phg/iodd-tool

Fork 0

Discover and analyze external host volumes #20

New issue

Closed

opened 2026-10-11 19:10:48 +00:00 by phg · 1 comment

phg commented

2026-10-11 19:10:48 +00:00

Owner

Parent

IODD Tool specification

What to build

Integrate production external FAT32/exFAT discovery and verified read-only analysis with the ordinary worker/access mechanism. Validate the native lifecycle through disposable virtual volumes and controlled discovery inputs.

Acceptance criteria

Discovery includes external fixed-media USB storage, labels/geometry/partitions, refresh, and insertion/removal updates; internal targets are excluded by the agreed scope.
The chosen worker/descriptor authorization route presents its actual permissions and lifecycle, without substituting folder consent for raw access.
Live identity and generation are revalidated before access, and stale callbacks/plans cannot describe or target replacement media.
Required claim/isolation and ordinary unmount behavior follows the chosen access contract; busy volumes give actionable failure outcomes.
Analyze uses read-only authority and produces the same independently checkable snapshot contract as the image slices.
Cancellation, denial, worker disconnection, removal/reconnection, and remount failure have distinct visible states and cleanup outcomes.
Disposable virtual-volume integration on macOS 15 and current stable macOS verifies authopen, device aliases/siblings, competing access, identity and mount lifecycle. Controlled descriptions/failures cover cases the virtual driver cannot produce; fixture admission does not weaken production external-only filtering.
Ordinary-worker signing, authenticated UI/worker IPC, descriptor transfer and standard-user authorization/denial are verified. No permanent daemon registration is required.

Blocked by

Analyze an exFAT image

Validation contract

Completion requires the applicable independently checked software evidence in Set validation gates and the implementation handoff. A closed policy decision does not establish that implementation tests have passed. Use disposable images/virtual volumes and controlled faults; no hardware-trial or performance gate applies.

Scope

This ticket belongs to the later implementation effort. All planning decisions are resolved; current work covers tracker and documentation updates. The parent specification indexes the authoritative product and software-validation contracts. Forgejo governs live updates; retained local files record the handoff.

## Parent [IODD Tool specification](https://git.s1q.dev/phg/iodd-tool/issues/7) ## What to build Integrate production external FAT32/exFAT discovery and verified read-only analysis with the ordinary worker/access mechanism. Validate the native lifecycle through disposable virtual volumes and controlled discovery inputs. ## Acceptance criteria - [ ] Discovery includes external fixed-media USB storage, labels/geometry/partitions, refresh, and insertion/removal updates; internal targets are excluded by the agreed scope. - [ ] The chosen worker/descriptor authorization route presents its actual permissions and lifecycle, without substituting folder consent for raw access. - [ ] Live identity and generation are revalidated before access, and stale callbacks/plans cannot describe or target replacement media. - [ ] Required claim/isolation and ordinary unmount behavior follows the chosen access contract; busy volumes give actionable failure outcomes. - [ ] Analyze uses read-only authority and produces the same independently checkable snapshot contract as the image slices. - [ ] Cancellation, denial, worker disconnection, removal/reconnection, and remount failure have distinct visible states and cleanup outcomes. - [ ] Disposable virtual-volume integration on macOS 15 and current stable macOS verifies authopen, device aliases/siblings, competing access, identity and mount lifecycle. Controlled descriptions/failures cover cases the virtual driver cannot produce; fixture admission does not weaken production external-only filtering. - [ ] Ordinary-worker signing, authenticated UI/worker IPC, descriptor transfer and standard-user authorization/denial are verified. No permanent daemon registration is required. ## Blocked by - [Analyze an exFAT image](https://git.s1q.dev/phg/iodd-tool/issues/9) ## Validation contract Completion requires the applicable independently checked software evidence in [Set validation gates and the implementation handoff](https://git.s1q.dev/phg/iodd-tool/issues/6). A closed policy decision does not establish that implementation tests have passed. Use disposable images/virtual volumes and controlled faults; no hardware-trial or performance gate applies. ## Scope This ticket belongs to the later implementation effort. All planning decisions are resolved; current work covers tracker and documentation updates. The parent specification indexes the authoritative product and software-validation contracts. Forgejo governs live updates; retained local files record the handoff.

phg added the

ready-for-agent

label

2026-10-11 19:10:48 +00:00

phg referenced this issue

2026-10-11 19:10:49 +00:00

Create a verified VHD on external storage #21

phg referenced this issue

2026-10-11 19:10:49 +00:00

Defragment files on external storage #22

phg referenced this issue

2026-10-11 19:10:50 +00:00

Compact external storage #23

phg referenced this issue

2026-10-13 08:29:08 +00:00

Set validation gates and the implementation handoff #6

phg referenced this issue

2026-10-13 09:44:53 +00:00

Analyze a FAT32 image #8

phg self-assigned this

2026-10-13 10:42:24 +00:00

phg referenced this issue from a commit

2026-10-13 18:36:38 +00:00

Merge ticket #20: discover host volumes and analyze through a read-only worker

phg commented

2026-10-13 18:37:32 +00:00

Author

Owner

Resolution — external-volume discovery and read-only analysis implemented

Implemented on implement/iodd-tool-spec-7, completed branch 8794b71, integration merge f424fb8.

