Publish verified Hydra OS 0.2.0 runtime and laptop acceptance records

2026-10-13 23:50:11 +03:00
parent ebeebc7fb1
commit 6855c62ba1
13 changed files with 9416 additions and 47 deletions
@@ -6,13 +6,15 @@ desktops may use the same independent VM manager and viewers.

 ## Status

-The terminal UX UEFI preview passed all 13 disposable QEMU/KVM acceptance checks:
-installation, boot without the ISO, password login, persistent data, networking,
-nested KVM, VM survival across logout, and the packaged download/run/open/menu
-workflow with Fastfetch. See the
-[release and acceptance record](docs/releases/2026-10-13-terminal-ux/README.md).
-The first physical target is ASUS TUF Dash F15 FX517ZC; laptop hardware checks
-remain pending. Existing NixOS and VM disks were not installation or test targets.
+Hydra OS 0.2.0 adds selected-partition installation, signed runtime updates,
+offline Btrfs base recovery and read-only laptop diagnostics. The complete source
+suite passed **431 tests**. The final ISO passed **13 whole-disk** and **23
+preserved-partition/recovery** UEFI/KVM checks, with no skips. See the
+[release and acceptance record](docs/releases/2026-10-13-laptop-ready/README.md).
+The [previous terminal UX preview](docs/releases/2026-10-13-terminal-ux/README.md)
+passed 13 disposable UEFI/KVM checks against its earlier image. The first physical
+target is ASUS TUF Dash F15 FX517ZC; hardware checks remain pending. No physical
+partition has been selected, and existing NixOS and VM disks were not targets.

 1. Independent QEMU/KVM lifecycle with private QMP control.
 2. Minimal labwc session and fullscreen SPICE viewers.
@@ -109,7 +111,7 @@ installation media and common recovery steps.

