Move to the torvalds-based hardware layer and device-generic CLI

image/j71b/image_policy.py

@@ -36,8 +36,7 @@ def ready(*, ssh_revoked=False):
 
 
 def validate_root(root, release):
-    for helper in ('usr/lib/systemd/systemd', 'usr/libexec/j71b-check-platform',
-                   'usr/libexec/j71b-charge-lease', 'usr/libexec/omarchy-diagnostics'):
+    for helper in ('usr/lib/systemd/systemd', 'usr/libexec/omarchy-diagnostics'):
         if not os.access(root / helper, os.X_OK):
             raise ValueError('Missing executable: ' + helper)
     root_release = json.loads((root / 'etc/orchard/release.json').read_text())
@@ -46,8 +45,7 @@ def validate_root(root, release):
 
 
 def validate_handoff(root):
-    for helper in ('usr/lib/systemd/systemd', 'usr/libexec/j71b-check-platform',
-                   'usr/libexec/j71b-charge-lease', 'usr/libexec/omarchy-diagnostics'):
+    for helper in ('usr/lib/systemd/systemd', 'usr/libexec/omarchy-diagnostics'):
         if not os.access(root / helper, os.X_OK):
             raise ValueError('Handoff executable missing: ' + helper)
 

release/j71b/audit.py

@@ -62,7 +62,7 @@ def audit(manifest):
     names, ancestors, directories = set(), set(), set()
     desktop = public = privileges = cursor = bluetooth = labwc = None
     recipe = json.loads(firmware_path('j71b').read_text())
-    private = {item['destination'] for item in recipe['files'] + recipe['generated']}
+    private = {item['destination'] for item in recipe['outputs']}
     with subprocess.Popen(['zstd', '-d', '-q', '-c', str(paths['root'])], stdout=subprocess.PIPE) as decoder:
         with tarfile.open(fileobj=decoder.stdout, mode='r|') as archive:
             for member in archive:
@@ -141,7 +141,7 @@ def audit(manifest):
     verify_labwc(labwc, hashes, modes, owners, groups)
     if 'home/tablet/.local/share/omarchy-ipad/shell/bluetooth-pairing/shell.qml' not in desktop:
         raise ValueError('Pairing UI is absent from desktop integrity manifest')
-    for name in ('j71b-check-platform', 'j71b-charge-lease', 'omarchy-diagnostics', 'omarchy-desktop-ready', 'omarchy-wtype', 'omarchy-screen-toggle', 'omarchy-bluetooth-pair'):
+    for name in ('omarchy-diagnostics', 'omarchy-desktop-ready', 'omarchy-wtype', 'omarchy-screen-toggle', 'omarchy-bluetooth-pair'):
         if modes.get('usr/libexec/' + name) != 0o755:
             raise ValueError('Required helper is not executable: ' + name)
     if links.get('lib') != (True, 'usr/lib') or owners.get('home/tablet') != 1000 or sizes.get('etc/machine-id') != 0:

release/j71b/public_root.py

@@ -221,7 +221,7 @@ def add_parents(name):
                     member = tarfile.TarInfo(name)
                     member.mode, member.size = mode, len(data)
                     add(member, data)
-                for unit in ('j71b-charge.service', 'omarchy-diagnostics.service'):
+                for unit in ('omarchy-diagnostics.service',):
                     member = tarfile.TarInfo('etc/systemd/system/multi-user.target.wants/' + unit)
                     member.type, member.linkname, member.mode = tarfile.SYMTYPE, '/usr/lib/systemd/system/' + unit, 0o777
                     if member.name not in seen:
@@ -231,7 +231,7 @@ def add_parents(name):
             if compressor.wait():
                 raise ValueError('Public root compression failed')
         required = {'lib', 'usr/lib/systemd/systemd', 'etc/group', 'etc/gshadow', qml_path,
-                    'arch-ipad-ui-manifest.json', 'usr/libexec/j71b-check-platform', 'usr/libexec/omarchy-diagnostics'}
+                    'arch-ipad-ui-manifest.json', 'usr/libexec/omarchy-diagnostics'}
         if not required <= seen or not privileges.keys() <= seen or not replacements.keys() <= seen:
             raise ValueError('Incomplete public root or privileged package metadata')
         receipt = {'schema': 1, 'kind': 'rootfs', 'profile': 'j71b', 'release': release,

release/j71b/recovery_audit.py

@@ -49,7 +49,7 @@ def audit_runtime(image, root_spec, release):
     part = next(row for row in receipt['components'] if row['name'] == 'initramfs')
     hashes, modes, records = {}, {}, {}
     firmware = json.loads(firmware_path('j71b').read_text())
-    private = {row['destination'] for row in firmware['files'] + firmware['generated']}
+    private = {row['destination'] for row in firmware['outputs']}
     names = set()
     with image.open('rb') as raw:
         raw.seek(part['offset'])

