KioskConfig/report.md

# KioskConfig Review Report

Verification of `kioskconfig` (target: `radiantwavekiosk-dev`) against the app source in `radiantwave-rebuild/` (flake input `radiantwave-dev` → `radiantwave-cpp.git?ref=dev`).

Severity legend: **Critical** = blocks boot/launch · **High** = wrong behavior in production · **Medium** = wrong behavior in a variant · **Low** = hygiene.

---

## Critical

### 1. Kiosk user is missing the `seat` group — cage/app can't get a seat

**Location:** `configuration.nix:111`

```nix
extraGroups = ["audio" "video" "input" "networkmanager" "wheel"];   # missing "seat"
```

**Why it breaks:** NixOS `services.seatd` owns `/run/seatd.sock` as `root:seat` (`nixos/modules/services/desktops/seatd.nix`, default `group = "seat"`). wlroots uses libseat, which connects to the seatd socket. Without `seat` group membership `libseat_open_seat` fails, and there is no logind fallback: getty autologin creates a `tty` (not `graphical`) session, which the logind backend rejects. The NixOS seatd test (`nixos/tests/seatd.nix`) explicitly adds the user to `seat`.

**Result:** `exec cage -- radiantwave` exits immediately — the app never appears on screen.

- [X] **Fix:** add `"seat"` to `extraGroups`.

**Also affected:** `radiantwave-rebuild/nixos/vm.nix:85` has the same omission.

---

## High

### 2. Healthcheck can never match → 10-minute rollback loop

**Location:** `configuration.nix:247`

```nix
if ${pkgs.procps}/bin/pgrep -x radiantwave > /dev/null; then
```

**Why it breaks:** The installed `radiantwave` is a `makeWrapper` script — `nix/package.nix:132-134` renames the real binary to `.radiantwave-unwrapped`, and the wrapper ends with `exec .radiantwave-unwrapped`. The kernel sets `comm` from the exec'd file, truncated to 15 chars: `.radiantwave-unw`. `pgrep -x radiantwave` (exact match) never matches.

**Result:** Every autoUpgrade (`dates = "*:00/10"` → every 10 min) is followed ~90s later by `nixos-rebuild switch --rollback`, so the system oscillates forward/backward forever and upgrades never stick.

- [x] **Fix:** match on the actual process, e.g. `pgrep -f '/radiantwave'` or `pgrep -x .radiantwave-unw`, or use a different liveness check.

**Related design flaw:** after `switch`, the running app is still the *old* binary (the login session persists; `loginShellInit` doesn't re-run), so even a correct healthcheck can't validate the new build — only a reboot can.

### 3. `radiantwavekiosk-commercial-dev` deploys production code

**Location:** `flake.nix:142-148`

```nix
radiantwavekiosk-commercial-dev = mkKioskSystem {
  radiantwave = radiantwave;      # should be radiantwave-dev
  ...
  upgradeFlakeRef = "...KioskConfig.git?ref=dev#radiantwavekiosk-commercial";  # should be ...-dev
```

**Result:** a "dev" commercial kiosk runs the production binary and auto-upgrades to the production config. Same bug class as finding #5's root cause: hand-wired per-variant wiring.

- [X] **Fix:** `radiantwave = radiantwave-dev;` and `#radiantwavekiosk-commercial-dev`.

### 4. Backup + tmpfiles use the wrong data directory

**Locations:**
- `configuration.nix:210` — tmpfiles: `d /home/kiosk/.local/share/radiantwave 0770 kiosk kiosk -`
- `configuration.nix:223-224` — backup: `BACKUP_DIR`/`SOURCE_DIR` under `.local/share/radiantwave`
- `configuration.nix:74-76` — `cleanRadiantFiles`: `rm -rf /home/kiosk/.local/share/radiantwave/audio`

**Why it's wrong:** the app uses `~/.local/radiantwave/` (verified: `config_manager.cpp:36`, `database_manager.cpp:36`, `logger.cpp:70`, `audio_downloader.cpp:22`, `scroller_page.cpp:766`). `~/.local/share/radiantwave` is the wrong path.

**Result:**
- Backup rsyncs an empty/nonexistent dir every upgrade → pre-upgrade backup is useless.
- `cleanRadiantFiles` is a silent no-op (audio never actually cleaned).
- The app creates its own dirs via `create_directories`, so the wrong-path tmpfiles rule is harmless functionally — but wrong.

- [X] **Fix:** replace `share/radiantwave` with `radiantwave` in all three places.

**Caution:** clarify `cleanRadiantFiles` intent — if the path were "fixed" naively it would wipe downloaded audio on every activation.

---

## Medium

### 5. Android ISO installs the wrong config

**Locations:** `flake.nix:215-236`, `iso-config.nix:8-12`

`android-iso` reuses `./iso-config.nix`, which hardcodes:

```nix
targetSystem = self.nixosConfigurations.radiantwavekiosk.config.system.build.toplevel;
```

`nixos-install --system` installs the plain (non-rotated) `radiantwavekiosk` closure even though the ISO ships `radiantwavekiosk-android` via `isoImage.storeContents`. The rotated variant never gets installed.

