Add STIG hrdening

docs/TODO.md

@@ -45,7 +45,24 @@ Done:
   transiently grabs `en*`, fall back to also baking a static `en*`-unmanaged file
   for secure-only builds.
 
-## [ ] 2. Apply RHEL9 STIG hardening to the built image
+## [~] 2. Apply RHEL9 STIG hardening to the built image
+
+**IMPLEMENTED 2026-06-18 — awaiting build/bench verification.** OpenSCAP + SSG
+remediation in a provisioner (`enable_stig` var, default on), tailored for the
+diskless/UKI/kiosk architecture via `files/stig/diskless-tailoring.xml`. STIG
+kernel params baked into the UKI cmdline (`extract-artifacts.sh`). Decisions:
+**FIPS off**, **audit local-only**, **CI report-only**. Deviations are documented
+in **[stig-deviations.md](stig-deviations.md)** (curated register) and reported
+per-build by **[../scripts/stig-deviations.sh](../scripts/stig-deviations.sh)**
+(non-pass rules tagged intentional vs REVIEW); CI publishes
+`stig-report.html` + `stig-arf.xml` + `stig-deviations.md`. Scanner tooling is
+removed from the shipped image. **BENCH-VERIFY:** SSG datastream name; boot/login
+still work; reproducible verity hash across two builds; triage REVIEW rows.
+
+Remaining (future hardening, currently waived — see the register): FIPS,
+firewall, remote audit offload, per-host/rotatable admin access.
+
+### Original spec (retained for reference)
 
 OpenSCAP + SCAP Security Guide (`xccdf_org.ssgproject.content_profile_stig`), run
 as a Packer provisioner after `dnf install` and before the dracut/initramfs build