Daemonarchy 1.3.1

Daemonarchy 1.3.1

Daemonarchy 1.3.1 brings the MacBookPro16,1 development work into a pinned FreeBSD 16 installer. On the development installation, Navi14 graphics, the built-in T2 keyboard and trackpad, and BCM4364 Wi-Fi reached a usable desktop. The installer has updated Wi-Fi association and DHCP checks, a verified Apple recovery firmware acquisition path, retained remote-debugging grants, and a corrected EFI autoboot countdown. The desktop exposes remote-debugging status and revocation. The selected Broadcom driver port includes the SDPCM event BSSID fix, verified by a native FreeBSD Poudriere testport run.

This is the next production release after 1.1.1; there was no published 1.2.0. Across that interval the repository also gained measured installer-progress displays, bounded package-acquisition and dependency-graph development, signed-catalogue and native package-plan verification, owned QEMU worker supervision, wired early-network debugger development, and in-place Literate AI contracts for the existing FreeBSD source. These development tools retain their recorded qualification boundaries; the public ISO's included runtime paths and the exact native/VM results are identified separately below and in the changelog. This release does not claim a complete LitAI-managed build graph, safe parallel package installation, or a physically qualified early-kernel network debugger.

The build selects product cdeb3434a2f7e5e205feb756c897b1e4a98d4c28, FreeBSD source d63d77f4eb3cc29e16510f7bdec73602e27c2844, ports b785784219af455a9ce4fd70c59bc96ba77f469f, and desktop ec2a00824ec95b342c0c095657ac725c56f0528b. Source contains FreeBSD CURRENT through a3d1d4e88ae7435cfc32a886999dcde2173839cd. The exact native world, kernel, release sets, and Secure Boot policy builds passed. The verified ISO uses versioned signed application and checkout feeds, a signed boot bundle, and a separate Secure Boot certificate. The private keys and Apple firmware bytes are not release assets.

The package set reuses five byte-identical archives from the published 1.1.1 feed: Chromium, CEF, OBS Studio, tensaku, and the Hyprland preview share picker. Their selected port subtrees are unchanged. Because those archives were built on FreeBSD 1600028, the complete desktop dependency set was installed and checked in the selected 1600029 base before reuse was admitted. Chromium and OBS ran, CEF loaded, and a native 1600029 pkg client verified the signed application feed. Changed packages, including LibreOffice, were built for the selected release. This qualification does not imply that every graphical application was exercised on physical hardware with the final ISO.

The first exact-ISO bhyve installer attempt found py312-brotli absent from its FreeBSD mirror catalogue. The failed attempt and mirror catalogue were retained. A dependency-closure audit isolated that one missing package; the protected signer added its verified native archive and re-signed the 204-package application catalogue. A FreeBSD 1600029 client verified both the local signed feed and the corrected public feed without IGNORE_OSVERSION. The exact-ISO bhyve install and installed boot passed on the corrected feed.

The selected public Secure Boot candidate certificate has SHA-256 DER fingerprint EE:14:0E:7A:68:D5:66:D3:7A:96:EA:49:AC:68:23:8D:2E:03:9C:11:72:EB:89:6A:B6:9B:FF:18:9D:70:B7:33. Its PEM and DER file SHA-256 digests are 26009db078d352318c06f1ea5cf7b5650dfd32137518f3a6fecd20802de2fb79 and ee140e7a68d566d37a96ea49ac68238d2e039c1172eb896ab69bff189d70b733. These identify the selected public certificate; the final signed boot bundle and exact ISO have been verified.

The 1.3.1 package feeds use a new signing key. The selected checkouts-16-amd64-1.3.1-r2 feed has 11 verified public assets and passed an isolated native FreeBSD pkg catalogue read from its public URL with that key; the selected application feed packages-16-amd64-1.3.1 is published with its native signed manifest and public assets verified. Fresh installations will receive the new public key from the verified ISO. Existing installations that trust only the 1.1.1 key need explicit enrollment before selecting the new versioned feed; the old feed is preserved. The selected release base is FreeBSD OSVERSION 1600029, whereas the tested 1.1.1 native system runs 1600028; key enrollment alone does not qualify an in-place upgrade. Use the new ISO or a separately qualified base upgrade before enabling the new package feed, without IGNORE_OSVERSION. No in-place 1.1.1 migration command is qualified for this release. The key rotation instructions record both public-key fingerprints and the selected feed tag.

