted | Product Owner + Windows Platform Owner | Sets the MVP commitment level for the most common desktop platform. |
|
||||
| DEC-024 | macOS desktop Global PTT priority | **P0 in MVP, with explicit permission UX flow.** Resolves PTT-OPEN-002. The macOS backend shall request the Input Monitoring / Accessibility permission, accept user denial gracefully (continue at `L0Focused` without functional regression), and upgrade to Global asynchronously when the user grants the permission. | Accepted | Product Owner + macOS Platform Owner | Forces the permission UX to ship with the rest of the macOS audio path rather than as a follow-up. |
|
||||
| DEC-025 | Officially-tested Linux environment for first public release | **GNOME on Wayland (only).** Resolves PTT-OPEN-003. The Linux backend shall use the freedesktop `org.freedesktop.portal.GlobalShortcuts` interface on GNOME-on-Wayland and fall back to Focused PTT on every other Linux environment (X11, sway, KDE, untested compositors). Release notes shall not claim Global PTT support outside the tested compositor. | Accepted | Product Owner + Linux Platform Owner | Bounds the verification matrix; honest claim on Linux. |
|
||||
| DEC-026 | Mouse side-button support in first desktop PTT release | **Supported on Windows and macOS; Linux follows whatever the GlobalShortcuts portal exposes.** Resolves PTT-OPEN-004. The Raw Input backend (Windows) and the Event Tap backend (macOS) shall accept Mouse4 / Mouse5 bindings; the Linux portal binding accepts whatever the session exposes and the release notes shall not over-claim. | Accepted | Product Owner + UX Owner | Common dedicated PTT input class; shipping in MVP avoids a follow-up. |
|
||||
| DEC-027 | PTT diagnostics privacy posture | **Capability and availability state only — no raw key codes ever leave the device.** Resolves PTT-OPEN-005. The diagnostic export shall name only `PttCapabilityLevel`, `backend_id`, `bound_input_class`, and `fallback_exercised`; the user's actual key value (scan code, virtual key, keysym) shall never be logged, persisted, or exported. `PttSanitizer` enforces this at write time. | Accepted | Security Reviewer + Privacy Reviewer | Closes a clear privacy risk that the gen2 review flagged; aligns with DEC-016. |
|
||||
| DEC-028 | Missed-key-up watchdog requirement | **P0.** Resolves PTT-OPEN-006. The audio engine shall include a missed-key-up watchdog that clears `transmit_active` after a configured ceiling (default 30 s) when no key-up event arrives. The watchdog is a P0 release-gate item rather than an implementation-level concern because the failure mode (stuck transmission after the user has released the binding) is user-visible and reputation-relevant. | Accepted | Audio Owner + Software Architect | Prevents stuck-PTT bug class regardless of platform-input quirks. |
|
||||
|
||||
## 4. Accepted MVP Defaults
|
||||
|
||||
@@ -141,6 +147,12 @@ release but is not an open decision:
|
||||
| DEC-020 | Product Owner / Legal | License model | Accepted (Apache-2.0 OR MIT dual-license) | 2026-05-14 | Compatible with every direct dependency; texts ship as LICENSE-APACHE / LICENSE-MIT. Full OSS legal review remains under DEC-012. |
|
||||
| DEC-021 | iOS Owner / Release Manager | Apple App Store SDK gate | Accepted | 2026-05-14 | Xcode 26+ / iOS 26 SDK+ on or after 2026-04-28. |
|
||||
| DEC-022 | Software Architect | Canonical implementation directory layout | Accepted (README sketch) | 2026-05-13 | Closes the absence flagged during PoC review. |
|
||||
| DEC-023 | Product Owner / Windows Platform Owner | Windows desktop Global PTT priority | Accepted (P0 / MVP) | 2026-05-15 | Resolves PTT-OPEN-001 from the gen2 desktop-PTT review. |
|
||||
| DEC-024 | Product Owner / macOS Platform Owner | macOS desktop Global PTT priority | Accepted (P0 / MVP, permission-UX required) | 2026-05-15 | Resolves PTT-OPEN-002. |
|
||||
| DEC-025 | Product Owner / Linux Platform Owner | Officially-tested Linux environment | Accepted (GNOME on Wayland only) | 2026-05-15 | Resolves PTT-OPEN-003. |
|
||||
| DEC-026 | Product Owner / UX Owner | Mouse side-button support | Accepted (Windows + macOS; Linux portal-dependent) | 2026-05-15 | Resolves PTT-OPEN-004. |
|
||||
| DEC-027 | Security / Privacy Reviewer | PTT diagnostics privacy posture | Accepted (capability + availability only, no key codes) | 2026-05-15 | Resolves PTT-OPEN-005. |
|
||||
| DEC-028 | Audio Owner / Software Architect | Missed-key-up watchdog | Accepted (P0) | 2026-05-15 | Resolves PTT-OPEN-006. |
|
||||
|
||||
## 8. Change History
|
||||
|
||||
@@ -197,3 +209,4 @@ release but is not an open decision:
|
||||
|---|---|---|
|
||||
| 0.9.7 | 2026-05-14 | DEC-001 release-sequence progress recorded: Internal Alpha (`v0.1.0-alpha.1`, commit 3bb038c) completed on 2026-05-14; **Internal Beta first build (`v0.2.0-beta.1`)** reached the same day. Beta milestone adds voice in/out: `crates/chanora_audio` promoted from scaffold to a cpal-based capture + playback engine with `audiopus` Opus encoding and tsclientlib `AudioHandler` for decode + jitter buffer + mix; `crates/chanora_protocol` extended to forward inbound voice packets and accept outbound `OutPacket`s via mpsc channels; `core/chanora_core::ChanoraSession` exposes `start_audio`, `set_ptt`, and `audio_stats`; `crates/chanora_bridge` adds matching DTOs; the Flutter UI gains a "Start audio" action and a hold-to-talk PTT button with live frame counters. Verified end-to-end against `cn.teamspeak.app`; capture runs in graceful playback-only mode on hosts with no usable microphone (e.g. the PipeWire `auto_null` source on the verification host). No decision rows change; this entry documents progress against DEC-001 only. |
