[hanthor]

The installed image used an initramfs generated before Utah's package transaction, so it lacked early CPU microcode and Common's TPM/passkey/smart-card unlock modules. Gaming images also installed OGC under /boot, while bootc and the ISO assembler selected a different kernel by release sorting.

After the final flavor package steps, regenerate the initramfs for the one kernel bootc will deploy. For gaming flavors, validate and promote the OGC kernel into that bootc layout first, preserve the remaining module trees, and use the same selected release when composing the live ISO. Fail closed if the source is missing, empty, or ambiguous. Include tpm2-tools, pcsc-lite, and pcsc-lite-ccid from the current pinned Utah factory image.

Validation: just check passed (1,040 tests) at 560781f; after the review cleanup, all 8 focused live-kernel tests and targeted pre-commit hooks passed at 17fa69a. The unrelated sandbox/VPN kernel-config change was removed at dc81990, so this fix retains the current signed kernel-cache input. The current image build is running at https://github.com/projectbluefin/utah/actions/runs/38179581789.

Physical GPU initialization, suspend, and Secure Boot enrollment remain hardware checks. Closes #564.

[hivecommons-hive]

Read the diff against the tree at merge-base 7cba2a8, plus the callers. The change does what it says and the build-time assertions are sound. Looks correct to me; the only thing in the way is the factory pin, which the body already names.

What I verified

• scripts/regenerate-initramfs.sh:24-31 — the "exactly one kernel with a vmlinuz under /usr/lib/modules" check holds for the gaming flavors: scripts/install-ogc-kernel.sh:195-197 puts OGC modules under /usr/lib/modules/<release>/ but installs the bzImage as /boot/vmlinuz-<release>, so only the base kernel's directory carries a vmlinuz.
• Containerfile:288 — the call sits inside the same RUN as the last package install, after utah-verify-rpm-contract and before the repo is flipped disabled, so dracut sees every package it needs.
• packages/utah.toml:297 — the transaction does not set install_weak_deps=False, so linux-firmware's amd-ucode-firmware Recommends lands, which is what the AuthenticAMD.bin assertion at scripts/regenerate-initramfs.sh:43 depends on.
• lsinitrd -m prints one module per line, so the grep -qx loop at :48 matches whole names.

Why contract is red — not a defect in this diff: just check-repos fails with No match for argument: tpm2-tools / pcsc-lite / pcsc-lite-ccid because the pinned PACKAGE_IMAGE_SHA predates utah-packages#364 (merged 2026-10-03T21:44Z). Sequencing for a maintainer: a PACKAGE_IMAGE_SHA bump whose digest was published after #364's factory run needs to land first (#568 is open; I could not confirm whether its digest d257e97… already contains the three packages), then re-run CI here.

One follow-up suggestion (low) — iso/live/Containerfile:43-53 still says tpm2-tools/pcsc-lite exist in "neither Hummingbird nor this factory" and "revisit if Utah ever wants TPM-bound LUKS"; both statements are stale once this merges. The --omit 'tpm2-tss pcsc' at :66 remains harmless for the live initrd, so this is a comment refresh, not a blocker.

Confidence: 5/5 (safe)

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hanthor]

Third installed KVM boot proved source b32c2b3 and exact offline manifest digest sha256:44f6546a30639e7aaa51a0e1aa38555c90dde1de2f6fa5682ce34bac21f12ac8 after LUKS installation/unlock. The image built with both CPU microcode and all required initramfs module assertions; the guest reached GNOME 51 Wayland and ran fastfetch. The broader gate failed later on the Flatpak ref display formatter; a repaired full-gate run is being dispatched. No hardware TPM/FIDO enrollment claim.

[hivecommons-hive]

Reviewed — no findings from correctness, security, intent-alignment, style, docs-currency.

Confidence: 5/5 (safe)

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hanthor]

Final combined-source verification passed at ecc3fdada8faab467a658f3cce367dc705dbe9b1: https://github.com/projectbluefin/utah/actions/runs/37578585571. No image was published.

