[Alexendros]

Objetivo

F1: construir la ISO de Forge con mkarchiso siempre dentro de Docker (nunca en el host, nunca con pkexec/sudo) y probar que arranca en QEMU con OVMF (UEFI).

Cambios

• docker/archiso.Dockerfile: archlinux fijado por digest (sha256:52dfbd5afb23a220d5ee92dafcb4c788d96c026ed04179890c23adef4c897fa0) con archiso.
• scripts/build-iso.sh: variante mínima (--cap-add SYS_ADMIN, apparmor/seccomp unconfined), overlay :ro, volumen anónimo para /work, salida explícita (por defecto target/iso), allowlist de rutas, append de paquetes al perfil base y SHA256SUMS.
• scripts/boot-test.sh: arranque QEMU+OVMF por serial con timeout; falla si no se observa login.
• .github/workflows/iso.yml: job de humo (baseline + --serial-console, qemu-system-x86/ovmf).
• ADR-0021 (construcción en Docker) con evidencia medida; ADR-0004 marcado superseded; actualizados dependsOn en ADR-0019, análisis de riesgos del runner e iso-scope.md.
• Fixture de overlay de humo y test de deriva contra el render real.

Evidencia medida (2026-10-25)

• Construcción: 93 s; ISO 483.733.504 bytes; dos imágenes El Torito (BIOS isolinux.bin y UEFI de 64 MiB).
• Arranque UEFI: QEMU+OVMF alcanza archlinux login: en 50 s.
• La variante mínima funciona sin --privileged ni dispositivos de loop explícitos.
• Requisito: bootmodes debe listar bios.syslinux antes de uefi.systemd-boot; con UEFI primero, mkarchiso pierde la entrada El Torito UEFI.

Verificación

cargo fmt --all; cargo clippy --workspace --all-targets -- -D warnings; cargo test --workspace (todo verde); archify 24/24; front matter 145 documentos OK.

Trazabilidad

FR-EXPORT-001, NFR-SEC-001, NFR-DET-001; ADR-0021; ADR-0004 superseded.

Tareas para Alejandro

Ninguna en este PR.

---

Note

Medium Risk
ISO builds run in Docker with SYS_ADMIN and relaxed AppArmor/seccomp; ADR-0004 is superseded, shifting the documented privilege model for image construction.

Overview
Forge ISO builds move off the host and into a pinned Docker image: scripts/build-iso.sh applies an allowlisted overlay to an archiso base profile and runs mkarchiso in a container (minimal caps, read-only overlay, SHA256SUMS), with optional --serial-console for CI. scripts/boot-test.sh boots the artifact under QEMU+OVMF and fails on timeout.

A new iso GitHub Actions workflow runs a smoke path (baseline overlay fixture → build → UEFI boot). profiledef.sh generation now lists bios.syslinux before uefi.systemd-boot so El Torito UEFI entries are not dropped; a pinned smoke overlay fixture and archiso_smoke_overlay_fixture_matches_render guard drift.

ADR-0021 records Docker-only construction and supersedes ADR-0004 (privileged runner); related ADRs and traceability inventory are updated accordingly.

^{Reviewed by Cursor Bugbot for commit f65ed35. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: 7a777d5b-0525-4b46-b456-52e935877fd2)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: cd86d906-6c7e-4248-b791-fc1ce69472b1)