 Follow the [isolated Gentoo build instructions](image/README.md). Outputs are
 `build/artifacts/hydra-os.iso` and `hydra-os.iso.sha256`; binary images stay out
-of Git. [Recorded source inputs and package versions](docs/releases/2026-10-13/rootfs-manifest.json)
+of Git. [Recorded source inputs and package versions](docs/releases/2026-10-13-laptop-ready/rootfs-manifest.json)
 identify the tested image. The builder uses Gentoo systemd for login/device
 management, labwc for the minimal graphical session, and QEMU/KVM for guests.
 Portage and the tracked QEMU/viewer patches remain available for ordinary updates.
@@ -0,0 +1,116 @@
+# Hydra OS 0.2.0 — installation, updates and recovery
+
+**The source suite passed 431 tests. The final ISO passed 13 whole-disk checks
+and 23 preserved-partition/recovery checks. No acceptance check was skipped.**
+
+Hydra OS is a Gentoo host for concurrent virtual desktops, with a minimal labwc
+session and terminal controls. This release adds installation into selected
+partitions, signed runtime updates, offline Btrfs base recovery and read-only
+laptop diagnostics.
+
+## Verification
+
+| Item | Final result |
+| --- | --- |
+| Image and runtime source | `ebeebc7fb1aed07a5f50bc62374365d614953dad` |
+| ISO | `hydra-os.iso`, 2,380,406,784 bytes |
+| ISO SHA-256 | `451e058228d7cbea87b5301ae6502b6be609cf7f52cc7c9e6fb477822501389b` |
+| Signed runtime | Version `0.2.0`, sequence `1` |
+| Complete source suite | `431` passed in `26.048` seconds |
+| Whole-disk UEFI/KVM acceptance | 13 passed; 0 skipped |
+| Preserved-partition/recovery UEFI/KVM acceptance | 23 passed; 0 skipped |
+
+Independent final integration review found no actionable issues and verified all
+19 signed runtime payload files against source bytes/modes and the pinned key.
+
+The final [artifact record](artifacts.json), [whole-disk report](whole-disk-acceptance.json)
+and [laptop report](laptop-acceptance.json) identify the exact ISO, firmware and
+harnesses. The [image audit](image-audit.json) checks packaged files, including the
+independent updater and pinned key, against source hashes and required ownership
+and modes. The [rootfs manifest](rootfs-manifest.json) records source inputs and
+package versions; [Fastfetch](fastfetch.txt) captures the final installed guest.
+
+Final acceptance uses fresh private virtual disks and the final ISO. Earlier
+diagnostic runs against an older ISO do not establish this release's acceptance.
+Both installed boot sequences remove ISO media. The laptop sequence checks GPT
+boundaries, foreign partition bytes and foreign/fallback EFI bytes across all
+boots. It checks BootOrder immediately around installation, checkpoint, restore
+and each deliberate boot-selection operation. OVMF may prune an empty DVD entry
+between boots; the report does not claim identical BootOrder across reboots.
+
+## Installation and recovery
+
+Existing-partition installation formats only the selected root partition and
+retains the existing ESP. It supports ext4 or Btrfs; Btrfs uses `@root`, `@home` and
+`@snapshots`. From the live ISO's `:shell`, inspect the devices and request a plan:
+
+```sh
+sudo hydra-install --root-partition /dev/CHOSEN_ROOT \
+  --esp-partition /dev/CHOSEN_ESP --user YOUR_USER --root-fs btrfs
+```
+
+These are placeholders; no physical target partition has been selected. Execution
+requires `--execute --confirm-format /dev/CHOSEN_ROOT`. The ESP needs room for
+`EFI/HydraOS`; select its `grubx64.efi` loader in firmware, or explicitly request
+`--register-boot-entry` to create an entry without changing BootOrder. See the
+[installation guide](../../install.md).
+
+Boot the trusted live ISO with the installed filesystems unmounted to create or
+restore a Btrfs checkpoint:
+
+```sh
+sudo hydra-system checkpoint --root-uuid ROOT_UUID --esp-partuuid ESP_PARTUUID \
+  --name before-update --execute --confirm-root-uuid ROOT_UUID
+sudo hydra-system list --root-uuid ROOT_UUID
+sudo hydra-system restore --root-uuid ROOT_UUID --checkpoint CHECKPOINT_ID \
+  --execute --confirm-root-uuid ROOT_UUID
+```
+
+Omit execution and confirmation options to inspect a plan first. Recovery restores
+the root, kernel, Portage state and owned EFI loader together. Current HOME and VM
+data stored there remain unchanged. An interrupted restore resumes with the same
+checkpoint ID. Acceptance upgrades a local Portage fixture, damages the actual
+kernel/owned loader, sends SIGKILL after a durable restore transition, resumes in
+a fresh process, then verifies exact restored base hashes and boots without ISO.
+This proves exact kernel restoration, not an upgrade between two kernel versions.
+
+Checkpoints share the original disk and are not external backups. Restoring the
+root also restores runtime update receipts and their replay floor. See
+[base recovery](../../system-recovery.md).
+
+## Updates and diagnostics
+
+```sh
+hydra update check
+sudo hydra update apply
+hydra update status
+sudo hydra update rollback TRANSACTION
+sudo hydra-update-recover
+hydra doctor
+```
+
+The [signed runtime manifest](../../../releases/stable/manifest.json) describes a
+passive payload verified against the image's independently pinned Ed25519 key.
+The public repository serves the release without a separate update server.
+The standalone recovery command works independently of a damaged normal CLI.
+Acceptance uses a disposable TEST key in its private guest, refuses a tampered
+archive, and verifies apply, rollback and fresh-process recovery after SIGKILL.
+The original pinned key is restored afterward.
+
+The payload updates Hydra runtime and branding. Gentoo packages/kernel, networking,
