mios-dev
diff --git a/‎.github/workflows/mios-ci.yml‎
Lines changed: 34 additions & 4 deletions b/‎.github/workflows/mios-ci.yml‎
Lines changed: 34 additions & 4 deletions
diff --git a/‎.gitignore‎
Lines changed: 2 additions & 7 deletions b/‎.gitignore‎
Lines changed: 2 additions & 7 deletions
diff --git a/‎ARCHITECTURE.md‎
Lines changed: 59 additions & 57 deletions b/‎ARCHITECTURE.md‎
Lines changed: 59 additions & 57 deletions
@@ -26,6 +26,10 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Read VERSION
+        id: ver
+        run: echo "version=$(cat VERSION)" >> "$GITHUB_OUTPUT"
+
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
 
@@ -47,7 +51,7 @@ jobs:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
             type=raw,value=latest,enable={{is_default_branch}}
-            type=raw,value=v0.2.0,enable={{is_default_branch}}
+            type=raw,value=${{ steps.ver.outputs.version }},enable={{is_default_branch}}
             type=ref,event=branch
             type=ref,event=pr
             type=semver,pattern={{version}}
@@ -64,12 +68,38 @@ jobs:
           provenance: true
           sbom: true
 
+      # Rechunking produces 5-10x smaller Day-2 deltas (Justfile:rechunk).
+      # Only worth the cost on tag pushes; branch builds skip it.
+      - name: Install podman
+        if: startsWith(github.ref, 'refs/tags/v')
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y podman
+
+      - name: Rechunk on tag
+        if: startsWith(github.ref, 'refs/tags/v')
+        env:
+          IMAGE_TAG: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.ver.outputs.version }}
+        run: |
+          podman pull "${IMAGE_TAG}"
+          podman run --rm \
+            --security-opt label=type:unconfined_t \
+            -v /var/lib/containers/storage:/var/lib/containers/storage \
+            "${IMAGE_TAG}" \
+            /usr/libexec/bootc-base-imagectl rechunk --max-layers 67 \
+              "containers-storage:${IMAGE_TAG}" \
+              "containers-storage:${IMAGE_TAG}-rechunked"
+          podman tag "${IMAGE_TAG}-rechunked" "${IMAGE_TAG}"
+          podman tag "${IMAGE_TAG}" "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest"
+          podman push "${IMAGE_TAG}"
+          podman push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest"
+
       - name: Install cosign
-        if: github.event_name != 'pull_request'
+        if: startsWith(github.ref, 'refs/tags/v')
         uses: sigstore/cosign-installer@v3
 
       - name: Cosign keyless sign
-        if: github.event_name != 'pull_request'
+        if: startsWith(github.ref, 'refs/tags/v')
         env:
           COSIGN_EXPERIMENTAL: '1'
         run: |
@@ -90,6 +120,6 @@ jobs:
           sudo apt-get update -qq
           sudo apt-get install -y podman
 
-      - name: Build for smoke test
+      - name: Smoke build (lint via Containerfile final RUN)
         run: |
           podman build -t mios:smoke -f Containerfile .
@@ -5,8 +5,8 @@
 #               then the parent's contents must be re-ignored before the child is unignored.
 #
 # IMPORTANT: /.gitignore must be a real file (not a symlink) because git opens it
-#            with O_NOFOLLOW. After editing this file run:
-#            sudo cp /workspaces/MiOS/.gitignore /.gitignore
+#            with O_NOFOLLOW. After editing this file at the repo root, run:
+#            sudo cp ./.gitignore /.gitignore
 
 # ─────────────────────────────────────────────────────────────────────────────
 # 1. BLOCK EVERYTHING
@@ -36,15 +36,10 @@
 !/LICENSES.md
 !/README.md
 !/SECURITY.md
-!/AUDIT-FINDINGS-*.md
-!/WORKFLOW-AUDIT-*.md
 !/SELF-BUILD.md
-!/SUMMARY.md
 !/VERSION
 !/llms-full.txt
 !/llms.txt
-!/root-manifest.json
-!/MiOS-SBOM.csv
 !/MiOS-Engineering-Reference.md
 !/image-versions.yml
 !/install.sh
 
