v2 Appliance Roadmap — sequencing & gates (provisional)

[VijitSingh97]

Single source of truth for the v2 appliance plan — same format as #364. Re-sequenced 2026-08-13: the machine exists and the roadmap's job has changed. Everything below describes what is shipped and proven versus what still gates the release tier. The full ADR trail lives in docs/dev/dual-distribution-plan.md; the release mechanics in docs/dev/appliance-release.md.

The theme: v2 turned the stack from software you install into a machine you boot — and that machine now boots. One immutable image (Debian 13, RAUC A/B — chosen over Rugix by the 2026-07-25 bake-off on stability grounds, fault-injection proven), read-only root, single /data persistence, the stack on Podman via the compose bridge, everything Tor-first. The DIY channel stays Docker Compose, byte-identical. What remains before the tier opens is parity, proof, and polish — not construction.

Shipped and proven (phases 0–3 of #77, RC20 line)

• Boots / updates / installs / provisions: KVM battery phases boot · update (A/B + rollback + commit gate) · install (one-page installer, reinstall tiers) · provision (headless from pre-seed; wizard with one-time token) · fault injection (power cuts mid-write/mid-commit, corrupt bundle). tests/os/run.sh is the release gate, tests/os/verify-image.sh the static half.
• Boot contract: pithead-boot renders derived config every boot, compose owns the stack, rauc status mark-good only after the dashboard answers through Caddy + doctor --json — derived is regenerated, state is validated, never the reverse.
• Security posture: cosign-mandatory releases; RAUC release keys with custody runbook (dev builds refuse without --dev); Tor egress fail-closed under netavark (proven live); shell-less release variant; per-machine host identity (SSH host keys + machine-id) generated on /data, never baked (2026-08-13); stale-artifact build guard.
• Roles: one stick provisions Pithead / Pithead + RigForge / RigForge (Master installer image: one stick provisions a Pithead coordinator, a RigForge rig, or both #797) — the rig phase runs in the battery; merged hugepage budget proven on the bench.

The parity arc — #786, decided 2026-08-13

Host-CLI-only settings were impossible to change on a shell-less box. Decision record on #786 (peer research: Talos, HAOS, TrueNAS/OPNsense, Synology/UniFi/umbrel):

• GA bar (in implementation now): Appliance backup export from the dashboard: encrypted archive + one-time emergency kit #908 backup export with one-time emergency kit · Restore at setup: the wizard accepts an encrypted backup in place of the config form #909 restore at setup · Physical-presence config channel: removable media applied at boot with console countdown #910 removable-media config channel (boot-time, console diff + countdown, credential-less by design — also the forgot-password path).
• Fast-follows: Out-of-band approval at the commit gate: host-verified, non-destructive sensitive keys only #911 host-verified remote approval (non-destructive keys only; the one genuinely novel design) → Fleet descriptor editing behind the approval channel #912 fleet descriptor edits, Surface the existing CLI remainder on the dashboard: support bundle, doctor detail, rotations #913 surfacing the existing doctor/support-bundle/rotations.
• Pending operator decision: tari_required=true stops Monero mining during a Tari-only outage — measured 22 minutes of zero revenue on the bench #897 as PR A Tari-only outage never rejects workers (issue 897, option 1) — HELD FOR OPERATOR DECISION #922 (Tari-only outage keeps mining Monero) — merge ratifies, close keeps today's behavior.

Hardening backlog (filed 2026-08-13 audit)

#923 factory-reset/wedged-/data reformat never battery-exercised · #924 headless setup() silent no-op · #925 role-select undocumented · #926 partition-derivation consolidation · #927 worker-verb dedup. Plus #851 (migration-manifest fields, open by design until a real migration exists) and #821 (RigForge repin, blocked on their next tagged release).

