Hive Exit stability gate

[Deadbytes101]

RIGOS is not allowed to claim HiveOS-class stability until all of these gates pass on exact release bytes.

Required runtime behavior:

• persistent SSH host identity across reboot and power loss
• bounded miner restart policy with no rapid crash loop
• miner hang detection that distinguishes process death from pool/network outage
• network outage recovery without reboot or config loss
• abrupt power-cut recovery with verified STATE and current revision
• atomic activation rollback to last known-good revision
• unprivileged public miner inspection without reading identity-bearing config
• truthful health status for state, network, miner, huge pages, SSH, and recovery access
• no internal-disk mutation in USB appliance mode
• A/B update and rollback proof before installable release

Physical acceptance:

• 24-hour single-node soak with zero rejected shares attributable to RIGOS
• 7-day three-node soak before v0.1.0 Hive Exit
• repeated cold boots and controlled power cuts
• unplug/replug network test
• forced miner crash and bounded autonomous recovery
• exact source commit, manifest, artifact SHA256, and evidence bundle recorded

Current Alpha8 evidence is a functional baseline only. It proves boot, SSH password login, persistent state, exact two-thread RandomX policy, huge pages, accepted shares, and zero failed units. It does not prove the failure cases above.

[Deadbytes101]

Hardening work started in draft PR #13 from verified Alpha8 source head 3024868d7e6a0ba9f938371607302c67aa413e11.

Current batch:

• bounded XMRig restart policy and crash-loop ceiling
• observe-only miner health authority with ready/warming/external-wait/blocked/degraded/failed states
• no automatic restart from heuristic health classification
• public redacted default for rigosd and rigosctl
• safe algorithm/thread/huge-page inspector compatibility fields
• regression fixtures for external outage, missing journal truth, revision mismatch, redaction, and systemd wiring

Persistent SSH host identity remains open because connector policy blocked private-key lifecycle writes; the unwired prototype was removed rather than left in the image.

No HiveOS parity claim is permitted until the full issue acceptance matrix passes on exact release bytes.

[Deadbytes101]

Hive Exit gate update

Hardening source head 53efcb826f35eef72ef14924c6201e65f7d68217 passed authoritative verification.

Confirmed:

• bounded miner restart policy
• observe-only miner health authority
• external pool/network outage is classified without restarting the miner
• unavailable journal truth is reported as unknown, not fabricated degradation
• runtime revision mismatch is reported as blocked
• public inspector path is redacted and preserves safe algorithm/thread/huge-page truth
• full workspace tests, release build, and systemd ordering verification passed

Still open before any HiveOS-class claim:

• exact image build from this head
• controlled miner crash recovery
• LAN unplug/replug recovery
• abrupt power-cut/state recovery
• last-known-good activation rollback
• persistent SSH host identity
• 24-hour single-node soak
• seven-day three-node soak

PR #13 stays draft until those physical gates pass.

[Deadbytes101]

Hive Exit gate update: targeted source contracts passed

Exact source head ebbca7dfd01de82c9bf3aea2481be38a3aac7b52 passed the targeted hardening suite.

Confirmed:

• explicit public inspector path wins with the managed XMRig short config option
• extensionless appliance scripts are LF-only and parse under /bin/sh
• runtime publication is staged and allowlist-based
• valid exact-thread runtime is allowed
• mismatched runtime thread profile is denied fail-closed
• image verifier requires the new runtime authority, public wrappers, health observer, bounded restart policy, and exact miner command
• recovery/runtime wiring regressions remain green

Still required before image build:

• full workspace/clippy/test/schema/release/systemd verification on the same head

Still required before any stability claim:

• exact image provenance
• controlled miner crash recovery
• network outage recovery
• abrupt power-loss recovery
• persistent SSH host identity
• rollback/A-B proof
• soak tests

[Deadbytes101]

Hive Exit source gate: authoritative PASS

Exact head 004eaebeef9b55297c38284aad7842fc0277e881 passed the complete local verification pipeline:

• formatting and clippy
• full workspace tests/doc-tests
• schema check
• release build
• systemd ordering
• runtime/miner/firstboot policy scans
• Alpha8 SSH and recovery hotfix verification

Final marker: HIVE_EXIT_AUTHORITATIVE_VERIFICATION=PASS

The next permitted stage is exact image construction and byte-level appliance verification from this head only.

Still open before any stability or HiveOS-parity claim:

• exact image manifest/SHA/source provenance
• persistent SSH host identity across reboot/power loss
• controlled miner crash recovery
• network outage/recovery
• abrupt power-cut/state recovery
• last-known-good rollback and A/B proof
• 24-hour single-node soak
• seven-day three-node soak

[Deadbytes101]

Exact stability image gate: PASS

Source commit 004eaebeef9b55297c38284aad7842fc0277e881 produced a fully verified Alpha8 image.

Artifact:

• rigos-usb-amd64-0.0.4-alpha.8.img
• SHA-256 ce87871e55b346e495b08d8f57411db99863aef843a82890850a0291975de746
• size 2685403136 bytes
• builder image 61d9acdc8292daa04191ec328237c90da472b2fc65d6ce8b4cf2a4724598b78e

The rootful build completed Debian live-build, MBR partitioning, BIOS/UEFI GRUB installation, appliance/recovery verification, external hashes, and manifest identity checks. Final marker: HIVE_EXIT_EXACT_IMAGE_BUILD=PASS.

Controlled physical flashing is now permitted for this exact SHA only.

Still open:

• persistent SSH host identity
• controlled miner crash/restart behavior
• network unplug/replug behavior
• abrupt power-cut/state recovery
• rollback and A/B proof
• 24-hour single-node soak
• seven-day three-node soak

[Deadbytes101]

Windows preflash identity gate: PASS

Immediately before physical flashing, the Windows-side artifact check confirmed:

• SHA-256 ce87871e55b346e495b08d8f57411db99863aef843a82890850a0291975de746
• size 2685403136 bytes
• marker PREFLASH_GATE=PASS

Physical flashing is authorized for this exact artifact only. No physical runtime, reboot, crash, network, power-loss, rollback, or soak gate is marked complete by this check.

[Deadbytes101]

Physical baseline update: blocked by runtime publication failure

Exact Alpha8 image ce87871e55b346e495b08d8f57411db99863aef843a82890850a0291975de746 booted successfully from USB and mounted persistent state from /dev/sdb4. Internal /dev/sda was not mounted and SSH access worked.

The physical baseline did not pass:

• rigos-firstboot.service: failed
• rigos-runtime-render.service: failed
• rigos-miner.service: inactive
• runtime status/public config absent

The miner remained fail-closed, which is correct safety behavior, but this image is not eligible for crash, network, power-loss, rollback, or soak gates. Runtime journal and firstboot status evidence are being collected before any source change.

[Deadbytes101]

Physical blocker root cause: appliance omitted jq

The exact image ce87871e55b346e495b08d8f57411db99863aef843a82890850a0291975de746 booted and preserved state correctly, but runtime publication failed with exit 127 because /usr/bin/jq was not present in the squashfs.

Observed cascade:

• runtime publisher: jq: not found
• runtime-render: failed
• firstboot activation retry: failed
• miner: correctly remained inactive/fail-closed

Source fix head: 732164021d450f5ab7986bfa3a1f3307a81b67e8.

The fix adds jq to the appliance package list, uses an absolute jq path, fails before staging when unavailable, and upgrades image/source tests so an image without jq cannot pass verification again.

The old image is not eligible for further physical stability gates. New source verification, image construction, hashing, flashing, and baseline evidence are required.

[Deadbytes101]

jq runtime fix source gate: PASS

Exact source head 223794509e82d5dedda79da87a11ed2941c16c34 passed authoritative verification.

