Changelog

2026-09-09

• d5383fc Save close-chat pickup: vendor-watch green, do not add Dependabot bypass.
• b77ee03 Stop vendor-watch dying on tutorial HTML the bot cannot push.

2026-08-31

• d27c188 Save close-chat pickup: site menu, Factory GitHub map, recommended USB wrap.
• a228a94 Group the left rail; keep GitHub in the top row; stop wide pages shoving the menu.
• 3cb8cb1 Fix Shipped first page breaking the left rail.
• e96c57c Split the site menu: top bar plus left rail on desktop.
• 09c1706 Map GitHub on Factory; wrap recommended USBs after overlay.
• 852fabe Bake DevTools into ostree; inspect Origin ELF tree.
• fa1483c Inspect ntsync conf: unpack modules-load.d.
• acdaea8 Fix bake (no scx/ppd dnf) and footnote stock install-docker.
• b0f4060 First-day ease: find Install, USBGuard in Setup, Start shortcuts.
• 975eb13 Note dark Anaconda on the empty-disk USB install page.
• 6df1ebd Brand the live Anaconda installer dark Unwoke navy.
• 28699d3 Tiny polish: ostree resume, KDE pin, idle signed reboot.
• d028d1a Make first login find setup; resume Whonix after the KVM reboot.
• b014105 Anonymity wins without cutting SELinux or Safe Browsing.
• 5a92580 Offer official Whonix KVM: OpenPGP, session virt, leaks off.
• 85ad84b Cut forensic leftovers: volatile journal, no hibernate, no cores.
• 173a7c4 Auto more CachyOS session tweaks; still restore when Steam quits.
• bacf846 Make the play window automatic: click Steam, close Steam, locks return.
• 15f1eb2 Add a Gaming sell tab: play, then lock again.
• af09b69 Add a play window: GameMode while you play, full locks after.
• 11bd171 Intercept every stock app installer so overlay locks are asked.
• 00cfaa9 Wrap stock Steam install with overlay lock questions.
• 8bdb0b6 Lock /var/tmp noexec the same way as /tmp and /dev/shm.

2026-08-30

• 31204c2 Handoff: pickup from PROGRESS.md; close this chat.
• 08c44db Harden further than stock: NTS, DevTools lock, USBGuard prompt, fail-closed proofs.
• f7876b4 Fill scorecard gaps: RAM disk, CET, /boot, CAs, nags, NTS, proof.
• 33fbd50 Add a see-it-yourself tutorial for every overlay lock.
• 892cc4d Sell on-disk proof: unwoke-test vs stock audit.
• 19b07eb Prove each shipped-first ticket in ujust unwoke-test.
• ed499e2 Add ujust unwoke-test: prove every overlay lock on the disk.
• db68456 Show the factory clock, USB baker, and alarms in full on Pages.
• 2dfcc9f Perpetual factory: weekly all-12 USB, stale-bake alarm, idle heartbeat.
• d5284fd Auto-wrap Origin USB after a green bake; rerun pin-only cosign flakes once.
• 9f37fa5 Unblock Origin overlay inspect; retry stock cosign pin flakes.
• 8814edd Install livesys/anaconda on Origin USB without dnf; curl Brave RPMs.
• 51642f3 Install dracut-live files on the live USB, not just the RPM row.
• 4601c9e Replace Origin live rpmdb with initdb+justdb kernel-core and dracut-live.
• 56a7316 Point Origin inspect at /usr/lib/opt Brave payload.
• d3854b9 Skip Fedora extras in Origin Brave extract; Fedora repos only.
• fac79ef Install Origin Brave as files; do not dnf into the RPM db.
• 58265c2 Handoff: Origin USB still red; stop restoring sqlite copies.
• b1cb805 Checkpoint RPM WAL before saving the Origin pre-flavor copy.
• 83a8dec Restore Origin rpmdb as sqlite+WAL; never mix leftover Origin WAL.
• 6b2d525 Handoff: Origin USB still open; resume from PROGRESS.md.
• e7494a7 Never sqlite3 .recover a full Origin RPM index.
• 7a3125a Copy restored sysimage rpmdb onto live rpm %_dbpath.
• 797ad85 Do not sqlite3 .recover a healthy Origin RPM index.
• 6f22bd9 Restore Origin RPM sqlite from the pre-flavor copy so ISO dnf works.
• b9a0e9e Register on-disk kernel-core into the live RPM db for titanoboa.
• 16aaf8c Recover Origin RPM sqlite with sqlite3; do not rebuilddb.
• c3e61d0 Pin dnf releasever in the ISO hook after Origin rpmdb rebuild.
• 3b5be42 Repair Origin RPM sqlite in the ISO hook before titanoboa dnf.
• d237cc1 Checkpoint RPM WAL only; do not sqlite-integrity the RPM db.
• 7abb60d Do not require rpm -q after overlay dnf; checkpoint sqlite WAL.
• 2d9e6d8 Rebuild the RPM sqlite db after overlay dnf so Origin USB wraps.

