Publish verified Hydra OS 0.2.0 runtime and laptop acceptance records

docs/superpowers/plans/2026-10-13-laptop-ready.md

@@ -19,7 +19,9 @@ QEMU/KVM, existing dedicated rootless Podman builder.
 
 - No physical block, firmware, host-service, original-container or existing-VM writes.
 - Install tests exclusively use fresh private qcow2 disks; no target selected for laptop.
-- Preserve partition boundaries, foreign EFI/fallback files and firmware BootOrder.
+- Preserve partition boundaries and foreign EFI/fallback files across reboots;
+  preserve firmware BootOrder around every installer/recovery/selection operation.
+  Firmware may independently prune empty-media entries between boots.
 - Runtime payloads never contain HOME, VM data/config, credentials or networking.
 - Check release signature using a separately installed key before trusting contents.
 - Keep physical functional claims separate from read-only diagnostics and VM results.
@@ -44,12 +46,12 @@ QEMU/KVM, existing dedicated rootless Podman builder.
 **Interfaces:** extend Request compatibly with root_partition, esp_partition,
 confirm_format, root_fs and register_boot_entry. Existing `install` stays the entry.
 
-- [ ] Add failing tests for mode parsing, identity/bounds/protection, mounted siblings,
+- [x] Add failing tests for mode parsing, identity/bounds/protection, mounted siblings,
   Btrfs member enumeration, ESP collision/space, only-root formatting and EFI policy.
-- [ ] Implement shared validated target plan and distinct storage/boot branches.
-- [ ] Add ext4 and Btrfs layouts plus explicit dependencies; test failure cleanup.
-- [ ] Run installer suite, self-review, commit only task-owned files.
-- [ ] Independent task review and scoped fixes.
+- [x] Implement shared validated target plan and distinct storage/boot branches.
+- [x] Add ext4 and Btrfs layouts plus explicit dependencies; test failure cleanup.
+- [x] Run installer suite, self-review, commit only task-owned files.
+- [x] Independent task review and scoped fixes.
 
 ## Task 2: Signed update and recovery
 
@@ -59,14 +61,14 @@ confirm_format, root_fs and register_boot_entry. Existing `install` stays the en
 **Interfaces:** the CLI actions from the spec; stable recover entrypoint runnable
 without importing hydra runtime; passive artifact manifest with version/sequence.
 
-- [ ] Add failing tests for real crypto, transport bounds, manifest/payload validation,
+- [x] Add failing tests for real crypto, transport bounds, manifest/payload validation,
   no-write failures, replay rules, locking and destination/backup path ownership.
-- [ ] Implement passive package builder, trusted verification and transactional apply.
-- [ ] Implement explicit rollback and independent crash recovery with durable journal.
-- [ ] Prove SIGKILL recovery in a fresh process, unchanged guest data and blocked
+- [x] Implement passive package builder, trusted verification and transactional apply.
+- [x] Implement explicit rollback and independent crash recovery with durable journal.
+- [x] Prove SIGKILL recovery in a fresh process, unchanged guest data and blocked
   corrupt backups; verify status/check work unprivileged.
-- [ ] Document release creation, local key ownership, bootstrap and runtime scope.
-- [ ] Run scoped suites, commit, independent review and scoped fixes.
+- [x] Document release creation, local key ownership, bootstrap and runtime scope.
+- [x] Run scoped suites, commit, independent review and scoped fixes.
 
 ## Task 3: Read-only laptop doctor
 
@@ -74,30 +76,42 @@ without importing hydra runtime; passive artifact manifest with version/sequence
 **Interfaces:** `doctor_report()` returns serializable bounded observations;
 `doctor_main(argv)` serves text/JSON. CLI wiring coordinated after Task 2.
 
-- [ ] Test fake proc/sys/tools with absent devices, timeouts and redaction.
-- [ ] Implement independent read-only probes and manual functional checks.
-- [ ] Run unit suite and safe host smoke, commit, independent review.
+- [x] Test fake proc/sys/tools with absent devices, timeouts and redaction.
+- [x] Implement independent read-only probes and manual functional checks.
+- [x] Run unit suite and safe host smoke, commit, independent review.
 
 ## Task 4: Integration and disposable acceptance harnesses
 
 **Files:** `dev/iso-smoke.py`, `tests/test_iso_smoke.py`, new `dev/update-smoke.py`
 or helper as needed, CLI wiring and docs; do not edit these while other tasks do.
 
-- [ ] Preserve whole-disk mode; add existing-partitions acceptance using seeded fresh
+- [x] Preserve whole-disk mode; add existing-partitions acceptance using seeded fresh
   disk only, no existing-disk argument. Capture partition/EFI/BootOrder identities.
-- [ ] Add signed update/tamper/apply/rollback/crash-recover installed-guest checks.
-- [ ] Confirm brand asset and doctor availability, compile standalone guest scripts.
-- [ ] Run full source suite once integrations settle; independent review.
+- [x] Add signed update/tamper/apply/rollback/crash-recover installed-guest checks.
+- [x] Confirm brand asset and doctor availability, compile standalone guest scripts.
+- [x] Run full source suite once integrations settle; independent review.
 
 ## Task 5: Build, run acceptance and deliver
 
 **Files:** source release records under `docs/releases`; build artifacts remain ignored.
 
-- [ ] Prepare isolated build checkout and preserve old ISO/firmware hashes.
-- [ ] Build needed packages/rootfs/ISO, retaining explicit signature trust material.
-- [ ] Run whole-disk and preserve-partitions real UEFI acceptance plus updater recovery.
-- [ ] Run focused fixes only for observed failures, rerun affected acceptance.
-- [ ] Verify exact release files, checksums, source revisions and absence of secrets.
-- [ ] Final independent branch review, integrate and publish authorized source/artifacts
-  using available authenticated transport; report any unavailable publishing action.
-- [ ] Report physical checks still requiring live laptop boot, not unsupported success.
+- [x] Prepare isolated build checkout and preserve old ISO/firmware hashes.
+- [x] Build needed packages/rootfs/ISO, retaining explicit signature trust material.
+- [x] Run whole-disk and preserve-partitions real UEFI acceptance plus updater recovery.
+- [x] Run focused fixes only for observed failures, rerun affected acceptance.
+- [x] Verify exact release files, checksums, source revisions and absence of secrets.
+- [x] Complete final independent branch review.
+- [ ] Integrate and publish authorized source/artifacts using available authenticated
+  transport; report any unavailable publishing action.
+- [x] Report physical checks still requiring live laptop boot, not unsupported success.
+
+## Verification status
+
+Implementation and scoped reviews are complete through source
+`ebeebc7fb1aed07a5f50bc62374365d614953dad`. The complete source suite passed
+431 tests in 26.048 seconds. Independent final review is complete. The final ISO
+passed the unchanged whole-disk harness (13 checks) and laptop/recovery harness
+(23 checks), with no skips. Exact artifact identities and public evidence passed
+review. Publication is the only remaining delivery step; physical checks remain
+operator work after live laptop boot.
+See the [release record](../../releases/2026-10-13-laptop-ready/README.md).