feat(display): add reviewed built-in profiles (DISP-04)

.gitattributes

@@ -5,6 +5,7 @@
 *.bats text eol=lf
 *.py text eol=lf
 *.json text eol=lf
+*.filt text eol=lf
 build/openbor/*.patch text eol=lf whitespace=-trailing-space,-space-before-tab
 tools/patches/*.patch text eol=lf whitespace=-trailing-space,-space-before-tab
 tools/bloom-device text eol=lf

.github/workflows/shell-test.yml

@@ -31,6 +31,7 @@ on:
       - 'tools/validate_core_selection_policy.py'
       - 'tools/display_auto_baseline.py'
       - 'tools/display_profile_policy.py'
+      - 'tools/display_built_in_profiles.py'
       - 'tools/validate_content_identity_policy.py'
       - 'tools/validate_libretro_artwork_policy.py'
       - 'tools/ci-scope.sh'
@@ -42,6 +43,7 @@ on:
       - 'build/core-selection-policy*.json'
       - 'build/display-auto-baseline.json'
       - 'build/display-profile-policy.json'
+      - 'build/display-built-in-profiles.json'
       - 'build/content-identity-policy.json'
       - 'build/libretro-artwork-policy.json'
       - 'build/ra-core-policy.json'

.gitignore

@@ -11,6 +11,7 @@ __pycache__/
 !/build/core-selection-policy.json
 !/build/display-auto-baseline.json
 !/build/display-profile-policy.json
+!/build/display-built-in-profiles.json
 !/build/libretro-artwork-policy.json
 !/build/themes.sha256
 !/build/provenance-policy.json

Makefile

@@ -185,6 +185,7 @@ core: $(CACHE)/.setup shared-libs
 	@cp $(ROOT_DIR)/build/transfer-policy.json $(BUILD_DIR)/.tmp_update/config/transfer-policy.json
 	@cp $(ROOT_DIR)/build/system-catalog.json $(BUILD_DIR)/.tmp_update/config/system-catalog.json
 	@cp $(ROOT_DIR)/build/libretro-artwork-policy.json $(BUILD_DIR)/.tmp_update/config/libretro-artwork-policy.json
+	@cp $(ROOT_DIR)/build/display-built-in-profiles.json $(BUILD_DIR)/.tmp_update/config/display-built-in-profiles.json
 
 # Build dependencies for installer
 	@mkdir -p $(INSTALLER_DIR)/bin

build/dependencies.lock

@@ -209,7 +209,7 @@ manifest = "build/legacy-manifest.json"
 schema = 1
 component_count = 336
 file_count = 2135
-byte_count = 314711917
+byte_count = 314717659
 source_build_components = 232
 unresolved_components = 104
 inherited_baseline = "07505ea58c7bba698d6b9220ff43946a43cac76b"

