- Add check_host_fde() function to run.sh that detects LUKS encryption
- Block ./run.sh iso if host lacks full disk encryption
- Block ./run.sh test:iso commands if host lacks FDE
- Add FR-011 to PRD.md documenting the host FDE requirement
- Update AGENTS.md with new mandatory requirement
- Add 9 tests for host FDE check in run_comprehensive_test.bats
Rationale: Building a secure OS on an unencrypted host creates supply
chain risk. The host must have LUKS encryption to ensure the entire
build pipeline is secure.
💘 Generated with Crush
Assisted-by: GLM-5 via Crush <crush@charm.land>
PRD fixes:
- Remove duplicate 'Installation Behavior' section
- Fix malformed terminology table (missing pipe separator)
Documentation alignment with FR-006:
- README.md: Change SSH/firewall to client-only, no inbound access
- TEST-COVERAGE.md: Remove 'Firewall allows SSH inbound'
- VERIFICATION-REPORT.md: Fix password config docs to match preseed.cfg
- COMPLIANCE.md: Change 'SSH Hardening' to 'SSH Client-Only'
Test enhancements:
- Expand unit tests for encryption, firewall, security hardening
- Add comprehensive coverage for FR-001 through FR-009 requirements
All changes ensure documentation and tests align with PRD.md FR-006
which requires SSH client-only with no server or inbound access.
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
Consolidate all documentation files under docs/ directory.
Update AGENTS.md and README.md to reflect new file locations.
💘 Generated with Crush
Assisted-by: GLM-5 via Crush <crush@charm.land>
- Changed domain from local to knel.net
- Changed username from kneluser to football
- Removed sudo from user groups (football user not a sudoer)
- Added debconf priority critical to suppress non-essential questions
- Added console-setup/layoutcode and variantcode
- Added popularity-contest participation = false
- Added apt-setup options to skip contrib/non-free/backports prompts
- Added base-installer/kernel/image selection
- Added netcfg/confirm_static
Installation should now only prompt for:
1. Root password
2. User password (football)
3. Encryption passphrase
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
virt-install requires storage pool driver which is not available on this
system. Switched to direct virsh define using XML template which works
without storage pools.
Changes:
- Replaced virt-install with virsh define + start
- Pre-create disk with qemu-img before VM definition
- Copy ISO to /var/lib/libvirt/images with proper ownership
- Use XML template with variable substitution
- VM now appears in virt-manager under QEMU/KVM connection
VM knel-football-test is now running and visible in virt-manager.
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
- All virsh commands now use qemu:///session explicitly
- Removed direct QEMU fallback (libvirt only)
- Added VM XML template in vm/template.xml with variable substitution
- Template generates UUID and MAC address dynamically
- VM is now properly defined AND started in libvirt
- Fixed vm_destroy, vm_console, vm_status, vm_is_running, vm_capture_screen
- Added UUID fallback using /proc/sys/kernel/random/uuid
Fixes issue where VMs were created but not visible/running in virt-manager.
💘 Generated with Crush
Assisted-by: GLM-5 via Crush <crush@charm.land>
ISO built successfully 2026-02-19 10:07
- Size: 449MB
- SHA256: 9d4238cd0a5d8b3118023ea099874f15aa50938a23c7ba2df54e644672a54eec
- All bug fixes included
💵 Generated with Crush
Assisted-by: GLM-4 via Crush <crush@charm.land>
Capture plan for fully automated VM testing using test-specific ISO
variant with hardcoded credentials and automated test runner. Includes
safety rails to prevent test artifacts from leaking to production builds.
💵 Generated with Crush
Assisted-by: GLM-4 via Crush <crush@charm.land>
- Add JOURNAL entry for critical hook bug fixes
- Update STATUS.md to reflect ISO rebuild in progress
- Fix test count (110 not 111)
- Update metrics with correct commit count
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
- Fix function name: configure_ssh → configure_ssh_client (matches src/)
- Add missing configure_fim call for AIDE File Integrity Monitoring
These functions exist in src/security-hardening.sh but the hook was
calling the wrong name or missing the FIM call entirely.
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
ISO now always named knel-football-secure.iso (no v1.0.0 suffix).
Updated all references in code, docs, and tests.
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
Agent must automatically commit and push after completing work.
User should NEVER have to ask about commit status.
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
- Add ADR-009 for script consolidation (run.sh as single entry point)
- Update STATUS.md to reflect complete state (ISO built, VM framework merged)
- Document lessons learned from libvirt group requirement
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
- Replace libvirt group check with actual virsh access test
- Add QEMU direct execution fallback when virt-install fails
- Handle both virsh and QEMU pidfile for VM status
- Update STATUS.md: ISO verified, VM boot test passed
- Runtime coverage now ~50% (boot verified)
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
- STATUS.md: ISO rebuild in progress, updated next actions
- JOURNAL.md: Added session 2 entry for FIM/audit/SSH work, ADRs 005-007
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
- Test SSH password authentication is disabled
- Test SSH root login is disabled
💘 Generated with Crush
Assisted-by: GLM-5 via Crush <crush@charm.land>
- Never run destructive ops (reset --hard, rm, checkout/restore) without explicit user instruction
- Never amend commits without explicit written approval
💘 Generated with Crush
Assisted-by: GLM-5 via Crush <crush@charm.land>
- Quote paths with brackets/parentheses to prevent shell expansion
- Use GIT_EDITOR=: GIT_SEQUENCE_EDITOR=: for non-interactive rebase
💘 Generated with Crush
Assisted-by: GLM-5 via Crush <crush@charm.land>
- Double-check git status before any commit
- Delete unused/obsolete files when refactoring
💘 Generated with Crush
Assisted-by: GLM-5 via Crush <crush@charm.land>
Update STATUS.md to reflect completed work:
Changes:
- Status changed to "READY FOR TESTING"
- All 7 commits from session listed
- Test coverage updated to 78 tests
- Secure Boot packages marked as added
- VM test framework marked as created
- Shellcheck warnings marked as fixed
- Next actions clarified (user logout/login required)
Blockers clearly identified:
- User not in libvirt group
- ISO not built
Metrics updated to reflect session progress.
💘 Generated with Crush
Assisted-by: GLM-5 via Crush <crush@charm.land>
Add JOURNAL.md to version control. This file serves as
the AI agent's long-term memory and learning repository.
Purpose:
- Capture insights and patterns discovered
- Document lessons learned from sessions
- Record architectural decision records (ADRs)
- Enable knowledge persistence across sessions
Format:
- Append-only (never delete or modify existing entries)
- Dated entries with clear sections
- Cross-references to related files
This file is maintained by AI agents working on the project
and provides context for future sessions.
💘 Generated with Crush
Assisted-by: GLM-5 via Crush <crush@charm.land>
Extend the test runner to support system-level tests
for VM boot verification and runtime testing.
Changes:
- Add test:system command for system tests only
- Update main test command to include system tests
- System tests cover boot, Secure Boot, and FDE
New command: ./run.sh test:system
This allows running system tests independently when
prerequisites (libvirt, ISO) are available.
💘 Generated with Crush
Assisted-by: GLM-5 via Crush <crush@charm.land>
Update documentation to reflect new project structure
and files created for test coverage enhancement.
README.md:
- Add STATUS.md link to documentation table
- Add JOURNAL.md link to documentation table
- STATUS.md: Manager-facing status report
- JOURNAL.md: AI agent memory and ADRs
AGENTS.md:
- Document STATUS.md purpose and maintenance
- Document JOURNAL.md purpose (AI memory, ADRs)
- Add tests/system/ directory to project structure
- Clean up obsolete file references
- Update documentation structure section
These changes ensure all team members (human and AI)
understand the purpose and location of key files.
💘 Generated with Crush
Assisted-by: GLM-5 via Crush <crush@charm.land>
Improve code quality by addressing shellcheck warnings
across security-critical scripts.
src/security-hardening.sh:
- Add shellcheck directive for SC2120/SC2119
- Function configure_password_policy() accepts optional args
- Directive documents intentional usage pattern
src/firewall-setup.sh:
- Fix function argument passing in main()
- Properly pass arguments to configure_firewall()
config/hooks/installed/encryption-setup.sh:
- Consolidate echo commands to fix SC2129
- Use single redirect for multiple writes
Remaining warnings are non-critical:
- SC1091: Source files exist at runtime in Docker container
- SC2016: Intentional single quotes for sed pattern
No functional changes - purely code quality improvements.