Confirmed:

• jq is present in the appliance package manifest
• package manifest is LF-only under the Windows checkout
• runtime publisher uses /usr/bin/jq
• missing jq is rejected before runtime staging
• built-image verifier now requires executable usr/bin/jq in squashfs
• full workspace, release, systemd, SSH, and recovery gates remain green

Final marker: JQ_RUNTIME_FIX_AUTHORITATIVE_VERIFICATION=PASS.

The previous image remains invalid for further physical gates. Next permitted step is a fresh rootful exact image build from this head, followed by new SHA/manifest/preflash and physical baseline evidence.

[Deadbytes101]

jq-fixed exact image gate: PASS

Source 223794509e82d5dedda79da87a11ed2941c16c34 produced a fresh verified Alpha8 image:

• SHA-256 736a265eec2d27c1dc746fb9d5847e76be2e954f0d7d9a041bab1c7bf30963d8
• size 2685403136 bytes
• builder image 61d9acdc8292daa04191ec328237c90da472b2fc65d6ce8b4cf2a4724598b78e

The built-image verifier passed with executable /usr/bin/jq extracted from squashfs, closing the physical blocker found in the previous image. BIOS/UEFI boot installation, appliance/recovery verification, external SHA checks, and manifest identity all passed. Final marker: JQ_FIXED_EXACT_IMAGE_BUILD=PASS.

The previous SHA ce87871e55b346e495b08d8f57411db99863aef843a82890850a0291975de746 remains invalid. Next required gates are Windows preflash identity and a fresh physical baseline before crash/network/power-loss tests.

[Deadbytes101]

jq-fixed Windows preflash identity: PASS

Immediately before physical flashing, Windows confirmed the new artifact:

• SHA-256 736a265eec2d27c1dc746fb9d5847e76be2e954f0d7d9a041bab1c7bf30963d8
• size 2685403136 bytes
• marker JQ_FIXED_PREFLASH_GATE=PASS

The exact jq-fixed image is now authorized for a fresh controlled physical baseline only. Crash, network, power-loss, rollback, and soak gates remain blocked until the new image boots with runtime publication and miner operation healthy.

[Deadbytes101]

Hard power-loss test exposed non-persistent SSH host identity

The appliance recovered correctly from a physical hard power-off: persistent state marker and SHA256 survived, RIGOS_STATE remounted read-write, zero failed units, miner and MSR authority recovered, and no storage corruption/fatal-kernel evidence was observed.

But SSH strict checking rejected the rebooted appliance because the host key changed. The new ED25519 fingerprint presented after reboot was:

SHA256:wGrmDNLRZlek12E2Lo0w8dQDwBfQEqUB/nDQuUb5400

The client had to remove the previous 192.168.1.80 entries from known_hosts before reconnecting. Therefore the required persistent SSH host identity across reboot and power loss gate remains FAIL.

This should be fixed by generating host keys once into persistent STATE and binding/copying them into /etc/ssh before sshd starts, with exact ownership and permissions, rather than generating fresh overlay keys on each boot.

[Deadbytes101]

SSH host-key root cause confirmed on physical boot

Evidence from the rebooted appliance:

• current ED25519 fingerprint: SHA256:wGrmDNLRZlek12E2Lo0w8dQDwBfQEqUB/nDQuUb5400
• /etc/ssh/ssh_host_ed25519_key resolves to the live overlay filesystem
• private key mode/owner are correct (0600 root:root)
• public key mode/owner are correct (0644 root:root)
• both key files were created at boot time (2026-07-08 20:04:11 +0700)
• no ssh_host_*_key* files exist anywhere under /var/lib/rigos

Root cause is therefore confirmed: SSH host keys are generated into the ephemeral live overlay on every boot, and no persistent host-key authority exists in RIGOS_STATE.

Required fix remains: generate once into persistent STATE, verify ownership/modes, expose those exact keys to sshd before ssh.service starts, and fail closed rather than silently regenerating a new appliance identity.