Repository navigation
Implement trusted startup code on SBX (read-only host mount) #640
Description
SBX has no host-config read-only mount, so trusted restart parity with MSB does not exist there. The proposed ADR-0036 (in Quickstart PR #637) recommends a dedicated read-only host mount as the implementation path, gated on live validation.
Scope: after the ADR is accepted, implement the chosen option and add SBX focused tests; until then keep the documented interim state.
Acceptance: guest-resident root startup code on SBX cannot be modified by a sudo guest, verified live.
Blocked on: the SBX portion of the live validation issue (#639) and acceptance of the ADR. Trigger: ADR status moves from proposed to accepted.
Child of #503. AI-assisted tracker entry (OpenCode). Human review required.
Activity
mogul commentedon Oct 28, 2026
Status after the merge of #637: ADR-0037 (
docs/adr/0037-sbx-trusted-startup-parity.md, renumbered from 0036 to avoid a clash) is still proposed. This issue is blocked on the owner's decision to accept an option or record the accepted-risk position, and on the SBX part of the live validation in #639. Nothing else is needed to unblock it.AI-assisted tracker comment (OpenCode). Human review required.