Mark Plan 0009 Phases 4 and 5 done

[bketelsen]

Summary

Updates the living Plan 0009 with what landed between 2026-10-02 and 2026-10-04.

• Phase 4 is done for every producer whose packages Snosi installs. The first release of each went through apt-publisher and was checked from outside:

  Producer	Release	Codenames	Attested
  updex	v2.0.2	trixie, forky	yes
  incus	7.5.1	trixie	no
  intuneme	v0.20.3	trixie, forky	yes
  firn	v0.6.1	trixie, forky	yes
  first-setup	v0.4.1	trixie	yes
  bootc-debian	bootc 1.16.8 / ostree 2026.3 ~deb13	trixie	no
  chairlift	v0.11.2	trixie	yes

  The checks covered routing, signature, index contents, apt canary, the attestation where registered, and legacy stable staying unchanged.

  • bootc-debian was made public so the writer can read its releases.
  • pilothouse, snowcat-cockpit and gchlog are not ported, by Brian's decision on 2026-10-04. Their Repogen .deb steps fail without credentials.
  • The org's R2 and Repogen signing secrets were limited to Snosi on 2026-10-03. That completes the credential-removal step for every producer, and closed the old-pin path that let incus and firn write signed stable.

• Phase 5 is done. Snosi reads /debian/ trixie (Read Frostyard packages from /debian/ trixie instead of frozen stable snosi#1042).

  • The post-merge builds passed.
  • Sysext publication leaves both Debian trees untouched.
  • The drift alarm passes on its re-baselined record (Re-baseline the stable drift alarm on the explained 2026-10-01 suite #153).

• Phase 6 notes:

  • Debian's half-published trixie-backports kernel (linux-signed-amd64 7.2.6 waiting in backports-new), and Take the secure profiles' kernel from forky until backports recovers snosi#1043, which takes the secure profiles' kernel from forky 7.2.8 meanwhile;
  • what each producer needs for forky.

• Later / ideas: refuse non-canonical asset names, accepting GitHub's ~→. rename; check the attestation's signer workflow.

Risk tier

Risk tier: 1 — docs only: a living plan.

Verification

• npm run verify green: 77 docs, 702 links, 68 of 68 tests.

🤖 Generated with Claude Code

[bsherman]

LGTM. The linked publication runs, Snosi builds, drift-alarm result and green CI support marking Phases 4 and 5 complete for the stated scope.

One small documentation nit: the opening paragraph still says producers, caching and Snosi remain to be done. Please update it to reflect that the remaining work is forky validation and steady state.

The kernel note also checks out. The affected images are still trixie-based and explicitly selected trixie-backports; the failure was missing matching kernel dependencies in that archive. Snosi #1043 temporarily selects forky’s native kernel. The full forky migration in #924 already removes the backports kernel selection and uses the native kernel.

[bsherman]

LGTM