Add read-only Keep status display on the physical console

[wksantiago]

Read-only, Keep-branded status screen on the physical console. Off by default.

An installed node boots to a bare kernel log dump and a login prompt where every account is password-locked, so an operator standing at the box learns nothing about why the vault did not unlock or the mesh did not form.

A root collector writes /run/keep-node-status/status.json; an unprivileged keep-status renderer paints tty1 with StandardInput=null, so it holds no descriptor on the keyboard. Physical console access grants nothing today and still grants nothing.

New: nixos/lib/brand.nix, nixos/status-display.nix, tests/status-display.nix. Checks: status-display, statusdisplay-assertions, brand-shapes. Installer MOTD shares the same mark.

Closes#101

Summary by CodeRabbit

• New Features

  • Added an optional, read-only console status display showing node/vault/service health, replication status, and anti-lockout warnings.
  • Configurable via keepNode.statusDisplay (VT/refresh/staleness, node label) with mesh address visibility as a separate opt-in.
  • Installer branding updated with a branded Unicode/ASCII block in the ISO/SSH MOTD.

• Documentation

  • Documented the physical-console threat model and the console status display behavior, security properties, and hardware testing notes.

• Tests

  • Added end-to-end integration coverage for status output, stale/degraded rendering, sanitization, and recovery behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 960b14d1-7e98-4bf8-9ef4-41d4927ac0ef

📥 Commits

Reviewing files that changed from the base of the PR and between dbc67e3 and 6a7a839.

📒 Files selected for processing (2)

• docs/hardware.md
• nixos/status-display.nix

🚧 Files skipped from review as they are similar to previous changes (2)

• docs/hardware.md
• nixos/status-display.nix

---

Walkthrough

Adds an optional branded, read-only console status display. A root collector publishes JSON health snapshots, while a sandboxed unprivileged renderer displays sanitized, stale-aware status data. NixOS assertions, VM coverage, brand validation, appliance wiring, and documentation are included.

Changes

Console status display

Layer / File(s)	Summary
Brand rendering foundation nixos/lib/brand.nix, nixos/installer.nix	Adds Unicode/ASCII brand geometry helpers and uses the generated block in the installer MOTD.
Status collection and rendering nixos/status-display.nix, nixos/keep-node.nix	Adds configurable collector and renderer services, JSON snapshots, health rows, stale handling, anti-lockout banners, VT ownership, and renderer confinement.
Evaluation and VM validation flake.nix, tests/status-display.nix	Adds configuration and brand-shape checks, enables the feature in Tier 4, and tests status semantics, security restrictions, sanitization, degradation, and replication behavior.
Operational and security documentation README.md, docs/SECURITY.md, docs/hardware.md	Documents configuration, exposed status, physical-console security properties, troubleshooting, and hardware bring-up behavior.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
participant systemd_timer
participant keep_node_status_collect
participant status_json
participant keep_node_status_render
participant virtual_console
systemd_timer->>keep_node_status_collect: trigger periodic collection
keep_node_status_collect->>status_json: publish atomic JSON snapshot
keep_node_status_render->>status_json: read and validate snapshot
keep_node_status_render->>virtual_console: render sanitized status frame

Loading

Possibly related PRs

• privkeyio/keep-node#49: Provides the replication-lag signal consumed and rendered by this status display.

Suggested labels:full-ci

Poem

I’m a rabbit by the glowing screen,
Where vault and mesh states can be seen.
No keys to type, no shell to hop,
Just fresh snapshots, never a prop.
If data grows old, the question marks show—
A tidy little console glow.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: a read-only Keep status display on the physical console.
Linked Issues check	✅ Passed	The changes match the linked scope: read-only console status, root collector/unprivileged renderer, stale handling, anti-lockout banner, tests, and branding.
Out of Scope Changes check	✅ Passed	No clear out-of-scope changes are evident; the added branding, docs, checks, and test support all serve the status display feature.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch console-status

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/hardware.md`:
- Around line 111-115: Update the anti-lockout recovery guidance in the
documented sections to reference the configured statusDisplay.tty rather than
assuming tty1, instruct operators to use any other available VT, and qualify
that /dev/console may not be the configured renderer VT.
- Around line 123-125: Update the shell code fence around the systemctl command
to specify the bash language identifier, using ```bash instead of an untyped
fence.
- Around line 101-109: Update the stale-state documentation to consistently
describe the renderer’s identity behavior: since nodeLabel defaults to
networking.hostName, clarify whether the hostname/node label is replaced with ??
or remains visible, and ensure the surviving identity statement names only the
elements that actually remain displayed.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 8f40e73b-6b7d-4427-89d5-7708925973bf

📥 Commits

Reviewing files that changed from the base of the PR and between ad8369d and dbc67e3.

📒 Files selected for processing (9)

• README.md
• docs/SECURITY.md
• docs/hardware.md
• flake.nix
• nixos/installer.nix
• nixos/keep-node.nix
• nixos/lib/brand.nix
• nixos/status-display.nix
• tests/status-display.nix

[wksantiago]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.