Release status — tier not open. Gates:

• KVM battery green per cut on the current tip (now includes identity-survival, hugepage, and honest fault-C asserts)
• Appliance feature parity: everything host-CLI-only is impossible on a shell-less box #786 GA bar merged: Appliance backup export from the dashboard: encrypted archive + one-time emergency kit #908 + Restore at setup: the wizard accepts an encrypted backup in place of the config form #909 + Physical-presence config channel: removable media applied at boot with console countdown #910
• 7-day unattended soak on the Comprehensive end-to-end infrastructure test matrix on a real Ubuntu server (full Monero + Tari node) #54 bench with zero interventions
• Repin the baked RigForge tree to a tagged release once one carries appliance mode #821 repin at the next tagged RigForge release
• docs/appliance.md never documents the installer's role select #925 role-select documentation (an operator can meet the erase page informed)
• Release lane per docs/dev/appliance-release.md exercised end-to-end for the first public cut

#479 (screenshots) rides the v1.12 milestone, not this tier.

[VijitSingh97]

Roadmap sync (2026-08-02): #77 phase 2-3 SHIPPED and soak-proven — RC20 declared on #797 (verify-image 53/53, KVM battery green after harness fixes, 6h18m overnight soak 1517/0 shares with a fleet rig attached). Both role (#796) live; R3 role select in review; R4 (rig boot leg) is next. Branch model simplified: develop-v2 is THE v2 integration line (bakery feature branch retired at 5336628). Update/scan posture landed via #841 (rootfs CVE scan, digest tracking, pin-watch). Remaining on this roadmap: R4, R5 (naming/branding), #786 sub-issues (awaiting operator answers), #821 (awaiting a rigforge tag), plus the closing architecture+security audit against the original plan.

🤖 Generated with Claude Code

[VijitSingh97]

Architecture audit vs the original v2 plan (2026-08-02)

A full pass over the appliance as-shipped (origin/develop-v2) against the ratified plan — immutable, IoT-style, A/B-updated image with one shared data folder. The verdict is that the core thesis holds: root is genuinely read-only, /data is the single state partition, derived config is rebuilt every boot (RC13 #790–#793), A/B install/rollback/fault are proven 11/11 on the bench. The gaps are at the edges the plan itself flagged as load-bearing, and they cluster in security and update-completeness.

Dimension verdicts

1. Immutability — solid. Read-only root; writable surfaces are exactly /data, the /var→/data overlay, /run, and the /etc tmpfs overlay for console-login/ssh (all derived, gone on power-off). No load-bearing mutable state lives off /data. Machine-id and SSH host keys are the one wrinkle (baked at image build, reset only by the installer) — already noted in KNOWN-ISSUES.
2. Single-data-folder — solid on mechanism, thin on contract. pithead-sync (program→/data), pithead-mount-generator (disk-derived, never by label), and the installer's keep/data/all wipe tiers all respect derived-vs-state. What is missing is a written /data layout contract a backup tool or operator could rely on, and the plan's two-tier reset — now filed as Appliance: two-tier reset (config + factory) and wedged-/data recovery are unimplemented #849.
3. Update posture — the weak axis. Install/commit/rollback/fault are real and tested. But: the commit gate is a curl probe, not the specified doctor --json (Appliance: A/B commit gate is curl-localhost, not the plan's 'pithead doctor --json' (narrower gate + doc mismatch) #852); there is no downgrade floor and no minimum_os_version (os-update has no version floor: a signed older bundle installs and commits (downgrade attack), minimum_os_version unimplemented #856); the migration-deadlock rule + data_migration/db_schema manifest fields are unbuilt (Appliance: migration-deadlock rule (data_migration flag) and manifest compatibility fields not implemented #851); the debug→release / release→debug variant transitions strand or backdoor a box (A/B update variant mismatch: a debug (SSH) box that installs a release bundle silently loses its only management channel #819 / os-update variant gate is one-directional: a release box installing a debug bundle silently gains a root SSH backdoor #854); and there is still no user-facing OS-update path (KNOWN-ISSUES, pre-GA blocker).
4. Drift from plan. The phase-0 netavark egress firewall was reported built but is not in the tree — the appliance is fail-open while log and doctor say enforced (Appliance: Tor-only egress firewall is fail-open under podman/netavark (DOCKER-USER chain never traversed) while log + doctor report it enforced #855). RAUC release-key custody is a dangling doc cross-reference (RAUC update-bundle signing key has no documented custody, generation, or rotation process #850, plus verify-image/chain-shape follow-ups in a comment there). Watchdog + CPU governor are specified but unbaked (Appliance: no hardware/systemd watchdog or CPU governor baked (plan calls for both) #853). Offline-first-boot is partial (only the wizard image is baked) and appliance size/full-bake are deliberately deferred (KNOWN-ISSUES).

