clawdie/clawdie-iso
Watch
1
0
Fork
You've already forked clawdie-iso
 0
Code Issues Pull requests Projects Releases 1 Packages Activity Actions

docs(image): record master-ISO scope and the four-phase lifecycle #26

Closed
clawdie wants to merge 0 commits from clawdie/docs/custom-image-product into main AGit
pull from: clawdie/docs/custom-image-product
merge into: clawdie:main
Conversation 0 Commits - Files changed -
clawdie commented 2026-10-29 23:31:22 +01:00
Owner
Copy link

Rewrite the custom image plan around what is actually proven.

Scope decision: one master ZFS image, no per-customer partitions or size
tiers; storefront/SaaS deferred until that image builds, boots, and validates
on FreeBSD.

Removed: provider keys baked into clawdie/env, the 8-digit PIN sealing the seed
with openssl, PIN-by-email, the CLAWDIESEED dependency, secrets in PostgreSQL,
and build_queue.config as free-form JSON.

Added: spec -> build -> signed manifest -> digest-verified delivery; a
four-phase x four-domain lifecycle table (build, network/proxy, jails/storage,
identity/vault) with an explicit fallback row; and six claims the page does not
make - quarantine is not enforced (PF egress is open), no Asgard restore
verification exists (mock + fake key), name matching is not authorization
(capability class required), ZFS properties are observations, the build is part
of the trust boundary, and fallback is a path rather than degraded execution.

Gates: scripts/ci-checks.sh PASS (prettier, wiki-lint, dates, okf, bash -n,
poudriere regression).

Rewrite the custom image plan around what is actually proven. Scope decision: one master ZFS image, no per-customer partitions or size tiers; storefront/SaaS deferred until that image builds, boots, and validates on FreeBSD. Removed: provider keys baked into clawdie/env, the 8-digit PIN sealing the seed with openssl, PIN-by-email, the CLAWDIESEED dependency, secrets in PostgreSQL, and build_queue.config as free-form JSON. Added: spec -> build -> signed manifest -> digest-verified delivery; a four-phase x four-domain lifecycle table (build, network/proxy, jails/storage, identity/vault) with an explicit fallback row; and six claims the page does not make - quarantine is not enforced (PF egress is open), no Asgard restore verification exists (mock + fake key), name matching is not authorization (capability class required), ZFS properties are observations, the build is part of the trust boundary, and fallback is a path rather than degraded execution. Gates: scripts/ci-checks.sh PASS (prettier, wiki-lint, dates, okf, bash -n, poudriere regression).
docs(image): record master-ISO scope and the four-phase lifecycle
All checks were successful
format-check / gates (pull_request) Successful in 19s
Details
4df45d90e1 
Rewrite the custom image plan around what is actually proven.

Scope decision: one master ZFS image, no per-customer partitions or size
tiers; storefront/SaaS deferred until that image builds, boots, and validates
on FreeBSD.

Removed: provider keys baked into clawdie/env, the 8-digit PIN sealing the seed
with openssl, PIN-by-email, the CLAWDIESEED dependency, secrets in PostgreSQL,
and build_queue.config as free-form JSON.

Added: spec -> build -> signed manifest -> digest-verified delivery; a
four-phase x four-domain lifecycle table (build, network/proxy, jails/storage,
identity/vault) with an explicit fallback row; and six claims the page does not
make - quarantine is not enforced (PF egress is open), no Asgard restore
verification exists (mock + fake key), name matching is not authorization
(capability class required), ZFS properties are observations, the build is part
of the trust boundary, and fallback is a path rather than degraded execution.

Gates: scripts/ci-checks.sh PASS (prettier, wiki-lint, dates, okf, bash -n,
poudriere regression).
docs(image): name the role family and the forge dependency
All checks were successful
format-check / gates (pull_request) Successful in 18s
Details
bf4cc77c0d 
The identity system already defines the two roles this plan needs: Petelin
(Rooster) is the father - forge, pinned commits and build provenance; Kokos
(Mother Hen) is the mother - host authority, ZFS pool and one quorum vote.

Add a roles table with the barebones set (Kolibri, Golob, Kokos, Vrabec,
Cuvaj), the optional roles (Pav, Clawdie, Lisica, Max), and the mapping to
services, jails, mesh tags, and credential classes. Record that Petelin is a
requirement only for a self-hosted Mother; a hosted build inherits its package
repo's availability, which is how a missing quarterly package becomes an
unexplained build failure.

Gates: scripts/ci-checks.sh PASS.
docs(image): correct the role authority boundaries
All checks were successful
format-check / gates (pull_request) Successful in 18s
Details
c81ad2712e 
Four corrections, each verified against the sources and cleared by Jev
(0.90 Golob, 0.92 Kokos, 0.86 Petelin, 0.75 Lisica; two runs each):

- Golob is the canonical ledger (SQLite memory.db); Oxigraph and OpenViking are
  derived projections, and a derived fact is not promoted by existing
- Kokos hosts an enrolled signing slot, not an automatic quorum vote;
  independent custody and policy decide what the slot counts toward
- Petelin is required when the forge capability is operated, which may be a
  different host; a self-hosted host may consume externally built packages
- Lisica is optional only against a policy that names no protected transitions;
  the configurator rejects incompatible selections instead of weakening policy

Delivery now names three separate artifacts: confirmed specification, signed
release manifest, and separately provisioned installation identity.

Gates: scripts/ci-checks.sh PASS.
clawdie closed this pull request 2026-10-30 13:45:19 +01:00
All checks were successful
format-check / gates (pull_request) Successful in 18s
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
clawdie/clawdie-iso!26
No description provided.