MacBook Wi-Fi firmware is acquired from a pinned Apple recovery image or operator-supplied local media and verified before disk writes. A Wi-Fi-only installation needs the firmware staged locally first; otherwise temporary wired connectivity is needed to download it. The operator confirmed on October 24 that all pre-production checks passed on the Intel 16-inch MacBook Pro and waived an additional acceptance rerun against the final public ISO. The pre-production checks retain their original artifact scope; this release does not claim that the final ISO bytes were installed on the MacBook.

Known limits: an earlier 1.1.1 S3 trial failed, and an earlier installer run reported an NVMe event that Apple Diagnostics ADP000 did not explain. These are historical observations on their recorded images, not current release gates. Apple's August 2026 T2 guide lists Microsoft UEFI CA 2023 among firmware bootloader certificates, but firmware enforcement of the final public ISO has not been demonstrated; hardware-rooted T2 attestation is not claimed. The MSI RTX 5080 laptop still resets during early kernel boot and is tracked for 1.3.2; this release makes no MSI installation or attestation claim.

Final artifact and native verification

• ISO: daemonarchy-1.3.1-amd64.iso — 2,041,176,064 bytes; SHA-256 ef5b1bec2189350e1ae194d251c35b959a39d7e4993b6a0f4deb7dcb30365735.
• Signed boot bundle SHA-256: 40dffd8a330ff2206ab892991dd518a8808ef77452326608310ccb9c653ca0df; signature SHA-256: 8f7d2bea61a8d9059cb7eb475e9ac8d30f754b26cc8cc5882c4501c755f01e21.
• Public Secure Boot certificate DER SHA-256: ee140e7a68d566d37a96ea49ac68238d2e039c1172eb896ab69bff189d70b733.
• Signed feeds: checkouts-16-amd64-1.3.1-r2 and packages-16-amd64-1.3.1.
• An independent FreeBSD bhyve run on daemon.local installed this exact ISO, checked the installed filesystem, booted the installed system, ran the installed-system checks and shut it down successfully.
• The release record selects product 2aa2ea995e511d3e55e02cab0aebee4b4350c5e5; the ISO itself was assembled from pinned product cdeb3434a2f7e5e205feb756c897b1e4a98d4c28.

The operator-confirmed Intel MacBook Pro pre-production pass retains its recorded artifact scope. The additional final-public-ISO physical rerun was waived; this release does not claim final-image physical boot or hardware-rooted T2 attestation.

Daemonarchy 1.3.1 packages for FreeBSD 16 amd64

Signed versioned application packages for Daemonarchy 1.3.1. The installer selects this feed and its new public key. The existing unversioned feed and 1.1.1 installs retain their previous trust key until deliberately migrated.

Daemonarchy 1.3.1 pinned source and ports checkouts

Daemonarchy 1.3.1 source and ports checkout feed (revision 2)

Signed FreeBSD 16 amd64 checkout packages for the 1.3.1 installer. This revision selects FreeBSD source d63d77f4eb3cc29e16510f7bdec73602e27c2844 and Daemonarchy ports b785784219af455a9ce4fd70c59bc96ba77f469f. The ports update adds the reviewed Broadcom SDPCM event BSSID fix.

The two source package assets are byte-identical to the prior checkout feed. The new ports checkout was packaged from the merged commit in a complete local repository and signed with the selected 1.3.1 package key. A native FreeBSD pkg client accepted the signed catalogue and listed all three checkout packages. These assets are installer inputs; the final ISO and application feed are separate release artifacts.

Daemonarchy 1.3.1 pinned source and ports checkouts

Daemonarchy 1.3.1 pinned source and ports checkouts

Optional, signed FreeBSD package repository for the exact trees selected by the 1.3.1 installer:

• FreeBSD source: d63d77f4eb3cc29e16510f7bdec73602e27c2844 (Daemonarchy source main, incorporating FreeBSD CURRENT a3d1d4e88ae7435cfc32a886999dcde2173839cd).
• Ports: 7e417dae24ffb95c4625601ae9d654eb2ca68f4d (Daemonarchy ports main).
• Catalogue SHA-256: 4b4e0a3dd22d61a064f22d4a78ac137cd5a4b2609ba103fa1e268e64b7ae51bf.
• Signing public key DER SHA-256: 67986b400f28a49e99df0f1f3368f60aca8064d5dc00094700ba1a17d8474ef7.

A native FreeBSD client authenticated the signed catalogue with the new public key, installed all three checkout packages, and materialized both selected trees. These optional packages are a supporting feed, not the installer ISO or a hardware qualification result. They remain separate from the latest stable installer release.

Daemonarchy 1.1.1 packages for FreeBSD 16 amd64

Signed Daemonarchy 1.1.1 application packages and rebuilt ordinary dependencies for FreeBSD 16 amd64, OSVERSION 1600028.

