TacidOS
Developers
Documentation

Decision 0094

94. A flash names the probe that is on the bus

Architecture decision record 0094: 94. A flash names the probe that is on the bus

Status
accepted
Date
2026-09-14

Refines ADR-0029 · ADR-0045 · ADR-0006

Context

The protocol has had FirmwareFlash and SerialOpen since the founding. The classifier treats a flash as irreversible (an external device), the policy defaults it to ask, and the invariant is that a firmware write names its exact target. Until now the keeper refused both by name: “nothing on this machine carries this out yet.”

A debug probe is USB. /dev/ttyACM0 is assigned in discovery order. The facts already identify a probe by vendor, product and serial. The scribe already runs as the person, which is who TAG+="uaccess" grants the node to.

Decision

A flash is an action, carried out by the person’s scribe, after the keeper has a word.

The probe is role:vid:pid:serial or vid:pid:serial. Sysfs is checked before probe-rs runs. The argument vector is closed: probe-rs download --probe VID:PID:SERIAL --chip CHIP IMAGE. The image is a file in the person’s home. The stem is not involved: root is not required, and the stem’s crate stays the size a reviewer can read in an afternoon.

A serial capture takes the same identity, or a /dev/serial/by-id/ path. A raw ttyACM0 is refused. The capture lasts three seconds.

The scribe’s unit admits hidraw, tty and usb_device nodes the same way the reader admitted ALSA: DevicePolicy = closed and an allow-list, not PrivateDevices.

tacid flash and tacid serial propose the action through the daemon. The model already can, because act_tool’s schema is generated from ActionItem.

Consequences

  • A probe that is not plugged in is refused by name, before probe-rs is started.
  • A machine without probe-rs on the scribe’s PATH fails the flash honestly.
  • Git push is still not built; a flash is not a push.

Alternatives rejected

  • A stem operation. Root can always open USB. It would also grow the one crate that must stay small, and it would flash as root rather than as the person the udev rule named.
  • The reading executor. It already has a physical device (the microphone). A flash writes; writing is the scribe’s. Mixing them would put a writable home on the process that holds a microphone, which ADR-0075 already refused.