Hardening/alpha25 operator automation

.gitattributes

@@ -1,7 +1,27 @@
 * text=auto
+/.gitattributes text eol=lf
 *.sh text eol=lf
+*.py text eol=lf
 *.rs text eol=lf
 *.toml text eol=lf
 *.json text eol=lf
 *.md text eol=lf
+*.service text eol=lf
+*.timer text eol=lf
+*.conf text eol=lf
 *.ps1 text eol=crlf
+
+build/usb/version.env text eol=lf
+build/usb/hooks/* text eol=lf
+build/usb/bootloaders/** text eol=lf
+build/usb/package-lists/rigos.list.chroot text eol=lf
+build/usb/includes.chroot/usr/local/bin/* text eol=lf
+build/usb/includes.chroot/usr/local/sbin/rigos-* text eol=lf
+build/usb/includes.chroot/usr/lib/rigos/rigos-firstboot-* text eol=lf
+build/usb/includes.chroot/usr/lib/rigos/rigos-randomx-msr text eol=lf
+build/usb/includes.chroot/usr/lib/rigos/rigos-runtime-* text eol=lf
+build/usb/includes.chroot/usr/lib/rigos/rigos-miner-* text eol=lf
+build/usb/includes.chroot/usr/lib/rigos/rigos-remote-* text eol=lf
+build/usb/includes.chroot/usr/lib/rigos/rigos-lifecycle-* text eol=lf
+build/usb/grub-theme/** text eol=lf
+build/usb/grub-theme/**/*.png -text

.github/workflows/source-gate.yml

@@ -0,0 +1,60 @@
+name: RIGOS Source Gate
+
+on:
+  pull_request:
+    branches:
+      - performance/randomx-sustained-hash
+      - stability/hive-exit-gates
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: source-gate-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    name: Authoritative Linux source verification
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+
+    steps:
+      - name: Check out exact pull-request head
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Install required host tools
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install --yes --no-install-recommends ripgrep
+
+      - name: Install locked Rust toolchain
+        run: |
+          set -euo pipefail
+          rustup toolchain install 1.85.1 \
+            --profile minimal \
+            --component rustfmt \
+            --component clippy
+          rustup override set 1.85.1
+          rustc --version
+          cargo --version
+          cargo fmt --version
+          cargo clippy --version
+
+      - name: Run authoritative RIGOS source gate
+        env:
+          CARGO_TERM_COLOR: always
+        run: |
+          set -euo pipefail
+          bash ./scripts/verify-wsl-entrypoint.sh "$GITHUB_WORKSPACE"
+
+      - name: Record exact verified revision
+        if: always()
+        run: |
+          set -euo pipefail
+          printf 'RIGOS_VERIFIED_HEAD=%s\n' "$(git rev-parse HEAD)"
+          git status --short

.gitignore

@@ -12,3 +12,5 @@
 *.age.partial
 *.pem
 *.key
+__pycache__/
+*.py[cod]

Cargo.toml

@@ -11,6 +11,7 @@ members = [
   "crates/rigos-pool",
   "crates/rigos-state",
   "crates/rigos-config",
+  "crates/rigos-performance",
 ]
 resolver = "2"
 

README.md

@@ -2,7 +2,7 @@
 
 Local-first CPU appliance delivered as a bootable USB image.
 
-Current development preview is `RIGOS 0.0.4-alpha.5`.
+Current development preview is `RIGOS 0.0.4-alpha.6`.
 
 The persistent appliance uses a raw MBR disk image for Legacy BIOS and removable-media UEFI boot.
 
@@ -23,9 +23,11 @@ The recovery ISO is stateless and does not grow the state partition.
 0.0.4-alpha.3  fixed console order but kept the first boot screen hidden
 0.0.4-alpha.4  keeps the first boot screen on tty and captures answers separately
 0.0.4-alpha.5  adds local rig profiles and portable XMRig Flight Sheets
+0.0.4-alpha.6  adds visible machine-wide huge page authority
 ```
 
-Alpha five is isolated on its development branch. Alpha four physical state validation remains separate.
+Alpha five is frozen at its physically validated image and Alpha six develops
+performance authority on a separate branch.
 
 ## Verification
 

build/usb/Dockerfile

@@ -7,5 +7,11 @@ RUN apt-get update \
       ripgrep rsync squashfs-tools syslinux-common syslinux-utils udev uuid-runtime xorriso zstd \
  && rm -rf /var/lib/apt/lists/*
 
+ENV PATH="/usr/local/cargo/bin:/usr/local/rustup/bin:${PATH}"
+
+RUN command -v cargo \
+ && cargo --version \
+ && rustc --version
+
 WORKDIR /source
-ENTRYPOINT ["./scripts/build-usb-image.sh"]
+ENTRYPOINT ["/bin/bash", "-c", "exec /bin/bash ./scripts/build-usb-image-entrypoint.sh"]

build/usb/bootloaders/grub-pc/live-theme/theme.txt

@@ -1,6 +1,6 @@
 title-color: "#ffffff"
 title-font: "Unifont Regular 16"
-title-text: "RIGOS Recovery 0.0.4-alpha.5 - Stateless Diagnostics"
+title-text: "RIGOS Recovery"
 message-font: "Unifont Regular 16"
 terminal-font: "Unifont Regular 16"
 

build/usb/bootloaders/syslinux_common/live.cfg.in

@@ -1,12 +1,12 @@
 label rigos-@FLAVOUR@
-	menu label ^RIGOS Recovery 0.0.4-alpha.5
+	menu label ^RIGOS Recovery
 	menu default
 	linux @LINUX@
 	initrd @INITRD@
 	append @APPEND_LIVE@
 
 label rigos-@FLAVOUR@-failsafe
-	menu label RIGOS Recovery 0.0.4-alpha.5 -- ^safe mode
+	menu label RIGOS Recovery (^Safe Mode)
 	linux @LINUX@
 	initrd @INITRD@
 	append @APPEND_LIVE_FAILSAFE@

build/usb/grub-theme/rigos/theme.txt

@@ -0,0 +1,112 @@
+desktop-color: "#00040a"
+title-color: "#00ff66"
+title-font: "Unifont Regular 16"
+title-text: "RIGOS"
+message-font: "Unifont Regular 16"
+terminal-font: "Unifont Regular 16"
+
++ label {
+        top = 9%
+        left = 8%
+        width = 84%
+        height = 24
+        text = "+--------------------------------------------------------------+"
+        color = "#008f39"
+        font = "Unifont Regular 16"
+        align = "center"
+}
+
++ label {
+        top = 13%
+        left = 8%
+        width = 84%
+        height = 24
+        text = "|  RIGOS DEADBYTE UTILITY BIOS                                |"
+        color = "#00ff66"
+        font = "Unifont Regular 16"
+        align = "center"
+}
+
++ label {
+        top = 17%
+        left = 8%
+        width = 84%
+        height = 24
+        text = "|  USB COMPUTE APPLIANCE   0.0.4-alpha.25   ALPHA CHANNEL     |"
+        color = "#ffcc33"
+        font = "Unifont Regular 16"
+        align = "center"
+}
+
++ label {
+        top = 21%
+        left = 8%
+        width = 84%
+        height = 24
+        text = "+--------------------------------------------------------------+"
+        color = "#008f39"
+        font = "Unifont Regular 16"
+        align = "center"
+}
+
++ label {
+        top = 31%
+        left = 8%
+        width = 84%
+        height = 24
+        text = "SELECT BOOT TARGET  //  LOCAL CONTROL"
+        color = "#ff66cc"
+        font = "Unifont Regular 16"
+        align = "left"
+}
+
++ boot_menu {
+        left = 12%
+        width = 76%
+        top = 37%
+        height = 28%
+        item_color = "#00ff66"
+        item_font = "Unifont Regular 16"
+        selected_item_color = "#00040a"
+        selected_item_font = "Unifont Regular 16"
+        selected_item_pixmap_style = "select_*.png"
+        item_height = 26
+        item_padding = 4
+        item_spacing = 5
+}
+
++ label {
+        top = 72%
+        left = 8%
+        width = 84%
+        height = 24
+        text = "STATUS READY  MEDIA USB  MODE LOCAL  STYLE RETRO"
+        color = "#00bfff"
+        font = "Unifont Regular 16"
+        align = "left"
+}
+
++ label {
+        top = 82%
+        left = 8%
+        width = 84%
+        height = 24
+        text = "[ ENTER BOOT ]     [ E EDIT ]     [ C CONSOLE ]"
+        color = "#ffcc33"
+        font = "Unifont Regular 16"
+        align = "center"
+}
+
++ progress_bar {
+        id = "__timeout__"
+        left = 14%
+        top = 88%
+        height = 12
+        width = 72%
+        font = "Unifont Regular 16"
+        text_color = "#000000"
+        fg_color = "#00ff66"
+        bg_color = "#001018"
+        border_color = "#008f39"
