feat(optid): WP-N4 hardware allowlist DB + actuation gate

[Nan0pk]

WP-N4 — Hardware allowlist DB

Implements the HWID → {domain,state} allow/deny safety gate from SPEC-northstar §3 (actuation rule, clause 2) and §6 WP-N4, following the Hybrid E design in docs/research/0006-hw-allowlist-db-design.md. This is the critical-path unblock for WP-N5/N6/N7.

Verifier PASS criterion (SPEC §6): "Default-deny for risky knobs; seeded safe baseline; denial logged with reason." — all three met.

What landed

• crates/optid/data/allowlist.toml — seeded safe baseline: NVMe APST allows with max_state caps for buggy deep states, and explicit denies for known-buggy PCIe L1.2 devices. All entries verified = false pending the §4 hardware experiments.
• crates/optid/build.rs — compiles the baseline into a static table (libinput-quirks pattern, §1.7), keyed by canonical kernel MODALIAS (pci:…, usb:…, acpi:…). Hermetic: one file read, scoped rerun-if-changed.
• crates/optid/src/allowlist.rs — Allowlist::check(domain, hwid, state) -> Verdict. Default-deny on unknown HWID (hwid_not_in_allowlist), explicit-deny entries, and max_state caps (state_exceeds_max). Runtime overrides layered compiled-in < distro (/usr/share) < admin+optctl (/etc) with last-write-wins precedence (§1.9). HWID resolved from a device's sysfs modalias.
• crates/optid/src/actuator.rs — wires the gate into the single write funnel behind the new --allowlist flag (default disabled per 0006 §7 medium-term). Denials are appended to audit.jsonl with their reason and the write is skipped. The orthogonal ADR-0009 guarded_write path-allowlist is untouched.
• crates/optctl/src/allow.rs — optctl allow|deny|list-allow: writes admin override entries to /etc/optid/allowlist.d/90-admin.toml; resolves dev-paths/modaliases.
• packaging/udev/rules.d/99-optid.rules — hot-plug notify draft (§1.5).
• Docs: appended the 0006 entry to docs/docmap.toml, synced 0006 Next-Steps; validate-doc-sync.py passes.

Design note

The gate landed in actuator.rs (the single funnel every mutation already passes through) rather than decision.rs::fits_contract. fits_contract remains the independent contract gate (clause 1) and is consumed when N5/N6 land. Out of scope (unchanged): the N5/N6/N7 enablers and hardware measurement.

Evidence

• cargo fmt --all --check, cargo clippy --workspace --all-targets — clean.
• cargo test --workspace — green (optid 59, optctl 6, rushbench 13).
• New tests prove: default-deny on unknown HWID; allow on seeded baseline; denial carries a reason; max_state cap; override precedence (admin > distro > seeded); last-file-wins; and the actuator gate's deny+audit / allow / disabled-no-op paths.

Per the Evidence Rule I do not self-certify — the rust-verifier verdict is the proof.

🤖 Generated with Claude Code

---

Generated by Claude Code