Network Manager refactor

docs/TODO.md

@@ -5,27 +5,40 @@ Persistent backlog, kept in sync with the working session task tracker. Status:
 
 ---
 
-## [ ] 1. Port the dracut module off `network-legacy` → `network-manager`
+## [~] 1. Port the dracut module off `network-legacy` → `network-manager`
 
-Durable replacement for the current `dhcp-client` stopgap. `dhclient` is
-deprecated in RHEL 9 and will eventually leave the repos; the build only works
-today because the provisioner installs `dhcp-client` so `network-legacy` passes
-dracut's `check()`.
+**IMPLEMENTED 2026-06-17 — awaiting boot-bench verification.** Fixes the
+confirmed lease-expiry outage: network-legacy's one-shot DHCP lease was never
+renewed post-switch-root, so the address dropped at lease expiry → NVMe/TCP root
+died ("keep alive timeout" / "no route to host"). NM hands its initramfs
+connections to the real-root NM (`/run/NetworkManager` state), which renews.
 
-- Rewrite both network bring-up paths in
-  [../files/dracut/95dot1x-macsec/dot1x-macsec-up.sh](../files/dracut/95dot1x-macsec/dot1x-macsec-up.sh):
-  the secure path's `ifup macsec0` and the `rd.dot1x=0` bypass path's
-  `ifup $NIC` — use `nmcli`/NetworkManager-in-initramfs (or `ip=` cmdline + the
-  nm module) instead.
-- Change `depends()` `network-legacy` → `network-manager` in
-  [../files/dracut/95dot1x-macsec/module-setup.sh](../files/dracut/95dot1x-macsec/module-setup.sh).
-- Update `add_dracutmodules` in
-  [../files/etc/dracut.conf.d/90-diskless.conf](../files/etc/dracut.conf.d/90-diskless.conf).
-- Drop `dhcp-client` from the provisioner `dnf install` in
-  [../diskless.pkr.hcl](../diskless.pkr.hcl).
-- Re-verify the `lsinitrd` assertion.
-- **Gate:** full boot-chain smoke test (swtpm + hostapd + FreeRADIUS) before
-  merge, per CLAUDE.md.
+Done:
+- `90-diskless.conf` `add_dracutmodules`: `network-legacy` → `network-manager`.
+- `module-setup.sh` `depends()` → `network-manager`; added `nmcli`; installs the
+  new cmdline hook.
+- NEW `nm-unmanaged.sh` (cmdline hook): secure mode writes
+  `/run/NetworkManager/conf.d/10-dot1x-unmanaged.conf`
+  (`unmanaged-devices=interface-name:en*`) **before NM starts**; no-op in test
+  mode. Replaces the deleted static `99-dot1x-unmanaged.conf` (couldn't be
+  mode-aware — it wrongly unmanaged `en*` in test mode, blocking renewal).
+- `dot1x-macsec-up.sh` secure path: `ifup macsec0` → `nmcli` (managed + DHCP,
+  poll for IPv4). macsec0 MANAGED so NM renews; physical NIC UNMANAGED.
+- `diskless.pkr.hcl`: dropped `dhcp-client`, added explicit `NetworkManager`;
+  removed the static-config install; lsinitrd now asserts `NetworkManager` +
+  `nm-unmanaged.sh` present.
+- Static lint clean (`bash -n`, `shellcheck`, `packer validate`).
+
+**BENCH-VERIFY before trusting (the gate):**
+- Test path (`disable_dot1x=true`): boot, `nmcli device` shows boot NIC MANAGED;
+  run past the DHCP lease time (drop the lab dnsmasq lease low) — address
+  persists, lease renews (`journalctl -u NetworkManager`), NVMe + SSH stay up.
+- Secure path (swtpm + hostapd + FreeRADIUS, `disable_dot1x=false`): `en*`
+  UNMANAGED, `macsec0` MANAGED + renewing; MKA survives switch-root; verity root
+  mapped; NVMe stays connected past lease time; no "Address already assigned".
+- **Risk:** ordering of the unmanaged drop-in vs NM start in secure mode. If NM
+  transiently grabs `en*`, fall back to also baking a static `en*`-unmanaged file
+  for secure-only builds.
 
 ## [ ] 2. Apply RHEL9 STIG hardening to the built image
 

docs/design-v2-errata.md

@@ -61,11 +61,16 @@ CLAUDE.md invariant #9.
 
 These don't contradict the PDF (it doesn't specify them) but are worth recording.
 
-- **Network backend.** The dracut hook uses `network-legacy`/`ifup`, which needs
-  `dhclient`; RHEL 9 deprecated it and the minimal ISO omits it, so the
-  provisioner installs `dhcp-client` explicitly. dhclient is on its way out — the
-  durable fix is porting the hook to the `network-manager` dracut module
-  (tracked; see project todo).
+- **Network backend.** The dracut hook uses the `network-manager` dracut module
+  (ported 2026-06-17 from `network-legacy`/`ifup`/`dhclient`). NM hands its
+  initramfs connections to the real-root NetworkManager, which **renews the DHCP
+  lease** in the running system — network-legacy's one-shot lease was never
+  renewed, so the address dropped at lease expiry and the NVMe/TCP root died.
+  Managed/unmanaged is mode-aware: secure path → `macsec0` managed (NM DHCPs +
+  renews it), physical `en*` unmanaged (wpa_supplicant owns EAPOL/MKA), enforced
+  by the `nm-unmanaged.sh` cmdline hook writing a `/run/NetworkManager/conf.d`
+  drop-in before NM starts; test path → boot NIC managed, hook is a no-op. No
+  static unmanaged file (it couldn't be mode-aware). Awaiting boot-bench verify.
 - **Build ISO.** Defaults to a version-pinned Rocky 9.x **minimal** ISO on the
   internal mirror (`iso_url` + `sha256` `iso_checksum`). `http/ks.cfg` installs
   only core+sshd+chrony from the ISO; the diskless tooling is pulled online by