build/display-built-in-profiles.json

@@ -0,0 +1,173 @@
+{
+  "schema": 1,
+  "policy_id": "bloomos-display-built-in-profiles-v1",
+  "scope": {
+    "product": "ssd202d-only",
+    "devices": [
+      "miyoo-mini-v1",
+      "miyoo-mini-v2-v3",
+      "miyoo-mini-v4",
+      "miyoo-mini-plus",
+      "miyoo-mini-flip-my285"
+    ],
+    "runtime_device": "miyoo-mini-plus",
+    "auto_selection": false,
+    "auto_behavior": "preserve-disp01-baseline",
+    "physical_certification": false
+  },
+  "authorities": {
+    "core_selection_policy": {
+      "path": "build/core-selection-policy.json",
+      "hash_mode": "raw",
+      "sha256": "2754e459eba3270b910a0335d5f7212c01242030bb3734defec86cc849015871"
+    },
+    "auto_baseline": {
+      "path": "build/display-auto-baseline.json",
+      "hash_mode": "raw",
+      "sha256": "d56c3ae130f61c28632a3a0aa9b9cc16ec1cae2195366240b0d92d9f78e09d06"
+    },
+    "filter_contract": {
+      "path": "static/build/RetroArch/RetroArch_Dingux_forMiyooMini.txt",
+      "hash_mode": "raw",
+      "sha256": "952a2656351cec8e4aed103c0c8c79d7a3c80def71d7628651381aa88a6bc651"
+    },
+    "retroarch_license": {
+      "path": "third-party/RetroArch-patch/submodules/RetroArch/COPYING",
+      "hash_mode": "raw",
+      "sha256": "0b383d5a63da644f628d99c33976ea6487ed89aaa59f0b3257992deac1171e6b"
+    }
+  },
+  "activation_contract": {
+    "selection_key": "exact-device-system-core",
+    "review_status": "source-reviewed",
+    "missing_profile": "unavailable-without-mutation",
+    "filter_path": "fixed-signed-runtime-path-never-user-input",
+    "filter_integrity": "exact-size-and-sha256-before-session-composition",
+    "axis_independence": "profile-supplies-capabilities-without-changing-selections"
+  },
+  "profiles": [
+    {
+      "id": "plus-gb-gambatte-lcd3x-v1",
+      "device_id": "miyoo-mini-plus",
+      "system_id": "gb",
+      "candidate_id": "gambatte",
+      "core_binary": "gambatte_libretro.so",
+      "source_geometry": {
+        "width": 160,
+        "height": 144,
+        "rotation_quarter_turns": 0,
+        "display_aspect": {"numerator": 10, "denominator": 9},
+        "authority": "reviewed-system-core-profile"
+      },
+      "effect": {
+        "id": "lcd3x-light",
+        "class": "lcd",
+        "descriptor": {
+          "source_path": "static/build/RetroArch/.retroarch/filters/video/Grids/LCD3x/LCD3x_light.filt",
+          "runtime_path": "/mnt/SDCARD/RetroArch/.retroarch/filters/video/Grids/LCD3x/LCD3x_light.filt",
+          "hash_mode": "text-lf",
+          "bytes": 21,
+          "sha256": "607c0fb49e6d3524972b9bfcbb88c5df644914e39f9474bcf9c9a86505e10bf9"
+        },
+        "implementation": {
+          "source_path": "static/build/RetroArch/.retroarch/filters/video/Grids/LCD3x/lcd3x_light.so",
+          "runtime_path": "/mnt/SDCARD/RetroArch/.retroarch/filters/video/Grids/LCD3x/lcd3x_light.so",
+          "hash_mode": "raw",
+          "bytes": 9588,
+          "sha256": "939c552b50b02472b438c35c3036c6173bbbf2f610c7abcc0f3c8e1a9d37b13e"
+        }
+      },
+      "qualification": {
+        "review_status": "source-reviewed",
+        "device_evidence_status": "pending",
+        "evidence_ids": ["retroarch-miyoomini-filter-contract"]
+      }
+    },
+    {
+      "id": "plus-gbc-gambatte-lcd3x-v1",
+      "device_id": "miyoo-mini-plus",
+      "system_id": "gbc",
+      "candidate_id": "gambatte",
+      "core_binary": "gambatte_libretro.so",
+      "source_geometry": {
+        "width": 160,
+        "height": 144,
+        "rotation_quarter_turns": 0,
+        "display_aspect": {"numerator": 10, "denominator": 9},
+        "authority": "reviewed-system-core-profile"
+      },
+      "effect": {
+        "id": "lcd3x-light",
+        "class": "lcd",
+        "descriptor": {
+          "source_path": "static/build/RetroArch/.retroarch/filters/video/Grids/LCD3x/LCD3x_light.filt",
+          "runtime_path": "/mnt/SDCARD/RetroArch/.retroarch/filters/video/Grids/LCD3x/LCD3x_light.filt",
+          "hash_mode": "text-lf",
+          "bytes": 21,
+          "sha256": "607c0fb49e6d3524972b9bfcbb88c5df644914e39f9474bcf9c9a86505e10bf9"
+        },
+        "implementation": {
+          "source_path": "static/build/RetroArch/.retroarch/filters/video/Grids/LCD3x/lcd3x_light.so",
+          "runtime_path": "/mnt/SDCARD/RetroArch/.retroarch/filters/video/Grids/LCD3x/lcd3x_light.so",
+          "hash_mode": "raw",
+          "bytes": 9588,
+          "sha256": "939c552b50b02472b438c35c3036c6173bbbf2f610c7abcc0f3c8e1a9d37b13e"
+        }
+      },
+      "qualification": {
+        "review_status": "source-reviewed",
+        "device_evidence_status": "pending",
+        "evidence_ids": ["retroarch-miyoomini-filter-contract"]
+      }
+    },
+    {
+      "id": "plus-gba-gpsp-lcd2x-v1",
+      "device_id": "miyoo-mini-plus",
+      "system_id": "gba",
+      "candidate_id": "gpsp",
+      "core_binary": "gpsp_libretro.so",
+      "source_geometry": {
+        "width": 240,
+        "height": 160,
+        "rotation_quarter_turns": 0,
+        "display_aspect": {"numerator": 3, "denominator": 2},
+        "authority": "reviewed-system-core-profile"
+      },
+      "effect": {
+        "id": "lcd2x",
+        "class": "lcd",
+        "descriptor": {
+          "source_path": "static/build/RetroArch/.retroarch/filters/video/Grids/LCD2x/LCD2x.filt",
+          "runtime_path": "/mnt/SDCARD/RetroArch/.retroarch/filters/video/Grids/LCD2x/LCD2x.filt",
+          "hash_mode": "text-lf",
+          "bytes": 15,
+          "sha256": "ad1d54093dab88a56ca91138b794e35702fec9ebbe3a1d865f868227e9432b28"
+        },
+        "implementation": {
+          "source_path": "static/build/RetroArch/.retroarch/filters/video/Grids/LCD2x/lcd2x.so",
+          "runtime_path": "/mnt/SDCARD/RetroArch/.retroarch/filters/video/Grids/LCD2x/lcd2x.so",
+          "hash_mode": "raw",
+          "bytes": 5492,
+          "sha256": "31fec21ab644e300d2ce1367a1461da0eac4a8d1c369108edde2f493ef19b081"
+        }
+      },
+      "qualification": {
+        "review_status": "source-reviewed",
+        "device_evidence_status": "pending",
+        "evidence_ids": ["retroarch-miyoomini-filter-contract"]
+      }
+    }
+  ],
+  "unsupported": {
+    "devices": [
+      "miyoo-mini-v1",
+      "miyoo-mini-v2-v3",
+      "miyoo-mini-v4",
+      "miyoo-mini-flip-my285"
+    ],
+    "effect_classes": ["crt"],
+    "artwork": "no-reviewed-built-in-bezels",
+    "alternate_cores": "explicitly-unavailable-until-reviewed",
+    "behavior": "preserve-auto-or-report-unavailable-without-partial-config"
+  }
+}