The offline ISO installed to LUKS, unlocked, and logged into GNOME 51 Wayland with active extensions. All declared Flatpak app/runtime refs were present offline. Installed timer enablement, Common countme opt-out, RPM contract, adversarial GPG key rejection, and About/icon/greeter assets passed. Screenshots were visually inspected; GDM asset/configuration match accepted #531 exactly. The command-menu screenshot proves the panel icon renders, but does not prove menu opening.

Independently hashing the retained raw manifest matches the guest bootc digest: sha256:949e4754ff084555cbfa0966eb64b8157e0bf4fb0deb33f69fd7561d4a23b9b9. Both uncached native builds produced the same image ID and all 37 native layers. This proves the combined main-flavor candidate; NVIDIA Secure Boot, physical TPM/FIDO enrollment, published rechunking and other-flavor repeatability remain separate.

Independent last-push approval remains required for #623. Its dependent PRs must be retargeted to main after that merge; they should not be merged into feature branches.

[hivecommons-hive]

HUMAN DECISION NEEDED — @hanthor confirm the gaming/nvidia-gaming VMs boot the promoted OGC kernel (uname matches /usr/lib/utah/ogc-kernel-release) before merge; review_vm (gaming)/(nvidia-gaming) were still in progress on run 37584977457 (cdeb4b0) at review time, and head 256bfef's run 37585769039 built all four flavors but ran no VM boot.

Reviewed at 256bfef.

correctness

• scripts/regenerate-initramfs.sh:23 now deletes the base kernel's vmlinuz/initramfs.img (iso/scripts/live-kernel.py:77-80) and makes OGC the only bootc kernel for the gaming flavors. The build-time assertions (early CPIO, both vendors' microcode, bootc ostree fido2 tpm2-tss pkcs11 pcsc) pass on all four flavor builds at head, but actually booting a dracut --no-hostonly initramfs on the defconfig-derived OGC kernel is a new path that nothing in this PR exercises before the pending VM jobs. Not a defect found — a verification gap that only CI/human can close.

docs-currency

• iso/live/Containerfile:48-57: the --omit 'tpm2-tss pcsc' rationale still says tpm2-tools/pcsc-lite "neither package exists in Hummingbird or in this factory" and "Revisit if Utah ever wants TPM-bound LUKS, which needs tpm2-tools in the installed image". This PR adds both to packages/utah.toml:246-248 and the installed image now ships them. The omit is still fine for the live initrd, but the comment's reason is now false — reword to "omitted because the live initrd has no TPM/smartcard volume to open".

style

• iso/scripts/live-kernel.py:2 docstring still reads "Find the selected release's kernel in a mounted live image, not the host", but bootc_release(..., promote_ogc=True) (lines 53-80) now copies files and deletes other kernels' boot files inside the root, and the same script is installed into the image as utah-live-kernel (Containerfile:141) to do that mutation. Update the docstring (and consider a name that does not say "live") so a reader does not assume the script is read-only.

No findings from: security, intent-alignment.

Confidence: 3/5 (needs attention) — 1 medium finding; 1 perspective requires a human decision

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed at head 098e4b1 (gh pr diff vs merge-base; branch is 19 commits behind main, mergeStateStatus: DIRTY).

correctness

• Factory pin regresses on merge — Containerfile:6 and packages/utah-packages.repo:4 set PACKAGE_IMAGE_SHA/factory-pin to sha256:1564d34c… (utah-packages published 2026-10-07). main already carries #625's sha256:0f8595d5… (published 2026-10-09) at the same two lines, and both files plus README.md, docs/skills/package-contract.md, site/data/packages.json conflict. The body says the PR "preserve[s] #625's exact package ARG/factory-stamp pair" but the diff pins an older digest. On rebase keep 0f8595d (or newer) and confirm tpm2-tools, pcsc-lite, pcsc-lite-ccid (packages/utah.toml:246-248) resolve there — the ISO gate cited in the body ran against 1564d34c, not the pin that will ship.
• Low: iso/scripts/live-kernel.py:73 shutil.copy2s the OGC bzImage into /usr/lib/modules/<ogc>/vmlinuz but leaves /boot/vmlinuz-<ogc> and the /boot/vmlinuz symlink from scripts/install-ogc-kernel.sh:76,203-204 in place, so gaming images ship the kernel twice. Not blocking; a move+relink or dropping the /boot copy after promotion would avoid it.

