Vitrallis Shell 1.0.4 — reliability hardening

Authorized as a full release on 2026-10-05. This release hardens the existing shell and native
utilities for continuous use on small Linux systems, preserving screen layouts,
keyboard/touch controls and Documents-based application storage.

• App Center now recognizes the Python interpreter options used by installed
  launchers. Updating a running app correctly prompts before replacement;
  Cancel keeps it open and Close and Update stops it before committing.
• Process cleanup retains child ownership until termination and reaping complete.
  Linux external-app closing uses process handles and rechecks executable/script
  and start identity, preventing signals from reaching a reused PID. Unsupported
  kernels or ambiguous process arguments require manual closing.
• State writes, file copies, package downloads and recovery preserve original
  failures, validate permissions and file identity, and reject unsafe files,
  duplicate entries, oversized payloads and arithmetic overflow.
• Stale UI selections, UTF-8 editing, image buffers and screenshots have checked
  boundaries. Worker and cleanup failures remain visible; artwork caches and
  idle rendering retain their bounded resource behavior.
• All five packages inherit the permanent Rust 1.99 lint policy. The audit resolves
  3,128 initial unique findings with zero final strict Clippy diagnostics; every
  local exception has a documented range or API justification.

Formatting, locked checks, strict Clippy, full Rust/Python suites, release builds,
renderer references, native accelerated readback and smoke tests pass on the
macOS/Linux hosts. Real 480×272 Linux simulations pass App Center install/update/
uninstall/error paths, keyboard/touch shortcuts, Settings persistence and the
Awesome/native-app lifecycle. See the full hardening report
for commands, changed files, exceptions and retained qualifications.

This release has no new physical PocketCHIP certification. Optional online
catalog validation encounters a package without a compatible host binary, and
in-process macOS GPU probes cannot initialize their video backend; process-isolated
accelerated CLI checks pass. Linux external-app closing requires Linux 5.3+
process handles. Release bundles retain glibc 2.36+, SDL2 2.26.5+ and Arti 2.7.0.

Release source: ed160d8, tag v1.0.4.

Release artifact validation

The exact tagged release build passed the Debian 12 validation gate, x86-64 bundle upgrade probe, ARMv7/Cortex-A8 QEMU frame and native utility smoke checks, and five-executable version/architecture checks. All 19 uploaded assets verified against GitHub SHA-256 digests and their sidecars. Embedded executable hashes and target headers pass; installation helpers and legal notices match the tagged source exactly.

Bundle SHA-256:

• ARMv7: eb2b9be59066112668f2802a91bfb5205ba3c7ded6f181dbda2b5d378b62212c
• x86-64: 064810351ff1e5bb1b2cfb8cfeecf809a008fe35f7ad5c36484e3b4871c1f34e

The separate general host validation runs for main and the tag remain in progress at publication. The exact tagged release validation and local canonical validation passed.

Vitrallis Shell 1.0.3 — certification prerelease

Shell 1.0.3 restores actual X11 keyboard focus when a background app exits while Settings or the launcher is visible. Another focused app keeps its focus. Linux process scans handle disappearing processes while permission and I/O errors still fail closed.

At the owner’s request, Rust minimum/development/release builds use 1.99/1.99.0. All ten direct workspace crates are newest stable at review; libc is 0.2.190, lazy_static 1.5.1, and bundled Arti is 2.7.0 with its publisher’s locked graph and verified notices. Three older transitive versions are required by upstream SDL2/PNG; see the dependency review.

RELEASE READY — certification complete. Exact-source macOS/Linux validation, strict Clippy, Rust/Python tests, actual Awesome/X11 regression and the tagged ARMv7/x86-64 packaging workflow pass. All 19 public assets and tagged helper/legal bytes verify. The fully cleaned physical PocketCHIP installs through the exact public README command; completed repeat installation and software reboot pass. Native utilities, App Center/Calculator lifecycle, graphics/VSync and all 15 real-device Arti tests pass. The owner confirms physical cold startup, keyboard, touch, display and audible audio; new boot, installed hashes, actual focus and logs independently verify. A further controlled software reboot passes all eight settings and preserves saved ALSA bytes, then restores the owner-confirmed live volume choice.

