Kwilabook

Kwilabook is a computer for children. Parents control what children can use.

Requirements

1. Admin and Student Access

• The computer must have separate Admin and Student access.
• Admins must be able to manage Kwilabook.
• Students must not be able to open Admin settings or use Admin features.

2. Websites

• Admins must be able to add and remove websites from the allowed list.
• Students must be able to visit websites on the allowed list.
• Students must not be able to visit other websites.

3. Android Apps

• Admins must be able to install, set up, and remove Android apps.
• Students must be able to use Android apps approved by Admins.
• Students must not be able to use other Android apps.

4. Screenshots

• The computer must take a screenshot at least every five minutes while a Student is using it.
• The computer must keep at least 30 days of screenshots.
• Admins must be able to view the last 30 days of screenshots.

5. Updates

• The computer must check for updates every night.
• It should try to install updates overnight. An update may be delayed if the computer is not connected to the internet or does not have power.
• Admins must be able to start an update manually.

Pause nightly updates until reboot (SSH only)

An admin can pause automatic updates remotely without sudo or a graphical authentication prompt:

ssh admin@kwilabook kwilabook-nightly-update-pause

The command stops the nightly timer and creates a root-owned marker in /run. Both the timer and nightly service refuse to start while that marker exists, including after system activation. The timer remains enabled; reboot clears the marker and restores normal scheduling. Manual updates remain available. The command is safe to repeat and does not interrupt an update already running; it reports failure if one is still running. There is no launcher UI for this command.

Update and generation-recovery checks

The committed updater failure contract is runnable through the flake check:

nix build .#checks.x86_64-linux.updater-failure-contract --no-link

A disposable non-Android NixOS VM was also exercised under QEMU TCG. It performed live generation A → B activation and explicit B → A recovery with switch-to-configuration test; it did not reboot or select a bootloader entry. The exact temporary NixOS test source and successful log are retained in .amp/in/artifacts/kwilabook-generation-recovery-test.nix and .amp/in/artifacts/kwilabook-generation-recovery-tcg.log for review, rather than being added as a new test: the repository's guidance prohibits adding Python source or runtime dependencies, while the stock make-test-python runner requires an embedded Python test script.