LUKS2 + TPM2 with PIN, Btrfs, impermanence, systemd-boot, Lanzaboote opt-in

Context

A machine that is a function of its declaration should have no hidden state, and a machine that updates its kernel hourly must not lock its owner out.

The three plans

• Grok: read-mostly /usr, writable overlay, TPM-sealed secrets.
• Fable: disko, Btrfs subvolumes, systemd-boot, UEFI only, sops-nix.
• Codex (Q2 decided): LUKS2 + Btrfs + subvolumes + snapshots, recovery UI, Secure Boot as a planned first-class feature.

Decision

GPT and UEFI only; systemd-boot with boot counting; systemd stage-1. LUKS2 on by default with TPM2 + PIN bound to PCR 7 (Secure Boot state), not to kernel PCRs, so updates never lock the owner out; a recovery key shown once (review: TPM2 without a PIN is evil-maid by default). Btrfs subvolumes @root (ephemeral), @persist, @home, @nix, @snapshots. Impermanence by default: only declared state survives; every tacid.services.* option declares its persistent directories; the agent detects writes to ephemeral paths and offers to declare them. Lanzaboote is integrated from the first ISO and enrolled after install with tacid secureboot enroll (Microsoft certificates included so NVIDIA option ROMs keep working); it is opt-in until the certified matrix passes, because upstream still has sharp edges; the documentation states that NixOS does not enforce kernel-module signing. zram swap; a swap file only for hibernation.

Consequences

• The machine is literally (genome, persist): the precondition for “the agent knows itself”.
• Impermanence will surprise people once; the agent is the safety net.
• Secure Boot is honest, not decorative.

Alternatives rejected

• Mutable root: hidden state accumulates and the agent cannot know the machine.
• TPM2 without PIN, or PCR 0/4/11 binding: either evil-maid-by-default or lockout-by-update.
• ext4/LVM: no cheap snapshots for the three-way rollback claim.