Network Manager refactor

docs/TODO.md

@@ -5,27 +5,40 @@ Persistent backlog, kept in sync with the working session task tracker. Status:
 
 ---
 
-## [ ] 1. Port the dracut module off `network-legacy` → `network-manager`
+## [~] 1. Port the dracut module off `network-legacy` → `network-manager`
 
-Durable replacement for the current `dhcp-client` stopgap. `dhclient` is
-deprecated in RHEL 9 and will eventually leave the repos; the build only works
-today because the provisioner installs `dhcp-client` so `network-legacy` passes
-dracut's `check()`.
+**IMPLEMENTED 2026-06-17 — awaiting boot-bench verification.** Fixes the
+confirmed lease-expiry outage: network-legacy's one-shot DHCP lease was never
+renewed post-switch-root, so the address dropped at lease expiry → NVMe/TCP root
+died ("keep alive timeout" / "no route to host"). NM hands its initramfs
+connections to the real-root NM (`/run/NetworkManager` state), which renews.
 
-- Rewrite both network bring-up paths in
-  [../files/dracut/95dot1x-macsec/dot1x-macsec-up.sh](../files/dracut/95dot1x-macsec/dot1x-macsec-up.sh):
-  the secure path's `ifup macsec0` and the `rd.dot1x=0` bypass path's
-  `ifup $NIC` — use `nmcli`/NetworkManager-in-initramfs (or `ip=` cmdline + the
-  nm module) instead.
-- Change `depends()` `network-legacy` → `network-manager` in
-  [../files/dracut/95dot1x-macsec/module-setup.sh](../files/dracut/95dot1x-macsec/module-setup.sh).
-- Update `add_dracutmodules` in
-  [../files/etc/dracut.conf.d/90-diskless.conf](../files/etc/dracut.conf.d/90-diskless.conf).
-- Drop `dhcp-client` from the provisioner `dnf install` in
-  [../diskless.pkr.hcl](../diskless.pkr.hcl).
-- Re-verify the `lsinitrd` assertion.
-- **Gate:** full boot-chain smoke test (swtpm + hostapd + FreeRADIUS) before
-  merge, per CLAUDE.md.
+Done:
+- `90-diskless.conf` `add_dracutmodules`: `network-legacy` → `network-manager`.
+- `module-setup.sh` `depends()` → `network-manager`; added `nmcli`; installs the
+  new cmdline hook.
+- NEW `nm-unmanaged.sh` (cmdline hook): secure mode writes
+  `/run/NetworkManager/conf.d/10-dot1x-unmanaged.conf`
+  (`unmanaged-devices=interface-name:en*`) **before NM starts**; no-op in test
+  mode. Replaces the deleted static `99-dot1x-unmanaged.conf` (couldn't be
+  mode-aware — it wrongly unmanaged `en*` in test mode, blocking renewal).
+- `dot1x-macsec-up.sh` secure path: `ifup macsec0` → `nmcli` (managed + DHCP,
+  poll for IPv4). macsec0 MANAGED so NM renews; physical NIC UNMANAGED.
+- `diskless.pkr.hcl`: dropped `dhcp-client`, added explicit `NetworkManager`;
+  removed the static-config install; lsinitrd now asserts `NetworkManager` +
+  `nm-unmanaged.sh` present.
+- Static lint clean (`bash -n`, `shellcheck`, `packer validate`).
+
+**BENCH-VERIFY before trusting (the gate):**
+- Test path (`disable_dot1x=true`): boot, `nmcli device` shows boot NIC MANAGED;
+  run past the DHCP lease time (drop the lab dnsmasq lease low) — address
+  persists, lease renews (`journalctl -u NetworkManager`), NVMe + SSH stay up.
+- Secure path (swtpm + hostapd + FreeRADIUS, `disable_dot1x=false`): `en*`
+  UNMANAGED, `macsec0` MANAGED + renewing; MKA survives switch-root; verity root
+  mapped; NVMe stays connected past lease time; no "Address already assigned".
+- **Risk:** ordering of the unmanaged drop-in vs NM start in secure mode. If NM
+  transiently grabs `en*`, fall back to also baking a static `en*`-unmanaged file
+  for secure-only builds.
 
 ## [ ] 2. Apply RHEL9 STIG hardening to the built image