Fix fapolicyd for kiosk

docs/TODO.md

@@ -106,6 +106,24 @@ full session for seat); sshd gets an `account sufficient pam_succeed_if.so user
 keeps full STIG. Justified as register deviation #10. **Bench-verify on rebuild:
 kiosk renders + admin SSH works with hardening on.**
 
+**UPDATE 2026-06-19 — offline erofs inspection of the hardened image (mounted
+`rootfs.erofs` read-only) pinned the real causes; the PAM-account theory above
+was incomplete:**
+- **Kiosk = fapolicyd (CONFIRMED).** fapolicyd is `enabled` and `kiosk-session`
+  was not in its trust → it blocks `/usr/local/bin/kiosk-session`. Fix: KEEP
+  fapolicyd (it's the exec-guard for the writable overlay dm-verity can't cover)
+  and add the kiosk binary to its trust DB at build (2c-STIG-postfix). Not waived.
+- **SSH = NOT a STIG/PAM/SELinux issue.** `enforcing=0` didn't help; pam_namespace
+  is inert (empty namespace.conf); account bypass present; key file + perms +
+  sshd config all correct. Remaining cause: **baked key mismatch** — the
+  `SSH_AUTHORIZED_KEY` CI secret bakes `audiobuzz@s3`
+  (`SHA256:30p4vOQdWk0TdRQIR3VMo95yc6I7cRmCwIBRVjIHaV4`); if the client uses a
+  different private key → `Permission denied (publickey)`. AWAITING client
+  fingerprint / `ssh -vvv` to confirm; fix is the secret, not code.
+- Side note: SMBIOS cmdline-extra injection works only after a Proxmox VM
+  **stop/start** (not `reset`); and the debug-shell-on-tty2 attempt did not come
+  up — diagnosis ended up done via offline erofs mount instead.
+
 Remaining (future hardening, currently waived — see the register): FIPS,
 firewall, per-host/rotatable admin access. **Remote audit offload — WIRED both
 ends** (2026-06-19): receiver `serving/audit-collector/` (rsyslog TCP/514,

docs/stig-deviations.md

@@ -37,6 +37,12 @@ Posture decisions (2026-06-18, lab phase):
 ## Things that are NOT deviations (kept / enforced)
 
 - **SELinux enforcing** (`selinux --enforcing`; labels preserved into the erofs).
+- **fapolicyd** kept **enabled** (NOT waived) — it's the real exec-allowlist guard
+  for the writable RAM overlay, which dm-verity does **not** cover. The only
+  adjustment: the one non-RPM executable, `/usr/local/bin/kiosk-session`, is added
+  to fapolicyd's trust DB at build (provisioner 2c-STIG-postfix) so the kiosk runs;
+  everything else stays RPM-trust-only. (fapolicyd blocking that binary was the
+  original kiosk-won't-start cause.)
 - **auditd** enabled; STIG audit rules applied; logs locally.
 - **sshd hardening**: root login off, password & keyboard-interactive auth off,
   key-only (drop-in `50-fleet-hardening.conf`); STIG ciphers/MACs/KEX applied.