Move home systems to first build slot

.gitea/workflows/build-dev.yml

@@ -1,80 +1,65 @@
 name: Build Dev ISOs
-
 on:
   workflow_dispatch:
   push:
     branches:
       - dev
-
 env:
   NIX_CONFIG: |
     extra-substituters = https://attic.radiantwavetech.com/radiantwave-dev
     extra-trusted-public-keys = radiantwave-dev:B8FhLu3MQ9JfeEIHIKNrKxnP+3akzzkqMbTZR4hRfj0=
-
 jobs:
-  build-dev-android:
-    runs-on: build-server
-    steps:
-      - name: Clone Repository
-        run: git clone --depth 1 --no-single-branch ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
-
-      - name: Checkout dev branch
-        run: git checkout dev
-
-      - name: Prepare output directory
-        run: mkdir -p /home/user/radiantwave
-
-      - name: Build dev android ISO
-        run: |
-          export NIXPKGS_ALLOW_UNFREE=1
-          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-          nix build -L --impure .#nixosConfigurations.android-dev-iso.config.system.build.isoImage
-
-      - name: Rename dev android ISO
-        run: |
-          ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
-          FILENAME="radiantwave-android-dev-${ISO_DATE}.iso"
-          cp -L result/iso/*.iso "/home/user/radiantwave/${FILENAME}"
-          echo "FILENAME=${FILENAME}" >> "$GITHUB_ENV"
-
-      - name: Copy dev android ISO to fileserver
-        run: |
-          scp "/home/user/radiantwave/${FILENAME}" \
-            radiantwave-infra:/mnt/infrastructure_data/files/images/
-
-      - name: Cleanup
-        run: rm -f "/home/user/radiantwave/${FILENAME}"
-
   build-dev-kiosk:
     runs-on: build-server
     steps:
       - name: Clone Repository
         run: git clone --depth 1 --no-single-branch ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
-
       - name: Checkout dev branch
         run: git checkout dev
-
       - name: Prepare output directory
         run: mkdir -p /home/user/radiantwave
-
       - name: Build dev kiosk ISO
         run: |
           export NIXPKGS_ALLOW_UNFREE=1
           . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
           nix build -L --impure .#nixosConfigurations.dev-iso.config.system.build.isoImage
-
       - name: Rename dev kiosk ISO
         run: |
           ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
           FILENAME="radiantwave-kiosk-dev-${ISO_DATE}.iso"
           cp -L result/iso/*.iso "/home/user/radiantwave/${FILENAME}"
           echo "FILENAME=${FILENAME}" >> "$GITHUB_ENV"
-
       - name: Copy dev kiosk ISO to fileserver
         run: |
           scp "/home/user/radiantwave/${FILENAME}" \
             radiantwave-infra:/mnt/infrastructure_data/files/images/
+      - name: Cleanup
+        run: rm -f "/home/user/radiantwave/${FILENAME}"
 
+  build-dev-android:
+    runs-on: build-server
+    steps:
+      - name: Clone Repository
+        run: git clone --depth 1 --no-single-branch ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
+      - name: Checkout dev branch
+        run: git checkout dev
+      - name: Prepare output directory
+        run: mkdir -p /home/user/radiantwave
+      - name: Build dev android ISO
+        run: |
+          export NIXPKGS_ALLOW_UNFREE=1
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+          nix build -L --impure .#nixosConfigurations.android-dev-iso.config.system.build.isoImage
+      - name: Rename dev android ISO
+        run: |
+          ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
+          FILENAME="radiantwave-android-dev-${ISO_DATE}.iso"
+          cp -L result/iso/*.iso "/home/user/radiantwave/${FILENAME}"
+          echo "FILENAME=${FILENAME}" >> "$GITHUB_ENV"
+      - name: Copy dev android ISO to fileserver
+        run: |
+          scp "/home/user/radiantwave/${FILENAME}" \
+            radiantwave-infra:/mnt/infrastructure_data/files/images/
       - name: Cleanup
         run: rm -f "/home/user/radiantwave/${FILENAME}"
 
@@ -83,30 +68,24 @@ jobs:
     steps:
       - name: Clone Repository
         run: git clone --depth 1 --no-single-branch ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
-
       - name: Checkout dev branch
         run: git checkout dev
-
       - name: Prepare output directory
         run: mkdir -p /home/user/radiantwave
-
       - name: Build dev commercial ISO
         run: |
           export NIXPKGS_ALLOW_UNFREE=1
           . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
           nix build -L --impure .#nixosConfigurations.commercial-dev-iso.config.system.build.isoImage
-
       - name: Rename dev commercial ISO
         run: |
           ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
           FILENAME="radiantwave-commercial-dev-${ISO_DATE}.iso"
           cp -L result/iso/*.iso "/home/user/radiantwave/${FILENAME}"
           echo "FILENAME=${FILENAME}" >> "$GITHUB_ENV"
-
       - name: Copy dev commercial ISO to fileserver
         run: |
           scp "/home/user/radiantwave/${FILENAME}" \
             radiantwave-infra:/mnt/infrastructure_data/files/images/
-
       - name: Cleanup
         run: rm -f "/home/user/radiantwave/${FILENAME}"

UPDATES.md

@@ -0,0 +1,19 @@
+Implementation complete and verified. Here's what was done:
+Implemented (both repos on dev)
+Checkpoints (return points if something fails):
+- radiantwave → tag pre-live-update @ d84307b
+- KioskConfig → tag pre-live-update @ b8d0f59
+radiantwave — .gitea/workflows/dev.yml: Added a "Publish manifest" step after the Attic push. It writes {"version","storePath"} using readlink -f ./result-pkg (the exact closure pushed to the dev Attic), then scps it to radiantwave-infra:/mnt/infrastructure_data/files/radiantwave-dev/manifest.json. main.yml untouched.
+KioskConfig:
+- New radiantwave-updater.nix module: tmpfiles seed (L /var/lib/radiantwave/current → <baked-in baseline>), a systemd oneshot service (curl manifest → nix copy --from dev Attic, never builds → atomic mv -T swap), and a 2-min persistent timer.
+- flake.nix: imports the module in both builders and enables it on all 4 -dev variants (radiantwavekiosk-dev, -commercial-dev, -android-dev, -rpi-dev) pointing at the dev manifest/attic.
+- configuration.nix: launches via /var/lib/radiantwave/current/bin/radiantwave when the updater is enabled; prod keeps /run/current-system/sw/bin/radiantwave.
+Verified
+- All dev configs evaluate with enable=true; prod enable=false, no updater service/timer, login path unchanged.
+- Rendered service script correct (escaped shell vars, resoled Nix ínterps); dev login line + tmpfiles seed rule confirmed.
+- All 14 nixosConfigurations evaluate; toplevel dry-run of radiantwavekiosk-dev plans cleanly.
+- dev.yml parses as valid YAML with the new step.
+Before this actually works end-to-end, you need to
+1. Create /mnt/infrastructure_data/files/radiantwave-dev/ on the infra host and confirm it's served as https://files.radiantwavetech.com/radiantwave-dev/manifest.json.
+2. Commit + push these changes (I staged radiantwave-updater.nix so nix can see it; nothing is committed yet) — push dev.yml change to radiantwave dev, and the KioskConfig changes to dev. The dev-iso/etc. workflows will then bake the seed in.
+Note: git add radiantwave-updater.nix was needed for flake evaluation; the KioskConfig changes are staged but uncommitted. Want me to commit them?