docs: clarify the _stage1 args / LoadOptions model

[HarryR]

Documentation only -- no code change. Records the argument model the boot-path audit clarified (stage0 already behaves exactly this way).

• _stage1.args / signed args_url set the booted EFI program's UEFI LoadOptions -- the generic contract for any EFI stage1. They come only from the metadata / signed URL; stage0 never forwards its own firmware/shell invocation arguments to stage1.
• For a Linux UKI stage1, the kernel command line is baked into the signed, measured UKI and is authoritative: under Secure Boot the stub ignores LoadOptions, so _stage1.args cannot alter the UKI cmdline (a replace would also escape PCR 14). Production runs Secure Boot on; operator config for a UKI flows through _stage2, not the kernel cmdline. A non-UKI EFI stage1 may read these LoadOptions as its args.

Touches config.rs (module + args field docs), set_load_options in main.rs, and the README _stage1 reference. All args/args_url/set_load_options/fetch_signed_args code is unchanged. Verified: stage0.efi still compiles in-container; the diff adds only comment/doc lines.

Pairs with lockboot/stage1#14 (the stage1 config-on-stdin + args-model docs).

🤖 Generated with Claude Code

[HarryR]

Documentation only -- no code change. Records the argument model the boot-path audit clarified (stage0 already behaves exactly this way).

• _stage1.args / signed args_url set the booted EFI program's UEFI LoadOptions -- the generic contract for any EFI stage1. They come only from the metadata / signed URL; stage0 never forwards its own firmware/shell invocation arguments to stage1.
• For a Linux UKI stage1, the kernel command line is baked into the signed, measured UKI and is authoritative: under Secure Boot the stub ignores LoadOptions, so _stage1.args cannot alter the UKI cmdline (a replace would also escape PCR 14). Production runs Secure Boot on; operator config for a UKI flows through _stage2, not the kernel cmdline. A non-UKI EFI stage1 may read these LoadOptions as its args.

Touches config.rs (module + args field docs), set_load_options in main.rs, and the README _stage1 reference. All args/args_url/set_load_options/fetch_signed_args code is unchanged. Verified: stage0.efi still compiles in-container; the diff adds only comment/doc lines.

Pairs with lockboot/stage1#14 (the stage1 config-on-stdin + args-model docs).

🤖 Generated with Claude Code

[HarryR]

Documentation only -- no code change. Records the argument model the boot-path audit clarified (stage0 already behaves exactly this way).

• _stage1.args / signed args_url set the booted EFI program's UEFI LoadOptions -- the generic contract for any EFI stage1. They come only from the metadata / signed URL; stage0 never forwards its own firmware/shell invocation arguments to stage1.
• For a Linux UKI stage1, the kernel command line is baked into the signed, measured UKI and is authoritative: under Secure Boot the stub ignores LoadOptions, so _stage1.args cannot alter the UKI cmdline (a replace would also escape PCR 14). Production runs Secure Boot on; operator config for a UKI flows through _stage2, not the kernel cmdline. A non-UKI EFI stage1 may read these LoadOptions as its args.

Touches config.rs (module + args field docs), set_load_options in main.rs, and the README _stage1 reference. All args/args_url/set_load_options/fetch_signed_args code is unchanged. Verified: stage0.efi still compiles in-container; the diff adds only comment/doc lines.

Pairs with lockboot/stage1#14 (the stage1 config-on-stdin + args-model docs).

🤖 Generated with Claude Code

[HarryR]

Documentation only -- no code change. Records the argument model the boot-path audit clarified (stage0 already behaves exactly this way).

• _stage1.args / signed args_url set the booted EFI program's UEFI LoadOptions -- the generic contract for any EFI stage1. They come only from the metadata / signed URL; stage0 never forwards its own firmware/shell invocation arguments to stage1.
• For a Linux UKI stage1, the kernel command line is baked into the signed, measured UKI and is authoritative: under Secure Boot the stub ignores LoadOptions, so _stage1.args cannot alter the UKI cmdline (a replace would also escape PCR 14). Production runs Secure Boot on; operator config for a UKI flows through _stage2, not the kernel cmdline. A non-UKI EFI stage1 may read these LoadOptions as its args.

Touches config.rs (module + args field docs), set_load_options in main.rs, and the README _stage1 reference. All args/args_url/set_load_options/fetch_signed_args code is unchanged. Verified: stage0.efi still compiles in-container; the diff adds only comment/doc lines.

Pairs with lockboot/stage1#14 (the stage1 config-on-stdin + args-model docs).

