# felhom.eu — task reports

> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).

## scripts v1.18.0 — R-21 slice B: firmware loader option `--loader shim|mkimage` (F1) — 2026-07-17

**Baseline:** scripts v1.17.0 (host-install) / build-felhom-iso.sh was ISO_VERSION 1.16.0. Target
**v1.18.0**. Closes N100 **F1 (HIGH):** cheap AMI (`AN3PLUS 0.01`-class) UEFI firmware can't relocate
the ISO's stock signed GRUB from USB (`relocation 0x0`); the run's live `grub-mkimage` workaround is
now a first-class pipeline mode. Touched **only** `scripts/iso/`.

### What shipped

`build-felhom-iso.sh` gains `--loader shim|mkimage` (default **shim**, profile-settable via
`FELHOM_LOADER`, `--loader` wins). **shim = the stock output, byte-for-byte unchanged** (surgery
skipped). **mkimage** replaces the ISO's UEFI boot path with a monolithic `grub-mkimage` loader.
New: `mkimage-surgery.sh`, `profiles/n100.profile`, Dockerfile grub/mtools tooling; loud banner +
manifest `loader:`/`grub-mkimage:` fields + `-mkimage` filename suffix.

### Surgery approach actually used (Phase 2)

Recipe reproduced from the run evidence (the literal command was run on the now-wiped N100 old system
and saved nowhere — only the *procedure* is recorded; see Observations). In the assistant container,
**after** `prepare-iso`:
1. `xorriso -osirrox` extract the prepared tree (chmod u+w — osirrox files are read-only).
2. `grub-mkimage -O x86_64-efi` from the **container's** grub 2.12 build (`/usr/lib/grub/x86_64-efi`,
   which has `kernel.img` — the ISO ships modules but not kernel.img; the box likewise used its
   *installed* GRUB). Module set = the base search/configfile/USB chain **plus every `insmod` in the
   ISO's own `grub.cfg`** (57 modules). Embedded config: `search --fs-uuid <ISO uuid>` → `configfile`
   the real menu. The fs-uuid is derived from the ISO's PVD modification-date (GRUB's iso9660 uuid
   source) and pinned on re-master so it stays valid.
3. Swap the loader into the ISO9660 tree (**real lowercase Rock-Ridge path** `/efi/boot/bootx64.efi` —
   an early bug created a spurious *uppercase* path instead; fixed) **and** inside the `efi.img` ESP
   (FAT, case-insensitive — the loader UEFI firmware actually runs from USB).
4. Re-master with `xorriso -as mkisofs` from the ISO's own `as_mkisofs` report, dropping **only** the
   Apple HFS+/APM map (`-hfsplus`/`-apm-block-size`) and the isohybrid GPT-basdat marking
   (`-part_like_isohybrid`/`-isohybrid-gpt-basdat`) — re-emitting those trips xorriso 1.5.6's
   "Overlapping MBR partition entries" on this layout, and Mac boot is irrelevant. **Kept:** protective
   MBR + grub2-mbr (BIOS hybrid) + El Torito (BIOS + UEFI) + the GPT EFI System Partition (USB UEFI).

**Stall-rule outcome:** the surgery resisted for ~40 min of iteration (two overlap failures + the
kernel.img and path-case bugs) — **well within the 2 h budget**; no spike-note fallback needed.