2026-08-29

• a0f980e Handoff: 12 ISO wraps started; resume from PROGRESS.md.
• 9ae34a4 Auto-apply the public mark and keep it out of live browser policies.
• 48aaf07 Make UNWOKE-SHIPPED-FIRST a default-on overlay lock.
• edff869 Mark every overlay script with UNWOKE-SHIPPED-FIRST by default.
• 736d4be Leave a public UNWOKE-SHIPPED-FIRST mark on disk, site, and receipt.
• 6dc5d9d Ship more overlay-safe stock FEATs: NTS, CAs, ramdisk, CET, /boot.
• 77cc2df Say [FEAT] on their tracker is a request, not a ship.
• 13e37c4 Keep shipped-first tickets until stock ships, then mark after us.
• a7c9a37 Show stock GitHub FEATs we shipped first.
• 0854d74 Add an After login walkthrough for the first session.
• 2e4bf8f Beat stock on encrypt, Flatpak record, NFS, extra lockdown.
• 300333f Say the sit-back factory on Home and Factory.
• 7440bcb Queue overlay bakes; retry ISO push; attach tiny USB sums.
• a9d54df Add a moving GitHub receipt release (pubkey + digests).
• 8db2c55 Give the GitHub repo a navy shield face.
• 6e08f1e Fix ISO GHCR publish: oras rejected the absolute path.
• 5bdfdbd Fix false titanoboa-pin alarm; name leftover private ISO.
• 5093a06 Handoff: save progress for pickup on another PC.
• 041d514 Strict contributor path: CODEOWNERS, PR gate, templates, maintainer merge only.
• 5705d03 Sell the privacy lead: a detailed Privacy page vs stock.
• c1ea432 More privacy defaults that are still locks; warn on real security cuts.
• 48ea0c3 Teach fingerprinting vs locks; keep the secure defaults.
• 7323ae5 Default-off leftover Fedora phone-home without cutting security.
• 9406dba Turn the last-green line into a four-tile stamp.
• fdf4430 Make the AI note the loudest block on Workarounds.
• d31fbed Drop Workarounds cards that pointed at the wrong ujust.
• 983b985 Write a short Unwoke answer on Workarounds via free Pollinations.
• 6d5767e Optional AI on Workarounds: pick from the allowlist only.
• 5c95515 Map stock Trivalent-titled issues to overlay policy diagnostics.
• 1dc04a1 Add a Workarounds page: stock issues that hit Unwoke, revertable ujust only.
• c14b4db Widen page content on desktop only.
• 84c60ef Fit every top-nav tab without a sideways scroll.
• d7c9793 Fix leftover kramdown on the mirror and let verify inspect all flavors.
• 4c40895 Make mirrored stock docs readable: grouped TOC, subnav, no leftover kramdown.
• fd1b7a8 Auto-footnote new stock ujust names on the mirror.
• d447767 Put Unwoke ujust under stock snippets that would do the wrong thing here.
• b6ba4fc Publish people-facing git onto Home, Compared, and Changelog.
• 0fc87c0 Keep stock FAQ deep links on the mirrored page.
• edbab0d Fix site copy and make the stock docs mirror usable.
• 68c5369 Nag leftover human gates without auto-trusting them.
• fc1f293 Keep the factory in sync without weakening locks.
• 4630f0e Generate the tutorials hub from the vendor list at Pages deploy.
• 7de7b1d Add Mullvad VPN to the shared vendor list (WireGuard first).
• 4e2597b Every vendors{} key is watched, healed, and installable.
• 8992187 Record first green Unwoke USB ISO (Trivalent GNOME, run 20).
• 0dde9ab Heal usual Proton/IVPN breakage, not only moved URLs.
• 818f4f9 Heal vendor URLs when Proton/IVPN move files on their own HTTPS.
• ccb6297 ISO: upload artifact even if GHCR publish has no Cosign sig.
• 447505d Watch Proton/IVPN installer contracts so wizards do not rot.
• 1e44479 ujust install-ivpn: WireGuard first, official repo only if asked.
• 2916879 ujust install-proton: web first, SHA512 RPMs, asked locks.
• 469a745 ISO: keep the wrap if Cosign cannot reach public Rekor.
• 7636ea0 Last-green stamp on the site; Reboot button on the signed nag.
• 9c5e28b ISO: sign SHA256SUMS in the wrap step, no path handoff.
• 0e3ba3e Search finds locks; You loosened puts them back; help works offline.
• 7014a98 Recommend Trivalent as the default flavor.
• b2a9a05 Add Compared tab: living list vs stock secureblue.
• 6e6fbb9 ISO: hash in the wrap step so checksum cannot lose the file.
• 77569a8 Desktop setup window, app-grid launcher, repeating signed nag.
• 1e24977 Add Tutorials tab: everyday tasks, secure path first.
• 5b13ff5 Fix iso.yml YAML: keep PEM check on one line so dispatch works.
• cd9c734 ISO checksum: sign with our key only, skip public Rekor.
• 4b16973 Guided recovery in setup; auto-public GHCR; honest USB status.
• 1323a2a First-session setup and a three-question install picker.
• 73ac2f2 ISO checksum: find the file, reject tiny ISOs, sign from a key file.
• 27cef02 ISO checksum: use workspace path, not empty action output.
• 15c318d ISO: run titanoboa Justfile with pinned just, skip setup-just.
• 51abaa4 Fix USB ISO: use Anaconda Titanoboa, not the old iso.yaml LiveCD.
• b6ee5f4 Fix ISO/verify dispatch: pick job, no matrix in job if.
• 29be70c Handoff: factory green, USB ISO path, resume from any clone.
• af7de25 Direct USB install: wrap Unwoke GHCR images, no stock ISO required.
• 505a88b Strip leftover Trivalent binaries on Origin and browserless images.
• 5ea8ef3 Inspect flavor from tar member types, not leftover dirs or skipped hardlinks.
• 29ec90c Inspect Unwoke key signatures, not GitHub certificate attestations.
• a25a3fa Canary extract: do not extractfile() hard links from a stream.
• f4ee350 Canary extract: copy stream members without tarfile.extract seek.
• 0041bab Canary: stream crane export through Python instead of GNU tar.
• 40c09c7 Fix canary on Atomic images; auto-inspect GHCR; one factory-alarm issue.
• 06005e0 Auto-refresh stock snapshots and lockdown lists in CI.
• 76cadad Do not block overlay when stock scripts change; still alarm and attach the new files.
• 953c7a5 Mask stock nags, replace MOTD, sanitize mirrored docs, watch flatpak.just.
• c481e82 Stop running stock harden_flatpak.py; watch it for changes.
• 95bfb8f Refuse to overlay if a signed stock image names Unwoke.
• 3cdaeb8 Features comparison: give Trivalent its own column on every row.
• 7697d05 Add Trivalent image flavor with extra reversible Chromium policies.
• 0a540c7 Stronger toolbox wrappers, tty1 daily-user prompt, mask Avahi and ModemManager
• f4cc00a Site: match every overlay toggle, including Flathub Bluetooth toolbox
• 1128c90 Flathub off by default; Bluetooth and toolbox/distrobox off until ujust on
• 0419313 Default-on reversible locks: Bubblejail, no brew, admin-split, camera-mic, Origin isolation