|
||||
| 0.9.8 | 2026-05-15 | DEC-001 release-sequence progress recorded for the polished Internal Beta and the External Beta milestones, plus the first MVP-public release candidate. **`v0.3.0-beta.1`** ("Internal Beta polish") added the supervisor + reconnect-with-watchdog path (A.6), OS-connectivity-aware backoff (A.6.1), persistent identity at rest as a plain 0600 file (A.2), the redacted in-memory log sink + user-initiated diagnostic export per DEC-016 (A.3), the `SnapshotChanged` lifecycle event for UI auto-refresh (A.4), and the `mobile_voice_preset` config-surface plumb-through (A.5). **`v0.4.0-beta.2`** ("External Beta") added the server-password input, channel join via tap, self mute (input + output), master output gain, SQLite-backed bookmark list, ChaCha20-Poly1305 encryption of the identity at rest with the DEK in a separate `identity.dek` file, Android `AudioManager.setMode(MODE_IN_COMMUNICATION)` routing engagement via JNI, and the `.github/workflows/ci.yml` pipeline. **`v1.0.0-rc.1`** ("MVP Public release candidate") closes the v0.4 DEK-on-disk weakness on every keyring-reachable platform: `chanora_storage::IdentityFileStore` now stores the DEK in the OS keyring (Linux Secret Service via D-Bus / macOS Keychain / Windows Credential Manager / iOS Keychain via the `keyring` crate) and migrates pre-existing file-fallback installs into the keyring opportunistically; bookmark server passwords are ChaCha20-Poly1305-encrypted under the same per-install DEK and the legacy plain `password TEXT` column is upgraded into a new `password_blob BLOB` column on the next `update()`; `SessionEvent::SnapshotChanged` now fires on any tree mutation (the in-channel-move blind spot from A.4 is closed); the in-app About dialog surfaces DEC-018 / DEC-019 / DEC-020. New `docs/governance/legal-review-readiness.md` carries the DEC-012 handoff package (trademark check, non-affiliation wording, third-party license posture, `cargo about` deliverables, `cargo deny` lifelines); new `docs/governance/staged-release-plan.md` enumerates the DEC-002 platform staging (Linux + Android sideload GA on DEC-012 sign-off; Windows, macOS, iOS gate on per-platform signed-build availability). No decision rows change; DEC-012 remains the sole outstanding release gate. |
|
||||
| 0.9.9 | 2026-05-15 | Recorded six new accepted decisions DEC-023 through DEC-028 closing the gen2 desktop-PTT review's open questions PTT-OPEN-001 through PTT-OPEN-006: Windows Global PTT is P0/MVP (DEC-023), macOS Global PTT is P0/MVP with permission UX (DEC-024), the officially-tested Linux environment is GNOME-on-Wayland only (DEC-025), mouse side buttons are supported on Windows + macOS and Linux follows the portal (DEC-026), PTT diagnostics carry capability/availability only with no raw key codes (DEC-027), and the missed-key-up watchdog is a P0 release-gate requirement (DEC-028). No prior decision rows are mutated. |
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
# Repo Documentation Format Validation Report
|
||||
|
||||
**Document type:** Configuration / Validation Report
|
||||
**Version:** 0.9.2
|
||||
**Version:** 0.9.3
|
||||
**Status:** Baseline Candidate
|
||||
**Language:** English
|
||||
**Product:** Chanora
|
||||
@@ -12,14 +12,14 @@
|
||||
## 1. Package
|
||||
|
||||
```text
|
||||
chanora-docs-repo-format-v0.9.2.zip
|
||||
chanora-docs-repo-format-v0.9.3
|
||||
```
|
||||
|
||||
## 2. File Count
|
||||
|
||||
| Type | Count |
|
||||
|---|---:|
|
||||
| Markdown files under docs/ | 37 |
|
||||
| Markdown files under docs/ | 38 (added `docs/architecture/desktop-ptt-architecture.md`) |
|
||||
| README files | 1 |
|
||||
|
||||
## 3. Naming Check
|
||||
@@ -28,17 +28,17 @@ chanora-docs-repo-format-v0.9.2.zip
|
||||
|---|---:|
|
||||
| Old `CHANORA_*_v*.md` filename references outside migration map | 0 |
|
||||
| Old `CHANORA_*_v*.zip` package references outside migration map | 0 |
|
||||
| CJK characters found | 0 |
|
||||
| CJK characters in en-only doc set | 0 |
|
||||
|
||||
## 4. Defined ID Counts
|
||||
|
||||
| ID family | Defined IDs |
|
||||
|---|---:|
|
||||
| SysRS | 295 |
|
||||
| SysDes | 141 |
|
||||
| SRS | 194 |
|
||||
| SAD | 70 |
|
||||
| SDD | 80 |
|
||||
| SysRS | 302 |
|
||||
| SysDes | 148 |
|
||||
| SRS | 203 |
|
||||
| SAD | 79 |
|
||||
| SDD | 92 |
|
||||
|
||||
## 5. Undefined Reference Check
|
||||
|
||||
@@ -73,3 +73,4 @@ chanora-docs-repo-format-v0.9.2.zip
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.2 | 2026-05-14 | Validated repository-format documentation package and internal filename reference updates. |
|
||||
| 0.9.3 | 2026-05-15 | Re-validated repository-format after desktop PTT update: added `docs/architecture/desktop-ptt-architecture.md`; ID totals advance to 302 / 148 / 203 / 79 / 92; naming, undefined-reference, and direct-layer-rule counts remain at zero. |
|
||||
|
||||
@@ -188,3 +188,43 @@ This build-SDK gate is separate from the iOS runtime deployment target.