intent-alignment

• #628 (fix/ogc-sandbox-vpn) was merged into this branch, not main, so its kernel-config change rides along here: scripts/install-ogc-kernel.sh:57,171-176 (USER_NS/TUN/SECCOMP…), tests/test_ogc_kernel_features.py, docs/skills/kernel-cache.md:164-175. That is outside #564 (initramfs regeneration) and contradicts the body's "This layout change leaves compiled kernel-cache inputs unchanged" — the added doc itself says "These config edits move the kernel-cache tag and need a fresh signed cache". Either land #628 on main separately or state in the body that this PR moves the kernel-cache tag.
• The remaining out-of-#564 files (.github/actionlint.yaml, scripts/check-skill-frontmatter.sh, site/assets/bluefin-logo.svg, docs/skills/skill-improvement.md, …) are already identical on main and will disappear on rebase.

No findings from: security, style, docs-currency.

Confidence: 2/5 (needs attention) — 1 high finding; 1 medium finding

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hanthor]

Request changes at 098e4b1. The PR conflicts with main and regresses the package ARG/factory-stamp pair from main's 0f8595d to older 1564d34c. Rebase preserving the current paired pin (or a newer reviewed pair), verify the full transaction and rerun the final-source ISO test. The merged-in OGC USER_NS/TUN/SECCOMP changes modify kernel-cache inputs; acknowledge the new cache tag and rebuild cost in the PR scope rather than claiming cache inputs are unchanged. Earlier combined-source VM evidence is not proof for the eventual rebased source/pin.

Reviewed with Codex.

[hivecommons-hive]

098e4b1

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @hanthor, head 098e4b1d3fe0) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 2 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/update-bluefin-parity.yml
  • Justfile
• remote_code_execution — adds a remote-fetch-and-execute, decoded payload, reverse shell or embedded credential (Adds curl|sh, eval of encoded payloads, reverse shells or embedded private keys)
  • tests/test_ogc_kernel_features.py

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hanthor]

Review blockers for the next revision: this branch is 19 commits behind main and would regress the factory pin from the newer digest merged by #625. Please rebase and retain the current or newer package digest, then verify tpm2-tools, pcsc-lite, and pcsc-lite-ccid against that exact Hummingbird package image and rerun the ISO evidence. Also separate or explicitly document the #628 kernel-config changes, since they change kernel-cache inputs and need a fresh signed cache. Resolve conflicts before requesting another review.

[hanthor]

Pushed a clean revision at 722991f based on current main. It preserves the current PACKAGE_IMAGE_SHA and matching factory stamp, adds the TPM/smart-card helper packages, and limits the diff to the kernel/initramfs work plus its tests and documentation.

Local just check passes (1,040 tests), including package availability resolution against the pinned Hummingbird and Utah factory repositories. Targeted pre-commit passes. The OGC USER_NS/TUN changes are documented as kernel-cache inputs; CI is now building this head, after which I’ll run the all-flavor offline ISO matrix against its signed cache.

[hanthor]

Rebased onto #681's merged Common image update at 7686ffb, then fixed the initramfs helper conflict CI found at 560781f. The PR preserves COMMON_IMAGE_SHA 2f0210b and the current Utah factory pin. just check now passes with the helper tracked (1,040 tests), and pre-commit passes; CI is restarting for 560781f.

[hivecommons-hive]

Reviewed at head 560781f (diff plus Containerfile, scripts/install-ogc-kernel.sh, iso/live/Containerfile, iso/scripts/build-iso.sh, scripts/install-nvidia.sh, .github/workflows/build.yml). The initramfs regeneration, the fail-closed bootc kernel selection, and the live ISO alignment do what #564 asks. Touched tests pass locally (64 ok).

intent-alignment

• scripts/install-ogc-kernel.sh:57,174-175 — the USER_NS/MEMCG/SECCOMP/TUN kernel config change is not part of #564 (stale initramfs). It is disclosed in the body, but it rolls a new kernel-cache tag (scripts/kernel-cache-tag.sh hashes this script) into a fix that otherwise needs no cache rebuild, so a cache failure now blocks the initramfs fix. Consider splitting it into its own PR. Low; not blocking.