Source: bdcfeac3e1cb8ce3f05c32d8a7ad3597deb48bdf
Ports: f7d7ee897405dcb8ce87e674588a4e1b3bfba00e

This versioned feed preserves the existing stable feed. Kernel-bound drivers remain with the matching installer image. A package transaction does not migrate an older FreeBSD base/kernel.

Daemonarchy 1.1.1

Daemonarchy 1.1.1

Published as the production 1.1.1 release with operator authorization to proceed without further hardware or final installation-matrix evidence. Outstanding qualification is disclosed below and is not a passing result.

This release refreshes FreeBSD 16.0-CURRENT and the complete ports build for community testing. It retains the 1.1 installer and native FreeBSD desktop work from rc1.

The source revision is bdcfeac3e1cb8ce3f05c32d8a7ad3597deb48bdf (OSVERSION 1600028). The upstream ports baseline is b1306594c4a601f98a3d28cbf6fc0569e218245f; the candidate integration is f7d7ee897405dcb8ce87e674588a4e1b3bfba00e on daemonarchy-1.1.1. Omarchy remains 4.0.4 with package revision 23; the desktop layer is version 1.1.1.

World, kernel, release sets, package jail and kernel modules are rebuilt together. OSVERSION 1600028 changes the kernel packet-header layout and requires rebuilt external drivers. Dependencies newer than the official package baseline are rebuilt and carried in the versioned application feed. The stable package feed remains unchanged. A package transaction does not upgrade the FreeBSD base/kernel or replace kernel-bound drivers; base/ABI migration requires matching inputs and separate qualification.

Rescue option 2 now toggles Pair/Unpair, including stale sessions left by resets. The rescue menu redraws after late boot messages. Installer completion requires actual package dependency/file verification and durable target-pool flushes. Graphical startup requires attached active DRM devices and card/render nodes; a successful module load after failed GPU attachment no longer produces a false-ready marker. The original ZFS root is created with canmount=noauto and explicitly mounted during installation, preventing an inactive original boot environment from covering a replacement root and hiding its devices. Older installations need the documented one-time property check; application updates alone do not repair this metadata. Candidate package adoption rejects a feed requiring a newer kernel or userland before changing package identities.

Approved debug sessions now collect bounded kernel/system logs, process wait states, memory/storage statistics, temperatures, power state and passive device events. The snapshot/observe commands and a finite controller receiver retain evidence off-target when the machine resets. Unsupported console-buffer capture is reported explicitly; SSH observation cannot guarantee messages after a hard reset or kernel/network failure. No source or loader network-debug patches were added; that work remains planned for 1.2.

All project documentation was reviewed, stale operational instructions corrected, and CHANGELOG.md backfilled from the first installer commit and every release record.

Optional ports and source checkouts are downloaded when selected. Both are pinned, owned depth-1 Git trees with self-contained objects. Their payloads and repository signatures are checked before use. Kernel identity checks accept the shallow build's revision label and reject mismatched or dirty source identities.

Refreshed upstream submissions:

• freebsd/freebsd-ports#640 — supporting ports
• freebsd/freebsd-ports#641 — Omarchy and Daemonarchy
• freebsd/freebsd-ports#642 — LinuxKPI configuration headers

Qualification

Completed: 749 source-package builds, 24 isolated native port checks, the final combined package pass, matching inventory of 186 external-module packages and 997 modules, native verified-boot/rejection checks, published signed application/checkout feeds with exact asset hashes and native wrong-key rejection, and native/controller diagnostics lifecycle tests. The final ISO passed its native public-image payload/runtime audit; all six release asset sizes and SHA-256 digests match the audited payloads. The exact final ISO passed BIOS and enforced UEFI boot, signature enforcement, and its embedded root-mount-policy fixture. The physical HP passed coordinated upgrade to the new base/kernel/packages, rollback to its original base, return boot, and actual AMD Wayland greeter rendering. The operator confirmed that normal authenticated jkh login opens the HP desktop and its applications work. All four full installation/desktop configurations on the preceding image passed actual native, Hyprland, Chromium and OctoPkg checks: BIOS and enforced UEFI, each plain ZFS and GELI/ZFS. UEFI plain also verified both optional clean depth-1 checkouts. One extra UEFI signing assertion initially mishandled module symlinks; the retained failure was followed by a passing verifier that resolves each alias to its signed target and verifies the target hash. These runs are component evidence, not final-ISO full-install proof. All four then passed an additional controlled boot into a staged replacement environment after the explicit root-property correction: original root inactive, /dev intact, matching new base/kernel, Secure Boot policy retained on UEFI, and actual GUI/application checks repeated successfully. These are preceding-image-plus-property-correction results, not complete installations from the corrected final ISO. Remaining hardware and recovery coverage is tracked in the qualification record. Further hardware and final-matrix evidence were explicitly waived as publication gates; documented limitations remain open.

