/data: replace the planned authenticated dm-integrity + dm-crypt AEAD stack with
confidentiality-only dm-crypt aes-xts-plain64 (AES-256-XTS). Authenticated
encryption has no internal hash, so a never-written sector EIOs on read; ext4
online-resize does read-modify-write of new-group metadata (backup GDT via
ext4_setup_new_descs) in the region it grows into, so the resize aborts unless
the whole grow region is pre-wiped first -- O(volume), unacceptable on large
volumes. XTS decrypts unwritten sectors to garbage instead of erroring, so the
resize needs no wipe (the standard LUKS/dm-crypt pattern) and cold-boot cost is
independent of volume size. Trade: at-rest tampering garbles plaintext rather
than being cryptographically detected -- media integrity is left to the storage
layer (EBS et al.), and a raw-disk-write adversary is out of scope. Key drift
still fails closed (superblock decrypts to garbage -> no ext4 magic -> reinit).
64-byte TPM-derived key, new key label.

loader: as PID 1, own fatal boot errors instead of returning. A returning init
panics the kernel ("Attempted to kill init") and spins a vCPU at 100% forever
(in prod and the QEMU harness). Now: log, 60s grace for console capture, then a
clean ACPI power-off.

ext4 /data base: meta_bg (drop resize_inode) for unbounded online growth; no
resize= ceiling or journal bump needed. Verified growing to ~12 GiB across a
meta_bg boundary with no wipe.

mkruntime.sh: env knobs (SOURCE_DATE_EPOCH, DATA_SIZE_MB, ROOTFS_UUID,
VERITY_SALT) with reproducible defaults; rootfs input now accepts a tar stream
on stdin, a tar file, a directory, or a single binary (docker export documented
as an example, not a dependency); <out> is a file path or - for stdout; and
--bootstrap prepends the loader ELF to emit a ready-to-run packed stage2. The
Makefile pack target uses --bootstrap and forwards the knobs.

tests: pivot-init drops the tamper-detection check (property removed with the
AEAD stack); add grow-probe (large-volume meta_bg growth + sparse-hole). Prune
unused probe examples. make ci green; PIVOT_TEST=PASS and GROW_TEST=PASS.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…E restructure

Make lockboot:erofs-builder a one-shot CLI: bake tools/mkruntime.sh in as the
ENTRYPOINT, so packaging no longer needs a repo bind-mount -- mount just the loader
ELF, pipe a rootfs in on stdin, get the stage2 out on stdout. Drop coreutils
(busybox covers touch -d @epoch, stat -c, tar, install, awk); output stays
byte-identical (same root hash), image 20.3 -> 18.2 MB. Makefile pack passes args
straight to the entrypoint.

Restructure the README to lead with what it is and how to use it (the mkruntime
one-liner with the built bootstrap), and move how-it-boots / security model /
testing into a Technical details section.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Clean check-context names (no spaces/parens) so the uniform branch ruleset across
the lockboot repos can require the same names everywhere.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>