football/STATUS.md

KNEL-Football Project Status Report

Last Updated: 2026-05-08 (Session 8 - Post-Audit Remediation) Maintained By: AI Agent (Crush) Purpose: Quick-glance status for project manager

---

Current Status: 🔧 REMEDIATION IN PROGRESS (Batch 3 - Honest Assessment)

Executive Summary

Deep audit (DeepReport-2026-05-08.md) had 39 findings. Three batches of fixes applied. 22 findings genuinely fixed, 6 remain open (3 deferred, 3 need human action). ISO has NOT been rebuilt since fixes — needs ./run.sh iso to validate.

What Changed in Batch 3

• C-01 Argon2id: Fixed properly via preseed partman/early_command patching partman-crypto
• COMPLIANCE.md: Marked CMMC/FedRAMP as aspirational (not certified)
• VERIFICATION-REPORT.md: Added self-review warning, fixed preseed path
• Removed sshd_config generation from src/security-hardening.sh entirely
• Fixed AIDE init to report errors instead of swallowing them
• Added .dockerignore, fixed .gitignore *key* pattern
• Fixed phantom script reference in COMPLIANCE.md
• Added Argon2id early_command to demo.preseed.cfg

---

Remediation Progress

#	Finding	Severity	Status
C-01	Argon2id KDF not enforced	CRITICAL	✅ Fixed
C-02	Host FDE check never called	CRITICAL	✅ Fixed
C-03	Docker --privileged	CRITICAL	✅ Fixed (fine-grained caps)
C-04	SB keys unencrypted (-nodes)	CRITICAL	✅ Fixed (chmod 600, dir 700)
C-05	USB automount noexec/nosuid/nodev	CRITICAL	✅ Fixed
C-06	Plaintext creds in git history	CRITICAL	⬜ Pending (git scrub)
H-01	StrictHostKeyChecking ask	HIGH	✅ Fixed (now yes)
H-02	sshd_config written	HIGH	✅ Fixed (removed)
H-03	src/firewall missing ct state	HIGH	✅ Fixed
H-04	QR code temp file insecure	HIGH	✅ Fixed (chmod 600)
H-05	cryptsetup broken syntax	HIGH	✅ Fixed
H-06	Hardcoded /dev/sda3	HIGH	✅ Fixed (dynamic discovery)
H-07	sbverify returns success on fail	HIGH	✅ Fixed (now fatal)
H-08	Missing module.sig_enforce	HIGH	✅ Fixed
H-09	Build cache no integrity	HIGH	⬜ Pending
M-01	apply_security_hardening missing calls	MEDIUM	✅ Fixed
M-02	Sudo group conflict	MEDIUM	✅ Fixed (removed from sudo group)
M-03	PAM not configured	MEDIUM	✅ Fixed (enforce_for_root)
M-04	Recovery key plaintext	MEDIUM	✅ Fixed (bs=32 count=1)
M-05	Firewall allows any WG endpoint	MEDIUM	✅ Fixed (single port)
M-06	AIDE not initialized	MEDIUM	✅ Fixed (aideinit + cron)
M-07	Mount hardening existing fstab only	MEDIUM	✅ Fixed (auto-add entries)
M-08	USB no audit logging	MEDIUM	✅ Fixed (logger)
M-09	Build not reproducible	MEDIUM	⏭ Deferred (post-deployment)
M-10	No GPG signing	MEDIUM	⏭ Deferred (post-deployment)
M-11	Docker base not digest-pinned	MEDIUM	⬜ Pending
M-12	WiFi blacklist incomplete	MEDIUM	✅ Fixed (added 8 drivers)

Legend: ✅ Done | 🔧 In Progress | ⬜ Pending | ⏭ Deferred

---

PRD → Code → Tests Alignment Matrix

|| PRD Requirement | Code | Tests | Audit Status | ||-----------------|------|-------|-------------| || FR-001: FDE (Argon2id) | encryption-*.sh | 10 files | ✅ Auto-conversion hook | || FR-002: Debian Base | preseed.cfg | config tests | ✅ | || FR-003: Desktop | desktop-environment.sh | 5 files | ✅ | || FR-004: Network/Firewall | firewall-setup.sh | 7 files | ✅ ct state fixed | || FR-005: Hardware Control | security-hardening.sh | 5 files | ✅ Blacklist expanded | || FR-006: SSH Client | security-hardening.sh | 5 files | ✅ StrictHostKeyChecking yes | || FR-007: System Hardening | hardening hooks | 12 files | ✅ PAM enforced, AIDE init | || FR-008: USB Automount | usb-automount.sh | 5 files | ✅ noexec,nosuid,nodev | || FR-009: Immutability | disable-pkg-mgmt.sh | 6 files | ✅ | || FR-010: ISO Build | build-iso.sh, Dockerfile | 8 files | ✅ Fine-grained caps | || FR-011: Host FDE | run.sh check | system tests | ✅ Now enforced | || FR-012: Secure Boot/UKI | run.sh | secureboot tests | ✅ sigverify fatal |

---

Build Information

|| Item | Value | ||------|-------| || Docker Image | knel-football-dev:latest | || Build Command | ./run.sh iso | || Output Location | output/knel-football-secure.iso | || ISO Status | ✅ BUILT (824 MB, 2026-05-07) | || Validation Command | ./run.sh validate |

---

Compliance Status

Note

: Compliance claims are aspirational targets for future production release. Current focus is on implementing correct technical controls.

Standard	Technical Controls	Org Controls	Status
NIST SP 800-111	🔧 In progress	N/A	Technical only
NIST SP 800-53 (partial)	🔧 In progress	N/A	Technical only
CIS Benchmarks	🔧 In progress	N/A	Technical only
CMMC L3	⏭ Future	⏭ Future	Aspirational
FedRAMP	⏭ Future	⏭ Future	Aspirational
ISO 27001	⏭ Future	⏭ Future	Aspirational

---

Known Limitations

Item	Status	Notes
Compliance claims	Aspirational	Org controls require dedicated future session
GRUB Serial Output	Not configured	GRUB uses VGA; serial boot detection limited
End-to-end Install Test	Not done	Full install + encryption prompt needs manual testing
Build Reproducibility	Deferred	Requires SOURCE_DATE_EPOCH, fixed mirrors
GPG Artifact Signing	Deferred	Requires key management infrastructure
Git History Scrub	Pending	C-06: demo.preseed.cfg creds in git history
Build Cache Integrity	Pending	H-09: No checksum verification of cache
Docker Base Pinning	Pending	M-11: Not digest-pinned

---

Architecture

KNEL-Football OS (this image)
    │
    │ WireGuard VPN (outbound only)
    ▼
Privileged Access Workstation (Windows 11)
    │
    │ Direct access
    ▼
Tier0 Infrastructure

No inbound services - SSH client, RDP client (Remmina), WireGuard client only.

---

This file is maintained by the AI agent. For AI memory and insights, see JOURNAL.md.