mouse/cheesed

PLAN.md

Mode 100644 → 100644; object e73c47c854ce → e0f97e6f31e1

@@ -271,7 +271,43 @@
 prove that a ports-provided service can be enabled only through
 `/etc/rc.conf`.
 
-## Acceptance gates
+### C4: persistent system
+
+Boot the same MOUSE base from a persistent ext4 root and prove that `/etc`,
+`/var`, `/home`, machine identity, and `/etc/rc.conf` policy survive poweroff
+and reboot. The kernel or a separate early-userspace layer mounts the real root;
+`cheesed` remains the boot coordinator and does not gain storage discovery,
+filesystem probing, or mount-policy logic. Shutdown must stop services, flush
+state, and leave the root cleanly mountable.
+
+### C5: networking
+
+Add a base-owned OpenRC service for the minimal QEMU VirtIO IPv4 path: interface
+setup, DHCP, default routing, and resolver configuration. Network configuration
+persists under `/etc`, while `/etc/rc.conf` remains the only persistent service
+enablement interface. Prove boot-time connectivity, runtime service control,
+configuration persistence, and clean shutdown ordering.
+
+### C6: multi-user system
+
+Ship the local account, group, password, and home-directory tools needed for an
+authenticated multi-user console. Remove development root autologin from the
+normal persistent image, prove ordinary-user authentication and isolation, and
+select an explicit minimal privilege mechanism for authorised administration.
+Recovery access remains a separate, documented failure path owned by
+`cheesed`.
+
+### C7: ports and source identity
+
+Add a transactional source-built ports system after persistent installed state
+exists. Generate an immutable base ownership manifest; record each port's
+sources, checksums, dependencies, and installed files; reject ownership
+collisions; and remove only files owned by the selected port. Record the MOUSE
+release and exact ports-tree revision in the running image. Ports may install
+OpenRC definitions, but only the administrator may enable them through
+`/etc/rc.conf`.
+
+## C0-C3 acceptance gates
 
 - The release build produces statically linked musl binaries for `cheesed` and
   every shipped OpenRC executable.
@@ -295,7 +331,7 @@
   QEMU integration tests cover boot, optional enablement, supervision, runtime
   service control, and shutdown.
 
-## Explicitly out of scope for the first release
+## PID 1 scope boundaries
 
 - Shipping `rc-update` or treating persistent runlevel symlinks as policy.
 - A custom `cheesed` dependency resolver, service supervisor, control socket, or
@@ -305,5 +341,6 @@
 - Socket, timer, path, device, user-session, or container activation.
 - Cgroup accounting and resource limits beyond capabilities provided directly
   by the selected OpenRC release.
-- Mounting root filesystems, discovering storage, or replacing the initramfs.
+- Mounting root filesystems or discovering storage inside `cheesed`; C4 uses the
+  kernel or a separate early-userspace layer for that work.
 - Shell-evaluated `enable_` values or a second persistent enablement database.