Skip to content

Record the P02 physical-HID output proof - #1299

Merged
malpern merged 9 commits into
masterfrom
p02-physical-hid-proof
Sep 15, 2026
Merged

malpern merged 9 commits into
masterfrom
p02-physical-hid-proof

Conversation

@malpern

@malpern malpern commented Sep 15, 2026

Copy link
Copy Markdown
Owner

What happened

P02 is proven. A disposable Parallels macOS 26.5.2 guest received real USB HID
keystrokes from the ESP32 fixture, and TextEdit observed the remapped output.

Every earlier attempt failed on the input source: Tart's VNC input never
appeared as a guest HID device, so Kanata reported InputGrab active=true devices=0 and the target app received the unmapped key. Parallels assigns a
physical USB device to the guest that owns the session, so the fixture
enumerates inside the guest as a genuine keyboard (CAFE:4010, PrimaryUsage 6,
Transport USB).

The controlled experiment

One TextEdit document accumulated every fire, ending at Qwwazvwbzqbz:

fire rules live fixture sent document gained
1 none q q (autocapitalized to Q)
2 q -> w q w
3 q -> w qaz waz
4 q -> w, a -> b qaz wbz
5 a -> b only qaz qbz

Fire 1 against 2 isolates the rule. Fires 3 and 4 show selectivity and a second
independent rule. Fire 5 is the round trip: removing only the q rule restored
q while a -> b kept working, ruling out a confound in the device, the app,
or the runtime.

Evidence

Lease cbx_f4fdf8bd64de, commit 5fce69ba, installer SHA-256
88fbb04f…, macOS 26.5.2 (25F84). Artifacts, including Kanata's log, the
live config, the guest USB tree, and a screenshot per fire:

/Volumes/KeyPath Lab/CrabBox/KeyPathInstallerLab/artifacts/cbx_f4fdf8bd64de/20260915T135147Z

Deviations recorded in the doc

  • The artifact was Developer ID signed but not notarized; Gatekeeper
    rejects it. A notarized build on this path is still unproven.
  • Three steps needed a human at the console: Setup Assistant, the permission
    grants that raise an authenticated password prompt, and confirming the
    Parallels USB attach dialogs.
  • The console ran as keypathmdm, so keypath-cli through the lab's SSH
    channel (which acts as keypathqa) reads a different config than the one
    Kanata loaded. That mismatch is why fire 1 produced q.

Review gate

./Scripts/review-gate.sh could not run: it invokes
/thermo-nuclear-swift-review, which is not installed on this machine. This is
a documentation-only change. Treat GitHub claude-review as the enforced gate.

Supporting lab fixes landed separately in malpern/vm-lab.

🤖 Generated with Claude Code

A disposable Parallels macOS 26.5.2 guest received real USB HID keystrokes
from the ESP32 fixture and TextEdit observed the remapped output. Parallels
assigns a physical USB device to the guest that owns the session, so the
fixture enumerates there as a genuine keyboard with PrimaryUsage 6 — the
input source every earlier attempt lacked, where Tart's VNC input left
Kanata reporting devices=0.

Five fires in one document form a controlled experiment: q alone with no
rule, q with the rule, selectivity against unmapped keys, a second
independent rule, and a round trip that restores passthrough when only the
q rule is removed.

Also rewrites the required-proof shape around a real HID source and replaces
the resume path with what actually remains: a notarized artifact, and
automating the three steps that still need someone at the console.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

malpern and others added 8 commits September 15, 2026 07:12
Five further tests ran on the same lease with the fixture attached: shift
and passthrough, tap-hold on both sides of its timeout, throughput at 10 ms
intervals, and the remap surviving a service teardown and repair.

Records two traps. TextEdit autocorrect silently rewrote remapped output and
made the first throughput run look like a failure. And a failed
`service restart` from outside a GUI session left com.keypath.kanata absent
from the launchd system domain, which no command-line path recovered; the
app's own repair step restored it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…e lifecycle

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…overy

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@malpern
malpern merged commit 79794b9 into master Sep 15, 2026
4 checks passed
@malpern
malpern deleted the p02-physical-hid-proof branch September 15, 2026 15:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant