- Fix function name: configure_ssh → configure_ssh_client (matches src/)
- Add missing configure_fim call for AIDE File Integrity Monitoring
These functions exist in src/security-hardening.sh but the hook was
calling the wrong name or missing the FIM call entirely.
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
ISO now always named knel-football-secure.iso (no v1.0.0 suffix).
Updated all references in code, docs, and tests.
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
Agent must automatically commit and push after completing work.
User should NEVER have to ask about commit status.
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
- Add ADR-009 for script consolidation (run.sh as single entry point)
- Update STATUS.md to reflect complete state (ISO built, VM framework merged)
- Document lessons learned from libvirt group requirement
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
- Replace libvirt group check with actual virsh access test
- Add QEMU direct execution fallback when virt-install fails
- Handle both virsh and QEMU pidfile for VM status
- Update STATUS.md: ISO verified, VM boot test passed
- Runtime coverage now ~50% (boot verified)
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
- STATUS.md: ISO rebuild in progress, updated next actions
- JOURNAL.md: Added session 2 entry for FIM/audit/SSH work, ADRs 005-007
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
- Test SSH password authentication is disabled
- Test SSH root login is disabled
💘 Generated with Crush
Assisted-by: GLM-5 via Crush <crush@charm.land>
- Never run destructive ops (reset --hard, rm, checkout/restore) without explicit user instruction
- Never amend commits without explicit written approval
💘 Generated with Crush
Assisted-by: GLM-5 via Crush <crush@charm.land>
- Quote paths with brackets/parentheses to prevent shell expansion
- Use GIT_EDITOR=: GIT_SEQUENCE_EDITOR=: for non-interactive rebase
💘 Generated with Crush
Assisted-by: GLM-5 via Crush <crush@charm.land>
- Double-check git status before any commit
- Delete unused/obsolete files when refactoring
💘 Generated with Crush
Assisted-by: GLM-5 via Crush <crush@charm.land>
Update STATUS.md to reflect completed work:
Changes:
- Status changed to "READY FOR TESTING"
- All 7 commits from session listed
- Test coverage updated to 78 tests
- Secure Boot packages marked as added
- VM test framework marked as created
- Shellcheck warnings marked as fixed
- Next actions clarified (user logout/login required)
Blockers clearly identified:
- User not in libvirt group
- ISO not built
Metrics updated to reflect session progress.
💘 Generated with Crush
Assisted-by: GLM-5 via Crush <crush@charm.land>
Add JOURNAL.md to version control. This file serves as
the AI agent's long-term memory and learning repository.
Purpose:
- Capture insights and patterns discovered
- Document lessons learned from sessions
- Record architectural decision records (ADRs)
- Enable knowledge persistence across sessions
Format:
- Append-only (never delete or modify existing entries)
- Dated entries with clear sections
- Cross-references to related files
This file is maintained by AI agents working on the project
and provides context for future sessions.
💘 Generated with Crush
Assisted-by: GLM-5 via Crush <crush@charm.land>
Extend the test runner to support system-level tests
for VM boot verification and runtime testing.
Changes:
- Add test:system command for system tests only
- Update main test command to include system tests
- System tests cover boot, Secure Boot, and FDE
New command: ./run.sh test:system
This allows running system tests independently when
prerequisites (libvirt, ISO) are available.
💘 Generated with Crush
Assisted-by: GLM-5 via Crush <crush@charm.land>
Update documentation to reflect new project structure
and files created for test coverage enhancement.
README.md:
- Add STATUS.md link to documentation table
- Add JOURNAL.md link to documentation table
- STATUS.md: Manager-facing status report
- JOURNAL.md: AI agent memory and ADRs
AGENTS.md:
- Document STATUS.md purpose and maintenance
- Document JOURNAL.md purpose (AI memory, ADRs)
- Add tests/system/ directory to project structure
- Clean up obsolete file references
- Update documentation structure section
These changes ensure all team members (human and AI)
understand the purpose and location of key files.
💘 Generated with Crush
Assisted-by: GLM-5 via Crush <crush@charm.land>
Improve code quality by addressing shellcheck warnings
across security-critical scripts.
src/security-hardening.sh:
- Add shellcheck directive for SC2120/SC2119
- Function configure_password_policy() accepts optional args
- Directive documents intentional usage pattern
src/firewall-setup.sh:
- Fix function argument passing in main()
- Properly pass arguments to configure_firewall()
config/hooks/installed/encryption-setup.sh:
- Consolidate echo commands to fix SC2129
- Use single redirect for multiple writes
Remaining warnings are non-critical:
- SC1091: Source files exist at runtime in Docker container
- SC2016: Intentional single quotes for sed pattern
No functional changes - purely code quality improvements.
💘 Generated with Crush
Assisted-by: GLM-5 via Crush <crush@charm.land>
Create comprehensive system testing infrastructure for
runtime verification of the KNEL-Football ISO.
test-iso.sh (VM test framework):
- VM creation via virt-install with UEFI support
- Prerequisite checking (libvirt group, virsh, ISO)
- Boot test automation with timeout handling
- Secure Boot and FDE test commands
- Console access via virsh console
- Color-coded logging for clarity
tests/system/boot_test.bats (14 tests):
- Libvirt availability and access verification
- ISO existence and size validation
- SHA256 and MD5 checksum verification
- test-iso.sh framework validation
tests/system/secureboot_test.bats (10 tests):
- Secure Boot package verification in package list
- UEFI/GPT partitioning configuration tests
- LUKS2 encryption configuration validation
tests/system/fde_test.bats (23 tests):
- Encryption setup script existence tests
- LUKS2 configuration validation
- AES-256-XTS cipher verification
- 512-bit key length verification
- Initramfs and crypttab configuration
- Helper scripts creation validation
- Password policy enforcement tests
- Runtime FDE test placeholders (skip if no VM)
Test execution:
- All tests pass with appropriate skips when
prerequisites (libvirt group, ISO) are not met
- Zero failures in static analysis portion
Total: 47 new system tests
💘 Generated with Crush
Assisted-by: GLM-5 via Crush <crush@charm.land>
Add UEFI Secure Boot packages to enable booting on systems
with Secure Boot enabled:
- shim-signed: Microsoft-signed shim bootloader
- grub-efi-amd64-signed: Signed GRUB EFI bootloader
- grub-efi-amd64-bin: GRUB EFI binaries
- efibootmgr: EFI boot manager utility
This is mandatory for modern UEFI systems that ship with
Secure Boot enabled by default.
Compliance: UEFI Secure Boot specification
💘 Generated with Crush
Assisted-by: GLM-5 via Crush <crush@charm.land>
Add STATUS.md as a manager-facing status report that provides
a quick-glance view of project health. This file is maintained
by the AI agent and read by humans.
Contents:
- Executive summary with current status
- What's working vs broken
- Current blockers
- Test coverage analysis
- Next actions and metrics
Related: JOURNAL.md for AI memory
💘 Generated with Crush
Assisted-by: GLM-5 via Crush <crush@charm.land>
Charles N Wyble