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.2 | 2026-05-14 | Corrected Apple App Store Connect upload gate to 2026-04-28 and checked full-package naming, references, and coverage. |
|
||||
|
||||
|
||||
## Desktop Push-to-Talk Traceability Addendum (Baseline Candidate 0.9.3)
|
||||
|
||||
Strict layered sourcing for the desktop PTT chain:
|
||||
|
||||
```text
|
||||
SysRS-296..302
|
||||
-> SysDes-142..148
|
||||
-> SRS-195..203
|
||||
-> SAD-071..079
|
||||
-> SDD-081..092
|
||||
```
|
||||
|
||||
| SysRS | SysDes | SRS | SAD | SDD |
|
||||
|---|---|---|---|---|
|
||||
| SysRS-296 (Focused PTT mandatory) | SysDes-142, SysDes-144 | SRS-201 | SAD-075 | SDD-089 |
|
||||
| SysRS-297 (Global PTT capability-dependent) | SysDes-142 | SRS-195 | SAD-071 | SDD-081 |
|
||||
| SysRS-298 (Capability exposed) | SysDes-143, SysDes-147, SysDes-148 | SRS-196 | SAD-076, SAD-078 | SDD-082, SDD-088, SDD-091 |
|
||||
| SysRS-299 (Windows ladder) | SysDes-145 | SRS-197 | SAD-072 | SDD-083, SDD-084 |
|
||||
| SysRS-300 (macOS permission-aware) | SysDes-145 | SRS-198 | SAD-073 | SDD-085 |
|
||||
| SysRS-301 (Linux GNOME-Wayland) | SysDes-145 | SRS-199 | SAD-074 | SDD-086 |
|
||||
| SysRS-302 (No raw key history) | SysDes-146 | SRS-202 | SAD-077 | SDD-090 |
|
||||
| (DEC-026 mouse buttons) | SysDes-142, SysDes-145 | SRS-200 | SAD-072..074 | SDD-082..086 |
|
||||
| (DEC-028 missed-key-up watchdog) | SysDes-142, SysDes-144 | SRS-203 | SAD-079 | SDD-092 |
|
||||
|
||||
Verification coverage:
|
||||
|
||||
```text
|
||||
SDD-081..092 -> SWE4-UV-035..039
|
||||
SAD-071..079 + SDD-081..092 -> SWE5-IV-015
|
||||
SRS-195..203 -> SWE6-SV-017
|
||||
SysDes-142..148 -> SYS4-SIV-016
|
||||
```
|
||||
|
||||
No forbidden direct links introduced: SRS continues to source from SysDes only, SAD from SRS only, SDD from SAD only.
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.3 | 2026-05-15 | Added desktop PTT traceability rows covering SysRS-296..302 -> SysDes-142..148 -> SRS-195..203 -> SAD-071..079 -> SDD-081..092 and the verification coverage onto SWE.4 / SWE.5 / SWE.6 / SYS.4. |
|
||||
|
||||
@@ -106,3 +106,17 @@ TBD.
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.2 | 2026-05-14 | Corrected Apple App Store Connect upload gate to 2026-04-28 and checked full-package naming, references, and coverage. |
|
||||
|
||||
|
||||
## Desktop Push-to-Talk Privacy Addendum (Baseline Candidate 0.9.3)
|
||||
|
||||
Per SysRS-302 / SRS-202 / DEC-027, the Chanora desktop PTT subsystem operates under the following privacy rule:
|
||||
|
||||
- Chanora shall not log, persist, or transmit raw keyboard key codes, scan codes, virtual-key values, keysyms, or key-press timing sequences.
|
||||
- The user-initiated diagnostic export shall include only the detected PTT capability level (`L0Focused`, `L1GlobalShortcut`, `L2GlobalHoldToTalk`, `L3GlobalWithMouseButtons`, or the reserved `L4DeviceAware`), the active backend identifier (a fixed string per implementation, for example `"raw-input"`, `"event-tap"`, `"gnome-wayland-portal"`, `"focused"`), and the bound input class (`"keyboard"`, `"mouse-side-button"`).
|
||||
- The bound key value itself is never included in any diagnostic, even when the user invokes the export explicitly.
|
||||
- Whether Global PTT is available depends on the operating system, the user-granted permission set, the display server, and the available input backend. Where Global PTT cannot be honoured, Chanora falls back to Focused PTT and reports the fallback honestly through the UI capability badge.
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.3 | 2026-05-15 | Added desktop Push-to-Talk privacy addendum: raw key history is not recorded or exported; Global PTT is capability-dependent and the UI reflects actual runtime capability. |
|
||||
|
||||
@@ -110,3 +110,19 @@
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.2 | 2026-05-14 | Corrected Apple App Store Connect upload gate to 2026-04-28 and checked full-package naming, references, and coverage. |
|
||||
|
||||
|
||||
## Desktop Push-to-Talk Reference Addendum (Baseline Candidate 0.9.3)
|
||||
|
||||
| Area | Reference (informative) |
|
||||
|---|---|
|
||||
| Windows input APIs | Microsoft Windows Raw Input documentation (`RegisterRawInputDevices`, `WM_INPUT`); Windows low-level keyboard / mouse hook documentation (`WH_KEYBOARD_LL`, `WH_MOUSE_LL`). |
|
||||
| macOS event tap | Apple Core Graphics event-tap documentation (`CGEventTapCreate`, `kCGEventTapDisabledByTimeout`); IOKit `IOHIDCheckAccess` for permission state. |
|
||||
| Linux Wayland global shortcuts | freedesktop.org XDG portal documentation for the `org.freedesktop.portal.GlobalShortcuts` interface. |
|
||||
| Permission-aware input on macOS | Apple privacy / TCC documentation for Input Monitoring and Accessibility entitlements. |
|
||||
|
||||
Reviewers should consult the current upstream version of each reference because OS surfaces change over time; the references above identify the relevant area rather than pinning a specific version.
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.3 | 2026-05-15 | Added desktop-PTT external references covering Windows Raw Input + hook documentation, macOS event-tap + IOHIDCheckAccess, Linux GlobalShortcuts portal, and macOS Input Monitoring / Accessibility entitlements. |
|
||||
|
||||
@@ -61,3 +61,23 @@ The Go/No-Go record shall record:
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.2 | 2026-05-14 | Corrected Apple App Store Connect upload gate to 2026-04-28 and checked full-package naming, references, and coverage. |
|
||||
|
||||
|
||||
## Desktop Push-to-Talk Release Policy Addendum (Baseline Candidate 0.9.3)
|
||||
|
||||
Per SysDes-148 the release readiness record shall carry, for every desktop release artefact, the following per-platform evidence:
|
||||
|
||||
| Field | Source | Acceptance |
|
||||
|---|---|---|
|
||||
| Detected `PttCapabilityLevel` | Live runtime measurement on the verification host. | Must equal the level the release notes claim. |
|
||||
| Active backend identifier | `DesktopPttBackend::backend_id()` reported by the live measurement. | Must equal the backend the release notes claim. |
|
||||
| Focused fallback exercised | Manual verification step. | Must record "yes" with a re-measurement of the same backend identifier after the user revokes the relevant permission / blocks the relevant input path. |
|
||||
| Capability badge UI | Screenshot or platform-test trace. | Must match the runtime capability. |
|
||||
|
||||
Release notes shall not claim Global PTT support on a platform when the live measurement returned `L0Focused`. Release notes shall not claim mouse-side-button support on a platform when the live measurement did not include a side-button binding (per DEC-026 the Linux portal may not expose side-button bindings on every session).
|
||||
|
||||
Per DEC-025 the only officially-tested Linux environment for the first public release is GNOME on Wayland. Other Linux environments are supported at the `L0Focused` capability only; the release notes shall not claim Global PTT support outside the tested compositor.