This remains a certification prerelease; full stable publication is a separate owner decision. The 14-item handoff and ledger retain failures, evidence and qualifications. All 93 tracked paths retain ownership/modes; 91 retain original contents and two hold valid Music/Sketch setting edits from manual use. Those edits and saved documents are preserved.

Includes Shell, Terminal, Notepad, Files and shared Arti for Linux ARMv7/x86-64, setup/removal helpers, SHA-256 sidecars and legal notices. Requires glibc 2.36+ and SDL2 2.26.5+. Use the README setup command to replace obsolete prereleases expecting Arti 2.6.0.

Known limits: strict software/hardware utility readbacks differ by at most one colour level on a small number of pixels; hardware/automatic readbacks match. Process interruption does not prove physical NAND power-loss durability. A stock PocketHome interval can reset brightness, while controlled Vitrallis persistence passes. Bluetooth, limited font shaping and owner-deferred app internals are qualified in the report. Earlier published release assets are unchanged.

Vitrallis Shell 1.0.2 — certification prerelease

Shell 1.0.2 corrects background-service cleanup before Restore/relaunch and reports setup cancellation without a Python traceback. The relaunch view remains responsive while owned children finish; failures refuse replacement and allow a retry. Application payloads and persistent AppData remain separate, and the installer preserves a distinct previous generation on repeat installation.

This is a certification prerelease. The exact tagged workflow passes validation and builds both platforms; all 19 asset sizes/digests, eight checksum sidecars, six source helpers and three legal files verify. Prepared installation and repeat installation of those exact bytes pass on PocketCHIP, preserving all 93 tracked saved entries and eight original settings. Hardware graphics self-test and Terminal/Notepad/Files smokes pass on Mali400 at 480×272 with VSync and no fallback. Actual keyboard focus belongs to the launcher; PocketHome and owned zombies are absent. Fully clean public README installation, completed repeat execution, saved-config checks and software reboot now pass. A later Python app-exit check leaves Settings visible while actual X keyboard focus is unset; touch still works. This is a release blocker. A prepared correction passes Mac/Linux validation and a real PocketCHIP regression, but has not been published. Final physical acceptance is postponed until the corrected release candidate is available. Stable readiness is not declared.

Includes Shell, Terminal, Notepad, Files and shared Arti bundles for Linux x86-64 and ARMv7, matching PocketCHIP setup/removal helpers, SHA-256 sidecars and required legal notices. Requires glibc 2.36+ and SDL2 2.26.5+. Applications run as the desktop user. Current filesystem and installation instructions are in the README.

Known qualification: previous real-device readbacks differ from software rendering by at most one color level on a small number of utility pixels. Hardware and automatic readbacks matched exactly. Physical NAND power-loss durability is not inferred from process-interruption tests. See the certification record for revision-specific results and scope.

Vitrallis Shell 1.0.1 — certification prerelease

Certification prerelease of Vitrallis Shell 1.0.1 for PocketCHIP on Debian 12 or 13. Public installer and update fault certification is continuing; stable release readiness has not been declared.

This release preserves the distinct previous generation when reinstalling the active bundle, correcting the lost restore choice in 1.0.0. Applications remain in Documents/Vitrallis/Apps and persistent data in Documents/Vitrallis/AppData.

Source: b2ff6d48be33b0a70c373d56d1a8c2f354501db2, tagged v1.0.1. The tagged workflow passes canonical validation, x86-64 and ARMv7 builds, native utility packaging and legal notice checks. Build evidence.

Exact tagged installation and repeat installation pass on the physical PocketCHIP, retaining 1.0.0 as the distinct previous generation. All 93 tracked saved data/config/app/integration entries and eight saved settings remain unchanged. All five executables pass version/hash/ownership/mode checks. Shell graphics self-test and all three native utility hardware smokes pass on Mali400 with VSync and no fallback. A software reboot reaches the focused 480×272 launcher with no PocketHome or service-owned zombies across three observations. Clean public installation and official update/interruption checks follow publication. Physical keyboard and touch acceptance applies to the repaired startup integration; the final candidate still requires its final physical smoke test.

