ADR-0016 übernahm ADR-0009s verkürzte Dateinamen (boot-grub.cfg/
isolinux-live.cfg) ungeprüft - die tatsächlichen Dateien heißen laut
Git-Historie seit ihrer Anlage mit mint-Präfix (mint-boot-grub.cfg/
mint-isolinux-live.cfg). Jetzt korrekt benannt, mit Hinweis auf die
Diskrepanz zu ADR-0009s Kurzform.
13-live-provisioning-boot.md: Vorwärtsverweis auf ADR-0016 an der
Stelle ergänzt, die die ursprüngliche 01.08.2026-Korrektur beschreibt -
für Leser, die von dort aus nachvollziehen wollen, dass die Korrektur
zunächst nicht überall ankam.
Restliche 15 ADRs erneut gegen die letzte Fassung geprüft: alle
vorherigen Korrekturen (0003, 0009, 0011, 0012, 0013, 0015) live und
korrekt formatiert bestätigt, keine neuen Befunde.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Wichtigster Fund: 13-live-provisioning-boot.md widersprach sich selbst
zum GRUB-Standardeintrag - ein noch nicht korrigierter Abschnitt
('Auto-Eintrag ist Index 0 und damit Standardauswahl') stand neben der
bereits vorhandenen Korrektur weiter oben im selben Dokument ('Standard
ist von lokaler Festplatte booten', Erkenntnis vom 01.08.2026). Ein
Reader des älteren Abschnitts hätte das sicherheitsrelevante Verhalten
bei destruktiven Installationen falsch verstanden. Jetzt konsistent,
mit Verweis auf die Korrektur. ADR-0003 (Ursprungsentscheidung, dort
unkorrigiert) bekam denselben Nachtrag.
Kleinere Korrekturen: zwei Anführungszeichen-Inkonsistenzen (ADR-0009,
ADR-0011) - gerade Anführungszeichen für eigene Zusammenfassungen des
Autors statt der sonst durchgängigen „..."-Form, während echte wörtliche
Zitate (Terminal-Fehlermeldungen, Anaconda-Doku) unangetastet bleiben,
weil die Originalschreibweise dort bewusst erhalten werden soll.
Alle ADR-Querverweise (0001-0015) auf Gültigkeit geprüft, keine toten
Verweise gefunden.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Dokumentiert nachträglich das Phase-4/5-Ergebnis des Self-Service-ISO-
Plans (04.-07.08.2026, laut Memory 'Phasen 1-5 abgeschlossen', bislang
komplett undokumentiert): Hintergrund-Thread-Orchestrierung in
provisioning-server, iso_builds-Statustabelle, Alt-Build-Aufräumung
wegen anodes begrenztem Plattenplatz, PSK-Verschlüsselung in
Kundenplattforms eigener DB statt provisioning-server, getrennte
Aufladen-/Neubau-Aktionen, gestreamter Download-Proxy.
13-live-provisioning-boot.md um den Mint/Casper-Payload-Mechanismus
ergänzt (Pendant zum dort bereits beschriebenen Fedora/Dracut-Weg,
inkl. des gefundenen Casper-ORDER-Bugs: neue Hook-Skriptnamen werden
nie ausgeführt, nur das Überschreiben eines bereits referenzierten
Pfads funktioniert).
09-data-model-v1.md um iso_builds als neues Kernobjekt ergänzt.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
d-i preseed/early_command produced no trace anywhere (no log, no
syslog/installer-debug mention) -- Ubiquity runs its install steps via
its own Python plugin system (plugininstall.py), not the classic
debian-installer shell components that early_command/late_command are
bound to. Decided not to build a custom Ubiquity plugin or a
pre-ubiquity live-filesystem hook for this; organizational,
install-time-fixed parameters (partitioning, filesystem, branding) go
back to being baked into the personalized preseed at ISO-generation
time in the portal instead.