+guest data, the updater engine and its trust key are outside its scope. Log out
+and in after applying or rolling back to load changed session code. Older images
+without the trusted updater need a verified new image or a separately verified
+bootstrap. See [update scope and trust](../../updates.md).
+
+`hydra doctor` reports observations without changing settings. Physical ASUS
+FX517ZC checks remain pending: live boot, Wi-Fi/Ethernet, audio playback, touchpad
+and input capture, brightness, USB, suspend/resume and delivered display refresh.
+The first image requires Secure Boot disabled. No physical disk, existing NixOS
+installation or existing user VM disk was an installation target. VM acceptance
+does not establish physical graphics performance or audio playback.
+
+See [acceptance instructions](../../laptop-acceptance.md) to repeat both harnesses
+with the recorded source, ISO and firmware inputs. ISO files, test disks, private
+build records and raw logs remain outside Git; this directory contains the
+public verification record.
@@ -0,0 +1,80 @@
+{
+  "schema": 1,
+  "product": "Hydra OS",
+  "version": "0.2.0",
+  "tag": "0.2.0",
+  "source_commit": "ebeebc7fb1aed07a5f50bc62374365d614953dad",
+  "iso": {
+    "name": "hydra-os.iso",
+    "size": 2380406784,
+    "sha256": "451e058228d7cbea87b5301ae6502b6be609cf7f52cc7c9e6fb477822501389b"
+  },
+  "runtime": {
+    "version": "0.2.0",
+    "sequence": 1,
+    "payload_files": 19,
+    "artifacts": [
+      {
+        "name": "manifest.json",
+        "size": 2831,
+        "sha256": "622eadd77d5eb18ba80d81f60f6d7ba4546ce8a4ba276152cf0b2b38d1c4ba03"
+      },
+      {
+        "name": "manifest.sig",
+        "size": 64,
+        "sha256": "4102a9f1d0f1ac00e848c00a9a37644647789a3e20b70aa41f1fd4a7e7a6974a"
+      },
+      {
+        "name": "runtime.zip",
+        "size": 71577,
+        "sha256": "9284edd5de37f621955189f3d317ebcfa76f60a4b6e1f481361b6aad1967f4f8"
+      }
+    ],
+    "public_key_der_sha256": "fb08fd4892c5e4de0dbda82ef43f911a423a24d0f82bdf70f7b6fcaeb1d9ad51"
+  },
+  "kernel": "6.18.54-gentoo-dist-bin",
+  "packages": 581,
+  "verification": {
+    "source_suite": {
+      "passed": 431,
+      "failed": 0,
+      "seconds": 26.048
+    },
+    "whole_disk": {
+      "passed": 13,
+      "skipped": 0
+    },
+    "laptop": {
+      "passed": 23,
+      "skipped": 0
+    },
+    "physical_hardware": "pending"
+  },
+  "evidence": [
+    {
+      "name": "whole-disk-acceptance.json",
+      "size": 6797,
+      "sha256": "dee6f6736a204126ff9594a258f14fe79b0edb7b24129afa5519ba5549fa8187"
+    },
+    {
+      "name": "laptop-acceptance.json",
+      "size": 181161,
+      "sha256": "15e4ccbef7696740debdf53b5c942cdc897d89467fb5583a365c143b3fd4e4a7"
+    },
+    {
+      "name": "image-audit.json",
+      "size": 5146,
+      "sha256": "697cd71dab2b4a8e299f9fcbfe133c418efb712e92b8bcd459455e18c2249024"
+    },
+    {
+      "name": "fastfetch.txt",
+      "size": 1132,
+      "sha256": "3e7f54fbd70a46dd8c655f5ff10e2afbbeac70608efdea12b3822a3a79567a9b"
+    },
+    {
+      "name": "rootfs-manifest.json",
+      "size": 142178,
+      "sha256": "126c66d84b7c2160a517cbd0c3649630982a4d734e113ecdd6ee48e0859f1630"
+    }
+  ]
+}
@@ -0,0 +1,22 @@
+                 =        =                    hydratest@hydra-os
+                =@        @=                   OS: Hydra OS x86_64
+                :@+  ::  +@:                   Kernel: Linux 6.18.54-gentoo-dist-bin
+               :-*@%*@@*%@#-:                  Uptime: 7 seconds
+        .  +:   -@@@@@@@@@@-   :+  .           CPU: 12th Gen Intel(R) Core(TM) i7-12650H (2) @ 2.69 GHz
+      =*:+#=    =@*+@@@@+*@=    =#+-*=         Memory: 425.80 MiB / 3.80 GiB (11%)
+     #@#@@##=   .%@=*@@*=@%.   =##@@#@#        Disk (/): 7.11 GiB / 30.34 GiB (23%) - ext4
+    #@@@@@@@@#=.  .@@@@@@.  .=#@@@@@@@@#       Local IP (enp0s2): 10.0.2.15/24
+  .%%=:%@@@@@@@*:  +%@@%+  :*@@@@@@@%:=%%.
+ .#@##@@@%*@@@@#:   =@@=   :#@@@@*%@@@##@#.
+@%@%=-%@#  .*@@@@. .%==%. .@@@@*.  #@%-=%@%@
+=%-:-%+      #@@@# .@@@@. #@@@#      +%-:=%+
+   -%-       @@@@% =@@@@= %@@@@       -%-
+           .%@@@@. @@@@@@ .@@@@%.
+          -@@@@@: *%@@@@%* :@@@@@-
+         .@@@@@* .-%@@@@%-. *@@@@@.
+         *@@@@@%:+@@@@@@@@+:%@@@@@*
+         =#%@@@@@@@@@@@@@@@@@@@@%#=
+           .*@@@@@@@@@@@@@@@@@@*.
+              .:-=+*#@@#*+=-:.
+
+               H Y D R A  O S
@@ -0,0 +1,165 @@
+{
+  "files": {
+    "usr/lib/hydra/hydra/__init__.py": {
+      "sha256": "2775bedc6bc41a09d8a492e99a38ce147730d979867316a672f0049f055c76a1",
+      "mode": 420,
+      "uid": 0,
+      "gid": 0
+    },
+    "usr/lib/hydra/hydra/build.py": {
+      "sha256": "7d130a0ce0eed8913d8402c28824b1dff139d33c6482d9616a01d30f96cd65ac",
+      "mode": 420,
+      "uid": 0,
+      "gid": 0
+    },
+    "usr/lib/hydra/hydra/cli.py": {
+      "sha256": "a9399544462279af97542de068907f6f2adb634874648338bdb6094606c03c78",
+      "mode": 420,
+      "uid": 0,
+      "gid": 0
+    },
+    "usr/lib/hydra/hydra/doctor.py": {
+      "sha256": "9d759958c48b56a5f58acaab301c8c6f49c3a6c2ea7d434ee7d17bc420ba51c2",
+      "mode": 420,
+      "uid": 0,
+      "gid": 0
+    },
+    "usr/lib/hydra/hydra/image.py": {
+      "sha256": "b4b77ad87ceba929ed39bee2b02852682718788dacbbbb550ee1a50c216e8070",
+      "mode": 420,
+      "uid": 0,
+      "gid": 0
+    },
+    "usr/lib/hydra/hydra/install_storage.py": {
+      "sha256": "3c59d5f295d6bdb86e6decbae668db67cc2f2d0b8c6abe49ef07f35d8aef7aee",
+      "mode": 420,
+      "uid": 0,
+      "gid": 0
+    },
+    "usr/lib/hydra/hydra/installer.py": {
+      "sha256": "3d038216c37e248db5ad8a76863663d701d5ef497cb5be52658c9382c92f0da5",