+        text = "@TIMEOUT_NOTIFICATION_SHORT@"
+}

build/usb/hooks/010-rigos.chroot

@@ -4,11 +4,14 @@ set -eu
 useradd --system --home-dir /var/lib/rigos --shell /usr/sbin/nologin --user-group rigos
 useradd --create-home --shell /bin/bash --groups sudo rigosadmin
 passwd --lock rigosadmin
-install -d -o rigos -g rigos -m 0750 /var/lib/rigos /run/rigos
-install -d -m 0755 /usr/lib/rigos
+install -d -o root -g rigos -m 0750 /var/lib/rigos
+install -d -m 0755 /usr/lib/rigos /usr/local/bin
+systemd-tmpfiles --create /usr/lib/tmpfiles.d/rigos.conf
 
-chmod 0755 /usr/local/sbin/rigos-firstboot /usr/lib/rigos/rigos-state-init /usr/lib/rigos/rigos-config /usr/lib/rigos/xmrig
-systemctl enable NetworkManager.service rigos-state.service rigos-profile-apply.service rigos-firstboot.service rigos-miner.service tmp.mount
+rm -f /etc/ssh/ssh_host_*_key /etc/ssh/ssh_host_*_key.pub
+chmod 0755 /usr/local/bin/rig /usr/local/bin/rigosd /usr/local/bin/rigosctl /usr/local/sbin/rigos-firstboot /usr/local/sbin/rigos-recovery-access /usr/local/sbin/rigos-state-orchestrate /usr/local/sbin/rigos-utility /usr/lib/rigos/rigos-admin-password /usr/lib/rigos/rigos-firstboot-whiptail /usr/lib/rigos/rigos-miner-gate /usr/lib/rigos/rigos-miner-health /usr/lib/rigos/rigos-runtime-render /usr/lib/rigos/rigos-runtime-publish /usr/lib/rigos/rigos-runtime-gate /usr/lib/rigos/rigos-randomx-msr /usr/lib/rigos/rigos-ssh-hostkeys /usr/lib/rigos/rigos-state-init /usr/lib/rigos/rigos-state-ready /usr/lib/rigos/rigos-config /usr/lib/rigos/rigos-performance /usr/lib/rigos/rigos-lifecycle-cycles /usr/lib/rigos/rigos-identity-seed /usr/lib/rigos/xmrig
+systemctl enable NetworkManager.service ssh.service rigos-state.service rigos-recovery-access.service rigos-state-ready.service rigos-ssh-hostkeys.service rigos-profile-apply.service rigos-runtime-render.service rigos-hugepages.service rigos-firstboot.service rigos-boot-utility.service rigos-randomx-msr.service rigos-miner.service rigos-miner-health.timer tmp.mount
+systemctl disable ssh.socket 2>/dev/null || true
 systemctl disable apt-daily.timer apt-daily-upgrade.timer logrotate.timer fstrim.timer 2>/dev/null || true
 systemctl disable systemd-journald-audit.socket 2>/dev/null || true
 

build/usb/includes.chroot/etc/ssh/sshd_config.d/00-rigos.conf

@@ -0,0 +1,12 @@
+PasswordAuthentication yes
+KbdInteractiveAuthentication no
+UsePAM yes
+AuthenticationMethods any
+PubkeyAuthentication yes
+PermitRootLogin no
+AllowUsers rigosadmin
+X11Forwarding no
+AllowAgentForwarding no
+AllowTcpForwarding no
+PermitTunnel no
+GatewayPorts no

build/usb/includes.chroot/etc/ssh/sshd_config.d/01-rigos-hostkeys.conf

@@ -0,0 +1,4 @@
+HostKey /run/rigos/ssh-hostkeys/ssh_host_ed25519_key
+PasswordAuthentication yes
+PermitRootLogin no
+AllowUsers rigosadmin

build/usb/includes.chroot/etc/systemd/system/getty@tty1.service.d/rigos-firstboot.conf

@@ -0,0 +1,3 @@
+[Unit]
+Wants=rigos-firstboot.service
+After=rigos-firstboot.service

build/usb/includes.chroot/etc/systemd/system/rigos-boot-utility.service

@@ -0,0 +1,20 @@
+[Unit]
+Description=RIGOS local boot utility console
+ConditionKernelCommandLine=rigos.utility=1
+After=rigos-recovery-access.service rigos-state-ready.service
+Wants=rigos-recovery-access.service rigos-state-ready.service
+Before=getty@tty1.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/rigos-utility
+StandardInput=tty-force
+StandardOutput=tty
+StandardError=journal
+TTYPath=/dev/tty1
+TTYReset=yes
+TTYVTDisallocate=yes
+RemainAfterExit=no
+
+[Install]
+WantedBy=multi-user.target

build/usb/includes.chroot/etc/systemd/system/rigos-firstboot.service

@@ -1,20 +1,19 @@
 [Unit]
 Description=RIGOS first-boot configuration
-After=network-online.target rigos-state.service rigos-profile-apply.service
-Wants=network-online.target
-Requires=rigos-state.service
+ConditionKernelCommandLine=!rigos.utility=1
+After=rigos-state.service rigos-state-ready.service
+Wants=rigos-state-ready.service
 Before=getty@tty1.service
-ConditionPathExists=!/var/lib/rigos/policy.json
 
 [Service]
 Type=oneshot
+ExecCondition=/usr/lib/rigos/rigos-config needs-activation
 ExecStart=/usr/local/sbin/rigos-firstboot
-StandardInput=tty
+StandardInput=tty-force
 StandardOutput=tty
-StandardError=tty
+StandardError=journal
 TTYPath=/dev/tty1
 TTYReset=yes
-TTYVHangup=yes
 TTYVTDisallocate=yes
 
 [Install]

build/usb/includes.chroot/etc/systemd/system/rigos-firstboot.service.d/2009-console-theme.conf

@@ -0,0 +1,3 @@
+[Service]
+Environment=RIGOS_WHIPTAIL=/usr/lib/rigos/rigos-firstboot-whiptail
+Environment="RIGOS_FIRSTBOOT_BACKTITLE=RIGOS SETUP UTILITY   LOCAL NODE CONFIGURATION"