style

• iso/scripts/live-kernel.py:74 — promotion copy2s the OGC kernel into /usr/lib/modules/<ogc>/vmlinuz and leaves /boot/vmlinuz-<rel> plus the /boot/vmlinuz symlink (scripts/install-ogc-kernel.sh:76,202-203) in place, so gaming images now carry the bzImage twice. A hardlink/move, or removing the /boot copy after promotion, avoids the duplicate and the pre-existing nonempty-boot lint warning. Low.

docs-currency

• iso/scripts/live-kernel.py:2 — module docstring still says "Find the selected release's kernel in a mounted live image"; with --select-bootc --promote-ogc it now also deletes base vmlinuz/initramfs.img inside the image (lines 76-80). The --select-bootc/--promote-ogc flags (lines 100-101) have no help=. Low.

correctness (review limit, not a defect)

• scripts/regenerate-initramfs.sh:32-43 asserts Early CPIO, both AuthenticAMD.bin/GenuineIntel.bin, and the bootc/ostree/fido2/tpm2-tss/pkcs11/pcsc modules. Whether Hummingbird's dracut 111 ships a bootc module and the factory microcode_ctl populates /usr/lib/firmware/intel-ucode could not be verified from the tree; the script fails closed, so the pending build_main/kernel_cache runs are the proof.

No findings from: security.

Confidence: 5/5 (safe)

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

560781f

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @hanthor, head 560781f44e41) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• remote_code_execution — adds a remote-fetch-and-execute, decoded payload, reverse shell or embedded credential (Adds curl|sh, eval of encoded payloads, reverse shells or embedded private keys)
  • tests/test_ogc_kernel_features.py

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hanthor]

Addressed the review notes on the latest head: the live-kernel helper now documents its promotion behavior and flags, promotes the OGC kernel with a hard link so the /boot copy does not consume space twice, and has a regression assertion for the shared inode. The final 8 focused live-kernel tests and targeted pre-commit hooks pass; the full CI build for the current head is running at https://github.com/projectbluefin/utah/actions/runs/38177657433. The earlier all-flavor test on current main demonstrated why this change is needed: the gaming install booted the base kernel instead of OGC. Please re-review after the build completes.

[hivecommons-hive]

17fa69a

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @hanthor, head 17fa69a81614) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• remote_code_execution — adds a remote-fetch-and-execute, decoded payload, reverse shell or embedded credential (Adds curl|sh, eval of encoded payloads, reverse shells or embedded private keys)
  • tests/test_ogc_kernel_features.py

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

Reviewed at head 17fa69a. The initramfs regeneration, package additions, OGC promotion into the bootc kernel layout, and the fail-closed checks all match what #564 asked for. One finding worth a decision, one limit of this review.

intent-alignment

• Medium — unrelated kernel-config change rides along and forces a new kernel cache. scripts/install-ogc-kernel.sh:56-57 adds NAMESPACES USER_NS MEMCG SECCOMP SECCOMP_FILTER TUN to required_config, and :174-176 enables them in the OGC config; tests/test_ogc_kernel_features.py and docs/skills/kernel-cache.md:159-165 exist only for this. Issue #564 is about the stale initramfs (microcode + unlock modules); Flatpak/VPN kernel features are a separate concern. Because the script hashes into the cache tag, this change alone invalidates the signed OGC cache (the PR body says as much), so the initramfs fix cannot land without a ~30-minute kernel rebuild and a new signed cache. Suggest splitting the config change into its own PR so #564 can merge on the existing cache.

correctness

• Info — not verifiable at review time. scripts/regenerate-initramfs.sh:31-44 asserts GenuineIntel.bin in the early cpio and the bootc ostree fido2 tpm2-tss pkcs11 pcsc dracut modules in every flavor. These depend on microcode_ctl's dracut integration under --no-hostonly and on Hummingbird's dracut.conf.d, which only an image build can confirm; no revision of this PR has had a green image build yet (7686ffb failed on conflict markers, 560781f cancelled, 17fa69a in progress). The checks fail closed, so the risk is a red build rather than a bad image. Also note this is the first time gaming images will deploy the OGC kernel through bootc (iso/scripts/live-kernel.py:66-78 removes the base vmlinuz/initramfs.img), so the flavored CI jobs are the real test here.