+      "mode": 420,
+      "uid": 0,
+      "gid": 0
+    },
+    "usr/lib/hydra/hydra/launch.py": {
+      "sha256": "e9e40af8cfb2aff39306735e6ad70c91d7f93cb01d1451daecbbebda8362c4b0",
+      "mode": 420,
+      "uid": 0,
+      "gid": 0
+    },
+    "usr/lib/hydra/hydra/media.py": {
+      "sha256": "4c85798a81e767605e8e0a1cd0eb21062f625c49dd71df511b2b67db375d95af",
+      "mode": 420,
+      "uid": 0,
+      "gid": 0
+    },
+    "usr/lib/hydra/hydra/menu.py": {
+      "sha256": "ba99dcc9ed33543d54ad61d13b6c5f02c2d4c6d60f6c2cf9c5ceeb0634a88f5c",
+      "mode": 420,
+      "uid": 0,
+      "gid": 0
+    },
+    "usr/lib/hydra/hydra/profiles.py": {
+      "sha256": "7e3074086172bfb1ebde89996a2ca9be4512250e667e1375b9086d7148f947c3",
+      "mode": 420,
+      "uid": 0,
+      "gid": 0
+    },
+    "usr/lib/hydra/hydra/qmp.py": {
+      "sha256": "e86da77103b991cf7f0104e701555ebbc91e2b526d6b7ec6db76209f264af024",
+      "mode": 420,
+      "uid": 0,
+      "gid": 0
+    },
+    "usr/lib/hydra/hydra/runtime.py": {
+      "sha256": "d72353ebd675135801a3686a69ee8a193b87d5787f691917a46c99de0555d5d3",
+      "mode": 420,
+      "uid": 0,
+      "gid": 0
+    },
+    "usr/lib/hydra/hydra/session.py": {
+      "sha256": "729d6cd263f9828850018b335917a15f03d2a2bda0e38e73f842d3cfc196db1d",
+      "mode": 420,
+      "uid": 0,
+      "gid": 0
+    },
+    "usr/lib/hydra/hydra/system_recovery.py": {
+      "sha256": "957d9b8ab422b446f1f7c0f922c1629a0728e0043bd0a3ade36495f4200d5c05",
+      "mode": 420,
+      "uid": 0,
+      "gid": 0
+    },
+    "usr/lib/hydra/hydra/update_engine.py": {
+      "sha256": "30e4175d9ab894d9ee0cfb825ff43bb376e82857241076554335a9c64e5e9258",
+      "mode": 420,
+      "uid": 0,
+      "gid": 0
+    },
+    "usr/lib/hydra-update/engine.py": {
+      "sha256": "30e4175d9ab894d9ee0cfb825ff43bb376e82857241076554335a9c64e5e9258",
+      "mode": 420,
+      "uid": 0,
+      "gid": 0
+    },
+    "usr/bin/hydra-update": {
+      "sha256": "faaf0c932e6d8009095c7d7c49c3b09eff9563c8537ae0944fc6fbd7daae7ec8",
+      "mode": 493,
+      "uid": 0,
+      "gid": 0
+    },
+    "usr/bin/hydra-update-recover": {
+      "sha256": "b5a66ce468f022c170276de4add3970b22c3bff8caf126dc23e85d655d482acd",
+      "mode": 493,
+      "uid": 0,
+      "gid": 0
+    },
+    "etc/hydra/update.pub": {
+      "sha256": "42cc72480eefa9ee1e5250451c16750710af4b45804e5c821b359780a7f2bed3",
+      "mode": 420,
+      "uid": 0,
+      "gid": 0
+    },
+    "usr/share/hydra/fastfetch.txt": {
+      "sha256": "a0c67cfbc66a3097fb3ac9b8ec16f75a8b59d8a8994ec43db144426fc089fa67",
+      "mode": 420,
+      "uid": 0,
+      "gid": 0
+    },
+    "etc/fastfetch/config.jsonc": {
+      "sha256": "2af12ce007705f039870867c89b0fc6f90bcf6c6b29c04b63ab75f345419b1a1",
+      "mode": 420,
+      "uid": 0,
+      "gid": 0
+    }
+  },
+  "builder_trust_and_state_absent": true,
+  "managed_root_tmpfiles": {
+    "home.conf": {
+      "vendor_sha256": "fcc7434662a40ed081eec2c608dd1a3ac8c909440359a7890c08175fb685ff68",
+      "override_sha256": "81cfa05bb475bf605d9fbdb2245705761b8f997727dac478b25b6babece34ee7",
+      "ordinary_directory": "/srv"
+    },
+    "systemd-nspawn.conf": {
+      "vendor_sha256": "29464830fe7050c98670a1560d76df2672ea1792e5d4ba00d13e16a15801808c",
+      "override_sha256": "85b74fa729d312f25d34cd2b8b300e53305ab15dcce8417c2eb05c224c46410d",
+      "ordinary_directory": "/var/lib/machines"
+    },
+    "portables.conf": {
+      "vendor_sha256": "00c398c1f82a0908f1cb45ce482dafcd99c2287a9432acdb385cc9d9a27cdd43",
+      "override_sha256": "910bdf0ceba6def64116bfcfbfa851d5934b4a62e0dbbaa74db19e21c00a7a69",
+      "ordinary_directory": "/var/lib/portables"
+    }
+  },
+  "sanitization": {
+    "files_scanned": 581,
+    "filtered_files": 41,
+    "variable_names": [
+      "HTTPS_PROXY",
+      "HTTP_PROXY",
+      "NO_PROXY"
+    ]
+  },
+  "source_commit": "ebeebc7fb1aed07a5f50bc62374365d614953dad",
+  "iso_sha256": "451e058228d7cbea87b5301ae6502b6be609cf7f52cc7c9e6fb477822501389b"
+}
@@ -0,0 +1,189 @@
+{
+  "schema": 1,
+  "status": "passed",
+  "iso_sha256": "451e058228d7cbea87b5301ae6502b6be609cf7f52cc7c9e6fb477822501389b",
+  "physical_hardware": "pending",
+  "nested_scope": "Normal-user KVM VM launch, bridge helper and QMP; no nested guest OS boot",
+  "ovmf_code_sha256": "f3ff7e73448ed2845ee15356f394882f5618eb5dab92c9a30ec6ee0e1468553a",
+  "ovmf_vars_input_sha256": "6ed987af3a3c155be71665f510eae3e007eda9b8b94afd59d45e91c4a11565cc",
+  "completed_utc": "2026-10-13T20:39:59Z",
+  "iso": "hydra-os.iso",
+  "source_commit": "ebeebc7fb1aed07a5f50bc62374365d614953dad",
+  "raw_report_sha256": "2ded3055b6999a3336ead6558bc8e7c134588c9353c5cd202c1116b881f43db1",
+  "harness_sha256": "a56b59b0259282e5b2beaa0a2ed7cb357f45d6c9bba29640aa4831296791ddff",
+  "memory_mib": 4096,
+  "checks": {
+    "live_qmp_kvm": {
+      "status": "passed",
+      "output_sha256": "73741bf0ae47c0d63e9e39bde651b5d15449d680658328b222ba2f837c84a1e3",
+      "evidence": {
+        "enabled": true,
+        "present": true
+      }
+    },
+    "live_boot": {
+      "status": "passed",
+      "output_sha256": "2595ba19b77bbbedac87fa974e237edff158512d7ea0ecfe42d32e431bfa242d",
+      "result": "/usr/bin/hydra\n/usr/bin/hydra-install\n/usr/bin/qemu-system-x86_64\n/usr/bin/qemu-img\n/usr/bin/remote-viewer\n/usr/bin/foot\n/usr/bin/labwc\nactive\nactive\nactive"
+    },
+    "real_installer": {
+      "status": "passed",
+      "output_sha256": "56876246904dce94ed1ac584883403c529267de15dc9918dcc96d4089b66a6d4",
+      "result": "Installer completed via guest controlling TTY"
+    },