Issues from this audit

Security-relevant first:

• Appliance: Tor-only egress firewall is fail-open under podman/netavark (DOCKER-USER chain never traversed) while log + doctor report it enforced #855 — Tor-only egress firewall fail-open under podman/netavark (the phase-0 port that was reported done but never landed). This is the single biggest risk.
• os-update has no version floor: a signed older bundle installs and commits (downgrade attack), minimum_os_version unimplemented #856 — os-update has no version floor; a signed older bundle installs and commits (downgrade).
• RAUC update-bundle signing key has no documented custody, generation, or rotation process #850 — RAUC signing-key custody undocumented (+ verify-image can't detect a dev keyring, chain-shape — in a comment).
• os-update variant gate is one-directional: a release box installing a debug bundle silently gains a root SSH backdoor #854 / A/B update variant mismatch: a debug (SSH) box that installs a release bundle silently loses its only management channel #819 — variant-transition backdoor / lockout.

Correctness:

• Appliance: migration-deadlock rule (data_migration flag) and manifest compatibility fields not implemented #851 — migration-deadlock rule + manifest compatibility fields unimplemented.
• Appliance: A/B commit gate is curl-localhost, not the plan's 'pithead doctor --json' (narrower gate + doc mismatch) #852 — commit gate is curl-localhost, not doctor --json (narrower than spec).
• Appliance: two-tier reset (config + factory) and wedged-/data recovery are unimplemented #849 — two-tier reset + wedged-/data recovery unbuilt.

Polish / posture:

• Appliance: no hardware/systemd watchdog or CPU governor baked (plan calls for both) #853 — hardware+systemd watchdog and CPU governor not baked.
• Appliance update strategy: staying on top of Debian base and package updates #833 — bake-cadence security-update tracking (already open).

Single biggest risk

#855 — the egress firewall. Every other gap degrades a recovery or update guarantee; this one silently breaks the product's core promise. Tor-first privacy is the reason the stack exists, the plan made a fail-closed netavark port the #78 go/no-go, the phase-0 notes claim it was built and verified — and it is absent from the shipped image, with both the startup log and doctor actively asserting it is enforced. An operator has no signal that their box is dialing clearnet. It ships green because no test phase ever dials out from a container and checks the drop.

[VijitSingh97]

Appliance roadmap — consolidated status (2026-08-02)

Recording everything closed on the v2 line so this tracker reflects reality. Note the branch mechanic: appliance work merges to develop-v2, and GitHub only auto-closes issues from the default branch — so v2-merged issues are closed by hand and can look stale until then.

Shipped this session

#797 phases — R0 recon (RigForge proven on the RO root) → R1 appliance mode (rigforge#330: RIGFORGE_APPLIANCE=1, /run units, GRUB skip) → R2 Both role (#812, closes #796) → R3 role select (#847: Pithead / Pithead + RigForge / RigForge, run-from-USB, marker contract). R4 (rig boot leg) is next; R5 (fleet polish + naming) after.