@@ -1,57 +1,59 @@
-# MiOS ARCHITECTURE — System Blueprint (Day 0)
-
-```json:knowledge
-{
-  "summary": "Consolidated architectural specification for MiOS. Hardware, Filesystem, and AI Interface SSOT.",
-  "logic_type": "blueprint",
-  "tags": ["MiOS", "Architecture", "Day-0", "SSOT"],
-  "version": "v0.2.0"
-}
-```
-
-## 🏗️ Core Pillars
-MiOS is a container-native workstation engineered for high-performance virtualization and local Generative AI development.
-
-1. **Transactional Integrity**: The system core is cryptographically sealed and managed via `bootc`.
-2. **Hardware Agnosticism**: Universal acceleration for primary GPU vendors (NVIDIA, AMD, Intel).
-3. **Zero-Trust Boundary**: Mandatory execution control and kernel-level isolation.
-
----
-
-## 💾 Filesystem Hierarchy (FHS 3.0 + bootc)
-MiOS mirrors the standard Linux FHS within its OCI root.
-
-| Path | Type | Intent |
-| :--- | :--- | :--- |
-| `/usr` | Immutable | System Binaries, Libraries, and Static Config. |
-| `/etc` | Persistent | Host-specific overrides. |
-| `/var` | Persistent | System state and User home directories. |
-| `/srv` | Persistent | Sidecar service data (Models, Databases). |
-
-### ⚖️ Immutability Mandate
-Build-time overlays into `/var` are architectural violations. All `/var` state must be declared via `tmpfiles.d` to ensure atomic, reproducible deployments.
-
----
-
-## 🖥️ Hardware Delegation
-
-### 🎮 Universal Acceleration
-Standardized CDI (Container Device Interface) and ROCm/Arc drivers ensure local AI tools access native hardware performance.
-- **Hardware Targeting**: Primary GPU IDs `10de:2204,10de:1aef`.
-
-### ⚡ Virtualization
-Tier-1 Hypervisor capabilities (KVM/QEMU) are native to the system core, supporting VFIO-PCI passthrough and shared memory (KVMFR) buffers.
-
----
-
-## 🤖 AI Interface Surface
-The system architecture exposes a local OpenAI-compatible API surface for autonomous management and user interaction.
-
-| Service | Protocol | Access Point |
-| :--- | :--- | :--- |
-| **Inference** | REST | `http://localhost:8080/v1` |
-| **Discovery** | MCP | `/usr/share/mios/ai/mcp/` |
-| **Metadata** | JSON | `/usr/share/mios/ai/v1/` |
-
----
-*Copyright (c) 2026 MiOS. Pure FOSS. Zero Day Ready.*
+# MiOS Architecture
+
+## Pillars
+
+1. **Transactional integrity** — system core is a content-addressed OCI image
+   managed by `bootc` (<https://bootc-dev.github.io/bootc/>). Atomic upgrade
+   and rollback via `bootc upgrade` / `bootc rollback`.
+2. **Hardware acceleration** — universal CDI (Container Device Interface,
+   <https://github.com/cncf-tags/container-device-interface>) for NVIDIA,
+   AMD ROCm/KFD, and Intel iGPU. CDI specs generated under `/var/run/cdi/`,
+   admin overrides under `/etc/cdi/` (declared in
+   `usr/lib/tmpfiles.d/mios-gpu.conf`).
+3. **Zero-trust execution** — `fapolicyd` deny-by-default, SELinux enforcing,
+   USBGuard, CrowdSec sovereign-mode IPS, kernel-lockdown integrity. See
+   `SECURITY.md`.
+
+## Filesystem layout (FHS 3.0 + bootc)
+
+Spec: <https://refspecs.linuxfoundation.org/FHS_3.0/>.
+
+| Path | Type | Source-of-truth in repo |
+|---|---|---|
+| `/usr` | Immutable image content | `usr/` (overlaid by `automation/08-system-files-overlay.sh`) |
+| `/etc` | Persistent admin-override surface; build-time writes are upstream-contract only | `etc/` |
+| `/var` | Persistent state; declared via `tmpfiles.d` | `usr/lib/tmpfiles.d/mios*.conf` |
+| `/srv` | Sidecar service data (models, databases) | `srv/`, `usr/lib/tmpfiles.d/mios.conf` |
+
+Build-time writes to `/var/` are forbidden (LAW 2). The overlay step at
+`automation/08-system-files-overlay.sh:49-67` writes home dotfiles to
+`/etc/skel/` and lets `systemd-sysusers` populate `/var/home/<user>/` at
+first boot.
+
+## Hardware delegation
+
+Default GPU passthrough targets (`ARCHITECTURE.md` previously hard-coded
+`10de:2204,10de:1aef`; current behavior detects at runtime via
+`automation/34-gpu-detect.sh` and writes `/run/mios/gpu-passthrough.status`).
+
+Virtualization: KVM/QEMU + libvirt (`automation/12-virt.sh`), VFIO-PCI
+passthrough kargs (`usr/lib/bootc/kargs.d/`), KVMFR shared-memory built
+in-image (`automation/52-bake-kvmfr.sh`), Looking Glass B7 client built
+in-image (`automation/53-bake-lookingglass-client.sh`).
+
+## AI surface
+
+| Service | Protocol | Path |
+|---|---|---|
+| Inference | OpenAI-compatible REST | `http://localhost:8080/v1` (LocalAI Quadlet `etc/containers/systemd/mios-ai.container`) |
+| Discovery | MCP | `usr/share/mios/ai/v1/mcp.json` |
+| Metadata | JSON | `usr/share/mios/ai/v1/models.json` |
+| System prompt | markdown | `usr/share/mios/ai/system.md` (canonical), `etc/mios/ai/system-prompt.md` (host override) |
+
+References:
+- bootc: <https://github.com/containers/bootc>
+- bootc-image-builder: <https://github.com/osbuild/bootc-image-builder>
+- Universal Blue (uCore base): <https://github.com/ublue-os/main>
+- rechunk: <https://github.com/hhd-dev/rechunk>
+- cosign: <https://github.com/sigstore/cosign>
+- LocalAI: <https://github.com/mudler/LocalAI>