build/display-profile-policy.json

@@ -10,8 +10,8 @@
       "miyoo-mini-plus",
       "miyoo-mini-flip-my285"
     ],
-    "runtime_integration": "deferred-to-DISP-03",
-    "built_in_profiles": "deferred-to-DISP-04",
+    "runtime_integration": "enabled-in-DISP-03",
+    "built_in_profiles": "enabled-in-DISP-04",
     "custom_packs": "deferred-to-DISP-05",
     "permanent_retroarch_config_mutation": false,
     "physical_certification": false
@@ -26,6 +26,11 @@
       "path": "static/build/.tmp_update/bin/bloom-platform",
       "hash_mode": "text-lf",
       "sha256": "ccc3d1ad7efd29c8864a2b274c6af1ab6aff5efe9c5098dbe1b542ceaa11258d"
+    },
+    "built_in_profiles": {
+      "path": "build/display-built-in-profiles.json",
+      "hash_mode": "raw",
+      "sha256": "c79a17aac3acd428cd21f1edffc0399e7917b73d38b12e490f7233368b53ee7b"
     }
   },
   "public_controls": [

build/legacy-manifest.json

@@ -488,8 +488,8 @@
       "kind": "runtime",
       "path": "static/build/.tmp_update/bin/bloom-dev-deploy",
       "file_count": 1,
-      "byte_count": 33011,
-      "tree_sha256": "4dd16ce6d73174d683d2b6b43161024a1694de4b48c58842ce89e80b15fa394e",
+      "byte_count": 33126,
+      "tree_sha256": "225e52c83020c0ebd88732688e8731125cc56fd912b77a010eb9696f2ade7ec9",
       "source": "https://github.com/boburning/BloomOS",
       "source_revision": "release-commit",
       "license": "GPL-3.0-only",
@@ -527,8 +527,8 @@
       "kind": "runtime",
       "path": "static/build/.tmp_update/bin/bloom-display-session-prepare",
       "file_count": 1,
-      "byte_count": 3190,
-      "tree_sha256": "5c4dff01fab14bac6d77ae7d0109d04e6b6eb736038a7d145f8d62db57b8a9bc",
+      "byte_count": 8817,
+      "tree_sha256": "89c91893f9f61d8c58853ad6f3602041bfc7935911745d4e5c8b216d6727bdc3",
       "source": "https://github.com/boburning/BloomOS",
       "source_revision": "release-commit",
       "license": "GPL-3.0-only",