Boot/update correctness

• Baked container images load only on the wizard path — keep-reinstalls and A/B updates run stale containers forever #798 — digest-keyed baked-image loading moved to the boot path, shared by wizard + pithead-boot (fix(os): one baked-image loader for both boot owners; the battery now proves containers refresh #807)
• apply leaves the deactivated-profile tari container running after a local→remote switch #795 — apply/upgrade remove deactivated-profile containers (fix(cli): remove profile-deactivated containers before every compose up #804)
• Appliance: A/B commit gate is curl-localhost, not the plan's 'pithead doctor --json' (narrower gate + doc mismatch) #852 — the A/B commit gate now requires real revenue-service health, not just a serving dashboard; syncing-vs-crashed distinguished so a fresh box can't brick (fix(appliance): commit gate consumes doctor --json, not just a curl (#852) #864)
• mkimage.sh: loop-partition race — mkfs.vfat hits /dev/loopNp1 before the kernel publishes it #818 — mkimage loop-partition settle race (fix(os): guard the loop-partition race and the debug->release update trap #827)
• A/B update variant mismatch: a debug (SSH) box that installs a release bundle silently loses its only management channel #819 + os-update variant gate is one-directional: a release box installing a debug bundle silently gains a root SSH backdoor #854 — bundle variant stamped; os-update confirms on BOTH losing and gaining a shell (a release box taking a debug bundle silently baked a root SSH backdoor) (fix(os): guard the loop-partition race and the debug->release update trap #827, fix(security): mask notification secrets + confirm any shell-gaining OS update (#848, #854) #865)
• build-image.sh: PITHEAD_UPDATER defaults to empty — a plain build produces an image that cannot update itself #815 — PITHEAD_UPDATER defaults to rauc; a plain build can no longer produce an image that cannot update itself (feat(os): one-flag debug builds — build-image.sh --ssh; updater defaults to rauc #816)

Security (from the closing audit)

• Appliance: Tor-only egress firewall is fail-open under podman/netavark (DOCKER-USER chain never traversed) while log + doctor report it enforced #855 — the headline: the Tor-only egress firewall was FAIL-OPEN under podman/netavark (rules sat in an orphaned iptables DOCKER-USER chain; doctor reported it enforced). Verified live on the bench: a mining container reached clearnet (HTTP 301). Fixed with a forward-hooked inet pithead_egress nft table + honest doctor detection + a battery phase that dials clearnet; re-verified on the deployed image — clearnet now dropped, Tor egress intact (fix(appliance): enforce Tor-only egress under podman/netavark, not just Docker #857)
• Egress firewall: fail-closed IPv6 coverage for the mining subnet (latent until mining_net enables IPv6) #858 — IPv6 fail-closed backstop for the same firewall, interface-scoped, refuse-rather-than-install when unresolvable (fix(appliance): fail-closed IPv6 coverage for the Tor egress firewall #861)
• RAUC update-bundle signing key has no documented custody, generation, or rotation process #850 — RAUC signing-key custody: release builds refuse to run without an explicit key, dev auto-gen gated behind --dev, verify-image hard-fails a dev keyring, rotation runbook written (fix(rauc): require an explicit release signing key, never auto-gen one #859)
• notifications.ntfy.token / .url and notifications.webhooks leak in cleartext through the masked config + dashboard API #848 — notification ntfy token/url + webhooks[] were leaking through the masked-config surface to the dashboard container (fix(security): mask notification secrets + confirm any shell-gaining OS update (#848, #854) #865)
• Wallet validation admits a checksum-invalid Monero address; p2pool then crash-loops silently #829 — wallet validation accepted a checksum-invalid Monero address, yielding a silently dead mining stack (fix(config): reject a checksum-invalid Monero payout address before anything launches #846)
• Appliance update strategy: staying on top of Debian base and package updates #833 — rootfs CVE scanning, base-digest tracking, pinned-binary watch (ci(appliance): rootfs CVE scan, Dependabot base-digest tracking, pinned-binary watch #841)

Robustness

• Appliance: no hardware/systemd watchdog or CPU governor baked (plan calls for both) #853 — systemd watchdog (RuntimeWatchdogSec=20s) + CPU governor baked into the image (Bake systemd watchdog + performance CPU governor into the appliance #860)
• Reinstall could inherit the previous machine's non-secret answers as the form's starting point #794 — reinstall pre-fills the form from the previous install's non-secret answers (Reinstall pre-fills the form with the previous install's non-secret answers #805)
• RAM floor ignores the local miner's share in the Both role #820 — RAM floor accounts for the local miner in the Both role (fix(dashboard): count the built-in miner in the mode-aware RAM floor #825)
• tari-wallet compose healthcheck can never report healthy — ps truncates CMD to 15 chars #777 — tari-wallet healthcheck survived ps CMD truncation (fix(compose): tari-wallet healthcheck pattern survives ps CMD truncation #800)

Still open, in flight: #849 (two-tier reset + wedged-/data recovery, PR #862 — verifier-clean, resolving a merge conflict), #851/#856 (downgrade floor + migration-deadlock guard, PR #863 — sent back for two fail-closed fixes).

