Add app

CLAUDE.md

@@ -34,6 +34,8 @@ files/kiosk/                              weston+Chromium kiosk + chromium lockd
 scripts/extract-artifacts.sh              qcow2 -> kernel/initramfs/erofs+verity/cmdline
 scripts/build-oci.sh                      ukify + sbsign + roothash gate + OCI image
 serving/                                  Lab serving stack: dnsmasq + nginx + SPDK
+serving/kiosk-app/                         Svelte+Tailwind spaceship-terminal SPA
+                                          (kiosk endpoint; nginx reverse-proxies /kiosk/)
 .gitea/workflows/                         Gitea CI: lint -> packer build -> push OCI
 docs/                                     Design PDF and supporting notes
 ```
@@ -152,9 +154,17 @@ instead of working around it.
   build; the supplicant config carries both options.
 - erofs module availability on the target RHEL kernel (fallback:
   journal-less ext4 in `extract-artifacts.sh`).
-- STIG remediation: (a) verify the SSG datastream name on the target distro
-  (`ssg-rhel9-ds.xml` vs `ssg-rl9-ds.xml` — the provisioner tries both) and that
-  the `...content_profile_stig` profile id exists; (b) remediation must not break
+- STIG remediation: (a) datastream **must match the distro**. The provisioner
+  maps `/etc/os-release` `$ID` → datastream (Rocky→`ssg-rl9-ds.xml`,
+  RHEL→`ssg-rhel9-ds.xml`, al9/cs9/ol9). **Do NOT run the RHEL9 datastream on
+  Rocky** — its CPE dictionary has no Rocky entry, so every rule returns
+  `notapplicable`, the scan evaluates **0** rules, remediation does nothing, and
+  the report is *falsely clean*. (Seen 2026-06-18: a build picked rhel9 via
+  `ls … | head -1` and produced 462 notapplicable + 1068 notselected, **0
+  pass/fail**.) Two guards now exist: the provisioner aborts the build if 0 rules
+  are evaluated, and `stig-deviations.sh` flags an INVALID SCAN + exits 2. Also
+  confirm the `...content_profile_stig` profile id exists in the chosen
+  datastream; (b) remediation must not break
   boot/login (NM/NVMe, key-only sshd, kiosk, SELinux enforcing) — `enable_stig=false`
   is the escape hatch; (c) **reproducibility**: build twice and confirm identical
   `root_hash` in verity.json — if it drifts, oscap wrote something
@@ -174,7 +184,10 @@ instead of working around it.
   into the initramfs (`lsinitrd | grep -E 'fleet.script|script.so'`), and (c) it
   renders (text via `Image.Text` needs the label plugin + a font in the early
   initramfs). If blank, the splash silently no-ops but boot continues; ESC shows
-  the log. Untested in this workspace (needs a display).
+  the log. **RENDER-VERIFIED 2026-06-18** (test-path build): the scripted theme
+  draws and the handshake checklist updates from the hook status tokens. Still
+  unverified on the **secure path** (the auth/macsec rows reaching `done` — see
+  #8 bench items).
 - `systemd.verity_root_options=hash-offset` is **NOT supported** by Rocky 9.8
   systemd-veritysetup (verified: "unknown option hash-offset=" → "Failed to load
   verity superblock"). Resolved by the documented fallback — data and hash are