docs/custom-image-product #28

Merged

clawdie merged 3 commits from docs/custom-image-product into main

2026-10-30 00:31:27 +01:00

clawdie commented

2026-10-30 00:30:54 +01:00

Owner

No description provided.

clawdie added 3 commits

2026-10-30 00:30:54 +01:00

docs(image): record master-ISO scope and the four-phase lifecycle

format-check / gates (pull_request) Successful in 19s

Details

4df45d90e1

Rewrite the custom image plan around what is actually proven.

Scope decision: one master ZFS image, no per-customer partitions or size
tiers; storefront/SaaS deferred until that image builds, boots, and validates
on FreeBSD.

Removed: provider keys baked into clawdie/env, the 8-digit PIN sealing the seed
with openssl, PIN-by-email, the CLAWDIESEED dependency, secrets in PostgreSQL,
and build_queue.config as free-form JSON.

Added: spec -> build -> signed manifest -> digest-verified delivery; a
four-phase x four-domain lifecycle table (build, network/proxy, jails/storage,
identity/vault) with an explicit fallback row; and six claims the page does not
make - quarantine is not enforced (PF egress is open), no Asgard restore
verification exists (mock + fake key), name matching is not authorization
(capability class required), ZFS properties are observations, the build is part
of the trust boundary, and fallback is a path rather than degraded execution.

Gates: scripts/ci-checks.sh PASS (prettier, wiki-lint, dates, okf, bash -n,
poudriere regression).

docs(image): name the role family and the forge dependency

format-check / gates (pull_request) Successful in 18s

Details

bf4cc77c0d

The identity system already defines the two roles this plan needs: Petelin
(Rooster) is the father - forge, pinned commits and build provenance; Kokos
(Mother Hen) is the mother - host authority, ZFS pool and one quorum vote.

Add a roles table with the barebones set (Kolibri, Golob, Kokos, Vrabec,
Cuvaj), the optional roles (Pav, Clawdie, Lisica, Max), and the mapping to
services, jails, mesh tags, and credential classes. Record that Petelin is a
requirement only for a self-hosted Mother; a hosted build inherits its package
repo's availability, which is how a missing quarterly package becomes an
unexplained build failure.

Gates: scripts/ci-checks.sh PASS.

docs(image): correct the role authority boundaries

format-check / gates (pull_request) Successful in 18s

Details

c81ad2712e

Four corrections, each verified against the sources and cleared by Jev
(0.90 Golob, 0.92 Kokos, 0.86 Petelin, 0.75 Lisica; two runs each):

- Golob is the canonical ledger (SQLite memory.db); Oxigraph and OpenViking are
  derived projections, and a derived fact is not promoted by existing
- Kokos hosts an enrolled signing slot, not an automatic quorum vote;
  independent custody and policy decide what the slot counts toward
- Petelin is required when the forge capability is operated, which may be a
  different host; a self-hosted host may consume externally built packages
- Lisica is optional only against a policy that names no protected transitions;
  the configurator rejects incompatible selections instead of weakening policy

Delivery now names three separate artifacts: confirmed specification, signed
release manifest, and separately provisioned installation identity.

Gates: scripts/ci-checks.sh PASS.

clawdie merged commit 91450550d8 into main

2026-10-30 00:31:27 +01:00

clawdie deleted branch docs/custom-image-product

2026-10-30 00:31:27 +01:00

clawdie referenced this pull request from a commit

2026-10-30 00:31:28 +01:00

Merge pull request 'docs/custom-image-product' (#28) from docs/custom-image-product into main