The native app discovers external fixed/removable volumes, invalidates stale selections and uses an ordinary signed worker for offline read-only FAT32/exFAT analysis. The worker derives device/partition identity from live evidence, checks both IPC peers, claims the whole device and siblings, requests ordinary unmounts, obtains explicit nontruncating read-only authopen/SCM_RIGHTS access and validates descriptor identity/geometry and selected bounds. Independent GPT primary/backup and MBR/extended parsing reject unsupported, overlapping or inconsistent layouts. Descriptor closure precedes separately reported mount restoration. Busy devices, denied/cancelled authorization, identity changes and unavailable exclusion produce truthful refusal; native writes remain unavailable.

Final combined source269b723 passed all 158 tests in 900.048 seconds using pinned Xcode27.0/27A266a and ordinary release optimization. Completed branch and integration preserve its exact qualified Sources/Tests/package/build scripts. Fresh integration passes all 15 public discovery/layout/lifecycle tests, arm64 app/worker release builds, plist and macOS15.0 checks. Canonical Developer ID deep/strict signatures and recorded binary hashes pass.

Actual signed v11 standard-user authorization, descriptor transfer, full 24-mode ordinary/exclusive whole/raw/block/sibling exclusion, cancellation, Stop, UI EOF, worker death and busy/removal handling are documented with their exact source/runtime provenance. Valid standard-account credentials were rejected by SecurityAgent; subsequent Cancel returned authorizationCancelled, without a false native authorizationDenied claim. The current authopen flag conflict was reproduced and corrected, then the final flags were exercised on both pristine runtime families. Final combined-source signed v12 exFAT scans ran as real nonadmin UID502 on macOS15.6.1/24G90 and27.0.1/26A434: independent six-file content/allocation/ValidDataLength/selected-range oracles match and complete offline container hashes remain unchanged. Gatekeeper stayed enabled; locally transferred signed artifacts are not final quarantined-download acceptance.

Reproducible validation, complete logs, native artifact provenance and limits. Physical media, native4K drivers, custom mount restoration, cache durability and final signing/notarization distribution gates remain separately scoped. Controlled adapters cover unavailable failure states. Both owned pristine VMs were handed back idle and normally shut down with disks/evidence preserved. Existing recovery evidence remains intact.

## Resolution — external-volume discovery and read-only analysis implemented Implemented on [implement/iodd-tool-spec-7](https://git.s1q.dev/phg/iodd-tool/src/branch/implement/iodd-tool-spec-7), completed branch [8794b71](https://git.s1q.dev/phg/iodd-tool/commit/8794b71f46100bff4ab88237e76c3dc93ae4440c), integration merge [f424fb8](https://git.s1q.dev/phg/iodd-tool/commit/f424fb8ca806d7268e33532e398439b850ff6426). The native app discovers external fixed/removable volumes, invalidates stale selections and uses an ordinary signed worker for offline read-only FAT32/exFAT analysis. The worker derives device/partition identity from live evidence, checks both IPC peers, claims the whole device and siblings, requests ordinary unmounts, obtains explicit nontruncating read-only authopen/SCM_RIGHTS access and validates descriptor identity/geometry and selected bounds. Independent GPT primary/backup and MBR/extended parsing reject unsupported, overlapping or inconsistent layouts. Descriptor closure precedes separately reported mount restoration. Busy devices, denied/cancelled authorization, identity changes and unavailable exclusion produce truthful refusal; native writes remain unavailable. Final combined source269b723 passed all 158 tests in 900.048 seconds using pinned Xcode27.0/27A266a and ordinary release optimization. Completed branch and integration preserve its exact qualified Sources/Tests/package/build scripts. Fresh integration passes all 15 public discovery/layout/lifecycle tests, arm64 app/worker release builds, plist and macOS15.0 checks. Canonical Developer ID deep/strict signatures and recorded binary hashes pass. Actual signed v11 standard-user authorization, descriptor transfer, full 24-mode ordinary/exclusive whole/raw/block/sibling exclusion, cancellation, Stop, UI EOF, worker death and busy/removal handling are documented with their exact source/runtime provenance. Valid standard-account credentials were rejected by SecurityAgent; subsequent Cancel returned authorizationCancelled, without a false native authorizationDenied claim. The current authopen flag conflict was reproduced and corrected, then the final flags were exercised on both pristine runtime families. Final combined-source signed v12 exFAT scans ran as real nonadmin UID502 on macOS15.6.1/24G90 and27.0.1/26A434: independent six-file content/allocation/ValidDataLength/selected-range oracles match and complete offline container hashes remain unchanged. Gatekeeper stayed enabled; locally transferred signed artifacts are not final quarantined-download acceptance. [Reproducible validation, complete logs, native artifact provenance and limits](https://git.s1q.dev/phg/iodd-tool/src/commit/f424fb8ca806d7268e33532e398439b850ff6426/docs/validation/host-volumes.md). Physical media, native4K drivers, custom mount restoration, cache durability and final signing/notarization distribution gates remain separately scoped. Controlled adapters cover unavailable failure states. Both owned pristine VMs were handed back idle and normally shut down with disks/evidence preserved. Existing recovery evidence remains intact.

phg closed this issue

2026-10-13 18:37:32 +00:00

phg referenced this issue

2026-10-13 18:38:03 +00:00

IODD Tool specification #7