fix: clawdie pre-build hardening + Codex handoff #6

Merged
clawdie merged 2 commits from fix/clawdie-prebuild-hardening into main 2026-06-02 10:49:22 +02:00

2 commits

Author SHA1 Message Date
Sam & Claude
73841d114f docs: add Codex ISO Builder handoff for the clawdie agent (Sam & Claude)
Step-by-step handoff for staging + validating the simplified `clawdie` agent on
the FreeBSD build host: build colibri release artifacts (incl. clawdie), ISO
preflight, build with FEATURE_CLAWDIE=YES (staged but CLAWDIE_ENABLE=NO),
mounted-image inspection, hardware validation, and cleanup timing. Includes the
two blocking PR merges, the baked-secret caveat, and deletion criteria.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-02 09:45:16 +02:00
Sam & Claude
09c7078d6c fix: clawdie pre-build hardening for first validation image (Sam & Claude)
Three low-risk fixes before enabling FEATURE_CLAWDIE on a build:

- build.cfg: CLAWDIE_ENABLE now defaults NO. Stage the binary + rc.d but do not
  auto-start at boot until rc.d supervision is proven on hardware (same caution
  as COLIBRI_DAEMON_ENABLE), so clawdie cannot interfere with SDDM/live boot.
  Start manually with `service clawdie start`, then flip to YES.
- build.sh: install_clawdie_service no longer re-creates a conflicting nologin
  `clawdie` user. The operator `clawdie` account is created earlier by
  configure_live_operator_session and reused (the agent runs as it, same as
  Clawdie-AI); we now assert it exists instead of silently diverging on
  home/shell. Matching CLAWDIE_ENABLE fallbacks flipped to NO.
- build.sh: build summary label disambiguated to "Clawdie agent :" (was a second
  "Clawdie :" line colliding with the Clawdie-AI ref banner).

sh -n clean on build.sh and scripts/stage-clawdie-iso.sh.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-02 09:28:47 +02:00