Requires glibc 2.36+ and SDL2 2.26.5+. See the repository certification ledger for remaining tests and hardware qualifications.

ARMv7 bundle SHA-256: 1ee6c8e5e4cd7184a27ce8668f252ab40ac8a339f30ba9e96e55f746910dc0e6

x86-64 bundle SHA-256: 3f4a8c74c40e61d998cf832ead89a3c2794f53d96e1d0f32d45aa4221134a804

Known rendering limitation: strict software/hardware equality fails on 73 Terminal, 41 Notepad and 90 Files pixels at 480×272, with a maximum one-colour-level difference. Hardware and automatic readbacks match exactly; repository assertions are unchanged.

Later certification found a process-lifecycle defect: Restore/relaunch can leave a background system query as a persistent zombie. Cancelling setup can also print a Python traceback. Corrections in PR #8 pass prepared-build host/device tests but are not part of published 1.0.1. The published assets remain unchanged; a fresh authorized release and final certification are required.

Vitrallis Shell 1.0.0 — certification prerelease

Certification prerelease of Vitrallis Shell 1.0.0 for PocketCHIP running Debian 12 or 13. Public installer, update and fault certification is in progress. Stable release readiness has not been declared.

This candidate places replaceable applications under Documents/Vitrallis/Apps and persistent data under Documents/Vitrallis/AppData, repairs installation ownership and directory permissions, and replaces PocketHome startup with Vitrallis in the existing Awesome session. Uninstall restores the original PocketHome launch command. The owner has accepted physical keyboard, touchscreen, automatic startup and display behavior after a cold start of the repaired integration.

Source: a57b107830b802372afe72fcb584386f1c3f6abd, tagged v1.0.0. The tagged release workflow passes canonical validation, release builds, ARMv7 probes and packaging checks. All 19 downloaded assets, eight checksum sidecars and committed helper/legal files verify. The ARM bundle contains Shell, Terminal, Notepad, Files and Arti 2.6.0; the five exact executables pass native device version, ownership and permission checks. Hardware graphics tests use Mali400 with VSync and no software fallback.

ARMv7 bundle SHA-256: 5ad2944b47f3152032c87ab87e2f4bb3466bc2bd841815a4176fdecd6938b615

x86-64 bundle SHA-256: 0f7d214d265b47cf6408c329412663cd5fcc5d2a799dd2353fb5c64bbbd3e878

Known rendering limitation: strict software-versus-hardware screenshot equality fails on 73 Terminal, 47 Notepad and 93 Files pixels at 480×272, each differing by at most one colour level. Hardware and automatic rendering match exactly. These inspected readbacks do not weaken or replace repository test assertions.

The exact tagged ARM bundle also passes a software reboot with current-session readiness at 480×272, sustained actual X11 keyboard focus, no PocketHome process/window and no service-owned zombies. Changed brightness, volume, clock format, timezone, background timeout, keep-running policy, screen timeout and Tor mode survive leaving/re-entering Settings, Shell restart, tagged-bundle installation and reboot. After publication, the exact public README command passes from an absent core runtime directory, its repeat execution passes, and a software reboot reaches the focused launcher without PocketHome. All 93 tracked saved data/config/app/integration entries remain unchanged. Official update and interruption checks remain open.

Known recovery bug: reinstalling the active bundle after changing generations replaces the saved previous-generation pointer with the active generation. The older files remain, but the normal restore choice is lost. A focused correction and regression test are under validation; the published 1.0.0 assets are unchanged, and this blocks stable release readiness.

Requires glibc 2.36+ and SDL2 2.26.5+. See the repository's device installation, recovery and certification documents for supported runtime requirements and remaining certification work.

