Panel LexiOS and Secure Boot

Panel LexiOS and Secure Boot

Use the LexiOS console at /rust/lexios to confirm first-administrator enrollment, examine firmware Secure Boot evidence, and check what LexiKernel actually reports on this machine. These screens are read-only unless they redirect to the existing protected first-boot form or trusted next-boot owner. They do not write firmware keys or storage devices.

Use Install From USB for writing and testing the development image, First Boot for initial credentials, Secure Boot for more background, and Kernels for kernel behavior.

Enable Secure Boot with the development certificate

1. Sign in as an administrator and open LexiOS console > Open Secure Boot guide (/rust/lexios/secure-boot). Read Firmware Secure Boot; unknown is not evidence of protection.
2. Under Download development certificate, compare the offered certificate's SHA-256 fingerprint to 6CEF944863C1F231AACF59DF9C4713B817CAB80D91FBE758E281C97B7E9D5944. Select Download verified development certificate when available. If not available, retrieve the public EFI/LEXIOS/OWNER.DER file from the matching development USB and have an administrator provision it to this Panel. Never enroll an unverified public certificate. The website never distributes a private signing key.
3. Before changing firmware trust, retain recovery access to any encrypted operating system on the computer.
4. Restart into the firmware setup. Leave existing platform, exchange and allowed-signature keys in place. Under Secure Boot key management open Authorized Signatures (db), choose Append, not Update, Replace or Delete. Locate EFI/LEXIOS/OWNER.DER on the USB, verify the certificate, confirm appending, then enable Secure Boot and save the firmware settings. The menu wording differs across computers.
5. Reboot the development image, return to Firmware Secure Boot, and select Refresh Secure Boot status. Secure Boot: on requires an observed enabled SecureBoot variable and disabled SetupMode variable. If firmware cannot report both, it remains unknown.
6. Enter firmware setup again to verify that the development certificate is present in db alongside the previous trusted entries. Verify firmware trust explains this separately because even Secure Boot on does not prove db enrollment. Use /rust/lexios/tasks/lexios.secure-boot to check each guided step.

Undo: Under Authorized Signatures (db) remove only the appended development certificate. Preserve the original certificates. Firmware enrollment and undo require physical presence; Panel checks cannot perform either action. This is a development certificate, not production qualification.

The public development image presents Linux 7.4 and LexiKernel boot entries. Booting one does not establish that all of the other's capabilities are available.

Enroll the first administrator from another computer

1. Boot the machine to its first-run console and obtain the six-word, one-time enrollment code locally. The code is never displayed by the Panel or by a guide.
2. From the other computer, open /setup on the running Panel and enter Temporary setup password or console code. Every remote enrollment requires this code; only a directly verified loopback connection may omit it.
3. Enter Root password (12+ characters) and Confirm root password. Choose Administrator username, Administrator password (12+ characters; uppercase, lowercase, digit) and Confirm administrator password. You may leave LexiOS hostname (optional) at its default.
4. Select Complete first-boot setup. The server validates confirmation fields and the one-time code, then closes enrollment after success. If the code expires, renew it locally at the console rather than placing it in a URL, guide or support request.
5. Sign in with the newly enrolled administrator and open /rust/lexios/first-boot. Enrollment status should say completed. The task /rust/lexios/tasks/lexios.first-admin provides reminders and a final owner-state check.

Root credentials and administrator credentials are never collected by the LexiOS guide. Enrollment changes are one-time and cannot be undone by replaying the code; later account changes belong to protected administration.

Check LexiKernel support on this machine

1. Open /rust/lexios/kernel and read Running kernel. Linux is explicitly reported as Linux; the Linux compatibility interface alone cannot identify LexiKernel.
2. Inspect Measured subsystem capabilities. Each reported subsystem is available, unavailable with the owner's reason, or unknown if malformed or absent. Missing evidence never becomes a support claim.
3. Open Open detailed kernel status and next-boot selection (/rust/kernel) for additional owner readings and any trusted next-boot control. Requesting next boot does not change the currently running kernel or reboot the machine.
4. Review Release qualification. The protected release-gate ledger uses a Linux 7.3 qualification reference; it is not an assertion that a Linux 7.4 image has passed those gates. Use /rust/lexios/tasks/lexios.check-kernel for the guided checks.

The Linux boot path cannot report LexiKernel-only subsystem results. The kernel console refuses to infer GPU, inference, recovery or supervisor support without owner evidence.

Controls and tooltips

Every help marker is attached to a named control or capability. Where the first-boot form is still active, its field markers appear directly next to the labels.

Control	Tooltip
LexiOS console	Opens first-boot, firmware trust and kernel-status guidance without changing the machine.
Secure Boot status	Reads firmware Secure Boot and setup mode; missing evidence is unknown, not enabled.
Download development certificate	Offers only the public certificate whose fingerprint matches the documented development image; it does not enroll a key.
Enroll in firmware db	Explains how to append the development certificate to the allowed-signatures list while preserving existing keys.
Verify firmware trust	Reminds you to inspect the firmware db; Secure Boot enabled alone does not prove certificate enrollment.
Console setup code	Requires the one-time console code for remote enrollment; only a verified loopback connection may omit it.
Root password	Sets the separate root password for major system administration during first-boot setup.
Administrator username	Names the first administrator; enrollment is a one-time operation.
Administrator password	Requires at least twelve characters with uppercase, lowercase and a digit for the initial administrator.
Optional machine name	Sets a machine name during first-boot enrollment, or leaves the default when omitted.
Complete first-boot setup	Submits the one-time administrator and root credentials to the protected setup owner, never to the guide.
Enrollment status	Reports whether first administrator enrollment remains pending, without revealing a code or password.
Running kernel	Uses the kernel owner identity to distinguish Linux from LexiKernel rather than guessing from kernel version text.
Kernel capabilities	Shows reported LexiKernel subsystems and explains why each missing reading is unavailable or unknown.
Qualification gates	Displays protected release-gate results without turning a missing check into a passed qualification.
Next-boot kernel	Requests a one-time kernel selection only if a trusted boot authority advertises and accepts it; it does not reboot.
Guided tasks	Runs one checked task step at a time using the caller's permissions; firmware and credentials still require manual action.

API readouts and permissions

Authenticated administrator requests can read GET /api/ux/lexios/secure-boot, GET /api/ux/lexios/development-certificate, GET /api/ux/lexios/enrollment, and GET /api/ux/lexios/kernel-capabilities. They delegate to the protected owners GET /api/system/security and GET /api/kernel/status. The independent qualification owner remains GET /api/kernel/release-gates. The certificate response returns base64-encoded public certificate bytes only if a regular, bounded provisioned file has exactly the expected SHA-256 fingerprint. Otherwise the UI says why the download is unavailable.

All new API routes refuse non-administrators. The existing /setup endpoint is a distinct, one-time authentication flow and remains available before the first administrator exists. Guides never reveal setup secrets or change firmware settings. Only guide inputs used by the current action are validated and substituted; unused inputs do not invalidate an unrelated read. Route paths still reject unsafe identifiers, and evidence is checked against the current owner response. The LexiOS step form remains separate from /setup, where credentials must be entered directly.