Blocked on the operator: #786 (feature-parity decomposition awaiting six answers), #821 (repin the baked RigForge tree — needs a rigforge release tag), #479 (screenshots — needs the logo).

Superseded / closed

#783 (rugix panic — the lane moved to RAUC), #784 (systemd-repart adopted).

Milestone status

RC20 was cut and soak-proven (6h+ with a real fleet rig attached, 1517/0 shares). The two release-blockers found by the audit are now fixed and verified. The immutable-IoT posture audit confirmed read-only root, single-/data persistence, and derived-vs-state discipline all hold.

🤖 Generated with Claude Code

[VijitSingh97]

Roadmap delta — everything since the last update (develop-v2 @ 4cd80cd)

Seven more PRs landed after the previous comment. Verified against the branch, not from notes.

R4 shipped — the phase arc is complete through the rig role

#876 — the rig boot leg. A role=rig box now boots into RigForge instead of the coordinator stack: the fork happens before the container-image loader (a rig loads none), the miner starts from the baked prebuilt XMRig with no compile and no clearnet, and journald flips volatile for a stick-resident root.

The real blocker was in the units, not the logic: pithead-boot.service required config.json, so it would never have fired on a rig, while pithead-firstboot.service fired on every rig boot forever. Both now use systemd triggering conditions keyed on the role marker — deliberately on machine-role, not rig.json, because a fleet stick holds a rig's answers in flight while installing, and keying on the answers would turn a power-cut stick into a machine that is neither installer nor rig. Adversarially verified across all three cases (coordinator boots, rig boots without re-arming firstboot, unprovisioned still reaches the wizard).

Also answered without code: repart cannot be role-conditional (it runs at first boot, before the wizard asks what the machine is) — /data already sizes to the medium, so a 16 GB stick leaves a rig ~6 GiB. Reasoning is written into 40-data.conf. Rig undo is a wipe-reinstall from the stick, documented rather than built.

#797 status: R0–R4 done, R5 (fleet polish + naming) remains — R5 needs the branding decision.

Audit close-out

#862 (#849 two-tier reset + wedged-/data recovery), #863 (#856 downgrade floor; both guards now fail closed — a pre-release/unparseable version or a corrupt floor refuses rather than silently skipping), #864 (#852 commit gate on real revenue health), #865 (#848 notification secrets + #854 the shell-gaining direction of the variant gate).

Audit tally: 9 found, 8 fixed and closed. #851's migration runner stays open on purpose — the deadlock guard shipped; executing migrations did not.

Quality pass (#867)

Doc-accuracy and dead-code fixes applied; four findings too big to fold in were filed: #868 (install.sh fail-closed paths untested), #869 (testing-strategy.md doesn't place the appliance in the four-tier model), #870 (apt-lists justification may be stale), #871 (duplicated wait loops / spool readers).

Regressions caught by deploying to the bench — none by CI

• fix(os): omit the migration floor when empty — rauc refused every plain bundle build #873 — minimum_os_version was emitted unconditionally, and RAUC rejects an empty manifest value: every ordinary bundle build was broken. CI missed it because the stack tests stub rauc bundle. Fixed, and the manifest renderer is now extracted and unit-tested on both the migrating and non-migrating shapes.
• The RAUC update-bundle signing key has no documented custody, generation, or rotation process #850 key guard fired on its first real use — refusing to sign a bench build without --dev. Working as designed.
• Dashboard stops xmrig-proxy when the node goes unreachable but never restarts it — a transient blip kills mining permanently #875 (open, unfixed) — the most operator-visible bug of the session: the dashboard stops xmrig-proxy when the node goes briefly unreachable and never restarts it. Node returns healthy and 100% synced, dashboard serves, 0 failed units, slot commits — and the box earns nothing indefinitely. On a shell-less release appliance there is no pithead up to recover with.

Bench state

Running 4cd80cd (the exact branch tip), coordinator role, 8 containers, mining, egress fail-closed (direct HTTP 000 / via-Tor 301), watchdog and governor live, 0 failed units. R4's unit-condition rewrite was re-verified here for coordinator regression — clean.