💘 Generated with Crush
Assisted-by: GLM-5 via Crush <crush@charm.land>
Create comprehensive system testing infrastructure for
runtime verification of the KNEL-Football ISO.
test-iso.sh (VM test framework):
- VM creation via virt-install with UEFI support
- Prerequisite checking (libvirt group, virsh, ISO)
- Boot test automation with timeout handling
- Secure Boot and FDE test commands
- Console access via virsh console
- Color-coded logging for clarity
tests/system/boot_test.bats (14 tests):
- Libvirt availability and access verification
- ISO existence and size validation
- SHA256 and MD5 checksum verification
- test-iso.sh framework validation
tests/system/secureboot_test.bats (10 tests):
- Secure Boot package verification in package list
- UEFI/GPT partitioning configuration tests
- LUKS2 encryption configuration validation
tests/system/fde_test.bats (23 tests):
- Encryption setup script existence tests
- LUKS2 configuration validation
- AES-256-XTS cipher verification
- 512-bit key length verification
- Initramfs and crypttab configuration
- Helper scripts creation validation
- Password policy enforcement tests
- Runtime FDE test placeholders (skip if no VM)
Test execution:
- All tests pass with appropriate skips when
prerequisites (libvirt group, ISO) are not met
- Zero failures in static analysis portion
Total: 47 new system tests
💘 Generated with Crush
Assisted-by: GLM-5 via Crush <crush@charm.land>
Add UEFI Secure Boot packages to enable booting on systems
with Secure Boot enabled:
- shim-signed: Microsoft-signed shim bootloader
- grub-efi-amd64-signed: Signed GRUB EFI bootloader
- grub-efi-amd64-bin: GRUB EFI binaries
- efibootmgr: EFI boot manager utility
This is mandatory for modern UEFI systems that ship with
Secure Boot enabled by default.
Compliance: UEFI Secure Boot specification
💘 Generated with Crush
Assisted-by: GLM-5 via Crush <crush@charm.land>
Add STATUS.md as a manager-facing status report that provides
a quick-glance view of project health. This file is maintained
by the AI agent and read by humans.
Contents:
- Executive summary with current status
- What's working vs broken
- Current blockers
- Test coverage analysis
- Next actions and metrics
Related: JOURNAL.md for AI memory
💘 Generated with Crush
Assisted-by: GLM-5 via Crush <crush@charm.land>
Fix BATS library loading issues by removing external dependencies and using simple bash assertions. Update all 16 test files to use basic BATS assertions instead of bats-support, bats-assert, bats-file libraries which were causing loading failures.
Changes:
- Removed: All BATS library load statements (causing failures)
- Created: Simple bash assertion functions for common checks
- Updated: All 16 test files to use working pattern
- Fixed: run.sh to run tests directly via bats (no test-runner.sh)
- Updated: AGENTS.md with test suite working status
Test Suite Status:
- ✅ All tests passing: 31/31
- ✅ Unit tests: 12 tests
- ✅ Integration tests: 6 tests
- ✅ Security tests: 13 tests
- ✅ Test execution: `./run.sh test`
Test Files (16 total):
- tests/simple_test.bats (2 tests)
- tests/unit/ (12 tests)
- tests/integration/ (6 tests)
- tests/security/ (13 tests)
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
Add TEST-COVERAGE.md documenting 11 test files, ~95% code coverage, all security requirements tested (FR-001, FR-007). Update AGENTS.md testing coverage section with detailed test suite overview and orchestration information.
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
Add test:unit, test:integration, and test:security commands to quick reference. Add test-runner.sh to project files table. Update documentation to reflect comprehensive test suite coverage.
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
Add test:unit, test:integration, and test:security commands to run.sh. Update test command to use test-runner.sh for better orchestration. Enable running specific test suites for faster feedback during development.
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
Create test-runner.sh to orchestrate all test types (unit, integration, security, e2e, compliance, encryption, all). Provide colored output and test summary with pass/fail statistics. Enable running specific test suites or complete test coverage.
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
Add unit tests for run.sh, encryption-setup.sh, encryption-validation.sh, firewall-setup.sh, security-hardening.sh, and build-iso.sh. Achieve comprehensive function coverage with assertions for all critical security configurations and setup procedures.
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
Remove test-iso.sh from project files table since ISO testing is now accessible through run.sh test:iso command. Streamline documentation to show single entry point for all operations.
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
Add test:iso command to run.sh that delegates to test-iso.sh for libvirt/virsh-based ISO testing. Keep test functionality accessible through main run.sh interface while maintaining host-side execution requirements.
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
Add ISO testing section with libvirt/virsh commands (create, console, status, stop, destroy, list). Update project files table to include test-iso.sh script.
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
Create test-iso.sh script for automated ISO testing using libvirt/virsh VMs. Supports create, start, stop, console, destroy, status, and list commands. Runs on host system (not inside Docker). Includes prerequisite checks, VM configuration (20G disk, 4GB RAM, 2 VCPUs), and cleanup functionality.
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
