From 51552245943c69659cc58dd50644aacfd331e095 Mon Sep 17 00:00:00 2001
From: BFE Engineering <engineering@bluefla.re>
Date: Sun, 30 Aug 2026 07:25:57 -0600
Subject: [PATCH] public-readiness: scrub internal details, split licensing,
 hosted kernel-build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Preparing the repo to go public (ADR-0007):

- CI: kernel-build moves from the self-hosted runner to ubuntu-latest
  (installs its own cross toolchain + qemu, caches the pristine tarball).
  On a public repo a registered self-hosted runner is reachable from
  approved fork-PR workflows — i.e. arbitrary code on private
  infrastructure — and the build never actually needed the SDK host.
  ADR-0004 marked superseded-in-part; docs/ci-cd.md rewritten (site
  specifics now live only in the private deployment log).
- Licensing: LICENSE gains the GPL-2.0 carve-out for patches/ and the
  kernel source excerpts (Linux derivatives; per-driver provenance was
  already tracked in PROVENANCE.md); patches/README.md states it too.
- Scrubbed from the tip: bench-unit dev credentials and its gadget IP
  (m2-boot notes), the site AP SSID+BSSID and a neighboring AP's BSSID
  and the device WLAN MAC (wifi bring-up evidence — BSSIDs are
  geolocatable), the runner mesh IP. NOTE: these remain in git history;
  decision on a pre-publication history rewrite is separate.
- Emoji cleanup across 21 tracked files (kernel port docs, review report,
  enforce-mcdc.sh) per repo text conventions: status marks became
  [x]/[wip]/[ ]/OK plain text.
- "[maintainer]-gated" process phrasing normalized to "maintainer-gated"
  (attributions in dated evidence docs kept).

Verified: zero emojis tracked; scrub grep clean; patches carry no internal
references; ci.yml parses; shellcheck unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K
---
 .github/workflows/ci.yml                      | 44 +++++++----
 LICENSE                                       | 12 ++-
 README.md                                     |  6 +-
 docs/architecture.md                          |  6 +-
 docs/ci-cd.md                                 | 66 +++++-----------
 docs/decisions/0003-standalone-repo.md        |  4 +-
 docs/decisions/0004-ci-runner.md              |  4 +-
 docs/decisions/0005-driver-source-of-truth.md |  2 +-
 .../0007-public-repo-hosted-kernel-build.md   | 37 +++++++++
 drivers/README.md                             |  2 +-
 drivers/enforce-mcdc.sh                       |  2 +-
 kernel/docs/m2-boot-on-c8a3.md                | 14 ++--
 .../rv1106-enablement/CAPABILITIES-AUDIT.md   | 20 ++---
 kernel/rv1106-enablement/DRIVER-PARITY.md     | 78 +++++++++----------
 kernel/rv1106-enablement/OVERNIGHT-RESULTS.md |  4 +-
 kernel/rv1106-enablement/PORT-STATUS.md       | 16 ++--
 kernel/rv1106-enablement/adc/SARADC-FIX.md    |  2 +-
 .../rv1106-enablement/audio/PORT-PROGRESS.md  |  2 +-
 kernel/rv1106-enablement/display/README.md    |  2 +-
 kernel/rv1106-enablement/display/VERIFIED.md  |  2 +-
 kernel/rv1106-enablement/gmac/PORT-DONE.md    |  2 +-
 kernel/rv1106-enablement/mailbox/VERIFIED.md  | 12 +--
 kernel/rv1106-enablement/npu/PORT-PLAN.md     |  2 +-
 kernel/rv1106-enablement/npu/PORT-PROGRESS.md |  2 +-
 kernel/rv1106-enablement/npu/VERIFIED.md      |  2 +-
 kernel/rv1106-enablement/pvtm/PORT-DONE.md    |  2 +-
 kernel/rv1106-enablement/rga/PORT-PLAN.md     |  4 +-
 kernel/rv1106-enablement/rng-otp/PORT-DONE.md |  4 +-
 kernel/rv1106-enablement/touch/VERIFIED.md    |  2 +-
 kernel/rv1106-enablement/wifi/PORT-PLAN.md    |  8 +-
 .../wifi/VERIFIED-on-c8a3.md                  |  8 +-
 patches/README.md                             |  8 ++
 qemu/README.md                                |  4 +-
 33 files changed, 213 insertions(+), 172 deletions(-)
 create mode 100644 docs/decisions/0007-public-repo-hosted-kernel-build.md

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e159f42..1c12c23 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,8 +2,9 @@
 #
 # Policy (mirrors flare-edge): only GitHub-owned actions get the repo token; the one
 # third-party helper (taiki-e/install-action) is pinned and never handed a token.
-# Host-testable jobs run on GitHub-hosted runners; only the heavy kernel build uses
-# the self-hosted [self-hosted, warden-sdk] runner on bfe-mpc-0640 (added in P5).
+# Every job runs on GitHub-hosted runners — no self-hosted runner may be reachable
+# from this repo's workflows (ADR-0007: public-repo fork PRs would otherwise be
+# able to run code on private infrastructure). kernel-build is dispatch-only.
 name: ci
 