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.3 | 2026-05-15 | Added desktop PTT release-policy evidence requirements: per-platform capability level + backend identifier + fallback-exercised + capability badge UI screenshot must be recorded before release notes may claim Global PTT support. |
|
||||
|
||||
@@ -208,3 +208,25 @@ Design documents alone do not authorize release. A release requires an explicit
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.2 | 2026-05-14 | Corrected Apple App Store Connect upload gate to 2026-04-28 and checked full-package naming, references, and coverage. |
|
||||
|
||||
|
||||
## Desktop Push-to-Talk Release Readiness Addendum (Baseline Candidate 0.9.3)
|
||||
|
||||
The release readiness checklist for every desktop release artefact gains the following items per SysDes-148, SysRS-298, and DEC-023 / DEC-024 / DEC-025 / DEC-026 / DEC-027 / DEC-028.
|
||||
|
||||
| Item | Owner | Evidence required | Status |
|
||||
|---|---|---|---|
|
||||
| RR-PTT-001 Windows Global PTT verified on a Windows reference host. | Windows Platform Owner | Live measurement of `PttCapabilityLevel` + `backend_id` returned at runtime. Backend identifier shall be `raw-input` (preferred) or `low-level-hook` (fallback) for Global. | Open |
|
||||
| RR-PTT-002 macOS Global PTT verified with permission granted on a macOS reference host. | macOS Platform Owner | Live measurement + `permission_state = Granted` reported through the Event-Tap backend; UI capability badge screenshot. | Open |
|
||||
| RR-PTT-003 macOS Focused PTT fallback verified with permission denied. | macOS Platform Owner | Live measurement of `PttCapabilityLevel::L0Focused` after revoking Input Monitoring; UI capability badge screenshot showing the fallback notice. | Open |
|
||||
| RR-PTT-004 Linux Global PTT verified on GNOME-on-Wayland. | Linux Platform Owner | Live measurement returning `gnome-wayland-portal` backend identifier from a live GNOME-on-Wayland host; portal binding dialog screenshot. | Open |
|
||||
| RR-PTT-005 Linux Focused fallback verified on a non-tested compositor (any of: X11, sway, KDE) | Linux Platform Owner | Live measurement of `L0Focused` on at least one non-tested compositor; release notes do not claim Global support on the untested environment. | Open |
|
||||
| RR-PTT-006 Diagnostic export carries no key data. | Privacy Reviewer | Inspection of a user-initiated diagnostic export captured while PTT is bound to a real key; export shall contain `capability_level`, `backend_id`, `bound_input_class` and shall not contain a recognisable key code. | Open |
|
||||
| RR-PTT-007 Missed-key-up watchdog timeout demonstrated. | Audio Owner | Test trace showing `transmit_active` clearing after the configured 30 s ceiling when the watchdog forces a release. | Open |
|
||||
| RR-PTT-008 Capability badge matches runtime capability on every supported platform. | UX Owner | UI screenshot or platform-test trace. | Open |
|
||||
|
||||
A release decision shall be **No-Go** for any platform whose RR-PTT items are not all closed.
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.3 | 2026-05-15 | Added desktop PTT release-readiness items RR-PTT-001 through RR-PTT-008 covering Windows / macOS / Linux Global verification, permission-denied fallback verification, diagnostic-export privacy inspection, missed-key-up watchdog test, and capability-badge UI verification. |
|
||||
|
||||
@@ -2506,12 +2506,94 @@ This section extends the ASPICE SWE.1 Software Requirements Specification. The s
|
||||
- Source SysDes: SysDes-141
|
||||
- Verification method: Privacy Review, Security Audit
|
||||
|
||||
**SRS-195**: The software shall expose a `DesktopPttBackend` trait owned by the audio subsystem, with one implementation per supported desktop platform (Windows, macOS, Linux/GNOME-Wayland) and a `FocusedPttBackend` implementation used as the universal terminal fallback. The selected backend shall be discoverable at runtime and shall report its identifier through the diagnostics sanitizer.
|
||||
|
||||
- Status: Baseline Candidate
|
||||
- Type: Software Interface Requirement
|
||||
- Stage: P0 / MVP
|
||||
- Allocated to: Audio, Platform Input
|
||||
- Source SysDes: SysDes-142, SysDes-145
|
||||
- Verification method: Architecture Review, Unit Test
|
||||
|
||||
**SRS-196**: The software shall publish a `PttCapabilityLevel` enum value (`L0` Focused, `L1` Global-shortcut-activation, `L2` Global-hold-to-talk, `L3` Global-with-mouse-buttons, `L4` Device-aware) from the active backend, and the value shall match the actual runtime capability rather than the platform's theoretical maximum.
|
||||
|
||||
- Status: Baseline Candidate
|
||||
- Type: Software Behavioural Requirement
|
||||
- Stage: P0 / MVP
|
||||
- Allocated to: Audio, Rust Core
|
||||
- Source SysDes: SysDes-143
|
||||
- Verification method: Unit Test, Integration Test
|
||||
|
||||
**SRS-197**: The Windows desktop backend shall attempt Raw Input first; if Raw Input is unavailable or initialisation fails, it shall attempt a low-level keyboard hook; if that also fails it shall return `PttCapabilityLevel::L0` and engage Focused PTT. The selected sub-strategy shall be recorded as the backend identifier for diagnostics and release verification.
