Adding packer host tooling

.gitea/workflows/gitea-main-ci.yaml

@@ -75,11 +75,17 @@ jobs:
         # libguestfs (virt-*), erofs-utils (mkfs.erofs), cryptsetup
         # (veritysetup), jq, systemd-ukify (ukify), buildah (OCI), plus qemu +
         # shellcheck for the lint gate.
+        #
+        # libguestfs builds a supermin appliance on first use, which needs a
+        # kernel + modules present on the runner (incl. xfs, to read the build
+        # VM's xfs root). The runner container ships none, so install one and
+        # make /boot readable (Ubuntu ships vmlinuz mode 0600).
         run: |
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
-            qemu-system-x86 qemu-utils libguestfs-tools \
+            qemu-system-x86 qemu-utils libguestfs-tools linux-image-generic \
             erofs-utils cryptsetup-bin jq systemd-ukify buildah shellcheck
+          sudo chmod 0644 /boot/vmlinuz-* 2>/dev/null || true
 
       -
         name: Setup Packer
@@ -106,6 +112,14 @@ jobs:
         name: packer validate
         run: packer validate .
 
+      -
+        name: Verify libguestfs appliance (fast gate)
+        # Fail in ~1 min if supermin can't build/boot the appliance, instead of
+        # after the ~17-min VM build when extract-artifacts.sh first runs virt-ls.
+        env:
+          LIBGUESTFS_BACKEND: direct
+        run: libguestfs-test-tool
+
       -
         name: Registry login
         # Enables oci_push=true in the build step below.

CLAUDE.md

@@ -7,6 +7,16 @@ immutable **erofs + dm-verity root over NVMe/TCP**. Each release is a signed
 **UKI** plus root image packaged as a **FROM-scratch OCI artifact image**.
 The authoritative architecture document is
 `docs/diskless-fleet-design-v2.pdf` — read it before structural changes.
+`docs/design-v2-errata.md` records where the as-built RHEL/Rocky 9
+implementation diverges from it (pending a consolidated v3).
+
+## Backlog (read at session start)
+
+`docs/TODO.md` is the **persistent backlog** and the durable source of truth for
+outstanding work — it survives across sessions (the TodoWrite task tracker does
+not). At the start of a session, read it and mirror its open items into the
+TodoWrite tracker. Whenever items change (added, started, completed), update
+**both** `docs/TODO.md` and the tracker so they stay in sync.
 
 ## Repo layout
 

README.md

@@ -5,7 +5,8 @@ authenticate with 802.1X EAP-TLS (TPM-held key, certificate in TPM NV) and run
 MACsec on the access link. The root filesystem is an immutable, reproducible
 **erofs image with an appended dm-verity hash tree**, served as a single
 shared **read-only NVMe/TCP namespace**, with a tmpfs overlay for runtime
-state. Companion to `docs/diskless-fleet-design-v2.pdf`.
+state. Companion to `docs/diskless-fleet-design-v2.pdf` (see
+`docs/design-v2-errata.md` for as-built deltas on RHEL/Rocky 9).
 
 ## Layout
 

diskless.pkr.hcl

@@ -179,7 +179,10 @@ build {
       # omits it; without it network-legacy fails dracut's check() and the
       # diskless module 'cannot be installed'. (Strategic path: port the hook to
       # the 'network-manager' dracut module — see CLAUDE.md bench-verify notes.)
-      "dnf -y install wpa_supplicant tpm2-tools tpm2-tss nvme-cli cryptsetup dracut-network dhcp-client openssl",
+      # zstd: dracut compresses the initramfs with compress="zstd"
+      # (90-diskless.conf); the minimal ISO lacks the zstd binary, so without it
+      # dracut warns and silently falls back to gzip (a larger initramfs).
+      "dnf -y install wpa_supplicant tpm2-tools tpm2-tss nvme-cli cryptsetup dracut-network dhcp-client zstd openssl",
 
       # Stage etc files into place
       "install -D -m0644 /tmp/etc-stage/dot1x/radius-ca.pem            /etc/dot1x/radius-ca.pem",