lfg2025/archy

Files

T

archipelago cbd463e980 feat(host): crash/hardware-error capture, delivered by a new host-fixup OTA channel (#144 )

kdump + rasdaemon on every node, per docs/kdump-rasdaemon-design.md with
the approved decisions: hang capture ON (a wedged kiosk dumps and reboots
itself instead of sitting dead), crashkernel=256M, backfill ships with
this release, phase-2 UI surfacing deferred.

Host fixups (docs/system-level-ota-design.md) are the general answer to
'deliver system-level updates OTA': curated OS packages, sysctl drop-ins,
service enablement and the GRUB crashkernel line, carried by the signed
binary and applied idempotently at startup — non-fatal by construction
(offline/locked-dpkg nodes converge on a later boot), skipped on dev
boxes and non-Debian hosts. This formalizes the polkit/audio repair
precedents into a channel with a stated policy: pinned packages and
parameter intent only, never dist-upgrade automation; the ISO bakes the
identical end state into fresh installs (next commit).

The one runtime limitation is honest: crashkernel memory can only be
reserved at boot, so the fixup writes GRUB, runs update-grub, and logs
that it takes effect on the next reboot.

tests/lifecycle/os-audit.sh gains section D — a graded baseline check:
FAIL if capture never landed, WARN if written but awaiting reboot, PASS
when reserved, policy live and rasdaemon recording. Section D runs
independently of RPC health: a wedged backend must not mask that the
node also stopped capturing evidence.

Verification: host_fixups unit tests 4/4; cargo fmt clean; full suite
runs in the release gate (create-release) and the archi-dev-box
lifecycle gate before the tag.

2026-08-31 07:23:44 -04:00

adr

Archipelago — open-source initial import

2026-08-12 10:55:50 +00:00

README.md

Archipelago documentation

Start here. This index groups the docs by what you're trying to do. The authoritative behaviour is always the code in core/; where a doc and the code disagree, the code wins and the doc is a bug.

Getting started

User Walkthrough — setting up and using a node, from hardware to daily use
Talking to your node — the conversational command surface
Seed Verification — independently verify your 24-word backup
Troubleshooting — common problems and how to resolve them
Gamepad / Controller Navigation — driving the UI from a controller
Pine voice commands — the voice-satellite phrase surface

Architecture

Architecture — the system at a glance
Multi-Node Architecture — how nodes relate across a fleet
API Reference — the JSON-RPC surface

Contributing to Archipelago itself

Developer Guide — building the workspace, the frontend, and an ISO
Contributor guide (CLAUDE.md) — invariants, build/verify, the production test gate
Bulletproof containers — why the reconciler is level-triggered
Release signing runbook — the ceremony and key handling
1.8.0 Release Hardening Plan — the release-blocking checklist
Third-party license audit — dependency licensing posture
Demo build info — operating the public demo sandbox

App development

App Developer Guide — build and package a containerized app
App Manifest Specification — the manifest schema, field by field
Manifest → Quadlet unit — how a manifest compiles to a systemd-owned container unit
Container lifecycle — the reconciler state machine: install/adopt/start/stop/self-heal
App secrets — declaring, generating and injecting per-install credentials
Registry-Distributed Manifests — how manifests reach nodes via the signed catalog
Decentralized Marketplace Protocol — publishing apps via an external registry
Bitcoin RPC Relay — letting an external wallet reach the node's Bitcoin RPC
Companion Pairing QR — the pairing handoff contract
TV input inside iframe apps — keyboard/gamepad routing into embedded apps

Design docs

These record why a thing is built the way it is. They are design records, not step-by-step guides, and some predate the current implementation.

Registry-Distributed Manifests
DHT Distribution
Bitcoin Multi-Version
Dual Ecash
Hardware Signer
Manifest Hooks
Peering & Federation Trust — naming/semantics of trust levels vs discovery (#134)
kdump + rasdaemon Troubleshooting — post-mortem and hardware-error capture on nodes (#144)
System-Level OTA — how host-level packages/config reach already-deployed nodes
Meshroller Integration
Nostr Git Source Hosting
Nostr Identity Import · Nostr Signer Login (research)
Streaming Ecash (phase 4)
App Packaging Migration

Decisions (ADRs)

There is no ADR-010 — the number was never issued, so the gap is not a missing file.

Security

Security Policy — how to report a vulnerability
PSBT Signing Architecture
Bitcoin RPC Proxy Exposure
Entropy Enforcement (KEY-05)

Roadmap & history

Roadmap — where the project is going
TODO — working backlog of unscoped forward-looking items
archive/ — superseded design and status documents, kept for provenance