|
||||
|
||||
- Status: Baseline Candidate
|
||||
- Type: Platform Behavioural Requirement
|
||||
- Stage: P0 / MVP
|
||||
- Allocated to: Audio (Windows)
|
||||
- Source SysDes: SysDes-145
|
||||
- Verification method: Platform Test (Windows), Unit Test
|
||||
|
||||
**SRS-198**: The macOS desktop backend shall query the operating-system Input Monitoring / Accessibility permission state, return `PttCapabilityLevel::L0` while the permission is undecided or denied, and upgrade to the appropriate Global level only after the user grants the required permission. The user shall be able to dismiss the permission prompt and continue using Focused PTT without functional regression.
|
||||
|
||||
- Status: Baseline Candidate
|
||||
- Type: Platform Behavioural Requirement
|
||||
- Stage: P0 / MVP
|
||||
- Allocated to: Audio (macOS)
|
||||
- Source SysDes: SysDes-145
|
||||
- Verification method: Platform Test (macOS), User Acceptance Test
|
||||
|
||||
**SRS-199**: The Linux desktop backend shall probe the active display server and compositor at runtime. On GNOME-on-Wayland (the officially-tested target per DEC-026), the backend shall use the freedesktop GlobalShortcuts portal. On any other Linux environment the backend shall return `PttCapabilityLevel::L0` and engage Focused PTT.
|
||||
|
||||
- Status: Baseline Candidate
|
||||
- Type: Platform Behavioural Requirement
|
||||
- Stage: P0 / MVP
|
||||
- Allocated to: Audio (Linux)
|
||||
- Source SysDes: SysDes-145
|
||||
- Verification method: Platform Test (Linux, GNOME Wayland), Unit Test
|
||||
|
||||
**SRS-200**: The software shall support mouse side buttons (typically labelled Mouse4 / Mouse5 or "back" / "forward") as bindable inputs for Global PTT on the Windows and macOS backends per DEC-027. The Linux GlobalShortcuts portal binding shall accept whatever input classes the portal exposes for the current session; missing mouse-button support shall not block release.
|
||||
|
||||
- Status: Baseline Candidate
|
||||
- Type: Platform Behavioural Requirement
|
||||
- Stage: P0 / MVP
|
||||
- Allocated to: Audio (Windows/macOS/Linux)
|
||||
- Source SysDes: SysDes-142, SysDes-145
|
||||
- Verification method: Platform Test, User Acceptance Test
|
||||
|
||||
**SRS-201**: The audio engine shall expose `capture_active` and `transmit_active` as independent atomic states. `capture_active` shall reflect the input-stream lifecycle and the platform input-permission state; `transmit_active` shall reflect the PTT subsystem's decision and shall be the only gate on outbound Opus frame emission.
|
||||
|
||||
- Status: Baseline Candidate
|
||||
- Type: Software Interface Requirement
|
||||
- Stage: P0 / MVP
|
||||
- Allocated to: Audio
|
||||
- Source SysDes: SysDes-144
|
||||
- Verification method: Unit Test, Integration Test
|
||||
|
||||
**SRS-202**: The diagnostics subsystem shall reject any log record carrying a raw key code, scan code, virtual-key value, or key-press timing sequence. The diagnostic export shall include the active `PttCapabilityLevel`, the active backend identifier, and the bound input class (for example "keyboard", "mouse-side-button") but shall never include the specific key value of any user binding.
|
||||
|
||||
- Status: Baseline Candidate
|
||||
- Type: Software Privacy Requirement
|
||||
- Stage: P0 / MVP
|
||||
- Allocated to: Diagnostics, Audio
|
||||
- Source SysDes: SysDes-146
|
||||
- Verification method: Privacy Review, Unit Test, Diagnostic Inspection
|
||||
|
||||
**SRS-203**: The software shall implement a missed-key-up watchdog per DEC-028: if `transmit_active` has been true for longer than a configured upper bound without a corresponding release event (for example because the OS suppressed the key-up while the application was minimised), the watchdog shall force `transmit_active` to false and emit a sanitised diagnostic record naming only the capability level and backend identifier.
|
||||
|
||||
- Status: Baseline Candidate
|
||||
- Type: Software Safety Requirement
|
||||
- Stage: P0 / MVP
|
||||
- Allocated to: Audio
|
||||
- Source SysDes: SysDes-142, SysDes-144
|
||||
- Verification method: Unit Test, Integration Test
|
||||
|
||||
## 17. Updated SRS to SysDes Coverage Statement
|
||||
|
||||
| SysDes Range | SRS Coverage |
|
||||
|---|---|
|
||||
| SysDes-001 through SysDes-132 | Covered by inherited SRS baseline `SRS-001` through `SRS-184` |
|
||||
| SysDes-133 through SysDes-141 | Covered by `SRS-185` through `SRS-194` |
|
||||
| SysDes-142 through SysDes-148 | Covered by `SRS-195` through `SRS-203` |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.1 Update
|
||||
@@ -2526,3 +2608,10 @@ This section extends the ASPICE SWE.1 Software Requirements Specification. The s
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.2 | 2026-05-14 | Corrected Apple App Store Connect upload gate effective date and preserved SRS direct-source rule through SysDes only. |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.3 Update
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.3 | 2026-05-15 | Added desktop PTT software requirements SRS-195 through SRS-203: `DesktopPttBackend` trait + per-platform implementations, `PttCapabilityLevel` enum, Windows Raw-Input ladder, macOS permission-aware backend, Linux GNOME-Wayland GlobalShortcuts portal backend, mouse-side-button support per DEC-027, `capture_active` / `transmit_active` split, sanitised diagnostics, missed-key-up watchdog per DEC-028. Sourcing remains strict (`SRS -> SysDes` only). |
|
||||
|
||||
@@ -1889,6 +1889,41 @@ This section converts the baseline product decisions into auditable system-level
|
||||
- Priority: P0
|
||||
- Verification: Privacy Review, Security Audit
|
||||
|
||||
**SysRS-296**: The Chanora desktop application shall support **Focused Push-to-Talk** on Windows, macOS, and Linux. Focused PTT is the minimum required behaviour: the user shall be able to hold a bound input (keyboard key, mouse button) inside the focused Chanora window to enable voice transmission, and release of that input shall disable voice transmission.