2026-08-28

• 4796f82 Refresh handoff for next chat
• 2798a54 Add public auto changelog tab from git subjects at Pages deploy
• 799ee7c Document every overlay extra; add Brand tab with wallpapers; save handoff
• 462f3ad Default Unwoke wallpaper, lock screen, and blue accent on GNOME and KDE
• c779b35 Overlay toggles: verified Flathub, split Origin policies, lockdown default on
• 4fbe6c9 Kill leftover green: navy/blue palette, no laptop hue-rotate
• 8096317 Switch accent from lime to a real blue (no teal)
• 4851be5 Add Contributing tab in the main nav like secureblue.dev
• a281e37 Add Post-install to the main nav like secureblue.dev
• 965d23f Mirror their post-install (already) and contributing, with 'this is them' banners
• 98ac941 Mirror their donate page; ours is a forever disclaimer
• 65f6e1a Add Unwoke conduct page: mock their Contributor Covenant, don't ship it
• 2070438 Mirror stock secureblue.dev docs daily without touching Unwoke pages
• 364365b Wordmark: Unwoke as the modifier, SecureBlue as one capped word
• 29478ff Brand as Unwoke SecureBlue; restyle the site wordmark
• e0d21fa Gate host browsers on browserless until ujust set-allow-browsers
• 7d6f29e Add browserless image flavor (no Trivalent, no Origin, no brave_t)
• d9b02d9 Replace README-style Pages dump with a secureblue.dev-inspired site
• b6428e8 Add GitHub Pages project site
• 66d8465 Install Brave Origin (brave-origin), not full brave-browser
• c5fb162 Add overlay ujust toggles and origin Brave managed policies
• bf66df2 Do not call rpm during ostree compose; detect selinux-policy-devel by Makefile
• 368aa4f Detect Brave by ELF path, not rpm -q, during image compose
• 621b448 Keep harden_userns on: run origin Brave in brave_t, drop GUI stores
• a537d32 First boot: auto-stage signed origin so updates check our cosign stamp
• 5430467 Fix provenance: attest subject must be the image name without :latest
• bc6832a CI extras: Harden-Runner, pin action SHAs, GitHub provenance attestations, signed rebase as the real install
• 9d23e36 Verify official secureblue cosign signature and pin base digest before each overlay build
• 28eb969 Market the overlay with receipts: Brave origin, no Bazaar, no Trivalent
• a02bc31 ISO: pull the image into root podman so titanoboa can see it
• 0cb3818 Add image inspect workflow; do not rebuild OS when only ISO/verify YAML changes
• f296f62 ISO: log in to GHCR so titanoboa can pull private images
• 44bed8a Lead with the one-command rebase so install is not a maze
• 91b3512 Fix store restore: set Fedora releasever instead of a second dnf module
• aa7c36b Fix Brave install: pull Fedora deps instead of pinning Brave repo only
• a4c61be Initial overlay: official Brave, drop Trivalent and Bazaar, daily rebuilds from secureblue