+    "live_poweroff": {
+      "status": "passed",
+      "output_sha256": "bfd9b9dfb2690be661de5e9d37e2272dc9c5a10fbd6e5d8ba10842e63329bab7",
+      "result": "QEMU exited before ISO-free reboot"
+    },
+    "installed_qmp_kvm": {
+      "status": "passed",
+      "output_sha256": "73741bf0ae47c0d63e9e39bde651b5d15449d680658328b222ba2f837c84a1e3",
+      "evidence": {
+        "enabled": true,
+        "present": true
+      }
+    },
+    "installed_password_login": {
+      "status": "passed",
+      "output_sha256": "2c32717f3fc0bb7f06629b8260f933c4f35d83ae585775835c746b279c4750b1",
+      "result": "hydratest"
+    },
+    "installed_terminal_ux": {
+      "status": "passed",
+      "output_sha256": "119506083ea62d990dcf6af8994add93cd09b34feded939fa867b3398c879123",
+      "evidence": {
+        "status": "passed",
+        "uid": 1000,
+        "normal_user": "hydratest",
+        "launcher": "/usr/bin/hydra",
+        "fixture_bytes": 43008,
+        "iso_sha256": "aa66329c263f560f514c00a71551490dd6593ee7632404e072584e2803e0a1c7",
+        "cache_reused": true,
+        "http_requests": [
+          "/fixture.iso"
+        ],
+        "before": {
+          "name": "ux-d7b31c1e",
+          "uuid": "b58b8996-8743-54ff-a362-42c847a37bd3",
+          "pid": 707,
+          "process_start": "749",
+          "kvm": true
+        },
+        "after_open": {
+          "name": "ux-d7b31c1e",
+          "uuid": "b58b8996-8743-54ff-a362-42c847a37bd3",
+          "pid": 707,
+          "process_start": "749",
+          "kvm": true
+        },
+        "after_menu": {
+          "name": "ux-d7b31c1e",
+          "uuid": "b58b8996-8743-54ff-a362-42c847a37bd3",
+          "pid": 707,
+          "process_start": "749",
+          "kvm": true
+        },
+        "memory_mib": 512,
+        "cpus": 1,
+        "disk_size": "64M",
+        "network": "bridge",
+        "fastfetch_command": [
+          "fastfetch",
+          "--pipe",
+          "false",
+          "--show-errors"
+        ],
+        "fastfetch_default_config_sha256": "2af12ce007705f039870867c89b0fc6f90bcf6c6b29c04b63ab75f345419b1a1",
+        "fastfetch_logo_sha256": "a0c67cfbc66a3097fb3ac9b8ec16f75a8b59d8a8994ec43db144426fc089fa67",
+        "scope": "Packaged installed CLI, cache, branding and live nested QMP/KVM; nonboot ISO fixture, no nested OS boot or performance claim",
+        "cleanup": "Only the verified private fixture VM stopped through hydra stop --force"
+      }
+    },
+    "disk_persistence": {
+      "status": "passed",
+      "output_sha256": "365e772a615be1727b4898bd10c984dc672790aaa617da6444d6281d5b2796be",
+      "result": "Sentinel content verified from command output frame"
+    },
+    "installed_contract": {
+      "status": "passed",
+      "output_sha256": "2b1b0972acbc56b5b6577ebbed2237dc6c285a35b4199a83f1cf9f8f6d6ccf1b",
+      "result": "All assertions in the recorded unchanged harness passed."
+    },
+    "lan_to_vm_tcp": {
+      "status": "passed",
+      "output_sha256": "39e841582e2fae2337515f751e47ce7aea62a04b8d0c81dcf54a0b31d1aee4cd",
+      "result": "PASS: routed new LAN-to-VM TCP connection on arbitrary port 43117"
+    },
+    "nested_kvm": {
+      "status": "passed",
+      "output_sha256": "6ed0138e29e02b7a80d02229febc1eaeb0a91771fb620c9772471f45d0da5317",
+      "result": "All assertions in the recorded unchanged harness passed."
+    },
+    "installed_user_logout": {
+      "status": "passed",
+      "output_sha256": "1f7d9f7fb23265d5cb9b7fbd9b01d9a457527b4017e3aff0b1a4651d5a1ba9cb",
+      "evidence": {
+        "status": "passed",
+        "real_logout": true,
+        "no_open_logins": true,
+        "survival_seconds": 15,
+        "same_vm": {
+          "name": "logout-9587e00e",
+          "uuid": "ed93cd51-4e26-5e1a-ae88-2b34ed2eb665",
+          "pid": 982,
+          "process_start": "1013",
+          "directories": {
+            "/run/user/1000/hydra-logout-9587e00e": [
+              46,
+              52,
+              16832
+            ],
+            "/run/user/1000/hydra-logout-9587e00e/logout-9587e00e": [
+              46,
+              53,
+              16832
+            ]
+          },
+          "sockets": {
+            "qmp": [
+              46,
+              57,
+              1000,
+              49640
+            ],
+            "spice": [
+              46,
+              56,
+              1000,
+              49640
+            ],
+            "pipewire": [
+              46,
+              28,
+              1000,
+              49590
+            ],
+            "pulse": [
+              46,
+              27,
+              1000,
+              49590
+            ]
+          },
+          "audio_services": {
+            "pipewire.service": "InvocationID=8d86c20efc8f48bf803994159b1b5335\nExecMainPID=954\n",
+            "pipewire-pulse.service": "InvocationID=5d452f74172b472c8fad2b998316d7bd\nExecMainPID=956\n",
+            "wireplumber.service": "InvocationID=9b92a86d9d3c47e08069ea7842191da5\nExecMainPID=955\n"
+          }
+        },
+        "audio_scope": "Socket and service continuity only; signal/playback untested"
+      }
+    },
+    "installed_poweroff": {
+      "status": "passed",
+      "output_sha256": "047a24b28a9faa96e7864cc9e6a0621210985e702324326b250028aad6fb15a9",
+      "result": "Normal installed guest shutdown"
+    }
+  }
+}
@@ -33,21 +33,30 @@ journal outside @root; matching EFI/HydraOS backups; explicit target identities.
 **Produces:** checkpoint/list/restore CLI; root-owned completed metadata and durable
 restore transaction; module has no import-time mutations and works from live ISO.

