From 6c8c0abe4314f12f947eb6056d26d368628ebbf2 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Sun, 8 Nov 2026 09:06:35 -0800 Subject: [PATCH] quest: clear the notary agreement wait, fold nixos2's boot order into windows-host Co-Authored-By: Claude Opus 5.5 --- quest/m0/signing.md | 27 ++++++++------------------- quest/m0/windows-host.md | 12 +++++++++++- 2 files changed, 19 insertions(+), 20 deletions(-) diff --git a/quest/m0/signing.md b/quest/m0/signing.md index 14711968..9b9551bd 100644 --- a/quest/m0/signing.md +++ b/quest/m0/signing.md @@ -21,22 +21,11 @@ Decided 2026-11-06 (maintainer, /quest-unblock): password), and `apple-api` (an App Store Connect API key, key ID `7WP7HJXJ4C`; its notes hold the issuer ID). - Renewed 2026-11-08, until 2027-11-08 (maintainer, /quest-unblock), after the - Account Holder signed the Apple Developer Program License Agreement. The API - key authenticates, but minutes after the renewal the notary API still answers - `FORBIDDEN.REQUIRED_AGREEMENTS_MISSING_OR_EXPIRED` (see `/business`). -- Once the notary API accepts the key, an agent with the maintainer's `op` - session creates the Developer ID profile through the App Store Connect API - with that key, and stores everything with `gh secret set` (no secret passes - through chat or a file outside `.tmp/`). Confirm the `.p12` holds the - Developer ID key, not a distribution one, before storing it. Then delete - this quest. - -## Waiting - -- Maintainer: accept any pending agreement at App Store Connect > Business - (appstoreconnect.apple.com/business), which the notary API names after the - Program License Agreement was signed; only the Account Holder can accept. - If none is pending, Apple may still be propagating the signature. Check: - `xcrun notarytool history` with the `apple-api` key succeeds (or a GET of - `https://appstoreconnect.apple.com/notary/v2/submissions` with a JWT from - that key returns 200). + Account Holder signed the Apple Developer Program License Agreement and + accepted the agreements pending at App Store Connect > Business. On + 2026-11-08 `xcrun notarytool history` with the `apple-api` key succeeds. +- An agent with the maintainer's `op` session creates the Developer ID profile + through the App Store Connect API with that key, and stores everything with + `gh secret set` (no secret passes through chat or a file outside `.tmp/`). + Confirm the `.p12` holds the Developer ID key, not a distribution one, before + storing it. Then delete this quest. diff --git a/quest/m0/windows-host.md b/quest/m0/windows-host.md index 0c3f08dc..3fefbe35 100644 --- a/quest/m0/windows-host.md +++ b/quest/m0/windows-host.md @@ -21,7 +21,12 @@ nixos2 already dual-boots: Windows sits on its own partition (`nvme0n1p3`, Manager); NixOS boots through systemd-boot on `nvme0n1p4`. The switch: 1. From NixOS, an agent moves `Boot0003` to the front of the firmware boot - order (`efibootmgr -o`, with passwordless sudo) and reboots. NixOS stays + order and reboots: `sudo efibootmgr -o + 0003,0006,0000,0004,0005,0007,0001,0002,0008,0009,000A,000B,000C`, from + `nix shell nixpkgs#efibootmgr` since nixos2 lacks it (passwordless sudo). + The order before the switch, and its revert, is + `0006,0000,0003,0004,0005,0007,0001,0002,0008,0009,000A,000B,000C` + (`0006` is systemd-boot). NixOS stays installed; boot it once with `bcdedit /set {fwbootmgr} bootsequence {}` from Windows when a Linux run needs it. 2. The maintainer turns on OpenSSH Server (see Waiting). @@ -32,6 +37,11 @@ Manager); NixOS boots through systemd-boot on `nvme0n1p4`. The switch: ## Waiting +- Maintainer: say nixos2 is free to reboot, once the Mesa trial is done. On + 2026-11-08 it ran an interactive `codex` session (open since 2026-11-06), a + `codex app-server`, and a rind `astro dev` server, and an agent cannot tell + whether such work is finished. Check: the maintainer says so, or `w` and + `ps` on nixos2 show no other session's work. - Maintainer: at nixos2's console once it boots Windows, turn on OpenSSH Server (Settings > System > Optional features), add the Mac's public key to `C:\ProgramData\ssh\administrators_authorized_keys`, and plug in a USB