ISO: daemonarchy-1.1.1-amd64.iso, 1,912,215,552 bytes. SHA-256: c1bc6e3a0d30e6806a324aa3abd76eb70f1593f9f22e7aab6d222491fc1eb956. The ISO installer code is commit 25c3354d2dc693311f599ed4f36b6ff233d9060b; the release tag additionally includes final documentation updates.

Known limits

Physical GPU/display/suspend, real Bluetooth headset/HID, enterprise Wi-Fi authentication and refreshed bhyve remain unqualified. The previously recorded ASRock X570/RTX 4090 boot/firmware failure, MSI Raider early reset, and T2 MacBook driver failures remain open. The MacBook Pro16,1 reset repeatedly during ordinary package writes before desktop GPU loading. Its installed package files and dependencies were subsequently repaired and verified, but controlled Navi14 initialization failed with a KGQ timeout and device-attachment error 60. SDDM had previously autostarted without a working display session and was stopped before that GPU test. The new graphics guard rejects this failed state. A later spontaneous restart retained ntpd/syslogd termination and a shutdown record, establishing a shutdown path without identifying its initiator. The GPU failure and restart trigger remain unresolved. The MacBook's BCM4364 built-in Wi-Fi was detected without an attached driver or wireless interface; its wired USB Ethernet connection works. See the MacBook application note for GPU recognition versus initialization and the wireless limitation. Earlier diagnostics do not qualify these machines for installation.

The selected dependency set has known advisories: Python 3.12.15 is affected by CVE-2025-15366 and CVE-2025-15367 when applications pass untrusted newline-containing IMAP/POP commands; setuptools 63.1.0_3 is affected by CVE-2025-47273 in its PackageIndex download path. These are not fixed by this release. See the qualification record for scope and precautions.

Verified boot requires manual enrollment of the existing project certificate; the installer does not enroll keys. Its SHA-256 is 111539a7fb7178cea65f3e2fc50ea00839d045324a4272ce190e4733a9c118dd. Append it to firmware db while preserving existing trust entries. Hardware with only factory keys will reject the project loader.

See the qualification record, hardware observations, and enrollment guide for the evidence and limits.

Daemonarchy 1.1.1 pinned source and ports checkouts

Pinned shallow source and ports checkout packages for Daemonarchy 1.1.1.

• FreeBSD source: bdcfeac3e1cb8ce3f05c32d8a7ad3597deb48bdf (OSVERSION 1600028).
• Ports: f7d7ee897405dcb8ce87e674588a4e1b3bfba00e, tracking daemonarchy-1.1.1.
• The package repository uses the existing Daemonarchy package-signing public key.
• Native signed-catalogue queries, all three package installs, payload/archive hashes, materialization, Git integrity, and wrong-key rejection passed before publication.

This release hosts optional checkout payloads. The 1.1.1 installer image and application feed are published separately after their remaining qualification completes. Private signing keys are excluded.

Daemonarchy 1.1 candidate packages for FreeBSD 16 amd64

Signed application packages used by the 1.1 candidate. This versioned repository does not change the default update feed for existing installations. Hardware qualification limits are recorded with the installer candidate.

Daemonarchy shallow checkout packages — October 12 snapshot

Pinned, signed optional checkout packages for the October 12 FreeBSD CURRENT snapshot (source 3ceb5f150bc1) and Daemonarchy package baseline 28d8f145fbec.

These payloads are fetched by daemonarchy-checkouts when source or ports checkouts are selected. They contain depth-1 Git checkouts; the source revision matches the installer kernel. This supporting data release is not an installer ISO or a final Daemonarchy 1.1 release.

The package repository is signed with the existing Daemonarchy repository key.

Daemonarchy shallow checkouts for the 1.1 release sources

Pinned, signed optional checkout packages for the October 12 FreeBSD CURRENT snapshot (source 3ceb5f150bc1) and Daemonarchy package baseline 08a6370a019a.

These payloads are fetched by daemonarchy-checkouts when source or ports checkouts are selected. They contain depth-1 Git checkouts; the source revision matches the installer kernel. This supporting data release is not an installer ISO or a final Daemonarchy 1.1 release.

The package repository is signed with the existing Daemonarchy repository key.