mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-11 22:54:01 +01:00
Krzysztof kuhy Rudnicki
fc4b504093
The on-device focus enforcer was overheating the phone by rebuilding firewall rules every tick. State-gate the work instead: - dns_enforcer.sh: only rebuild the DNS chain when it's missing, detached from OUTPUT, or the wrong rule count (chain_intact/expected_rule_count), instead of flushing+reinserting ~50-100 rules every tick (~50% netd CPU). - config.sh: throttle CURFEW_NET_REASSERT_INTERVAL 1s -> 15s (1s forked iptables every second all night, overheating); also whitelist com.kuhy.wake_alarm_sync (general + curfew-night lists). - focus_daemon.sh: build the blocked-system-apps file once at startup and memoize is_allowed() per tick. - deploy.sh: drop `su --mount-master` (removed in Magisk v26+). - SKILL.md: document the state-change-gate polling pattern. Verification: shellcheck clean; no-polling-antipatterns + evidence/contract hooks pass. Evidence + contract artifacts included. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017RRCdR4D8SaVrN2xraMQxM
17 lines
1.1 KiB
JSON
17 lines
1.1 KiB
JSON
{
|
|
"title": "phone_focus_mode CPU/overheat hardening",
|
|
"objective": "Eliminate redundant per-tick firewall and rule rebuilds in the on-device focus enforcer that were pegging netd and overheating the phone, without weakening enforcement or self-healing, and whitelist the wake_alarm_sync companion app.",
|
|
"acceptance_criteria": [
|
|
"DNS chain is rebuilt only when missing, detached from OUTPUT, or the wrong rule count; identical rebuilds are skipped.",
|
|
"Curfew net reassert runs every 15s instead of every 1s.",
|
|
"Blocked-system-apps file is built once at startup; is_allowed() is memoized per tick.",
|
|
"com.kuhy.wake_alarm_sync is present in both the general and curfew-night whitelists.",
|
|
"shellcheck --severity=warning passes on all four scripts and the no-polling-antipatterns hook passes."
|
|
],
|
|
"out_of_scope": [
|
|
"Replacing the interim iptables stopgap with a netd/eBPF per-UID firewall.",
|
|
"Any change to the Linux-side focus daemon (this is the Android/ADB enforcer)."
|
|
],
|
|
"verifier": "shellcheck --severity=warning + pre-commit no-polling-antipatterns hook + on-device netd CPU observation"
|
|
}
|