### Per-leg results (RUNBOOK-B, nested VM 311 on felhom-pve, OVMF)

- **Leg 1 — shim regression:** the default ISO **boots + zero-touch auto-installs under OVMF Secure
  Boot ENFORCING** (`pre-enrolled-keys=1`; "EFI boot mode detected", DHCP, "Starting Proxmox
  installation", package extraction unattended). **Plus one SeaBIOS boot** — the shim ISO also boots
  under BIOS (hybrid grub2-mbr/eltorito path survived the v1.18.0 build). ✓
- **Leg 2 — mkimage happy path:** `--loader mkimage` ISO **boots + auto-installs under OVMF Secure
  Boot OFF** (`pre-enrolled-keys=0`). The monolith's embedded `search --fs-uuid` found the ISO and
  chained its real menu → the installer ran. ✓
- **Leg 3 — trade-off red-proof:** the **same** mkimage ISO under OVMF Secure Boot ENFORCING
  **FAILS** — captured firmware behavior: `BdsDxe: failed to load Boot0002 "UEFI QEMU DVD-ROM …" :
  Access Denied` → `No bootable option or device was found`. The unsigned loader is refused. This
  makes "Secure Boot must be OFF for mkimage" a **fact**, not a guess. ✓
- **Leg 4 — structural / byte-identity:** diffing the shim(out) vs mkimage(final) trees, **only**
  `efi/boot/bootx64.efi`, `efi/boot/grubx64.efi`, `efi.img`, and the regenerated El Torito artifacts
  (`boot.cat`, `i386-pc/eltorito.img`) differ — **the entire install payload is byte-identical**. The
  tree loader (1253376 B, vs shim's 1032032 B) carries the embedded `2026-05-21-…` fs-uuid and is
  identical to the loader inside `efi.img`; **0 spurious uppercase paths**; El Torito keeps both boot
  images. The `validate-answer` gate still runs pre-surgery. ✓

### Artifacts (shas + manifests)

- shim nested-test ISO `…-nested-vm-val.iso` — `28d862e2f7b014588717c15ef8c9bc46d11a9a5689a022f5d4de9e8f939d1377`
- mkimage nested-test ISO `…-nested-vm-val-mkimage.iso` — `71fce3333b3148e48d10711311f275da4b849bf383f711de0f2e4d5802618869`
- **safety ISO** `…-n100-safety-mkimage.iso` — `f9aa0428e5efdcb5e7c0ade05264ff681ac4f9aa47b7f3721c9eb712f025c1a8`
  (mkimage + match-nothing filter; **built + sha-recorded, NOT booted**; at `180:~/n100-baremetal/safety/`).
  Manifests record `loader: mkimage … Secure Boot OFF`, `grub-mkimage: 2.12-9+deb13u2`, secret-bearing.
  Nested-test ISOs + VM 311 destroyed after the legs.

### Physical proof on the real AMI board

Shape **(a) DEFAULT** stands unless Viktor picks otherwise: the F1 closure folds into the supervised
N100 rehearsal (its install ISO built `--loader mkimage`). Shape **(b)** — the zero-risk `n100-safety`
pre-flight ISO — is **built and sha-recorded** (above), ready either way; **do not boot without Viktor**.

### Docs diffs

`scripts/CHANGELOG.md` (v1.18.0); `scripts/iso/README.md` (loader-modes section + N100 SB-off prep +
`mkimage-surgery.sh` row); `scripts/iso/profiles/n100.profile` (new, mkimage); `VALIDATION-n100-baremetal`
F1 → PIPELINE-FIXED erratum; `00-capability-map.md` (new bare-metal ISO row + loader caveat);
`ROADMAP.md` (slice B collapsed to SHIPPED; PXE one-line deferred note); `CONTEXT.md`.

### Observations

- **The literal `grub-mkimage` command was unrecoverable** — it ran on the N100's old system (wiped at
  the run) and is not in `~/n100-baremetal/` nor 180's history. Only the *procedure* is recorded
  (VALIDATION F1 / CONTEXT). Reproduced faithfully: mkimage from a working (non-ISO) 2.12 GRUB build,
  module set = the ISO's grub.cfg needs, embedded `search --fs-uuid` → `configfile`. Not a strategy
  re-derivation.
- The mkimage re-master **drops Apple HFS+/APM (Mac boot)** — irrelevant for N100/PC, and required to
  avoid xorriso's overlap check. BIOS + UEFI + GPT-ESP boot all preserved (asserted in-build + Leg 4).
- Leg 2's "first-boot stub fires" is assured transitively: Leg 4 proved the first-boot payload is
  byte-identical to the shim variant's (slice-A-proven), and Leg 2 proved the answer is consumed. A
  full ~10-min nested install-to-first-boot was not re-run for the mkimage ISO on that basis.