- [ ] Write failing topology/ownership/path/format checks and checkpoint publication tests.
- [ ] Implement root/ESP resolution and private mount cleanup, read-only planning.
- [ ] Implement offline checkpoint snapshot and EFI backup with exact metadata/hashes.
- [ ] Implement restartable restore preserving failed roots and all non-owned data.
- [ ] Test process interruption/restart at journal transitions and malformed backups.
- [ ] Scoped tests, self-review, commit, independent task review.
+- [x] Write failing topology/ownership/path/format checks and checkpoint publication tests.
+- [x] Implement root/ESP resolution and private mount cleanup, read-only planning.
+- [x] Implement offline checkpoint snapshot and EFI backup with exact metadata/hashes.
+- [x] Implement restartable restore preserving failed roots and all non-owned data.
+- [x] Test process interruption/restart at journal transitions and malformed backups.
+- [x] Scoped tests, self-review, commit, independent task review.

 ## Task 2: Bootable acceptance and integration

 **Files:** new `dev/system-recovery-smoke.py` or extension to preserve-partition
 acceptance, associated harness tests, image wiring and release evidence.

- [ ] Consume completed installer mode; seed and record fresh qcow2 only.
- [ ] Install, checkpoint offline, upgrade real fixture package and change HOME.
- [ ] Damage selected kernel and owned EFI, recover from live ISO and boot disk-only.
- [ ] Verify exact old base/kernel/Portage and unchanged current HOME/foreign data.
- [ ] Exercise interrupted restore, record hashes/states and honest limitations.
- [ ] Integrate with laptop ISO acceptance and final review before delivery.
+- [x] Consume completed installer mode; seed and record fresh qcow2 only.
+- [x] Install, checkpoint offline, upgrade real fixture package and change HOME.
+- [x] Damage selected kernel and owned EFI, recover from live ISO and boot disk-only.
+- [x] Verify exact old base/kernel/Portage and unchanged current HOME/foreign data.
+- [x] Exercise interrupted restore, record hashes/states and honest limitations.
+- [x] Integrate with laptop ISO acceptance and final review before delivery.
+
+## Verification status
+
+The command, tests, image wiring and independent source reviews are complete.
+The unchanged final laptop harness passed all 23 checks against the final ISO,
+including real SIGKILL/resume, restored disk-only boot, exact base/kernel/Portage/EFI
+hashes, current HOME and unchanged guest/foreign data. Physical laptop checks
+remain separate; exact kernel restoration does not establish a two-kernel upgrade.
+See the [release record](../../releases/2026-10-13-laptop-ready/README.md).
@@ -19,7 +19,9 @@ QEMU/KVM, existing dedicated rootless Podman builder.

 - No physical block, firmware, host-service, original-container or existing-VM writes.
 - Install tests exclusively use fresh private qcow2 disks; no target selected for laptop.
- Preserve partition boundaries, foreign EFI/fallback files and firmware BootOrder.
+- Preserve partition boundaries and foreign EFI/fallback files across reboots;
+  preserve firmware BootOrder around every installer/recovery/selection operation.
+  Firmware may independently prune empty-media entries between boots.
 - Runtime payloads never contain HOME, VM data/config, credentials or networking.
 - Check release signature using a separately installed key before trusting contents.
 - Keep physical functional claims separate from read-only diagnostics and VM results.
@@ -44,12 +46,12 @@ QEMU/KVM, existing dedicated rootless Podman builder.
 **Interfaces:** extend Request compatibly with root_partition, esp_partition,
 confirm_format, root_fs and register_boot_entry. Existing `install` stays the entry.

- [ ] Add failing tests for mode parsing, identity/bounds/protection, mounted siblings,
+- [x] Add failing tests for mode parsing, identity/bounds/protection, mounted siblings,
  Btrfs member enumeration, ESP collision/space, only-root formatting and EFI policy.
- [ ] Implement shared validated target plan and distinct storage/boot branches.
- [ ] Add ext4 and Btrfs layouts plus explicit dependencies; test failure cleanup.
- [ ] Run installer suite, self-review, commit only task-owned files.
- [ ] Independent task review and scoped fixes.
+- [x] Implement shared validated target plan and distinct storage/boot branches.
+- [x] Add ext4 and Btrfs layouts plus explicit dependencies; test failure cleanup.
+- [x] Run installer suite, self-review, commit only task-owned files.
+- [x] Independent task review and scoped fixes.

 ## Task 2: Signed update and recovery

@@ -59,14 +61,14 @@ confirm_format, root_fs and register_boot_entry. Existing `install` stays the en
 **Interfaces:** the CLI actions from the spec; stable recover entrypoint runnable
 without importing hydra runtime; passive artifact manifest with version/sequence.

- [ ] Add failing tests for real crypto, transport bounds, manifest/payload validation,
+- [x] Add failing tests for real crypto, transport bounds, manifest/payload validation,
  no-write failures, replay rules, locking and destination/backup path ownership.
- [ ] Implement passive package builder, trusted verification and transactional apply.
- [ ] Implement explicit rollback and independent crash recovery with durable journal.
- [ ] Prove SIGKILL recovery in a fresh process, unchanged guest data and blocked
+- [x] Implement passive package builder, trusted verification and transactional apply.
+- [x] Implement explicit rollback and independent crash recovery with durable journal.
+- [x] Prove SIGKILL recovery in a fresh process, unchanged guest data and blocked
  corrupt backups; verify status/check work unprivileged.
- [ ] Document release creation, local key ownership, bootstrap and runtime scope.
- [ ] Run scoped suites, commit, independent review and scoped fixes.
+- [x] Document release creation, local key ownership, bootstrap and runtime scope.
+- [x] Run scoped suites, commit, independent review and scoped fixes.

 ## Task 3: Read-only laptop doctor

@@ -74,30 +76,42 @@ without importing hydra runtime; passive artifact manifest with version/sequence
 **Interfaces:** `doctor_report()` returns serializable bounded observations;
 `doctor_main(argv)` serves text/JSON. CLI wiring coordinated after Task 2.

