1# Frozen compatibility identifiers23goq is the project and public site, Sigil is the Linux host, and Portal is the4client. Some earlier `sigil` and `sigil-spark` values are nevertheless5permanent compatibility identifiers. They are not display branding and must6not be changed as part of a product rename or cleanup.78## Portal enrollment identity910Portal derives one stable Iroh endpoint identity from the FIDO211`hmac-secret`. Existing Sigil enrollment grants are bound to that endpoint.12Changing any derivation input silently produces a different endpoint and13strands the enrollment.1415| Identifier | Frozen value |16| --- | --- |17| FIDO relying-party ID | `sigil` |18| HMAC salt message | `sigil-iroh-identity-v1` |19| Salt SHA-256 | `147ec51fc95a4add3b73f9f366b157fb5dec706a12173151062728dbad1584aa` |20| Resident user ID | `sigil-user` |21| Resident user name | `sigil` |22| Resident user display name | `Sigil` |23| Portal identity domain bytes | `goq/portal-client-identity/v1\0` |2425The fixed non-secret test input consisting of 32 `0x2a` bytes derives the26secret-key seed27`78ccce6e04070fff0ac5f74cde6d948ea48042a66f45a8c58a96eb459ca10dd9`28and Iroh endpoint ID29`0383aa3774fe624d7a3bc9189c64770e077c43db7315dde1df19085538adc136`.30Portal has a golden test for the complete derivation. This vector is test data,31not a deployed credential.3233## Sigil host filesystem namespace3435The following host paths are frozen because the installer, service, rollback36tooling, Decky plugin, and recovery documentation consume them independently:3738| Purpose | Frozen path |39| --- | --- |40| Installed releases and current link | `~/.local/libexec/sigil-spark` |41| Host configuration | `~/.config/sigil-spark/host.toml` |42| Identity and package-owned shared data | `~/.local/share/sigil-spark` |43| Authorization and configuration state | `~/.local/state/sigil-spark` |44| Volatile daemon management runtime | `$XDG_RUNTIME_DIR/sigil-spark` |4546For an explicit management runtime root, Sigil also appends the frozen child47`sigil-spark`. The daemon lifecycle lock and status document live below that48child. A repository gate keeps the independent Decky, systemd, installer,49activation, staging, and Rust consumers synchronized.5051## Linux virtual-input ABI5253All three virtual devices use Linux `BUS_VIRTUAL`, vendor `0x5347`, and device54version `1`.5556| Device | Product | Name |57| --- | ---: | --- |58| Pointer | `1` | `Sigil Spark Virtual Pointer` |59| Gamepad | `2` | `Sigil Spark Virtual Gamepad` |60| Keyboard | `3` | `Sigil Spark Virtual Keyboard` |6162These values are visible to Gamescope, udev, libinput, games, diagnostics, and63hardware evidence. Host tests pin the complete tuple, and a package test64requires the shipped udev rule to match its checked-in frozen source exactly.6566## Change policy6768Never silently edit a frozen value or accept an alternate value at runtime.69Any intentional successor requires a separately versioned identifier and an70explicit migration design covering existing FIDO credentials, Sigil71enrollments, local-management consumers, udev/libinput rules, and rollback.72The migration must preserve a clear failure mode and must be proven with an73already-enrolled Portal and an upgraded host before release.