fix(drivers): let a channel driver control what it was ported to control

[frahlg]

Pairs with srcfl/device-drivers#31.

directManifestRuntimePolicy refused any device-drivers artifact that was not marked read-only, and the channel marked every one of them read-only. Meanwhile the bundled copy — a pinned snapshot of the same repository since #673 — carries no runtime policy at all and drives batteries fine.

One source file, two behaviours, decided by where the file came from.

What changes

A driver the channel publishes with control_enabled now gets no runtime policy — exactly what the bundled copy of that same source already gets. A driver that declares itself read-only still gets a read-only policy bound to its signed identity and permissions, as before.

read_only and control_enabled are two spellings of one fact, so a manifest where they agree with each other — both true, or both false — is refused. A driver that may control while claiming to be read-only reads as safe to anything that checks only one of them.

Merge order

This side has to reach the field before device-drivers#31 publishes controlling artifacts. A gateway on an older build refuses to load them (public FTW driver lacks signed read-only policy), so it would simply keep running what it has — no breakage, but no update either.

What this means

The signature still guarantees the artifact is authentic and unmodified. It no longer constrains what the artifact may do; a controlling driver from the channel has the same reach as the same driver bundled in the build. That is the intended trade — the alternative was drivers that cannot do the thing they were written for.

For measuring without controlling, observe_only already exists per driver in the configuration and skips dispatch and the watchdog.

make verify clean.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e72cce908d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Define the optimizer channel markup before rendering

Whenever /api/components has loaded and the Updates dialog renders, _componentsSectionHTML() still interpolates optimizerChannelButtons, but this replacement block removes that declaration and only creates the unused optimizerTarget. The resulting ReferenceError aborts _render(), so the normally populated update dialog cannot open; either remove the stale interpolation now that channels moved or keep the variable defined.

Useful? React with 👍 / 👎.