release/manifests.py

@@ -17,7 +17,7 @@ def write(output, version, root):
     document = ('schema = 1\nkind = "orchard.install"\ndistro = "omarchy-a"\n'
                 'name = "Omarchy A"\nversion = ' + json.dumps(version) + '\n'
                 'device = "j71b"\nboot_method = "checkm8-pongo"\n'
-                'min_orchard = "0.1.10"\nprotocol = 1\n\n'
+                'min_orchard = "0.1.11"\nprotocol = 1\n\n'
                 '[install]\ndefault_root = "/omarchy"\n')
     for role, name in (('root', 'rootfs.tar.zst'), ('boot', 'recovery.bin'), ('pongo', 'pongo.bin')):
         item = receipt(output / name)

requirements-build.txt

@@ -1,2 +1,2 @@
 # Install the local wheel until public package distribution is published.
-orchard-hardware>=0.1.10,<0.2
+orchard-hardware>=0.1.11,<0.2

tests/test_device_install.py

@@ -28,8 +28,6 @@ def exercise(self, *, corrupt=False, existing=True, unexpected_link=False, bad_s
             ('etc/omarchy/package-privileges.json', 'file', json.dumps(privileges).encode()),
             ('lib', 'symlink', 'usr/lib'),
             ('usr/lib/systemd/systemd', 'file', b'executable'),
-            ('usr/libexec/j71b-check-platform', 'file', b'executable'),
-            ('usr/libexec/j71b-charge-lease', 'file', b'executable'),
             ('usr/libexec/omarchy-diagnostics', 'file', b'executable'),
             ('etc/orchard/release.json', 'file', b'{"release":"1.0"}'),
         ])

tests/test_extraction.py

@@ -200,7 +200,7 @@ def test_static_diagnostics_authenticates_with_stock_arch_nss(self):
             result = subprocess.run(['podman', 'run', '--rm', '--network', 'none', '--cap-add', 'NET_ADMIN',
                                  '--userns', 'keep-id:uid=0,gid=0', '-v', str(tools) + ':/probe:ro',
                                  '-v', str(staged) + ':/runtime:ro',
-                                 '-v', str(HARDWARE / 'boot/initramfs/j71b/recovery') + ':/recipe:ro',
+                                 '-v', str(HARDWARE / 'boot/initramfs/recovery') + ':/recipe:ro',
                                  image, 'sh', '-c', script], capture_output=True, text=True, timeout=30)
         self.assertEqual(result.returncode, 0, result.stderr)
 
@@ -235,7 +235,7 @@ def test_public_producer_bakes_parent_directories_and_desktop_updates(self):
                  patch.object(public_root, 'bluetooth_files', return_value={}), \
                  patch.object(public_root, 'labwc_files', return_value={}), \
                  patch.object(public_root, 'runtime_files', return_value=('test', {
-                     'usr/libexec/j71b-check-platform': (b'platform', 0o755)})):
+                     'usr/bin/orchard-device': (b'device', 0o755)})):
                 result = public_root.build(base, receipt, root, dropbear, root / 'release', 'test', root / 'cursor-tools')
             raw = subprocess.check_output(['zstd', '-dq', '-c', str(root / 'release/rootfs.tar.zst')])
             with tarfile.open(fileobj=io.BytesIO(raw)) as bundle:
@@ -340,7 +340,7 @@ def test_recovery_adt_endpoint_owns_size_and_exact_binary_selection(self):
             table.write_text('dev: size erasesize name\nmtd3: 00000004 00000001 "adt"\n')
             (root / 'mtd3').write_bytes(b'\x00\xff\r\n')
             env = {**os.environ, 'ADT_MTD_TABLE': str(table), 'ADT_MTD_DEV': str(root)}
-            endpoint = HARDWARE / 'boot/initramfs/j71b/recovery/capture-adt'
+            endpoint = HARDWARE / 'boot/initramfs/recovery/capture-adt'
             size = subprocess.check_output(['sh', str(endpoint), '--size'], env=env)
             self.assertEqual(int(size.strip(), 16), 4)
             self.assertEqual(subprocess.check_output(['sh', str(endpoint)], env=env), b'\x00\xff\r\n')

tests/test_manifests_and_recovery.py

@@ -29,7 +29,7 @@ def test_single_target_manifest_and_index_pin_exact_bytes(self):
             self.assertEqual(doc['device'], 'j71b')
             self.assertEqual(doc['install']['default_root'], '/omarchy')
             self.assertEqual(doc['root']['sha256'], hashlib.sha256(b'rootfs.tar.zst').hexdigest())
-            self.assertEqual(doc['min_orchard'], '0.1.10')
+            self.assertEqual(doc['min_orchard'], '0.1.11')
             self.assertEqual(manifests.read_release(path)['assets']['recovery'], doc['boot'])
             with self.assertRaises(FileExistsError):
                 manifests.write(output, 'test-1', root)
@@ -101,7 +101,7 @@ def test_actual_recovery_root_lock_and_public_hashes_are_checked(self):
 
     def test_public_recovery_cannot_contain_firmware_or_session_credentials(self):
         recipe = json.loads(firmware_path('j71b').read_text())
-        for name in (recipe['files'][0]['destination'], 'run/recovery/ssh_host_ed25519_key'):
+        for name in (recipe['outputs'][0]['destination'], 'run/recovery/ssh_host_ed25519_key'):
             with self.subTest(name=name), self.assertRaises(ValueError):
                 self.exercise(private_file=name)