|
||||
|
||||
- Priority: P0
|
||||
- Verification: Platform Test, User Acceptance Test
|
||||
|
||||
**SysRS-297**: The Chanora desktop application shall additionally support **Global Push-to-Talk** where the operating system, the user-granted permission set, the display server, and the available input backend together permit it. Where global PTT is not available, the application shall fall back to Focused PTT without claiming Global PTT support.
|
||||
|
||||
- Priority: P0
|
||||
- Verification: Platform Test, Architecture Review
|
||||
|
||||
**SysRS-298**: The detected desktop PTT capability level shall be exposed to the user interface and to the release verification record. The exposed value shall match the actual runtime capability — the application shall not advertise a Global PTT level when the active backend is the Focused fallback.
|
||||
|
||||
- Priority: P0
|
||||
- Verification: Integration Test, Release Inspection
|
||||
|
||||
**SysRS-299**: The Chanora Windows desktop application shall prefer the Raw Input backend for Global PTT, with a low-level keyboard hook used only as a fallback when Raw Input is unavailable, and Focused PTT used as the final fallback when no Global PTT backend can be initialised.
|
||||
|
||||
- Priority: P0
|
||||
- Verification: Platform Test (Windows), Architecture Review
|
||||
|
||||
**SysRS-300**: The Chanora macOS desktop application shall request the operating-system permission required for Global PTT (Input Monitoring / Accessibility), use the permission-aware Global PTT backend when the permission is granted, and fall back to Focused PTT when the permission is denied, revoked, or not yet decided. The application shall not block voice functionality while the user decides on the permission prompt.
|
||||
|
||||
- Priority: P0
|
||||
- Verification: Platform Test (macOS), User Acceptance Test
|
||||
|
||||
**SysRS-301**: The Chanora Linux desktop application shall use a capability-dependent Global PTT backend selected from the available display server (X11 or Wayland) and compositor support (GNOME on Wayland is the officially-tested target for the first public release per DEC-026; other compositors fall back to Focused PTT). The application shall not claim Global PTT support on an untested Linux environment.
|
||||
|
||||
- Priority: P0
|
||||
- Verification: Platform Test (Linux, GNOME Wayland), Architecture Review
|
||||
|
||||
**SysRS-302**: The Chanora application system shall not log, store, persist, or include in the user-initiated diagnostic export any raw desktop key-event history, key code stream, or key-press timing sequence. Diagnostic export may include the detected PTT capability level, the active backend identifier, and the bound input class (for example "keyboard", "mouse-side-button"), but shall not include the specific key code, scan code, or virtual-key value of any user binding.
|
||||
|
||||
- Priority: P0
|
||||
- Verification: Privacy Review, Security Audit, Diagnostic Inspection
|
||||
|
||||
|
||||
## 32. Change History Addendum
|
||||
|
||||
@@ -1902,3 +1937,9 @@ This section converts the baseline product decisions into auditable system-level
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.2 | 2026-05-14 | Corrected Apple App Store Connect upload gate effective date to 2026-04-28 and propagated distinction between runtime deployment target and build-SDK upload gate. |
|
||||
|
||||
## Baseline Candidate 0.9.3 Update
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.3 | 2026-05-15 | Added desktop Push-to-Talk requirements SysRS-296 through SysRS-302: mandatory Focused PTT on Windows/macOS/Linux, capability-dependent Global PTT, capability-level exposure to UI and release record, Windows Raw Input + low-level-hook + Focused fallback ladder, macOS permission-aware Global PTT, Linux capability-dependent Global PTT (GNOME on Wayland officially-tested per DEC-026), and the privacy rule prohibiting raw key-event history in logs and diagnostic exports. Owner-resolved gen2 review questions PTT-OPEN-001..006 land as DEC-023..028 in the product decision register. |
|
||||
|
||||
@@ -110,3 +110,25 @@ This report records evidence that Chanora logs and diagnostic exports do not lea
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.3 | 2026-05-14 | Recorded PoC empirical evidence: REDACT-TC-001..010 status set to PoC Pass with evidence pointers to `poc/diagnostics-redaction-spike/tests/redaction.rs`. Export bundle policy §5 populated for every row. Findings REDACT-FIND-001..003 added (regex coverage limits, tracing-layer integration gap, KnownSecretRegistry cross-spike contract). |
|
||||
|
||||
|
||||
## Desktop Push-to-Talk Redaction Addendum (Baseline Candidate 0.9.3)
|
||||
|
||||
Per SysRS-302 / SRS-202 / SAD-077 / SDD-090, the redaction policy adds the following rules for desktop PTT diagnostics:
|
||||
|
||||
| Rule | Banned field name | Disposition |
|
||||
|---|---|---|
|
||||
| REDACT-PTT-001 | `key_code` | Drop record. |
|
||||
| REDACT-PTT-002 | `scan_code` | Drop record. |
|
||||
| REDACT-PTT-003 | `virtual_key`, `vk` | Drop record. |
|
||||
| REDACT-PTT-004 | `keysym`, `keysym_string` | Drop record. |
|
||||
| REDACT-PTT-005 | `key_sequence`, `key_press_history`, `key_timing` | Drop record. |
|
||||
| REDACT-PTT-006 | Free-form `message` strings shall not embed key values; offending records shall be reformatted by the originating backend before emission. | Drop record. |
|
||||
|
||||
The `PttSanitizer` `tracing_subscriber::Layer` decorates `RedactingLogLayer` and is the enforcement point. Fields whose names match the banned list cause the entire record to be dropped — Chanora does not attempt to redact-in-place because partial-redaction false negatives are riskier than a missing line.
|
||||
|
||||
Permitted fields for PTT diagnostics: `capability_level`, `backend_id`, `bound_input_class`, `fallback_exercised`.
