From 2fa7825f12b91cc062cd638a3b05632679257590 Mon Sep 17 00:00:00 2001
From: Sam & Claude <hello@clawdie.si>
Date: Thu, 25 Jun 2026 07:05:16 +0200
Subject: [PATCH] fix(iso): bind colibri_daemon_require_secured=YES to complete
 the interlock

The rc.conf.sample on the live USB now sets require_secured=YES.
Together with the paired colibri change, this ensures the daemon
disables autospawn until the console gate writes .secured.
---
 scripts/stage-colibri-iso.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/scripts/stage-colibri-iso.sh b/scripts/stage-colibri-iso.sh
index 10b73e3..517f259 100755
--- a/scripts/stage-colibri-iso.sh
+++ b/scripts/stage-colibri-iso.sh
@@ -105,6 +105,7 @@ colibri_daemon_logfile="/var/log/colibri/daemon.log"
 colibri_daemon_provider_env="/usr/local/etc/colibri/provider.env"
 colibri_daemon_host="\$(/bin/hostname)"
 colibri_daemon_cost_mode="${COLIBRI_COST_MODE}"
+colibri_daemon_require_secured="YES"
 EOF
 
 cat > "${ETC_DIR}/provider.env" <<'EOF'