🤖 Generated with Claude Code

[HarryR]

Documentation only -- no code change. Records the argument model the boot-path audit clarified (stage0 already behaves exactly this way).

• _stage1.args / signed args_url set the booted EFI program's UEFI LoadOptions -- the generic contract for any EFI stage1. They come only from the metadata / signed URL; stage0 never forwards its own firmware/shell invocation arguments to stage1.
• For a Linux UKI stage1, the kernel command line is baked into the signed, measured UKI and is authoritative: under Secure Boot the stub ignores LoadOptions, so _stage1.args cannot alter the UKI cmdline (a replace would also escape PCR 14). Production runs Secure Boot on; operator config for a UKI flows through _stage2, not the kernel cmdline. A non-UKI EFI stage1 may read these LoadOptions as its args.

Touches config.rs (module + args field docs), set_load_options in main.rs, and the README _stage1 reference. All args/args_url/set_load_options/fetch_signed_args code is unchanged. Verified: stage0.efi still compiles in-container; the diff adds only comment/doc lines.

Pairs with lockboot/stage1#14 (the stage1 config-on-stdin + args-model docs).

🤖 Generated with Claude Code

[HarryR]

Documentation only -- no code change. Records the argument model the boot-path audit clarified (stage0 already behaves exactly this way).

• _stage1.args / signed args_url set the booted EFI program's UEFI LoadOptions -- the generic contract for any EFI stage1. They come only from the metadata / signed URL; stage0 never forwards its own firmware/shell invocation arguments to stage1.
• For a Linux UKI stage1, the kernel command line is baked into the signed, measured UKI and is authoritative: under Secure Boot the stub ignores LoadOptions, so _stage1.args cannot alter the UKI cmdline (a replace would also escape PCR 14). Production runs Secure Boot on; operator config for a UKI flows through _stage2, not the kernel cmdline. A non-UKI EFI stage1 may read these LoadOptions as its args.

Touches config.rs (module + args field docs), set_load_options in main.rs, and the README _stage1 reference. All args/args_url/set_load_options/fetch_signed_args code is unchanged. Verified: stage0.efi still compiles in-container; the diff adds only comment/doc lines.

Pairs with lockboot/stage1#14 (the stage1 config-on-stdin + args-model docs).

🤖 Generated with Claude Code

[HarryR]

Documentation only -- no code change. Records the argument model the boot-path audit clarified (stage0 already behaves exactly this way).

• _stage1.args / signed args_url set the booted EFI program's UEFI LoadOptions -- the generic contract for any EFI stage1. They come only from the metadata / signed URL; stage0 never forwards its own firmware/shell invocation arguments to stage1.
• For a Linux UKI stage1, the kernel command line is baked into the signed, measured UKI and is authoritative: under Secure Boot the stub ignores LoadOptions, so _stage1.args cannot alter the UKI cmdline (a replace would also escape PCR 14). Production runs Secure Boot on; operator config for a UKI flows through _stage2, not the kernel cmdline. A non-UKI EFI stage1 may read these LoadOptions as its args.

Touches config.rs (module + args field docs), set_load_options in main.rs, and the README _stage1 reference. All args/args_url/set_load_options/fetch_signed_args code is unchanged. Verified: stage0.efi still compiles in-container; the diff adds only comment/doc lines.

Pairs with lockboot/stage1#14 (the stage1 config-on-stdin + args-model docs).

🤖 Generated with Claude Code

[HarryR]

Documentation only -- no code change. Records the argument model the boot-path audit clarified (stage0 already behaves exactly this way).

• _stage1.args / signed args_url set the booted EFI program's UEFI LoadOptions -- the generic contract for any EFI stage1. They come only from the metadata / signed URL; stage0 never forwards its own firmware/shell invocation arguments to stage1.
• For a Linux UKI stage1, the kernel command line is baked into the signed, measured UKI and is authoritative: under Secure Boot the stub ignores LoadOptions, so _stage1.args cannot alter the UKI cmdline (a replace would also escape PCR 14). Production runs Secure Boot on; operator config for a UKI flows through _stage2, not the kernel cmdline. A non-UKI EFI stage1 may read these LoadOptions as its args.

Touches config.rs (module + args field docs), set_load_options in main.rs, and the README _stage1 reference. All args/args_url/set_load_options/fetch_signed_args code is unchanged. Verified: stage0.efi still compiles in-container; the diff adds only comment/doc lines.

Pairs with lockboot/stage1#14 (the stage1 config-on-stdin + args-model docs).

🤖 Generated with Claude Code