No findings from: security, style, docs-currency.

Confidence: 3/5 (needs attention) — 1 medium finding; 1 perspective requested changes

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hanthor]

Followed the review and dropped the unrelated USER_NS/MEMCG/SECCOMP/TUN change in dc81990, restoring the kernel-cache tag to main. The OGC duplicate-copy improvement remains, with a regression test. The current-head full image build is running at https://github.com/projectbluefin/utah/actions/runs/38179581789; once it passes, I will use #627 for the offline all-flavor install test after this change merges.

[hivecommons-hive]

HUMAN DECISION NEEDED — @hanthor confirm the image build at run 38179581789 (all four flavor jobs were still in progress when this was reviewed) is green before merging; the only proof that the new initramfs step works lives in that build.

correctness

This PR makes a change that only a real image build can validate, and that build had not finished at review time. Two things in it have never run before in this repository:

• scripts/regenerate-initramfs.sh:30 runs dracut --no-hostonly --reproducible --kver "$kver" --force and then asserts (lines 32-44) that the result carries an early CPIO with both AuthenticAMD.bin and GenuineIntel.bin, plus the bootc ostree fido2 tpm2-tss pkcs11 pcsc modules. The script relies on the base image's dracut.conf.d to add bootc/ostree (comment at lines 27-29); nothing in this repo adds them. If that assumption is wrong the assertion fails closed and every flavor build fails — good behavior, but I could not verify it from the tree.
• For gaming flavors, iso/scripts/live-kernel.py:52-80 (bootc_release(..., promote_ogc=True)) is the first time the OGC kernel gets a /usr/lib/modules/<ogc>/vmlinuz and an initramfs at all. At head, scripts/install-ogc-kernel.sh never calls dracut (the issue text says it does; it does not). So this PR also changes which kernel the gaming installed image and the gaming live ISO (iso/scripts/build-iso.sh:78, iso/live/Containerfile:61-66) boot — from the Fedora base kernel to OGC. That is the intended fix, but it is a behavior change the unit tests in tests/test_live_kernel.py:66-123 cannot cover; only the gaming/nvidia-gaming image jobs and the ISO e2e can.

The selection logic itself reads correctly: the receipt release is validated through kernel_file (rejects /, ., ..), module dirs are checked with is_relative_to(root) before any unlink, base boot files are only removed after the OGC source is confirmed non-empty, and the final len(releases) != 1 / releases[0] != ogc checks (live-kernel.py:85-89) fail closed. Tests cover the missing-source, empty-source and ambiguous cases.

No findings from: security, intent-alignment, style, docs-currency.

Confidence: 3/5 (needs attention) — 2 medium findings

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hanthor]

The latest review follow-up removed the unrelated sandbox/VPN kernel configuration, retained the current cache input, and kept the initramfs/live-kernel work scoped to this PR. The full image build now passes on head dc81990 (run 38179581789). This is ready for maintainer re-review.

[castrojo]

Reviewed at dc81990. regenerate-initramfs.sh calls utah-live-kernel --select-bootc --promote-ogc from the flavor RUN step (Containerfile:342). That runs after the OGC, NVIDIA and v4l2loopback installs and the RPM contract check, so dracut sees the final package set. bootc_release validates the OGC receipt and a non-empty in-image source kernel before removing anything, and removes only the base vmlinuz/initramfs.img while keeping the module trees. It fails unless exactly one kernel is selected and a gaming image never selects base. build-iso.sh and iso/live/Containerfile now take the single kernel that has a vmlinuz, not the sort -V winner, so the live ISO boots the installed image's kernel.

CI run 38179581789 shows the regenerated initramfs passing its microcode and unlock-module checks for main/nvidia (7.2.9-200.fc44) and gaming (7.1.8-ogc1). nvidia-gaming unpacks the OGC module. tests/test_live_kernel.py passes locally. On the /usr/lib/modules -> /boot cross-directory hardlink: raw ostree commit would reject it, but bootc's non-ostree import path keeps it, and an ostree container pull of a podman image reproducing it worked. Earlier requests (rebase/pins, dropping the kernel-config change, the TPM comment, the docstring/help text, the duplicate copy) are all addressed. Not yet covered: a VM install/boot on this exact head.