Alpha.10 diagnostic SSH fallback

[Deadbytes101]

Purpose

Allow remote SSH diagnostics when persistent state is unavailable or reports limited_capacity, without weakening configuration or miner state gates.

Tracks #22.

Physical trigger

Alpha.9 successfully displayed the firstboot state diagnostic on tty1, but ssh.service was dependency-blocked because rigos-ssh-hostkeys.service hard-required successful state readiness. This prevented remote collection of the exact state and service evidence needed for physical testing.

Changes

• advance the next immutable image artifact to 0.0.4-alpha.10
• keep ssh.service dependent on successful host identity establishment
• change the host-key authority from Requires= to Wants= state readiness
• use the verified persistent ED25519 host identity when state is ready
• otherwise generate a boot-scoped ED25519 identity only under /run/rigos
• point sshd at the runtime-published identity
• explicitly permit password SSH for rigosadmin, deny root login, and restrict logins to rigosadmin
• expose persistent versus ephemeral host-key mode in runtime status
• add source and image gates for the fallback path

Safety boundary

The fallback never writes keys into unverified persistent storage. Mining, configuration activation, huge pages, and persistent identity claims remain fail-closed when state readiness is unavailable. Only diagnostic SSH is allowed to start with an ephemeral per-boot host identity.

Stacked relationship

This draft is based on fix/alpha9-firstboot-config and must remain unmerged until exact-head source verification, alpha.10 exact-image verification, and physical SSH validation pass.

[Deadbytes101]

Exact-head Alpha.10 source verification passed on the recovered WSL authority.

BRANCH=fix/alpha10-diagnostic-ssh
HEAD=33e02e253b9d0691909e22464d0eee34056958f6
WORKTREE=CLEAN

DIAGNOSTIC_SSH_SOURCE_TESTS=PASS
SYSTEMD_ORDERING=PASS
RIGOS_VERIFICATION=PASS
RIGOS_FIRSTBOOT_THEME_WRAPPER=PASS
RIGOS_WSL_SOURCE_GATE=PASS

The diagnostic SSH fixture verified both paths:

• state unavailable / limited_capacity -> boot-scoped ephemeral ED25519 identity under runtime storage
• verified state ready -> persistent identity selected and published to runtime

No image has been built from this head yet. PR remains draft and unmerged pending Alpha.10 exact-image verification and physical SSH validation.

[Deadbytes101]

Alpha.10 exact-image build completed successfully from exact head 33e02e253b9d0691909e22464d0eee34056958f6.

Verified build evidence:

• EXACT_HEAD=PASS
• WORKTREE_CLEAN=PASS
• RIGOS USB appliance verification passed
• RIGOS RandomX performance image verification passed
• RIGOS authenticated XMRig observer image verification passed
• RIGOS firstboot exact-image verification passed
• rigos-usb-amd64-0.0.4-alpha.10.img: OK
• ALPHA10_EXACT_IMAGE_BUILD=PASS

Artifact:

• dist/usb/rigos-usb-amd64-0.0.4-alpha.10.img
• SHA256: 479ac1d66529aa4904e3556a6ba9c8fc92aff72468ea75a6c46f31cf885bdab5

PR remains draft and unmerged pending Windows-side checksum confirmation and physical validation of diagnostic SSH on state failure.

[Deadbytes101]

Physical alpha.10 validation on exact head 33e02e253b9d0691909e22464d0eee34056958f6 passed the diagnostic SSH boundary.

Observed on hardware:

• release reports RIGOS 0.0.4-alpha.10
• ssh.service active and listening on IPv4/IPv6 port 22
• password SSH login as rigosadmin succeeded from 192.168.1.33
• host-key authority reported outcome=ready, persistence_mode=ephemeral
• active host key path is /run/rigos/ssh-hostkeys/ssh_host_ed25519_key
• persistent state remained unavailable
• rigos-state-ready.service failed
• rigos-profile-apply.service remained inactive
• rigos-miner.service remained inactive

This confirms the intended fail-closed split: diagnostic SSH remains available with a boot-scoped identity while configuration and mining stay blocked.

A separate state-initialization defect was exposed: /run/rigos/state-status.json reports message="bounded command failed: resize2fs: timeout" but classifies the outcome as limited_capacity. Reboot/ephemeral fingerprint rotation is still pending before final physical closeout.