Factory

This is the living map of how Unwoke keeps itself current. Four lanes stay in sync. Most breakage heals itself. A few gates stay manual on purpose. Auto-heal never means “make it green by loosening a lock.”

You should not have to refresh Actions. Watch the stamp below and the GitHub issues named in Alarms. That is the pager. Chat is not.

Checking last green…

Security boundary. The factory will not auto-merge a canary hit, a new keys/secureblue.pub, a new vendor hostname, gpgcheck=0, unverified Flathub, or a titanoboa pin bump. Those need a human because they are trust changes, not URL typos.

In easy words

Images

Twice a day, every day

Pull their signed Fedora Atomic image, prove it is still theirs, refuse it if it names this overlay, layer Unwoke, inspect all twelve flavors, sign ours, rewrite the receipt.

USB

Recommended after overlay; all twelve on Sunday

After a green overlay (not a PR), wrap the two advertised Trivalent sticks. Sunday still wraps all twelve. Origin stays weekly so the baker does not wrap eight Origin sticks a day. Each wrap still verifies our :latest.

Flakes

Retry, then one rerun

Stock cosign sometimes says “no signatures found” for a few seconds. The pin step retries. If that was the only failed step, those jobs rerun once. Inspect and canary failures stay red.

On the box

Users can prove the overlay

ujust unwoke-test is PASS/LOOSE/FAIL with a path for every lock and shipped-first ticket. Stock audit does not. Compared.

Away

Alarms, not babysitting

If overlay has not been green for ~40 hours, factory-alarm opens. If git is idle 10+ days, a timestamp-only commit keeps GitHub from killing cron (~60 days of no activity). A one-image USB dispatch cannot close a weekly ISO fail. Watch issues, not Actions.

GitHub map

This is the same factory, named as GitHub objects. The pager is still the stamp above and the issues in Alarms. You should not have to live in Actions.

Object	What it does	Where you look
Repo	Overlay sources, workflows, this site. Not a fork of stock.	SeRgi270710267/unwoke-secureblue
`bluebuild`	Canary → pin → overlay all twelve → inspect → attest → try Public → rewrite `receipt`. Twice daily and on overlay pushes. Docs / ISO / Pages edits do not start it.	Actions → bluebuild
`iso`	USB baker. After a green overlay: two recommended Trivalent sticks. Sunday: all twelve. Dispatch: the one you picked. Not `on: push`.	Actions → iso
`pages`	This site: changelog, tutorials hub, last-green stamp, docs mirror, Workarounds, Shipped first.	Actions → pages
`verify`	Twice-daily inspect of published images, stock-key / titanoboa-pin / GHCR-public watch, rewrite `receipt`. Schedule + dispatch only. Does not bake.	Actions → verify
`vendor-watch`	Allowlisted vendor URL heal, tutorial hub (Pages still generates the live hub if git HTML cannot land), idle heartbeat so cron stays enabled. A blocked bot push pages `factory-alarm` for heals; HTML-only drift does not fail the contracts job.	Actions → vendor-watch
`pr-gate`	Pull requests only. Blocks `gpgcheck=0`, `setenforce 0`, secrets in the diff, `pull_request_target`, auto-merge in workflows. Vendor schema, Python compile, public mark. Does not bake or publish.	Actions → pr-gate. Job name `Strict PR gate`.
Dependabot	Weekly GitHub Actions SHA bumps. Those PRs are still CI code.	Review and merge. Do not auto-merge.
`CODEOWNERS`	`@SeRgi270710267` on every path. Green CI is not permission to land.	`.github/CODEOWNERS`. Contributing.
Ruleset `main-strict`	PRs to `main` need 1 approval + Code Owners + status `Strict PR gate`. Blocks force-push and deletion. Repository admin bypass so the owner (and this agent) can still `git push` `main`. Factory bot commits (vendor heal, snapshot refresh, heartbeat) also need GitHub Actions (app 15368) as a bypass actor — the bot is not an admin. No auto-merge. Grok cannot merge.	Repo → Settings → Rules → `main-strict`. Only that ruleset; no `protect-main`. Bypass list: Repository admin + GitHub Actions.
Release `receipt`	One moving tag: `cosign.pub` + verified GHCR digests. After a USB wrap, tiny `SHA256SUMS` only. Never the ISO (GitHub will not host ~4 GB).	Releases → receipt
GHCR	Twelve OS images `:latest` and twelve `-iso:latest` packages. Anonymous rebase/USB fetch needs Public. The factory tries; GitHub often still wants one click.	Repo → Packages. Working URL is `/pkgs/container/NAME`, not `/users/…/settings`.