- [ ] Test fake proc/sys/tools with absent devices, timeouts and redaction.
- [ ] Implement independent read-only probes and manual functional checks.
- [ ] Run unit suite and safe host smoke, commit, independent review.
+- [x] Test fake proc/sys/tools with absent devices, timeouts and redaction.
+- [x] Implement independent read-only probes and manual functional checks.
+- [x] Run unit suite and safe host smoke, commit, independent review.

 ## Task 4: Integration and disposable acceptance harnesses

 **Files:** `dev/iso-smoke.py`, `tests/test_iso_smoke.py`, new `dev/update-smoke.py`
 or helper as needed, CLI wiring and docs; do not edit these while other tasks do.

- [ ] Preserve whole-disk mode; add existing-partitions acceptance using seeded fresh
+- [x] Preserve whole-disk mode; add existing-partitions acceptance using seeded fresh
  disk only, no existing-disk argument. Capture partition/EFI/BootOrder identities.
- [ ] Add signed update/tamper/apply/rollback/crash-recover installed-guest checks.
- [ ] Confirm brand asset and doctor availability, compile standalone guest scripts.
- [ ] Run full source suite once integrations settle; independent review.
+- [x] Add signed update/tamper/apply/rollback/crash-recover installed-guest checks.
+- [x] Confirm brand asset and doctor availability, compile standalone guest scripts.
+- [x] Run full source suite once integrations settle; independent review.

