Implement Superuser Mode transitions and scoped Run Script consent

WH
22d ago
+9686-504

Description

Complete the stacked Superuser Mode transitions and settings work on PR #7. The service owns the durable Execution Mode decision, admission and shutdown ordering, root startup and repair retries, and the separate automatic Run Script authorization policy.

Changes

  • Move root-selected startup and configuration access to bounded workers. Reconcile service recreation from the committed mode, exact execution evidence, and Managed State accessibility.
  • Make enable, disable, Disable anyway, and State Access Repair respect launch, mutation, certificate recovery, and Run Script admission. Keep Normal Mode blocked when Managed State still needs repair.
  • Show committed mode, typed failures, Retry, and device-local script consent in Settings. Keep passive UI and optional tuning prompt-free.
  • Add the explicit default-OFF Run Script prompt exception: admitted sync-completion events run asynchronously with one operation-scoped UID-0 helper, durable attempt state, suspension after authorization failures, and Resume for future events only. Cancellation, opt-out, destruction, and mode changes prevent stale authorization results from rearming consent.
  • Add deterministic service, runtime, policy, backend, and real REST completion regressions. Resolve local review findings around destruction cleanup, Run Condition restart, script drain, passive configuration I/O, and full Managed State accessibility.
  • Include the separately delegated app/build.gradle.kts correction so every JNI merge variant depends on :syncthing:buildNative, including IS_COPILOT=true builds.

Summary

Settings request -> SyncthingService transition -> drain admitted work
  -> prove old execution exit -> commit PREF_USE_ROOT -> select backend
  -> verify Managed State access -> launch only when Run Conditions allow

REST sync completion -> reserve both admissions -> broadcast without waiting
  -> service policy commits attempt -> bounded root helper -> script result
  -> release admissions after terminal settlement

Evidence

  • Before: IS_COPILOT=true make all failed because the app JNI merge consumed native output without a producer dependency. After: IS_COPILOT=true make all and make all pass, including native build, debug lint, and debug assembly.
  • Fresh full JVM run: ./gradlew :app:testDebugUnitTest --rerun-tasks --offline passed 787 tests across 62 suites, with 0 failures, errors, or skips.
  • git diff --check passed. The repository all validation profile passed.
  • The earlier local Cubic review findings were addressed. A final cubic review -j attempt returned no verdict because the subscription expired.
  • Physical Magisk, KernelSU, APatch, and SELinux enforcing qualification was not performed. The device-dependent Run Script criterion remains unverified.

Merge Danger

Door: two-way

Blast Radius: lifecycle

Mode selection, privileged state repair, and automatic Run Script authorization affect startup and shutdown. The implementation fails closed on uncertain ownership or authorization. Device testing remains required before treating root-manager prompt presentation and SELinux behavior as qualified.

Screenshots

No screenshots were captured for the Settings changes. The JVM suite exercises the service-facing status and Retry behavior.

Stack and provenance

Base: codex/privileged-folder-scripts-and-tuning (PR #7, commit 7fb89b487441ba640506ad69689563ef3d8f38cb).

The JNI build dependency is separately authorized under delegation 2026-10-11T000355Z-fix-copilot-jni-native-output-task-dependency. The approved Run Script contract documentation was added after the original PR #8 delegation and is identified as such; it is not claimed under the original immutable path scope.

Summary by cubic

Implements Superuser Mode transitions with proper admission, shutdown ordering, and repair retries, and adds opt-in, device-local consent for automatic root authorization of sync-completion Run Scripts. Also fixes IS_COPILOT=true builds, which previously consumed native output without a producer dependency.

New Features

  • Enabling or disabling Superuser Mode now drains admitted work, proves the old execution exited, commits the mode durably, verifies Managed State access, then launches only when Run Conditions allow.
  • "Disable anyway" is allowed only after repair failed and old-mode work is safely quiesced; Normal Mode stays blocked while Managed State still needs repair.
  • Automatic root Run Script prompts are off by default, never restored by backup/import, and apply to future events only through explicit Resume after an authorization failure.
  • An admitted script event that still owns consent and the selected mode may request one UID-0 helper with durable attempt state; cancellation, opt-out, destruction, and mode changes prevent stale authorization from rearming consent.
  • Settings now show the committed mode, typed failures, and Retry; passive UI and stopped-state screens never prompt or read privileged state.

Bug Fixes

  • Every JNI merge variant now depends on :syncthing:buildNative, so IS_COPILOT=true make all and make all pass.
  • Onboarding records an installation marker and skips identity replacement when Superuser Mode is selected or configuration exists but is unreadable.