Also fixes a real safety bug in the test boot menus: the destructive
auto-install entry was the default (would run automatically on
timeout). Corrected to the opposite -- default is "boot from local
disk" (safe, nothing happens), the destructive install requires
actively selecting it from the menu. Verified in both the UEFI
grub.cfg and the BIOS isolinux config.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Mint itself only ships Live Desktop ISOs (Cinnamon/MATE/Xfce) -- these
are inherently the "fat" self-contained variant already (packages in
the squashfs, no network dependency during install). The
netinstall-vs-DVD customer choice documented for the general model
doesn't apply to this specific backend; a genuine netinstall
alternative would mean plain Ubuntu Server/Subiquity, a different
backend entirely.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Real hardware test (Intel AX210) shows the tested Fedora Everything
netinstall initrd ships no iwlwifi driver at all -- three kickstart
variants all hung identically at dracut-initqueue regardless of syntax,
confirming the cause was never the kickstart itself. Documents the
kexec test series (ADR-0009), the DB-driven kickstart success on
netinstall, and the resulting architecture: a personalized installer
ISO per workspace/backend/media-variant with the kickstart baked in,
no live-session/kexec transition, WLAN and blueprint application moved
to the Provisioning Agent's first boot on the fully installed target
system instead of the constrained installer environment.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Real test on Fedora 44 / Anaconda 44.30-2.fc44 (bypassing the liveinst
wrapper, which explicitly rejects kickstart on live media) confirmed
the documented restriction firsthand rather than just by reading
about it: --liveinst --kickstart in text mode silently drops rootpw/
user directives (require full manual re-entry, no error), and cmdline
mode exits cleanly with CmdlineError naming Installation Destination,
Root password, and User creation as unfinished despite being fully
specified in the kickstart.
Reimplementing install logic to bypass Anaconda entirely was
considered and explicitly rejected. Next step is re-evaluating
Ubuntu/Debian-based installer media instead of Anaconda's live mode;
switching Fedora to the officially supported inst.ks=/liveimg pattern
(separate netinstall media) remains a last resort.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The previous Auto-Modus-Gate rule unconditionally forced new devices
into the interactive flow because no better mechanism was known yet.
Enrollment Sessions (11-device-enrollment.md) already solve planned
bulk rollouts, but not a single, spontaneously booted new device.
New devices in auto mode now go on hold after the identification
handshake and wait for a customer to confirm registration and assign
a workspace via the future management UI, reusing the same
fail-closed poll mechanism already planned for the interactive flow's
kiosk communication (ADR-0007). Devices covered by an active
Enrollment Session are unaffected and remain fully unattended.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Kiosk UI: Chromium was evaluated as an Epiphany alternative (ADR-0005)
after ADR-0004's application-mode approach turned out unusable
end-to-end, then abandoned after four distinct real-boot failures in a
row (ADR-0006) in favor of a hardened plain --profile Epiphany launch.
ADR-0004 amended with the actual fix history (profile directory
creation, application-mode's undocumented web-app requirement,
--private-instance/--profile conflict on the target's Epiphany 50.1
vs. the 43.1 used for local testing). ADR-0007 resolves ADR-0004's
open question: the kiosk web UI and installer.sh never talk directly,
only via the provisioning server.
WLAN autoprovisioning: customer profile gets an "Autoprovisionierung"
flag plus WLAN credentials, driving self-service generation of a
personalized ISO with the credentials baked in as a NetworkManager
profile — works from device one, no persistent on-stick state needed.
Personalizing the build this way also motivated giving the ISO its
own volume label (TUXFLOTTE) instead of the source Fedora label.
Also folds in the EROFS root-cause writeup and the Ubuntu-live-medium
alternative noted for a future ISO rework, and brings
roadmap/installer-roadmap.md's checkboxes in line with actual status.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Replaces the stale "not yet implemented" note for installer.sh
autostart with the actual mechanism (dracut's official
20-apply-live-updates.sh pre-pivot hook via a top-level /updates/
directory, not squashfs/EROFS remastering - that image is EROFS
despite the filename, and hit a reproducible erofs-utils extraction
bug even freshly built from source). Adds the milestone entry for the
first clean end-to-end run through every module, live in Proxmox.
Fedora Cinnamon Live 44 chosen as the concrete base (interchangeable
with Workstation Live for this purpose), tuxflotte.mode kernel cmdline
flag name, 10s countdown with auto as default entry, and the
xorriso-based build.sh/extract.sh that no longer needs root. Checks
off 'Boot from local disk' in the installer roadmap, now verified
end-to-end in QEMU/KVM.
Moves from a Fedora DVD/netinst base (GRUB boots straight into Anaconda
via a static inst.ks= URL, bypassing installer.sh entirely) to a real
live medium. installer.sh runs as an application inside the live
session; backend_launch() starts the native installer explicitly at
the end instead of a boot-time kickstart parameter.
The boot menu offers two entries: a default with a countdown that
leads to an unattended flow, and a manual entry for the branded
interactive flow. The unattended flow is gated on
device.registration_status == "existing" - unknown devices always
fail closed into the interactive enrollment path. Device registration
now documents that this is a condition of registering a device.
Also notes the tension with the installer roadmap's long-term
minimal-medium vision: distribution packages still aren't bundled and
are pulled per install, but the live environment itself makes the
medium larger, accepted for the UX it enables.
Details: architecture/13-live-provisioning-boot.md.