Vitrallis Shell 1.0.0-beta-2

Vitrallis Shell 1.0.0-beta-2 polishes the established 480×272 PocketCHIP interface and preserves synchronized SDL backbuffer rendering.

• Settings: eight compact categories; the Wireless page now exposes Tor with matching touch bounds. Tor, read-only pages and partial time-zone lists keep keyboard focus visible. Headings, hints, disabled update actions and the About display label are consistent.
• App Center: install/update/uninstall and publisher/trust confirmations display their warnings, wrap within the screen and keep Cancel as the safe default. Stale approval indices cannot panic. Text entry stays above the keyboard; denser browsing, search and filters remain intact.
• Reliability: regression coverage verifies failed downloads/updates/removals, running-app cancellation, offline cache recovery, repeated app/dialog use and actual 12/24-hour persistence across Shell restarts.
• Setup and documentation: one-command PocketCHIP setup prepares prerequisites and starts Vitrallis at desktop login. The README, release notes and visual-validation workflow are refreshed. Exact renderer references cover 337 frames for each reviewed OS/CPU profile at native and scaled sizes.

Downloads include complete five-executable bundles (Shell, Terminal, Notepad, Files and Arti) for Linux ARMv7 hard-float and x86-64, SHA-256 checksums, matching PocketCHIP helpers and legal notices. Requires glibc 2.36+ and SDL2 2.26.5+.

Validation and scope: beta-2 validation record. No new physical PocketCHIP testing is claimed. Real radio/service behavior, physical touch, suspend/resume, Mali/Lima scanout/VSync and NAND durability remain hardware acceptance work. Apps run with the user's permissions; third-party artwork/licensing caveats remain in the attached notices.

Vitrallis Shell 1.0.0 Beta

Vitrallis Shell 1.0.0 Beta

This is the first 1.0.0 beta release of Vitrallis Shell and represents the current release-candidate baseline ahead of the final 1.0.0 release. This is a testing pre-release, not stable 1.0.0.

Highlights

• Updated Shell, Terminal, Notepad, Files, and shared native UI for consistent keyboard and touch operation across supported display sizes.
• Refined layout and text handling so long names, paths, versions, and status messages remain within their controls; expanded renderer and geometry regression coverage.
• Added the managed App Center lifecycle and safer install/update handling, including catalog and download work outside the cross-process storage lock with revalidation before commit.
• Added guarded restoration of a retained, fully validated previous Shell build while preserving installed apps and user data.
• Continued the desktop shortcut, folder, and PocketCHIP session workflows, with bounded process cleanup and input/path validation improvements.
• Included shared supervised Arti/Tor support, required-app network policy, and SDL hardware-renderer selection with software fallback and diagnostics.

Reliability and performance

This release includes App Center transaction and cache hardening, bounded worker and child-process shutdown, safer document offsets and stale-index handling, responsive update progress, cached renderer artwork, and a shared font atlas. The release workflow packages Linux x86-64 and ARMv7 bundles and validates the ARMv7 build under QEMU.

Beta status

This build is intended for testing before the final 1.0.0 release. Linux release bundles require glibc 2.36 or newer and SDL2 2.26.5 or newer. Hardware acceleration depends on the host graphics stack; supported configurations can use the SDL software-renderer fallback.

Known issues

No additional release-specific known issues are recorded. Please report issues with the device, OS, and graphics backend details.

v0.1.0-beta4.1

Shell UI polish, safe background application policy, storage accounting, and the desktop Manage [F10] action label.

Includes complete Shell, Terminal, Notepad, Files, and Arti 2.6.0 bundles for Linux x86-64 and ARMv7, plus matching session helpers. Requires glibc 2.36+ and SDL2 2.26.5+.

Validation:

• Host CI and the complete release workflow passed for commit 78024c3.
• Formatting, strict Clippy, Rust/Python tests, native release builds, SDL smoke checks, and documentation checks passed.
• ARMv7 version and SDL smoke checks passed under QEMU with the Cortex-A8 CPU model.
• All 16 uploaded assets were downloaded and verified: SHA-256 sidecars, five-executable bundle contents and hashes, ELF architectures, and session helpers matching the tagged source.

