Merge nucleic/lucid-lunar-wren-wxyw into dev

2026-07-21 01:19:00 -07:00
parent e48c604421
commit ee401ff5b4
16 changed files with 275 additions and 6 deletions
@@ -0,0 +1,42 @@
+#!/bin/sh
+# Realize the naros-vm desktop policy (NAROS.md §7.4 N5). Runs at image-build configure time in
+# the mmdebstrap chroot (no running systemd) — every step is offline-safe.
+set -e
+[ "$1" = "configure" ] || exit 0
+
+# 1. The narOS `agent` user GDM auto-logs into. uid 501 is in lockstep with the sandbox/agent
+#    tiers (the uid ContainerEngine execs as); login shell is the contract nash path.
+if ! id -u agent >/dev/null 2>&1; then
+  useradd --uid 501 --user-group --create-home --home-dir /home/agent \
+    --shell /usr/local/bin/nash agent
+fi
+for g in video input render sudo; do
+  getent group "$g" >/dev/null 2>&1 && usermod -aG "$g" agent || true
+done
+passwd -l agent >/dev/null 2>&1 || true   # auto-login only, no password
+
+# 2. sudoers drop-in must be 0440 (git can't track that mode).
+chmod 0440 /etc/sudoers.d/naros-agent 2>/dev/null || true
+
+# 3. GDM auto-login into the agent's Wayland session, so the host surface sees a live screen.
+#    (Debian gdm3 reads /etc/gdm3/daemon.conf; we own the desktop policy, so write it whole.)
+mkdir -p /etc/gdm3
+cat > /etc/gdm3/daemon.conf <<'GDM'
+[daemon]
+WaylandEnable=true
+AutomaticLoginEnable=true
+AutomaticLogin=agent
+GDM
+
+# 4. Compile the system dconf defaults (AT-SPI on, scale=1, no idle/lock, geometry ext enabled).
+dconf update 2>/dev/null || true
+
+# 5. Boot to the graphical session.
+systemctl set-default graphical.target >/dev/null 2>&1 || true
+
+# 6. Skip GNOME's first-run tour so the first host screenshot is a usable desktop.
+mkdir -p /home/agent/.config
+echo yes > /home/agent/.config/gnome-initial-setup-done
+chown -R agent:agent /home/agent/.config 2>/dev/null || true
+
+exit 0