KNEL-Football Secure OS

⚠️ READ THESE FILES FIRST

🚀 Quick Start

1. AGENTS.md - Current status + critical requirements (START HERE)
2. RESUME.md - Complete resumption guide
3. QUICK_START.md - Quick reference commands

📋 Documentation Files

File	Purpose
AGENTS.md	⚡ START HERE - Current status + requirements
RESUME.md	Complete resumption guide + build history
QUICK_START.md	Quick commands and status
JOURNAL.md	Append-only development journal

🔧 Project Files

File	Purpose
run.sh	Main entry point (build/test/lint/clean/iso/test:iso)
Dockerfile	Build environment
config/	Live-build configuration
tests/	BATS test suite

---

Current Status (2026-01-24 19:00 CST)

ISO Build Running

• Status: Active build (3rd attempt, minimal config)
• Current Stage: lb binary_chroot (creating binary filesystem)
• Started: 18:04 CST
• Expected Completion: 19:00-19:15 CST (~15 min remaining)
• Build Log: /tmp/knel-iso-build.log
• Output: output/ (ISO will appear here when complete)

First Actions

cd /home/tsys/Projects/KNEL/football

# 1. Check if ISO is ready
ls -lh output/

# 2. If ready, verify
cd output/
sha256sum -c knel-football-secure-v1.0.0.iso.sha256

# 3. If not ready, monitor
tail -f /tmp/knel-iso-build.log

---

Quick Commands

Project Management

./run.sh build    # Build Docker image
./run.sh test     # Run tests
./run.sh lint     # Check scripts
./run.sh clean    # Remove artifacts
./run.sh iso      # Build ISO (30-60 min)
./run.sh shell    # Interactive shell

Build Commands

# Monitor ISO build
tail -f /tmp/knel-iso-build.log

# Check build status
tail -50 /tmp/knel-iso-build.log | grep "P:"

# Check output
ls -lh output/

ISO Testing (libvirt/virsh)

./test-iso.sh create              # Create and boot test VM
./test-iso.sh console             # Connect to VM console
./test-iso.sh status              # Show VM status
./test-iso.sh stop                # Stop VM
./test-iso.sh destroy             # Remove VM
./test-iso.sh list                # List all test VMs

---

Project Overview

Goal

Build KNEL-Football secure ISO with Docker-only workflow following AGENTS.md requirements.

Features

• Mandatory Full Disk Encryption - LUKS2 with AES-256-XTS
• Mandatory Strong Passwords - 14+ chars, complexity requirements
• Debian Testing base
• IceWM + LightDM desktop
• WiFi/Bluetooth permanently disabled
• SSH with wireguard keys
• Firewall rules (inbound SSH, outbound VPN only)
• USB automount support
• QR code import for WireGuard

Security Requirements (MANDATORY)

• Full disk encryption with LUKS2 (AES-256-XTS, 512-bit key)
• Encryption passphrase required at every boot (14+ characters)
• Password complexity enforced (14+ chars, mix of classes)
• Network isolation (VPN-only access)
• No wireless networking
• Comprehensive audit logging

Compliance

✅ All operations in Docker container ✅ Docker volumes for file I/O ✅ No directories in /home ✅ No host system modifications ✅ Only final artifacts in output/ ✅ File ownership preserved

---

Documentation

AGENTS.md (READ FIRST)

• Current build status
• Critical requirements
• Docker-only workflow
• Volume structure

RESUME.md (Detailes Guide)

• Build progress timeline
• Issues encountered and solutions
• Working configuration
• Restart instructions
• Compliance verification

QUICK_START.md (Quick Reference)

• First actions
• Quick commands
• Key files reference
• Expected output

JOURNAL.md (Development Log)

• Append-only journal
• Daily work notes
• Lessons learned
• Technical decisions

---

Session Summary

Date: 2026-01-24 Duration: 8 hours (11:00-19:00 CST) Goal: Build ISO with Docker-only workflow Status: Build running (expected completion ~15 min) Attempts: 7 Working Strategy: Minimal configuration (all problematic flags removed)

Next Actions:

1. Check output/ for ISO
2. Verify ISO with checksums
3. Test ISO with libvirt/virsh
4. Validate security features

---

📍 START HERE: AGENTS.md → Current status + requirements 📖 DETAILS: RESUME.md → Complete resumption guide ⚡ QUICK: QUICK_START.md → Quick commands

ISO Build Running - Expected completion: 19:00-19:15 CST