Trust

Check the box is what we shipped

Keep locked Terminal only. No extra scanner app, no store, no new key. Nothing unlocks.

1. Prove every Unwoke addition

   ujust unwoke-test

   Walks flavor, browser, every default-off lock, and each shipped-first ticket. Each line is PASS, LOOSE, SKIP, or FAIL with a proof: path. Setup → Test everything Unwoke added is the same command. If you do not trust the script, type the same proofs yourself: See each lock yourself. Short dashboard: ujust unwoke-status. Fast invariants: ujust audit-unwoke.

2. Stock audit

   ujust audit-secureblue

   Theirs. Kernel args, USBGuard, malloc, and the rest of the inherited story. Overlay audit does not replace it.

3. Signature on the image you pull

   On another machine (or this one if cosign is available), with our repo’s cosign.pub:

   cosign verify --key cosign.pub ghcr.io/sergi270710267/unwoke-silverblue-trivalent

   Use the image name you actually rebased to (recommended default is *-trivalent). First rebase is unverified by design; after the signed reboot, the origin must stay signed.