TacidOS
DevelopersGitHub

Decision 0013

Signed channels, quiet-point updates, health-gated automatic rollback

Architecture decision record 0013: Signed channels, quiet-point updates, health-gated automatic rollback

Status
Accepted
Date
2026-09-03

Context

“It will just download updates to itself constantly” must not mean “it breaks itself constantly”. The update path is the most attacked path in an agent-operated system.

The three plans

  • Grok: signed images and model packs; generations with rollback as a first-class key.
  • Fable: tacid update pulls a new lock and rebuilds with the same diff/approval/rollback flow; a binary cache so users do not compile Hyprland.
  • Codex: stable/edge/dev channels; a promotion pipeline; signed metadata; keep the previous known-good generation; a recovery UI.

Decision

Channels dev, edge, stable. A channel advances only when CI has built every reference configuration for both architectures and the cache is fully populated. Manifests are signed with TUF roles (offline root in the maintainer’s custody; online snapshot and timestamp keys with short expiry; revocation by manifest) because one leaked key must not own every edge machine within the hour (review). Store paths carry separate cache signatures. Cache: Attic behind a CDN.

tacid-update.timer polls hourly on edge and daily on stable, builds when new, and switches only at quiet points (idle, on AC, no active session, or a scheduled window) by activation class; boot-class changes wait for a reboot and use boot counting. The immune system, owned by the keeper and the bootloader: pre-switch checks, a post-switch health gate (targets reached, daemons up, declared services healthy, network if declared, inference answers a stub prompt, agent tool-use smoke test), automatic re-activation of the previous generation on failure with state snapshots restored, journaling and notification. Retention: last ten, thirty days, pinned; weekly garbage collection at a quiet point. Kernel: edge newest stable series; stable newest series validated by the hardware matrix; LTS available.

Consequences

  • The immune system ships in Phase 1 because the level-2 default is unsafe without it (review).
  • Updates are boring; the boot menu is the recovery UI with plain-language labels.
  • Infrastructure cost is real and is covered by sponsors (ADR-0026).

Alternatives rejected

  • Following nixos-unstable directly: users become the CI.
  • A single signing key: one leak, every machine.
  • Switching whenever an update lands: kills sessions and compositors under the owner.