docs/1.0_TEST_MATRIX.md

@@ -23,6 +23,7 @@ observable properties and never substitutes for physical UX review.
 | Display Auto compatibility | Deterministic per-system/core effective visual fixture plus explicit no-selectable-core catalog dispositions; exact policy/catalog/manifest, core binary, core metadata, global, core-override, and content-directory hashes; representative legacy geometry/effect assertions; runtime user and per-game overrides excluded |
 | Display profile semantics | Exact Scaling, Screen Effect, and Bezel controls; disjoint geometry/sampling/effect/artwork key ownership; PLAT-01 framebuffer capability; bounded centered Auto/integer/aspect/fill geometry fixtures for 640x480 and 752x560; invalid geometry and stale/coupled/unsafe policy mutations fail without partial config |
 | Display settings and session composer | Canonical backward-compatible display selections; exact enum rejection; no Onion projection; observed framebuffer input; independent axis fallback; one private `0600` RetroArch append config shared with achievements; no permanent-config mutation; decorator failure and timeout preserve the immutable base launch |
+| Built-in display profiles | Versioned signed authority; exact Mini Plus device/system/default-core joins for GB, GBC, and GBA; reviewed source geometry/aspect and packaged LCD2x/LCD3x-light descriptor plus implementation hashes; exact filter byte/hash verification before use; Auto unchanged; alternate devices/cores, CRT, custom effects, and bezels fail unavailable |
 | Performance | Input/render timings, 30-minute shell soak, 500 open/back cycles |
 | Privacy | Allowlisted health/support export contains no private data |
 | Developer deployment | Dual-marker/update/session preflight; deterministic allowlisted manifest; exact byte/hash/mode transfer; sealed slots; atomic activation; readiness auto-rollback; active/previous overlay; bounded cleanup; ordinary network-helper activation denied |

docs/ARCHITECTURE.md

@@ -1410,6 +1410,27 @@ and shell punctuation remain data. The runner retains all safety boundaries:
 explicit developer mode, supported-system allowlisting, ROM confinement,
 bounded duration, structured launch/session handling, and save flushing.
 
+## Built-in display profile authority
+
+`build/display-built-in-profiles.json` is the schema-1 DISP-04 authority for
+reviewed display identities. It is included in the signed payload and joined at
+session preparation by exact device, canonical system, and selected core. The
+initial authority is deliberately narrow: Mini Plus with the default Gambatte
+core for GB/GBC and default gpSP core for GBA. Each row owns reviewed source
+geometry and aspect plus the exact packaged LCD filter descriptor and
+implementation size and SHA-256. Auto remains the complete DISP-01 baseline;
+the catalog never performs implicit selection.
+
+`bloom-display-session-prepare` trusts the canonical launch request for system
+and core identity and `bloom-platform` for the device. It reads only the signed
+catalog location, resolves one exact row, verifies the selected filter bytes,
+and passes reviewed numeric geometry and one fixed filter path to
+`bloom-launch`. The native composer uses checked integer geometry and emits only
+its display-owned keys into the private session config. It accepts no arbitrary
+path or raw RetroArch setting. Unsupported devices, alternate cores, missing or
+stale filter bytes, CRT, custom effects, and bezels resolve unavailable without
+partially applying that axis or mutating global RetroArch configuration.
+
 ## Development deployment overlay
 