Stranger path: fork → PR → green pr-gate + canary → the maintainer merges. There is no auto-merge. Owner pushes to main skip the ruleset because of the admin bypass; the overlay bake and inspect still run on that push. github-actions[bot] does not skip it unless GitHub Actions is on the bypass list — without that, vendor heal and the idle heartbeat file cannot land (HTML-only tutorial regen still happens on Pages; heartbeat falls back to a keep-alive issue comment so cron does not die at ~60 days).

Four lanes

Overlay

Images

Twice-daily bake of twelve GHCR images on signed stock. Canary → pin digest → BlueBuild → inspect → attest → try Public → rewrite receipt. A later overlay push queues; it does not cancel a bake that is already running. One factory-alarm issue if this lane is red. A bake that never ran also alarms after ~40 hours (stale-bake watch).

USB

ISO baker

After a green overlay bake (not a PR): wrap the two advertised Trivalent sticks (unwoke-silverblue-trivalent, unwoke-kinoite-trivalent). Sunday 10:00 UTC still wraps all twelve. Dispatch any one image on demand. Each wrap still cosign verifys our :latest before Titanoboa. Auto wraps queue with each other; a human dispatch does not cancel them. oras push retries once (same titanoboa pin). Actions artifact kept 90 days; GHCR -iso:latest is the long-lived copy. Tiny checksums go on the receipt tag; never the 4 GB ISO. Own iso-alarm: a recommended-two wrap or a one-image dispatch that succeeds does not close a weekly fail.

Site

Pages

Every main push: changelog, tutorials hub from the vendor list, last-green stamp, docs mirror. Own pages-alarm.

Apps

Vendor list

vendor-installers.json is the only list. Check + allowlisted heal twice a day. Setup, search launchers, ujust install-vendor, tutorials, and inspect all iterate the same keys.

What already fixes itself

If this breaks	What the factory does	Still will not do
Stock `:latest` moves during a bake	Cosign verify + pin the digest before BlueBuild (retries; official bundle format pinned off)	Skip verify to finish faster
Stock cosign says “no signatures found” for a few seconds	Pin step retries up to five times. If every failed job died only on that pin step, those jobs rerun once	Rerun inspect, compose, or canary. Rerun a second time
Stock base names this overlay in the clear	Canary fails; no overlay; `factory-alarm` opens	Auto-merge the hit or ignore the needle
Stock `harden_flatpak.py` / `flatpak.just` change	Targeting scan; if clean, commit snapshots. Overlay still runs Unwoke scripts	Copy a file that names Unwoke (poison)
Published flavor missing setup, trampoline, or the wrong browser	Inspect fails; no provenance attest; alarm	Publish anyway
First GHCR push is private	Tries Public after overlay, ISO, and twice-daily trust-watch. Anonymous OCI pull is the truth. Does not invent ISO names or `/users/.../settings` URLs (those 404 if oras never pushed). Opens `ghcr-private` only for packages that exist. Closes after a real Public click	Fail the bake. Auto-guess a different registry
Stock `harden_flatpak.py` path 404s (same repo, same filename)	Vendor-watch relocates the raw URL inside `secureblue/live` only	Fetch from some other GitHub org. Exec their live Python
Their `cosign.pub` differs from our copy	Bake already refuses. Also opens `stock-key` so you do not have to read a generic factory fail	Auto-replace `keys/secureblue.pub`
Titanoboa pin commit disappears	Opens `titanoboa-pin` only if the pinned commit object 404s (not `git ls-remote SHA`, which misses tag v0.2)	Auto-bump to `@main`
Stock closes a GitHub FEAT we already shipped	Shipped first page keeps the ticket and moves it to “they shipped after us.” Opens `stock-feats` so you can read their PR	Auto-copy their patch. Drop the card
Proton/IVPN/Mullvad URL moves on an allowlisted HTTPS host	Heal rewrites JSON, regenerates the tutorials hub, overlay bake picks it up	Add a new hostname, HTTP, Flathub, or `gpgcheck=0`
Vendor `version.json` field rename / sidecar checksum / www vs apex	Heal tries those. Live SHA512/SHA256 still required	Ship an RPM with no checksum
429 / 5xx / timeout on a vendor URL	Retry. Do not rewrite the list	Treat a outage as a new URL
You add a stanza to `vendors{}`	Watch, Setup, search launcher, `ujust install-vendor`, inspect, tutorials hub, offline help stub	Need a new Python watch path
New `/usr/libexec/unwoke/*` script	Compose `chmod a+x` every file there. No name list	—
Green overlay bake (push or twice-daily, not a PR)	Wrap the two advertised Trivalent USBs. Still `cosign verify` our `:latest`. Same titanoboa pin. Queues with Sunday’s baker	Wrap Origin or all 12 after every bake. Skip verify. Close `iso-alarm` (only Sunday all-12 may)
ISO wrap or Pages deploy fails	Own GitHub issue. ISO alarm closes only when the weekly all-12 wrap is green. Pages closes when that deploy is green	Auto-bump titanoboa. Let a recommended-two wrap or a one-image dispatch hide another flavor’s fail
No successful overlay bake for ~40 hours	Inspect/trust-watch opens `factory-alarm` (stale-bake). Only a later green overlay bake may close it	Invent a green bake. Close the alarm from inspect alone
No human git on `main` for 10+ days	Vendor-watch writes `docs/factory-heartbeat.txt` (timestamp only) so GitHub does not disable cron after ~60 days of no repo activity	Touch recipes, keys, or titanoboa. Fake overlay work
GitHub Release `receipt` missing or stale	Full verify and a finished overlay bake both rewrite one moving tag: `cosign.pub` + verified GHCR digests. After a USB wrap, tiny `SHA256SUMS` files are attached (never the ISO). Opens `receipt-alarm` if that fails. Next green run overwrites and closes	Host a 4 GB USB. A new tag every bake. Auto-accept a new signing key
Last-green stamp stale on the site	Pages writes `status.json` from successful overlay / inspect / ISO / vendor-watch runs	Invent a green bake that did not happen
Compared / What’s new / Changelog highlights lag the git	Pages runs `generate-progress.py` from people-facing commits (+ optional `People:` / `Vs:` / `Where:` trailers)	Put factory-only noise on Home. Auto-edit the Features toggle table
Stock update unmasks countme or restores Fedora connectivity URI	Every boot `privacy.sh apply-boot` remasks / rewrites NM conf unless the user stamped `allow-*`	Disable fwupd or Safe Browsing to “win” privacy
Stock GitHub issues that might hit this overlay	Pages scans open issues and lists allowlisted revertable `ujust` on Workarounds. PRs/CI/other flavors omitted	Patch GHCR from an issue body. Suggest setenforce 0. Bake a “fix”
Stock mirrored FAQ says `ujust install-vpn` / unfiltered Flathub / `rebase-secureblue`, or they add a new `set-*-modules`	JSON map + auto-pair to overlay justfile (`set-foo-modules` → `set-foo`). Unknown risky names get `ujust why` plus a `mirror-cmds` issue	Rewrite their markdown. Auto-unlock Flathub to “make the stock command work”. Invent a mapping that weakens a lock

