Sessiond coordinates the decisions that affect a personal device: lock and idle policy, power, device actions and the evidence those decisions consume. Applications and agents ask through its interfaces rather than maintaining a competing account of the session.
A request is not an observation
Requesting a lock does not establish that a lock surface exists. ViewTop owns the Wayland protocol and display-side acknowledgement. Sessiond consumes that fact before treating the transition as complete. A dark display is insufficient evidence.
Physical input, agent-originated input and typed software actions keep distinct provenance. Synthetic activity must not manufacture evidence that a person is present. Fresh credentials remain with the human and the authentication boundary.
Device policy in one place
Sensor readings, saved policy and action execution have different jobs. Their separation lets the system retain unknown or stale evidence without silently treating it as permission. The runtime also records a forensic chronology for examining what was requested and what happened.
Managed D-Bus application launch
The application executor probes NameHasOwner on the selected principal's
session bus with auto-start disabled. Only a successful typed false reply
permits starting the admitted service command. Bus errors, malformed replies,
and owner loss during lookup refuse the launch rather than implying absence.
An existing owner still passes the exact PID, UID, start-time and cgroup checks
before dispatch; a new service inherits the admitted Wayland connection.
This source repair is tracked by OS#135. CI and target-device validation remain required; source presence is not delivery.
What remains open
- Security claims require exercising the complete protocol and credential path on the target device.
- Some device-state and sensor code is still being separated into smaller owned components.
- A running session service does not establish that every device actuator has been exercised.