No new physical-device validation was performed for this release.

Build: https://github.com/csd113/Vitrallis-Shell/actions/runs/35540868581

Vitrallis Shell 0.1.0-beta4 — shared Arti Tor service

Adds Arti as one shared, Shell-managed Tor service. Arti remains a separate executable/process and is never embedded into the Shell runtime.

• On-demand startup by default, plus Always on and Disabled modes.
• Settings → Device → Wireless → Tor: status, bootstrap, app count, startup mode, start/stop/restart and diagnostics, usable with keyboard and touch at 480×272.
• App manifests support network.tor = "required", "preferred" or "none".
• Required apps wait for Tor and use Linux network isolation to prevent accidental clearnet fallback. One loopback SOCKS endpoint serves all apps.
• Bounded supervision/retries, private state, no idle Arti process, and standalone Arti 2.6.0 provisioning in the full v2 bundle.

Updating without reinstalling

From beta3.9: Check, Install and Relaunch once to install the full beta4 bundle.

From an older managed Shell: Check, Install and Relaunch to enter beta4, then repeat Check, Install and Relaunch once. The second check says Complete this release: 0.1.0-beta4 and adds Arti through the verified five-executable v2 bundle. Existing apps continue working during this transition; required Tor apps fail closed until completion. A complete beta4 installation reports up to date.

Both routes preserve app/wallet data and configuration and retain the previous binary generation. New installations use the full v2 bundle directly. See upgrade details.

Required-app isolation needs Bubblewrap and unprivileged Linux namespaces. Fresh PocketCHIP bootstrap installs Bubblewrap; OTA does not silently run root package operations. Systems missing it report the prerequisite and fail closed. This protects against accidental direct connections, not hostile same-user applications. Connected means bootstrapped local proxy readiness, not guaranteed reachability of every destination.

Validation: formatting, strict Clippy, full Rust/Python suites, Linux CI on Rust 1.91.0 and 1.91.1, simulator, uploaded checksums/inventories, real release-bundle update transactions, and isolated PocketCHIP tests for both the beta3.9 bridge and skipped-bridge route. Tor device validation passed all 15 tests, including real bootstrap, repeated restarts, direct IPv4/IPv6/DNS blocking and 480×272 UI checks. Release transaction tests used temporary installations; they did not replace the installed configuration or apps.

Assets: 20 files. Each architecture has a complete five-executable -v2.vtrbundle, a four-executable OTA entry-point bundle, and their SHA-256 sidecars. Matching ARM installer/session helpers are included. Requires glibc 2.36+ and SDL2 2.26.5+.

Release build and native/ARM verification: successful workflow.

Vitrallis Shell 0.1.0-beta3.9 — beta4 update bridge

This bridge release lets existing managed Vitrallis installations accept beta4’s five-executable bundle without reinstalling.

• Ships the original four-executable bundle: Shell, Terminal, Notepad and Files.
• Updates the downloader/installer to select the full v2 bundle and verify shared Arti 2.6.0 independently of the Shell version.
• Preserves application data, configuration, the previous generation and atomic update switching.

Use Settings → Device → Updates → Check / Install / Relaunch. Then update to beta4 through the same controls. This bridge does not include Tor itself.

Users who skip this release are also covered: beta4 supplies a compatible four-executable entry point, followed by one additional Settings update to complete the five-executable installation.

Validation: formatting, strict Clippy, complete Rust/Python suites, Linux CI on Rust 1.91.0 and 1.91.1, ARMv7 QEMU checks, uploaded asset/checksum verification, and the beta3.1 updater installing this release’s actual ARM bundle in an isolated PocketCHIP fixture. No installed device configuration or apps were replaced.

Assets: 16 files, covering Linux x86-64 and ARMv7 hard-float bundles, SHA-256 sidecars and matching ARM session helpers. Requires glibc 2.36+ and SDL2 2.26.5+.