What stays a human, and why

Event	Why it is not automatic	What you do
Canary hit (base names this repo / GHCR / `/usr/share/unwoke`)	Could be stock talking about us, or a hostile swap. Auto-merge would bake on a lie	Read the canary log. Decide. Do not “fix” by deleting the needle
New `keys/secureblue.pub`	Key rotation is a trust change. Auto-accept is how you follow an attacker’s key	Compare to their published key. Replace our copy only if it is really them
Vendor needs a new hostname	Allowlist is the heal boundary. Auto-adding hosts is how a redirect steals the installer	Add the host in `vendor.py` `HOSTS` only if you intend to trust it
Vendor switches to Flathub / Snap / `gpgcheck=0`	That is a weaker contract. Heal must not “make it work”	Keep WireGuard / official repo, or drop the app. Open issue stays
Stock ships a FEAT we already shipped	Their patch might be better or weaker. Auto-copy is how we import a lock we did not review	Read the PR on Shipped first. Keep ours (`stock_reviewed: keep`) or copy on purpose (`adopted` in `stock-feats.json`)
Titanoboa pin dies	The wrap tool is in the ISO trust path. Auto-bump is a supply-chain skip	Read the new commit. Pin a hash. Re-dispatch ISO
First GHCR package still private after the job	GitHub often refuses visibility changes from `GITHUB_TOKEN`	One click: Packages → the image → Public. After that the job is a no-op
Dependabot GitHub Actions PRs	Action SHA bumps are still code in CI	Review and merge. Do not auto-merge
Origin / NVIDIA / browserless USB mid-week	Those ten wraps stay on Sunday. Origin’s torn rpmdb path is the slow/fragile one; we will not bake eight of those a day	Dispatch that one image if you need it. Do not add `on: push` to `iso.yml`
Enroll Secure Boot	The kernel is still theirs. Their key, not ours	Stock post-install. We do not enroll a second key for you

Alarms (one issue per lane)

You should not have to refresh Actions to learn something is red. Each lane reuses a single issue (comment on repeat, close when green):

factory-alarm — canary, snapshot watch, overlay bake, post-publish inspect, or no green bake for ~40 hours
iso-alarm — USB wrap. Overlay can be green while this is red. A recommended-two wrap or a dispatch of one image does not close it; only Sunday’s all-12 success does
pages-alarm — site generate/deploy
vendor-installers — a vendor contract still broken after allowlisted heal
ghcr-private — a package is still private; one Public click, then it closes
stock-key — their published key changed; do not auto-accept
titanoboa-pin — the USB wrap commit is gone; do not auto-bump
receipt-alarm — the moving GitHub Release receipt could not be rewritten; last good files stay. Next green full verify or bake heals it. Never attach the ISO
mirror-cmds — stock docs grew a ujust we do not footnote yet. The mirror still injects ujust why. Do not auto-unlock Flathub to match them
stock-feats — they closed a FEAT we already shipped. Read their PR on Shipped first. Do not auto-copy

A 429 is not a contract break. Heal does not rewrite on transients. Inspect on a schedule does not close factory-alarm by itself (that would hide a failed canary behind a still-signed old image).