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.3 | 2026-05-15 | Added desktop PTT redaction rules REDACT-PTT-001..006: ban raw key codes, scan codes, virtual-key values, keysyms, and key timing sequences from logs and exports. |
|
||||
|
||||
@@ -136,3 +136,19 @@ Out of scope unless later added:
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.2 | 2026-05-14 | Corrected Apple App Store Connect upload gate to 2026-04-28 and checked full-package naming, references, and coverage. |
|
||||
|
||||
|
||||
## Desktop Push-to-Talk Threat Addendum (Baseline Candidate 0.9.3)
|
||||
|
||||
| ID | Threat | Asset | Likelihood | Impact | Mitigation |
|
||||
|---|---|---|---|---|---|
|
||||
| THREAT-PTT-001 | A desktop PTT backend logs raw key codes or scan codes to the in-memory log sink. | User keystroke privacy | Medium (without controls) | High | `PttSanitizer` per SAD-077 / SDD-090 drops records with banned field names before they reach any sink; backend implementations call `AudioTransmitGate::set` only and never log key data. |
|
||||
| THREAT-PTT-002 | A desktop PTT backend leaks raw key codes through the user-initiated diagnostic export. | User keystroke privacy | Medium | High | Diagnostic export carries only the capability level, backend identifier, and bound input class per SRS-202 / DEC-027. |
|
||||
| THREAT-PTT-003 | The application advertises Global PTT support on a platform / permission / environment where it does not actually work. | Honest release claim | Medium | Medium (UX regression, support load) | `PttCapabilityLevel` is published from the *active* backend only; the UI capability badge reflects runtime measurement (SRS-196 / SysRS-298). Release readiness record carries per-platform evidence per SysDes-148. |
|
||||
| THREAT-PTT-004 | A missed key-up event leaves `transmit_active` true after the user releases the binding (for example because the OS suppressed the event while Chanora was minimised). | Voice transmission integrity, user expectation of mute | Medium | Medium | `MissedKeyUpWatchdog` per SAD-079 / SDD-092 self-clears `transmit_active` after a configured timeout (default 30 s); the watchdog timeout is a P0 requirement per DEC-028. |
|
||||
| THREAT-PTT-005 | A malicious or buggy third-party application registers a global hook that intercepts Chanora's binding and forces PTT on. | Voice transmission integrity | Low | Medium (user can mitigate by switching binding) | Out of MVP scope; documented as a deferred risk. Chanora reports the active backend identifier so a support investigation can correlate. |
|
||||
| THREAT-PTT-006 | macOS Input-Monitoring / Accessibility permission is revoked at runtime; the application continues to claim Global PTT. | Honest capability state | Low | Medium | `MacOSEventTapBackend` re-queries the permission state on each tap-disabled callback and downgrades to `L0Focused` via `BridgeEvent::PttCapability`. |
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.3 | 2026-05-15 | Added desktop PTT threats THREAT-PTT-001..006: raw key logging, key data in diagnostic export, capability over-claim, missed key-up, third-party hook interference, and macOS permission revocation. |
|
||||
|
||||
@@ -356,9 +356,45 @@ Unit verification results shall be summarized in a unit verification summary rep
|
||||
- Pass criteria: Non-secret storage, secret storage, typed bridge DTOs, and disabled automatic upload/crash behavior match detailed design.
|
||||
- Evidence: Test result, security review
|
||||
|
||||
**SWE4-UV-035**: Verify `DesktopPttBackend` trait + `PttCapabilityLevel` enum + `FocusedPttBackend` units.
|
||||
|
||||
- Source SDD: SDD-081, SDD-082, SDD-087
|
||||
- Verification method: Unit test
|
||||
- Pass criteria: Trait surface compiles for every implementation; enum `as_str()` mapping is unambiguous; `FocusedPttBackend` reports `L0Focused` and forwards `set_ptt` events into `AudioTransmitGate` unchanged.
|
||||
- Evidence: Test result
|
||||
|
||||
**SWE4-UV-036**: Verify Windows / macOS / Linux platform backend units in isolation.
|
||||
|
||||
- Source SDD: SDD-083, SDD-084, SDD-085, SDD-086
|
||||
- Verification method: Unit test (with mocked OS surfaces), Platform Test (Windows / macOS / GNOME-Wayland reference hosts)
|
||||
- Pass criteria: Each backend reports the expected `PttCapabilityLevel` for the current host configuration; the ladder falls through to `FocusedPttBackend` when its preferred OS API is unavailable.
|
||||
- Evidence: Test result, platform-test trace
|
||||
|
||||
**SWE4-UV-037**: Verify `PttController` + `AudioTransmitGate` units.
|
||||
|
||||
- Source SDD: SDD-088, SDD-089
|
||||
- Verification method: Unit test
|
||||
- Pass criteria: `PttController::set_binding` rebinds the active backend without dropping `AudioTransmitGate`; `AudioTransmitGate::subscribe()` returns a `watch::Receiver` that delivers every transition the gate observes.
|
||||
- Evidence: Test result
|
||||
|
||||
**SWE4-UV-038**: Verify `PttSanitizer` and `PttCapabilityBadge` units.
|
||||
|
||||
- Source SDD: SDD-090, SDD-091
|
||||
- Verification method: Unit test, UI review
|
||||
- Pass criteria: `PttSanitizer` drops records whose field names match the banned list (`key_code`, `scan_code`, `virtual_key`, `vk`, `keysym`, `keysym_string`, `key_sequence`); `PttCapabilityBadge` renders the correct label and explanation sheet for each `PttCapabilityLevel`.
|
||||
- Evidence: Test result, UI screenshot
|
||||
|
||||
**SWE4-UV-039**: Verify `MissedKeyUpWatchdog` unit.
|
||||
|
||||
- Source SDD: SDD-092
|
||||
- Verification method: Unit test (tokio time-paused)
|
||||
- Pass criteria: After a simulated `false -> true -> (timeout elapsed)` sequence the watchdog calls `AudioTransmitGate::set(false)` exactly once and emits a sanitised diagnostic record naming only `capability_level` and `backend_id`.
|
||||
- Evidence: Test result
|
||||
|
||||
| SDD Range | SWE.4 Coverage |
|
||||
|---|---|
|
||||
| SDD-071 through SDD-080 | SWE4-UV-031 through SWE4-UV-034 |
|
||||
| SDD-081 through SDD-092 | SWE4-UV-035 through SWE4-UV-039 |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.1 Update
|
||||
@@ -373,3 +409,10 @@ Unit verification results shall be summarized in a unit verification summary rep
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.2 | 2026-05-14 | Corrected Apple App Store Connect upload gate to 2026-04-28 and checked full-package naming, references, and coverage. |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.3 Update
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.3 | 2026-05-15 | Added desktop PTT unit-verification items SWE4-UV-035 through SWE4-UV-039: `DesktopPttBackend` trait + `PttCapabilityLevel`, platform backends, `PttController` + `AudioTransmitGate`, `PttSanitizer` + `PttCapabilityBadge`, `MissedKeyUpWatchdog`. |
|
||||
|
||||
@@ -210,6 +210,21 @@ Software integration verification results shall be summarized in an integration
|
||||
| SAD-061 through SAD-070 | SWE5-IV-014 |
|
||||
| SDD-071 through SDD-080 | SWE5-IV-014 |
|
||||
|
||||
**SWE5-IV-015**: Verify integrated desktop PTT subsystem (audio engine, Rust core PTT controller, bridge, Flutter UI, diagnostics).