 ## Task 5: Build, run acceptance and deliver

 **Files:** source release records under `docs/releases`; build artifacts remain ignored.

- [ ] Prepare isolated build checkout and preserve old ISO/firmware hashes.
- [ ] Build needed packages/rootfs/ISO, retaining explicit signature trust material.
- [ ] Run whole-disk and preserve-partitions real UEFI acceptance plus updater recovery.
- [ ] Run focused fixes only for observed failures, rerun affected acceptance.
- [ ] Verify exact release files, checksums, source revisions and absence of secrets.
- [ ] Final independent branch review, integrate and publish authorized source/artifacts
-  using available authenticated transport; report any unavailable publishing action.
- [ ] Report physical checks still requiring live laptop boot, not unsupported success.
+- [x] Prepare isolated build checkout and preserve old ISO/firmware hashes.
+- [x] Build needed packages/rootfs/ISO, retaining explicit signature trust material.
+- [x] Run whole-disk and preserve-partitions real UEFI acceptance plus updater recovery.
+- [x] Run focused fixes only for observed failures, rerun affected acceptance.
+- [x] Verify exact release files, checksums, source revisions and absence of secrets.
+- [x] Complete final independent branch review.
+- [ ] Integrate and publish authorized source/artifacts using available authenticated
+  transport; report any unavailable publishing action.
+- [x] Report physical checks still requiring live laptop boot, not unsupported success.
+
+## Verification status
+
+Implementation and scoped reviews are complete through source
+`ebeebc7fb1aed07a5f50bc62374365d614953dad`. The complete source suite passed
+431 tests in 26.048 seconds. Independent final review is complete. The final ISO
+passed the unchanged whole-disk harness (13 checks) and laptop/recovery harness
+(23 checks), with no skips. Exact artifact identities and public evidence passed
+review. Publication is the only remaining delivery step; physical checks remain
+operator work after live laptop boot.
+See the [release record](../../releases/2026-10-13-laptop-ready/README.md).
@@ -0,0 +1 @@
+{"architecture":"x86_64","archive":{"name":"runtime.zip","sha256":"9284edd5de37f621955189f3d317ebcfa76f60a4b6e1f481361b6aad1967f4f8","size":71577},"channel":"stable","files":{"etc/fastfetch/config.jsonc":{"mode":420,"sha256":"2af12ce007705f039870867c89b0fc6f90bcf6c6b29c04b63ab75f345419b1a1","size":569},"etc/motd":{"mode":420,"sha256":"67f9a310050964a9bfefa728e22eaa127c651fc325b6af97b3268261c45b79e2","size":446},"usr/lib/hydra/bin/hydra":{"mode":493,"sha256":"04e83985f4667f727518c36f952c17aad2e82957a3ca86ebb643ce665109a0cb","size":250},"usr/lib/hydra/hydra/__init__.py":{"mode":420,"sha256":"2775bedc6bc41a09d8a492e99a38ce147730d979867316a672f0049f055c76a1","size":42},"usr/lib/hydra/hydra/build.py":{"mode":420,"sha256":"7d130a0ce0eed8913d8402c28824b1dff139d33c6482d9616a01d30f96cd65ac","size":31591},"usr/lib/hydra/hydra/cli.py":{"mode":420,"sha256":"a9399544462279af97542de068907f6f2adb634874648338bdb6094606c03c78","size":8444},"usr/lib/hydra/hydra/doctor.py":{"mode":420,"sha256":"9d759958c48b56a5f58acaab301c8c6f49c3a6c2ea7d434ee7d17bc420ba51c2","size":8699},"usr/lib/hydra/hydra/image.py":{"mode":420,"sha256":"b4b77ad87ceba929ed39bee2b02852682718788dacbbbb550ee1a50c216e8070","size":22481},"usr/lib/hydra/hydra/install_storage.py":{"mode":420,"sha256":"3c59d5f295d6bdb86e6decbae668db67cc2f2d0b8c6abe49ef07f35d8aef7aee","size":8481},"usr/lib/hydra/hydra/installer.py":{"mode":420,"sha256":"3d038216c37e248db5ad8a76863663d701d5ef497cb5be52658c9382c92f0da5","size":50513},"usr/lib/hydra/hydra/launch.py":{"mode":420,"sha256":"e9e40af8cfb2aff39306735e6ad70c91d7f93cb01d1451daecbbebda8362c4b0","size":5845},"usr/lib/hydra/hydra/media.py":{"mode":420,"sha256":"4c85798a81e767605e8e0a1cd0eb21062f625c49dd71df511b2b67db375d95af","size":9445},"usr/lib/hydra/hydra/menu.py":{"mode":420,"sha256":"ba99dcc9ed33543d54ad61d13b6c5f02c2d4c6d60f6c2cf9c5ceeb0634a88f5c","size":11472},"usr/lib/hydra/hydra/profiles.py":{"mode":420,"sha256":"7e3074086172bfb1ebde89996a2ca9be4512250e667e1375b9086d7148f947c3","size":4364},"usr/lib/hydra/hydra/qmp.py":{"mode":420,"sha256":"e86da77103b991cf7f0104e701555ebbc91e2b526d6b7ec6db76209f264af024","size":4585},"usr/lib/hydra/hydra/runtime.py":{"mode":420,"sha256":"d72353ebd675135801a3686a69ee8a193b87d5787f691917a46c99de0555d5d3","size":15605},"usr/lib/hydra/hydra/session.py":{"mode":420,"sha256":"729d6cd263f9828850018b335917a15f03d2a2bda0e38e73f842d3cfc196db1d","size":16098},"usr/lib/hydra/hydra/system_recovery.py":{"mode":420,"sha256":"957d9b8ab422b446f1f7c0f922c1629a0728e0043bd0a3ade36495f4200d5c05","size":30194},"usr/share/hydra/fastfetch.txt":{"mode":420,"sha256":"a0c67cfbc66a3097fb3ac9b8ec16f75a8b59d8a8994ec43db144426fc089fa67","size":769}},"format":1,"product":"Hydra OS","scope":"runtime","sequence":1,"source_commit":"ebeebc7fb1aed07a5f50bc62374365d614953dad","version":"0.2.0"}
				`@@ -0,0 +1 @@`
				{"architecture":"x86_64","archive":{"name":"runtime.zip","sha256":"9284edd5de37f621955189f3d317ebcfa76f60a4b6e1f481361b6aad1967f4f8","size":71577},"channel":"stable","files":{"etc/fastfetch/config.jsonc":{"mode":420,"sha256":"2af12ce007705f039870867c89b0fc6f90bcf6c6b29c04b63ab75f345419b1a1","size":569},"etc/motd":{"mode":420,"sha256":"67f9a310050964a9bfefa728e22eaa127c651fc325b6af97b3268261c45b79e2","size":446},"usr/lib/hydra/bin/hydra":{"mode":493,"sha256":"04e83985f4667f727518c36f952c17aad2e82957a3ca86ebb643ce665109a0cb","size":250},"usr/lib/hydra/hydra/__init__.py":{"mode":420,"sha256":"2775bedc6bc41a09d8a492e99a38ce147730d979867316a672f0049f055c76a1","size":42},"usr/lib/hydra/hydra/build.py":{"mode":420,"sha256":"7d130a0ce0eed8913d8402c28824b1dff139d33c6482d9616a01d30f96cd65ac","size":31591},"usr/lib/hydra/hydra/cli.py":{"mode":420,"sha256":"a9399544462279af97542de068907f6f2adb634874648338bdb6094606c03c78","size":8444},"usr/lib/hydra/hydra/doctor.py":{"mode":420,"sha256":"9d759958c48b56a5f58acaab301c8c6f49c3a6c2ea7d434ee7d17bc420ba51c2","size":8699},"usr/lib/hydra/hydra/image.py":{"mode":420,"sha256":"b4b77ad87ceba929ed39bee2b02852682718788dacbbbb550ee1a50c216e8070","size":22481},"usr/lib/hydra/hydra/install_storage.py":{"mode":420,"sha256":"3c59d5f295d6bdb86e6decbae668db67cc2f2d0b8c6abe49ef07f35d8aef7aee","size":8481},"usr/lib/hydra/hydra/installer.py":{"mode":420,"sha256":"3d038216c37e248db5ad8a76863663d701d5ef497cb5be52658c9382c92f0da5","size":50513},"usr/lib/hydra/hydra/launch.py":{"mode":420,"sha256":"e9e40af8cfb2aff39306735e6ad70c91d7f93cb01d1451daecbbebda8362c4b0","size":5845},"usr/lib/hydra/hydra/media.py":{"mode":420,"sha256":"4c85798a81e767605e8e0a1cd0eb21062f625c49dd71df511b2b67db375d95af","size":9445},"usr/lib/hydra/hydra/menu.py":{"mode":420,"sha256":"ba99dcc9ed33543d54ad61d13b6c5f02c2d4c6d60f6c2cf9c5ceeb0634a88f5c","size":11472},"usr/lib/hydra/hydra/profiles.py":{"mode":420,"sha256":"7e3074086172bfb1ebde89996a2ca9be4512250e667e1375b9086d7148f947c3","size":4364},"usr/lib/hydra/hydra/qmp.py":{"mode":420,"sha256":"e86da77103b991cf7f0104e701555ebbc91e2b526d6b7ec6db76209f264af024","size":4585},"usr/lib/hydra/hydra/runtime.py":{"mode":420,"sha256":"d72353ebd675135801a3686a69ee8a193b87d5787f691917a46c99de0555d5d3","size":15605},"usr/lib/hydra/hydra/session.py":{"mode":420,"sha256":"729d6cd263f9828850018b335917a15f03d2a2bda0e38e73f842d3cfc196db1d","size":16098},"usr/lib/hydra/hydra/system_recovery.py":{"mode":420,"sha256":"957d9b8ab422b446f1f7c0f922c1629a0728e0043bd0a3ade36495f4200d5c05","size":30194},"usr/share/hydra/fastfetch.txt":{"mode":420,"sha256":"a0c67cfbc66a3097fb3ac9b8ec16f75a8b59d8a8994ec43db144426fc089fa67","size":769}},"format":1,"product":"Hydra OS","scope":"runtime","sequence":1,"source_commit":"ebeebc7fb1aed07a5f50bc62374365d614953dad","version":"0.2.0"}