Blocked on the operator

#786 (six questions), #821 (needs a RigForge release tag), #479 + R5 naming (needs the logo).

🤖 Generated with Claude Code

[VijitSingh97]

Roadmap delta — 2026-08-04 session (develop-v2 @ the #889 merge)

Ten merges, six issues closed by hand (develop-v2 doesn't auto-close), one new issue. Verified against the branch and the bench, not from notes.

The operator-visible bug is dead — #875 (#881)

Root cause re-derived from the bench's live dashboard log, not from reading code: workers_rejected (restored from the persisted snapshot) was held for ~21 hours because readmission required a required Tari to be confirmed healthy — and a Tari whose gRPC has never answered this run (post-boot it takes many minutes to listen) is neither down nor healthy, so it blocked readmission forever on a node that never caused the stop. The fix mirrors the stop side's ever-up guard; monerod's confirmed-healthy requirement is unchanged. Sibling audit clean (p2pool's gates have no one-way stop); the commit-gate question from the issue is moot with readmission self-healing.

Tari checksum gate — #845 (#882)

tari_address_type: split-byte base58 and the 256-emoji form, DammSum, mainnet network byte, feature bits — mirroring tari's own from_bytes, with the algorithm, layouts, alphabet (extracted programmatically, never transcribed), and test vectors all sourced from the tari repository's code and test suite. One gate at parse_and_validate_config covers setup/apply/wizard-spool/control-runner; inline wizard retry and a doctor verdict on top; fail-open without python3. Also verified privately against the bench's live payout-proven address. (Found en route: Python ≤3.9's tokenizer rejects a >1 KB non-ASCII source line — the alphabet ships split across short concatenated lines or old hosts silently degrade.)

The migration runner — #851 closed (#883)

The automatic-fallback half of the deadlock rule: os-update leaves a version-stamped .os-migration-pending marker; pithead-boot on a matching boot withholds the chain services (PITHEAD_HOLD_CHAIN=1 compose subset), doctor judges the held chain by the sync-hold rule so the gate can't deadlock on itself, and post-commit the marker is consumed and a plain up runs the migration on a slot fallback can no longer leave. Proven on the KVM bench: monerod never ran while the slot was uncommitted, hold and release both in the boot journal, marker consumed.

The leg's first two runs each refuted a layer of os-update on real hardware — the appliance image shipped no unsquashfs, and then RAUC 1.11's JSON output turned out to omit [meta.*] entirely (the #863 stack-test fixtures were synthetic JSON in a shape real rauc never emits, so every guard was dead on-appliance and CI could not see it). Both fixed in #883; os_bundle_meta now parses the shell format, which still signature-verifies.

The rig phase ran — the #77 gate is met (#888)

First-ever execution of --phase rig. It refuted two of its own assertions: the leg waited for the miner on the updated slot — the very event a rig commits on — then expected an "uncommitted" reboot to revert. The corrected leg asserts the real contract (self-commit B_OK=1 B_TRY=0 with no harness hands, persistence across reboot; uncommitted-fallback stays the update phase's to prove on an unprovisioned box). Re-run: 21 passed, 0 failed — a rig boots from the image, mines the baked binary with no compile and no clearnet, and takes an A/B update like a coordinator.