|
||||
|
||||
- Source SAD: SAD-071 through SAD-079
|
||||
- Source SDD: SDD-081 through SDD-092
|
||||
- Verification method: Software integration test on every supported desktop reference host (Windows, macOS, GNOME-on-Wayland Linux)
|
||||
- Pass criteria: For each platform the live measurement of `PttCapabilityLevel` and `backend_id` matches the design expectation; pressing the bound input toggles `transmit_active` end-to-end; the missed-key-up watchdog clears `transmit_active` after the configured timeout; the user-initiated diagnostic export does not contain raw key data; the UI capability badge matches the active capability.
|
||||
- Evidence: Integration test trace, diagnostic-export inspection, UI screenshot
|
||||
|
||||
| Architecture / Design Area | SWE.5 Coverage |
|
||||
|---|---|
|
||||
| SAD-061 through SAD-070 | SWE5-IV-014 |
|
||||
| SDD-071 through SDD-080 | SWE5-IV-014 |
|
||||
| SAD-071 through SAD-079 | SWE5-IV-015 |
|
||||
| SDD-081 through SDD-092 | SWE5-IV-015 |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.1 Update
|
||||
|
||||
@@ -223,3 +238,10 @@ Software integration verification results shall be summarized in an integration
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.2 | 2026-05-14 | Corrected Apple App Store Connect upload gate to 2026-04-28 and checked full-package naming, references, and coverage. |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.3 Update
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.3 | 2026-05-15 | Added desktop PTT software-integration verification item SWE5-IV-015 covering the integrated audio engine + Rust core PTT controller + bridge + Flutter UI + diagnostics path on Windows, macOS, and GNOME-on-Wayland Linux reference hosts. |
|
||||
|
||||
@@ -209,6 +209,18 @@ Software verification results shall be summarized in a software verification sum
|
||||
|---|---|
|
||||
| SRS-185 through SRS-194 | SWE6-SV-016 |
|
||||
|
||||
**SWE6-SV-017**: Verify integrated software behaviour for desktop Push-to-Talk against SRS-195 through SRS-203.
|
||||
|
||||
- Source SRS: SRS-195, SRS-196, SRS-197, SRS-198, SRS-199, SRS-200, SRS-201, SRS-202, SRS-203
|
||||
- Verification method: Software verification test (end-to-end) on Windows, macOS, GNOME-on-Wayland reference hosts
|
||||
- Pass criteria: PTT trait abstraction is platform-agnostic from the caller's perspective; reported capability level equals live runtime behaviour; Windows ladder degrades correctly when Raw Input is denied; macOS Global ↔ Focused toggles with permission state changes; Linux honours portal availability; mouse-side-button binding works where the backend exposes it; `capture_active` and `transmit_active` are independently observable; diagnostic export contains zero raw key data; missed-key-up watchdog clears `transmit_active` after the configured timeout.
|
||||
- Evidence: SWE.6 test report
|
||||
|
||||
| SRS Range | SWE.6 Coverage |
|
||||
|---|---|
|
||||
| SRS-185 through SRS-194 | SWE6-SV-016 |
|
||||
| SRS-195 through SRS-203 | SWE6-SV-017 |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.1 Update
|
||||
|
||||
@@ -222,3 +234,10 @@ Software verification results shall be summarized in a software verification sum
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.2 | 2026-05-14 | Corrected Apple App Store Connect upload gate to 2026-04-28 and checked full-package naming, references, and coverage. |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.3 Update
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.3 | 2026-05-15 | Added desktop PTT software-verification item SWE6-SV-017 covering end-to-end SRS-195..203 verification across Windows, macOS, and GNOME-on-Wayland Linux reference hosts. |
|
||||
|
||||
@@ -226,6 +226,18 @@ System integration verification results shall be summarized in a system integrat
|
||||
|---|---|
|
||||
| SysDes-133 through SysDes-141 | SYS4-SIV-015 |
|
||||
|
||||
**SYS4-SIV-016**: Verify integrated system-level desktop Push-to-Talk behaviour against SysDes-142 through SysDes-148.
|
||||
|
||||
- Source SysDes: SysDes-142, SysDes-143, SysDes-144, SysDes-145, SysDes-146, SysDes-147, SysDes-148
|
||||
- Verification method: System integration verification on Windows, macOS, GNOME-on-Wayland reference hosts
|
||||
- Pass criteria: Platform PTT Backend layer is the only surface generating PTT state transitions; `PttCapabilityLevel` and `backend_id` propagate from backend through Rust Core through bridge to Flutter UI without modification; `transmit_active` and `capture_active` are observably independent at the system boundary; diagnostics sanitizer rejects raw key payloads; UI capability badge matches the active capability; release readiness record carries the live-measurement evidence per RR-PTT-001..008.
|
||||
- Evidence: SYS.4 verification report
|
||||
|
||||
| SysDes Range | SYS.4 Coverage |
|
||||
|---|---|
|
||||
| SysDes-133 through SysDes-141 | SYS4-SIV-015 |
|
||||
| SysDes-142 through SysDes-148 | SYS4-SIV-016 |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.1 Update
|
||||
|
||||
@@ -239,3 +251,10 @@ System integration verification results shall be summarized in a system integrat
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.2 | 2026-05-14 | Corrected Apple App Store Connect upload gate to 2026-04-28 and checked full-package naming, references, and coverage. |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.3 Update
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.3 | 2026-05-15 | Added desktop PTT system-integration verification item SYS4-SIV-016 covering SysDes-142..148 across Windows, macOS, and GNOME-on-Wayland Linux reference hosts. |
|
||||
|
||||
Reference in New Issue
Block a user