- [ ] **Fix:** parameterize the ISO config (a TODO already exists in `commercial-iso-config.nix`) or add an android-specific ISO config.

---

## Low

### 6. `-d -s` launch flags are dead

**Locations:** `rotated_display.nix:7`, `configuration.nix:145`

Both invoke `radiantwave -d -s`, but `main.cpp:17` (`SDL_AppInit(void **appstate, int argc, char *argv[])`) never parses `argc/argv` — there is no getopt/argv handling anywhere in the source. The flags are silently ignored.

- [ ] **Fix:** implement the flags in the app's CLI parsing, or drop them from the launch commands.

### 7. Secrets committed

**Locations:** `configuration.nix:64`, `configuration.nix:113`

- Gitea `nix.settings.access-tokens` token in plaintext.
- Plaintext kiosk password (`Fuckp@ssw0rds`); the user is in `wheel` and has SSH key + NetworkManager access, so the password effectively grants root.

- [ ] **Fix:** rotate both; the repo already has `.sops.yaml` / age encryption for secrets.

### 8. CI trigger mismatch (AGENTS.md stale)

**Location:** `.gitea/workflows/build-dev.yml:1-6`

The workflow triggers on `push` to `dev` + `workflow_dispatch`, but AGENTS.md documents a `repository_dispatch` (`radiantwave-dev-built`) trigger that isn't in the workflow. If the app repo dispatches that event, CI won't fire. Also note the workflow lives in `.gitea/workflows/` (AGENTS.md says `.forgejo/workflows/`).

- [X] **Fix:** Ignore this; Gitea does not yet support repository_dispatch

### 9. Dead `enableAutoUpgrade` parameter

**Location:** `flake.nix:56`

`mkKioskSystem` accepts `enableAutoUpgrade ? true` but never uses it; all variants auto-upgrade unconditionally. If the intent was to disable auto-upgrade on dev systems, it doesn't work.

- [X] **Fix:** use `enableAutoUpgrade` to gate `system.autoUpgrade.enable`, or remove the dead parameter.

### 10. Dead files

- `hardware/x86_64-nvme-uefi.nix` — not referenced by `flake.nix`.
- `vm-disk-config.nix` — not referenced by `flake.nix`.

- [ ] **Fix:** delete `hardware/x86_64-nvme-uefi.nix` and `vm-disk-config.nix`, or wire them into `flake.nix`.

---

## Verified not-bugs

- **Unprivileged `ping` works.** NixOS sets `net.ipv4.ping_group_range = mkDefault "0 2147483647"` (`nixos/modules/tasks/network-interfaces.nix:1786-1787`), so the 10s `loginShellInit` network wait works as the kiosk user. iputils built without setcap is fine.
- **Plymouth theme is correct in both phases.** The flake's sed rewrites `/usr/` → store path, and the NixOS module's `plymouth-initrd-themes` runCommand rewrites initrd store paths again (`sed -i "s,${builtins.storeDir}/.*/share/plymouth/themes,$out,"`), so `ImageDir`/`ScriptFile` resolve in both initrd and runtime.
- **`sudo -n plymouth quit --wait` works.** The `security.sudo.extraRules` NOPASSWD rule (`configuration.nix:46-56`) matches; NixOS default sudoers `secure_path` includes `/run/current-system/sw/bin`.
- **`wlr-randr` parsing in `rotated_display.nix:5` is correct.** Output header is `DP-1 "…"` — the first field is the output name, so `grep -m1 '^\S' | awk '{print $1}'` yields the right name.
- **`radiantwave-dev` exposes the needed outputs.** `nixosModules.default` and `packages.default` exist for `x86_64-linux` and `aarch64-linux` (RPi dev OK).
- **Disk configs match target hardware.** `disk-config.nix` → `/dev/nvme0n1` (NUC), `commercial-disk-config.nix` → `/dev/sda`.
- **Rollback churn won't kill the session.** `seatd` and `plymouth-quit` set `restartIfChanged = false`.

---

## Priority fix order

- [ ] 1. Add `"seat"` to kiosk `extraGroups` (`configuration.nix:111`). **Unblocks the app.**
- [ ] 2. Fix the healthcheck matcher (`configuration.nix:247`) and wrong data dirs (`configuration.nix:74-76, 210, 224`).
- [ ] 3. Wire `radiantwavekiosk-commercial-dev` to `radiantwave-dev` + `-dev` upgrade ref (`flake.nix:142-148`).
- [ ] 4. Parameterize the ISO config so `android-iso` installs `radiantwavekiosk-android`.
- [ ] 5. Rotate committed secrets.

## Open item

Whether the seat-group issue is field-confirmed. If a deployed NUC currently boots into the app, finding #1 isn't biting and the mechanism needs re-checking (e.g. different seatd group config or a graphical session somewhere).