Integrate verified Pi kiosk release-readiness work

jdh commented

2026-07-23 12:11:36 -04:00

Owner

Supersedes PR #1 and all older agent/repro branches. Includes the complete release-ready candidate plus fail-closed staged-systemd validation. Local repository gate: 116 tests passed with exactly one declared root-only skip. Do not merge until the dedicated printago-pi-ci check is green.

jdh added 19 commits

2026-07-23 12:11:37 -04:00

Authenticate complete staged runtime tree d93ee83bbe

Pin release and image workflow checkouts 0326a230c2

Add isolated unprivileged Pi pull request CI 6b0820e855

Harden privileged Pi release workflows 70cb016eb9

Require explicit browser scanner pairing addb33d325

Bind QEMU attempts to emulator provenance ffde81d91b

Classify Pi image QEMU evidence b3b2fce1b2

Contain Pi file selection and correct scanner claims d189fead31

Require Pi QEMU guest contract evidence 78dbc3b4fd

Fix kiosk boot-blocking runtime.env perms and cage VT escape 7f922ef1cc

Adversarial release audit of the Pi image recipe found a ship-stopper and
a lockdown gap that the host/QEMU evidence levels cannot observe.

- CRITICAL: printago-kiosk-configure wrote /etc/printago-kiosk/runtime.env
  mode 0640 with no chown, so as root it stayed root:root. The kiosk
  launcher sources that file as the unprivileged kiosk user under set -eu,
  which then hits EACCES and the kiosk service crash-loops into its start
  limit into a permanent black screen. The serial-scanner unit masks it
  (systemd reads its EnvironmentFile as root) and the QEMU smoke masks the
  kiosk service, so no automated level catches it. Write runtime.env 0644
  (named RUNTIME_ENV_MODE) so the root-owned file is readable by the kiosk
  user; it holds no secrets and its root:kiosk 0750 parent still blocks
  other users.
- MEDIUM: the kiosk cage session ran with -s (Allow VT switching), so a
  physical Ctrl+Alt+F<n> could leave the kiosk for a getty login. Drop -s
  (cage's secure default).

Regression coverage: test_configure pins runtime.env other-readability
(portable constant check plus a POSIX stat check); validate-mounted-image
asserts runtime.env 0644 and that the cage session does not enable VT
switching; README adds a VT-switch physical acceptance item. Pi suite
104 tests, 5 POSIX-only skips, recipe validation passes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

State absent-release reality in flash guide and runner evidence in status eb8320241f

- docs/FLASH-AND-DEPLOY.md: lead with the fact that zero releases exist, so
  the download/verify steps are not followable yet.
- CURRENT-RELEASE-STATUS.md: list both required runner labels
  (printago-pi-builder, printago-pi-ci) and record zero Actions runs and
  zero published releases as of 2026-07-22.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Harden Pi stable promotion and public evidence c09b0429ff

Document honest Pi release and rollback boundaries 59fc88de95

Close final Pi release audit gaps 132ae45988

Make Pi physical acceptance API and model scoped 073296395c

Require both Pi models for shared stable channel 6d38f8d79d

docs: complete Pi operator lifecycle handoff ebc698b97a

feat: add manual no-signing image mode 2ca619a1c3

Fix staged systemd validation in Pi CI

CI / verify (pull_request) Successful in 8s

Details

3915345227

jdh referenced this pull request