Add an app (one stanza)

Put a key in files/system/usr/share/unwoke/vendor-installers.json. The rest is generated:

Twice-daily check + heal (allowlisted HTTPS + checksum / gpgcheck=1)
Setup → Strict apps and ujust install-vendor NAME
Search launcher at image bake
Tutorials hub card + vendor block at Pages deploy (and vendor-watch)
Offline help stub at compose if that tutorial slug has no page yet
Inspect fails the bake if the desktop or help page is missing

If the official site is a new hostname, that is the human step: add it to HOSTS in vendor.py. Do not add Flathub. Prefer a wireguard-import or https-ok (Trivalent) key marked strictest before any RPM.

A day in the factory

Overlay image (every flavor)

CanaryCrane-export the signed stock base. Do not run it. If it names this repo, our GHCR, or /usr/share/unwoke, stop. No overlay.
Match their keyOur keys/secureblue.pub must still equal their live cosign.pub. A rotation opens stock-key and refuses the bake.
Pin the digestcosign verify their :latest, then freeze BlueBuild on that digest so the tag cannot move mid-job. Retries on a flake; pin-only failures rerun once.
BlueBuildLayer Unwoke on that digest. Twelve recipes. Fail-fast is off so one flavor does not hide the others.
InspectOur signature, right browser, no leftover Trivalent on Origin/browserless, stores hidden, setup files present. Fail here: no provenance attest.
Attest + Public + receiptProvenance on non-PR bakes. Try GHCR Public. Rewrite the moving receipt tag (pubkey + digests, not the OS).

USB ISO

PickGreen overlay (not a PR) = the two recommended Trivalent sticks. Sunday schedule = all 12 names. Dispatch = the one you chose. Not on: push.
Verify ourscosign verify --key cosign.pub on ghcr.io/sergi270710267/<name>:latest. Unsigned images are not wrapped.
TitanoboaPinned commit 840217d only. Live hook can stub a torn Origin RPM index so initramfs still builds. The pin is never auto-bumped.
Publishoras push <name>-iso:latest, retry once. Sign the package. Upload the Actions artifact (90 days). Attach tiny SHA256SUMS to receipt.

Clock (UTC)

08:00 and 20:00
Overlay bake of all twelve images, then rewrite receipt. Later overlay pushes queue; they do not cancel a bake that is already running. If that bake is green and was not a pull request, the USB baker then wraps the two recommended Trivalent sticks (still cosign verify of our :latest).
After overlay
Recommended USB: unwoke-silverblue-trivalent and unwoke-kinoite-trivalent only. Queues with Sunday’s all-12 baker; a one-image dispatch keeps its own lane. Origin, NVIDIA, and browserless stay weekly.
09:15 and 21:15
Vendor check/heal (allowlisted HTTPS + checksum). HTML-only tutorial regen is Pages; a blocked heal pages factory-alarm. If main has had no commits for 10+ days, write the idle heartbeat timestamp so GitHub cron stays enabled (issue comment fallback if the bot cannot push).
09:30
Pages: docs mirror, tutorials hub, last-green stamp. Pages also run on every main push. Inspect of all twelve published images at 09:30 and 21:30, then rewrite receipt. Stale overlay (~40 hours without a green bake) opens factory-alarm here.
Sunday 10:00
USB wrap of all twelve flavors (Trivalent, Origin, browserless × GNOME/KDE × NVIDIA/not). Morning overlay is 08:00 the same day. oras retries once. Tiny sums on receipt.

Docs-only and ISO workflow edits do not start an overlay bake (build.yml paths-ignore). Changing the vendor JSON or overlay scripts does.

If you are away

Turn on GitHub email for issues on this repo. The factory will keep overlay images current, wrap the two recommended Trivalent USBs after each green overlay, and wrap all twelve on Sunday. GHCR -iso:latest outlives the Actions zip. Real trust hits (key, canary, titanoboa pin, new vendor host, Dependabot) stay red until a human is back. That is the design.

What this page is not

Not a store. Not a promise that canary catches a generic backdoor. Not affiliated with secureblue. Kernel, SELinux, hardened_malloc, USBGuard, firewall remain theirs. We overlay. We do not fork.

Vs stock in easy words: Compared. How to install: Install. Everyday tasks: Tutorials.