 `bloom-dev-deploy` provides the device half of the guarded Hot/Warm development

docs/DISPLAY_PROFILE_POLICY.md

@@ -58,13 +58,28 @@ python3 tools/display_profile_policy.py geometry \
 
 ## Capability and delivery boundaries
 
-Explicit LCD and CRT modes require a qualified signed built-in effect profile;
-those assets belong to DISP-04. Auto effect and Auto bezel resolve to None when
-no reviewed profile exists. Custom effect and bezel selections accept only a
-validated bounded pack ID after DISP-05, never an arbitrary filesystem path.
-
-DISP-02 does not add settings, assets, runtime config writes, or device code.
-DISP-03 will integrate the policy with `bloom-settings` and the one trusted
-temporary session config composer. Permanent `retroarch.cfg` mutation remains
-forbidden. This host-only authority is not evidence of ideal visual output,
-LCD quality, gameplay, physical controls, or certification for any device.
+DISP-04 adds one signed, versioned built-in profile authority without changing
+Auto. It reviews only the Mini Plus default GB/GBC Gambatte and GBA gpSP
+selectors: GB/GBC use the packaged LCD3x-light filter and GBA uses the packaged
+LCD2x filter, with exact source geometry, aspect, descriptor and implementation
+hashes. Selection is an exact device/system/core join. Mini V1-V4, Flip,
+alternate cores, CRT, bezels, and custom packs remain unavailable rather than
+inferred.
+
+DISP-03 integrated the policy with `bloom-settings` and the one trusted
+temporary session config composer. DISP-04 supplies reviewed source geometry
+and a fixed packaged filter identity to that composer. Permanent
+`retroarch.cfg` mutation remains forbidden. Host and remote Mini Plus evidence
+does not certify ideal LCD output, gameplay, physical controls, audio, or any
+other device revision.
+
+Validate or resolve the built-in authority with:
+
+```sh
+python3 tools/display_built_in_profiles.py validate \
+  --repository . --policy build/display-built-in-profiles.json
+
+python3 tools/display_built_in_profiles.py resolve \
+  --repository . --policy build/display-built-in-profiles.json \
+  --device miyoo-mini-plus --system gba --core gpsp_libretro.so
+```

docs/DISPLAY_SESSION_COMPOSER.md

@@ -26,23 +26,29 @@ the validated display contribution and atomically replace the same file.
 
 `auto` does not rewrite an axis from the DISP-01 baseline. `fill`, nearest or
 linear sampling, effect `none`, and bezel `none` have complete typed composer
-implementations. Integer Pixels and Correct Aspect remain unavailable until a
-trusted source raster/aspect is connected. LCD, CRT, and custom effect or
-bezel selections remain unavailable until DISP-04/DISP-05 provide reviewed
-identities. An unavailable selection resolves that axis to `auto`, records a
-bounded reason, and emits no partial keys for that axis.
+implementations. DISP-04 connects trusted source raster/aspect and a fixed
+filter identity for three exact Mini Plus default-core selectors: GB/GBC with
+Gambatte and GBA with gpSP. Integer Pixels and Correct Aspect can therefore be
+composed for those selectors, and LCD selects the reviewed packaged LCD3x-light
+or LCD2x filter. Other devices, systems, cores, CRT, custom effects, and bezels
+remain unavailable. An unavailable selection resolves that axis to `auto`,
+records a bounded reason, and emits no partial keys for that axis.
 
 The display owner can emit only the allowlisted display keys in
 `bloom_retroarch_config.c`; it cannot emit achievement, input-safety, driver,
-network, or arbitrary filesystem settings. Custom selections are bounded IDs
-in settings and never become raw paths in DISP-03.
+network, or arbitrary filesystem settings. The session helper accepts only a
+catalog path from the signed payload and verifies the selected filter's exact
+size and SHA-256 before passing its fixed `/mnt/SDCARD/RetroArch/.retroarch/filters/video/`
+path. Custom selections are bounded IDs in settings and never become raw paths.
 
 Validation:
 
 ```sh
 make test GTEST_FILTER='BloomSettingsTest.*:BloomRetroarchConfigTest.*:BloomLaunchTest.*'
 docker run --rm -v "$PWD:/workspace" -w /workspace \
   ghcr.io/boburning/bloomos-shell-test@sha256:36adeca7c265345688ebf47b575c56e350b9016257e0a9ed15c63dc7e0447d63 \
+  test/shell/display_built_in_profiles.bats \
+  test/shell/display_profile_policy.bats \
   test/shell/display_session_prepare.bats \
   test/shell/bloom_session.bats \
   test/shell/ra_session_prepare.bats

docs/SECURITY.md

@@ -330,4 +330,14 @@ older-schema status cannot invoke any primary network operation. This prevents
 stale or lossy Boolean projection from repeatedly restarting a connection in
 progress or treating an unknown backend contract as authorization.
 
+Built-in display profiles are data, not a path-selection capability. The signed
+schema-1 authority permits only exact Mini Plus device/system/default-core
+selectors and repository-owned filter identities. Session preparation verifies
+the selected descriptor and implementation size and SHA-256, and the native
+composer accepts only a fixed path below
+`/mnt/SDCARD/RetroArch/.retroarch/filters/video/` with no traversal or unsafe
+characters. User settings choose typed semantic modes; they never supply a raw
+RetroArch key, path, geometry, or filter. The resulting contribution is private
+session state and cannot mutate global RetroArch configuration.
+
 Security-sensitive migrations and repair operations must be bounded, logged, reversible where possible, and validated before activation.