Quality pass closed out

• install.sh: the sha256 and cosign fail-closed paths have no test #868 (test: the curl installer's verification paths fail closed, proven by mutation #884): installer sha256/cosign fail-closed paths pinned and mutation-proven — removing either check breaks exactly the new assertions.
• testing-strategy.md does not place the appliance in the four-tier model #869 (docs: place the appliance in the four-tier testing model #885): testing-strategy.md section J — tier 4 has one meaning, two harnesses (live matrix / KVM battery); every battery phase cataloged, all rows backed by executed runs as of today.
• os/rootfs/Dockerfile: is the apt-lists justification still true under RAUC? #870 (fix(os): drop the apt lists after the last apt step; correct the stale comment #889): the Rugix-era apt-lists comment was stale, but the lists were still load-bearing inside the Dockerfile — comment corrected, and a post-last-apt cleanup drops ~21 MB from every slot and bundle (bake + verify-image 69/0 proven).
• Appliance session left duplicated wait loops and spool readers #871: wizard half merged (refactor(wizard): one spool-JSON reader, one atomic writer #886, net −10 lines); the tests/os/run.sh wait-loop half stays open to ride the next battery-paying change.
• KVM battery: the egress leg runs before monerod's container exists, and misreports it as 'lacks curl' #887 (new): the battery's egress leg runs before monerod's container exists and misreports it as "lacks curl" — the Appliance: Tor-only egress firewall is fail-open under podman/netavark (DOCKER-USER chain never traversed) while log + doctor report it enforced #855/Egress firewall: fail-closed IPv6 coverage for the mining subnet (latent until mining_net enables IPv6) #858 assertions are silently unexercised per run (they pass live on the bench).

Bench

Running c29eb10 (BUILD_COMMIT verified — a stale-tarball deploy earlier in the session was caught by exactly that check), coordinator role, mining with accepted shares, egress fail-closed (direct 000 / via-Tor 301), unsquashfs present on-appliance, doctor PASS, 0 failed units. One wart observed: the new slot presented a fresh SSH host key (per-slot overlay keys), which strict-checking clients see as a MITM warning after an update.

develop stayed fully contained in develop-v2 throughout (re-checked at close).

🤖 Generated with Claude Code

[VijitSingh97]

Appliance wave 2026-08-13 — merged, filed, and a release-gate catch

Merged to develop-v2 (all reviewed + ponytail-gated before merge): #915 stale-tarball build guard, #916 battery egress-leg + wait-loop dedup (#887/#871), #917 per-machine host identity on /data (#894/#895), #918 doc-drift corrections, #919/#920 simplification cuts, #928 five audit smalls, #930 ssh-service ExecStartPre ordering, #931 machine-id restore + harness fixes. Closed: #871 #880 #887 #894 #895 #896.

The gate did its job. The first KVM battery run on the merged tip (31/7) caught two real regressions the whole wave's review had missed, both traced by journal forensics on the failed guest:

1. ssh.service could never start on a first boot — Debian's unit carries its own ExecStartPre=sshd -t, and a drop-in's ExecStartPre appends, so the config test ran before the new host-key generator against an empty /data/ssh. Fixed (ssh.service could never start on a first boot: run the host-key generator before Debian's sshd -t #930): the drop-in resets the list, generates first, then restates the distro's test.
2. The first A/B update bricked networking — the machine-id restore unmounted /etc/machine-id before writing, but systemd's first-boot bind mount there is writable; the umount exposed the read-only lower image, the write failed, machine-id stayed empty, and systemd-networkd then never brought up DHCP. Fixed (machine-id restore must write THROUGH /etc, not unmount it — first A/B update bricked networking #931): write through the writable layer. Both regressions were in code that had passed verifier + security review — only power-cycling a real A/B slot surfaced them, which is exactly why tests/os/run.sh is the gate and not the reasoning. Battery rerun on the fixed tip (c69258d) is in progress.

New issues filed for larger gaps: #923 (factory-reset reformat path never battery-exercised), #924 (headless setup() silent no-op), #925 (role-select undocumented), #926 (three partition-derivations → lsblk), #927 (worker-verb dedup), #929 (image build 404s on a stale cached apt index).

#786 parity — decided and in build. Peer research (Talos, Home Assistant OS, TrueNAS/OPNsense, Synology/UniFi/umbrel) → decision record on #786, sub-issues #908–#913 filed. The GA-bar trio is up as PRs: #933 restore-at-setup (B), #932 removable-media config channel (D); #908 backup export (A) is in implementation. Each rides its own security/verifier pass — two caught critical holes already fixed (a fail-open secret-mask bypass in D, a tar path-traversal in B). They merge once their KVM legs prove in a battery, not before.

Pending your call: #922 (issue #897) — a Tari-only outage keeping Monero mining. Merge ratifies option 1; close keeps today's behavior.

develop is fully folded into develop-v2; the roadmap body above is rewritten to current reality.