- commit
- ec801ccbcea034a0cb60dfc54e3c72cb0f8759f7
- parent
- 4779fbefffe7bea522212ee2f07945c228b63b81
- author
- Dami <dami.etoile@gmail.com>
| M | AGENTS.md | 13 | +++++++++++-- |
@@ -202,14 +202,23 @@ Sigil host.
202202 Gamescope connection from the exact candidate commit. A successful config203203 check, capture probe, headless probe, or loopback is supporting evidence, not204204 a substitute for that end-to-end session. Fresh exact-commit builds are not205- expected to be enrolled: do not skip the connection because ordinary206- authentication blocks it. For development hardware testing, build Sigil with205+ expected to be enrolled. This also applies when authentication or identity206+ code changed: do not skip the connection because ordinary authentication207+ blocks it. For development hardware testing, build Sigil with207208 `demo-auth-bypass`, run it with208209 `--dev-allow-unauthorized` and a bounded `--max-runtime-seconds`, and connect209210 a debug Portal with `--dev-connect`. Verify the affected live diagnostics210211 and interaction path, then stop the bypass process, undo temporary Gamescope211212 controls, and restore and verify the ordinary authenticated212213 `sigil-host.service` before calling the test complete.214+- The bypass proves the exact runtime connection, not authorization semantics.215+ For authentication, enrollment, identity, grants, invitation, and reconnect216+ changes, supplement that session with deterministic FIDO-response tests and217+ a persistent software Iroh identity using signed invitations and218+ authenticated probes. Cover the relevant grant, replay, expiry, peer/host219+ binding, and ticket-free reconnect behavior. A physical security-key PIN or220+ tap is not required unless the operator explicitly requests authenticator221+ hardware acceptance.213222 214223 - On Linux with NVIDIA, set `WEBKIT_DISABLE_DMABUF_RENDERER=1` for Portal.215224 - Treat `experimental-non-macos-pointer-capture` as an explicit non-release