A standard defined in advance cannot be rationalised afterwards, and this is the artifact that most
needs one: once a file is on iso.felhom.eu and someone has downloaded it, it cannot be recalled.
Twelve criteria, each checkable against the UPLOADED FILE rather than the build inputs, and each
carrying the spike measurement that justifies it:
- G1 no answer.toml / auto-installer-mode.toml — deletes the whole Spike 1-2 problem space and
removes the Automated menu entry by construction rather than by a guard
- G2/G3/G4 no root hash, no SSH key, no customer identity — the shared-credential classes
- G5 credential scan by ENUMERATION against the stock ISO, not a pattern sweep (Spike 1 found
/answer.toml precisely because the earlier recon grepped the wrong file)
- G6 menu present, interactive default, timeout >= 10 (Spike 2 lost a probe to a 1-second menu),
underscore timeout_style, and the banned-token safety gate kept unchanged
- G7/G8 the felhom .deb present, and a postinst that cannot fail: no systemctl start/daemon-reload
(no systemd runs in the installer chroot), no network use (the cable may be out), no 'set -e',
ends 'exit 0'
- G9 felhom-bootstrap.sh byte-identical to repo HEAD — the one frozen, drift-capable payload
- G10 every build input committed (Spike 1: demo-felhom came from an uncommitted profile)
- G11 published checksum AND a verified download round trip
- G12 bucket Public Access stays Disabled
Committed on its own, before any build.
admin
e787391c0a