 on:
@@ -170,36 +171,49 @@ jobs:
           exit 0
 
   kernel-build:
-    # Full hermetic build on the warden-sdk self-hosted runner (bfe-mpc-0640,
-    # ADR-0004). Manual-dispatch by design — a full kernel build is too heavy to run
-    # on every push; trigger it via `gh workflow run ci.yml` / the Actions UI.
+    # Full hermetic build on a GitHub-hosted runner (ADR-0007; supersedes the
+    # self-hosted half of ADR-0004 — a self-hosted runner must never be reachable
+    # from a public repo's workflows). Manual-dispatch by design — a full kernel
+    # build is heavy; trigger via `gh workflow run ci.yml` / the Actions UI.
     if: github.event_name == 'workflow_dispatch'
     needs: [prune-artifacts]
-    runs-on: [self-hosted, warden-sdk]
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - name: install cross toolchain + kernel build deps + qemu
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y -qq gcc-arm-linux-gnueabihf qemu-system-arm \
+            cpio bc bison flex libssl-dev
       - name: provision `python` (SDK quirk — build calls bare python)
         run: |
           mkdir -p "$RUNNER_TEMP/bin"
           ln -sf "$(command -v python3)" "$RUNNER_TEMP/bin/python"
           echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+      - name: cache pristine kernel tarball
+        uses: actions/cache@v4
+        with:
+          path: ~/linux-6.18.46.tar.xz
+          key: linux-6.18.46-tarball
       - name: build zImage + rv1106-warden.dtb
         env:
           # WORK must be OUTSIDE the repo checkout: build-kernel.sh applies the patch
           # series with `git apply`, which silently ignores out-of-subdir paths when
           # run inside another git repo (issue #1). $RUNNER_TEMP is outside the checkout.
           WORK: ${{ runner.temp }}/kbuild-out
-          JOBS: 4   # belt-and-braces bound in addition to the runner's cgroup cap
-          # The kernel is freestanding; use the stable generic arm cross toolchain
-          # (Debian gcc-arm-linux-gnueabihf on the runner) rather than depending on
-          # the ephemeral Luckfox SDK checkout path.
+          # Reuse the cached tarball when present (build-kernel.sh still verifies
+          # the sha256 pin fail-closed either way; it downloads if the file is absent).
+          KERNEL_TARBALL: ~/linux-6.18.46.tar.xz
+          # The kernel is freestanding; the generic arm cross toolchain links it.
           CROSS_COMPILE: arm-linux-gnueabihf-
-        run: bash build/build-kernel.sh
+        run: |
+          [ -f ~/linux-6.18.46.tar.xz ] || \
+            curl -fSL https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.18.46.tar.xz \
+              -o ~/linux-6.18.46.tar.xz
+          bash build/build-kernel.sh
       # Boot smoke under QEMU: the zImage this job just built must reach the
       # initramfs sentinel on -M virt (verified 2026-08-29: the canonical
-      # config boots virt as-is). FAIL-CLOSED on a missing qemu-system-arm —
-      # provisioning the runner (one-time `apt-get install qemu-system-arm`
-      # on bfe-mpc-0640) is part of docs/ci-cd.md, never a silent skip.
+      # config boots virt as-is). FAIL-CLOSED on a missing qemu-system-arm.
       - name: boot smoke (qemu-system-arm -M virt)
         run: |
           bash qemu/mkinitramfs.sh
@@ -208,7 +222,7 @@ jobs:
       # Best-effort: the build IS the gate. Uploading the zImage/dtb to GitHub
       # artifact storage can fail on an account-wide storage-quota hit (recalculated
       # every 6-12h) that has nothing to do with this build — don't red-X a good
-      # kernel build over it. The outputs also remain on the self-hosted runner host.
+      # kernel build over it.
       - uses: actions/upload-artifact@v4
         continue-on-error: true
         with:
diff --git a/LICENSE b/LICENSE
index b0b40ae..b685a10 100644
--- a/LICENSE
+++ b/LICENSE
@@ -3,8 +3,16 @@ warden-sdk is dual-licensed under either of
   * Apache License, Version 2.0 (LICENSE-APACHE)
   * MIT license (LICENSE-MIT)
 
-at your option.
+at your option — EXCEPT for the Linux kernel material:
+
+  * `patches/` (the RV1106 forward-port series) and the kernel source
+    excerpts under `kernel/rv1106-enablement/` are derivative works of the
+    Linux kernel and of GPL-2.0 vendor kernel code, and are licensed
+    **GPL-2.0-only** (or the per-file SPDX identifier where one is present,
+    e.g. GPL-2.0-or-later). Per-driver origin and license are tracked in
+    `kernel/rv1106-enablement/PROVENANCE.md`.
 
 Unless you explicitly state otherwise, any contribution intentionally submitted
 for inclusion in this work by you, as defined in the Apache-2.0 license, shall be
-dual licensed as above, without any additional terms or conditions.
+licensed as described above (dual MIT/Apache-2.0, or GPL-2.0 for the kernel
+material), without any additional terms or conditions.
diff --git a/README.md b/README.md
index ad29eaf..b8505cf 100644
--- a/README.md
+++ b/README.md
@@ -17,9 +17,9 @@ what runs on real silicon versus what we simulate.
 > boots the real kernel + real userspace on `-M virt` — check-in/OTA against the
 > mock portal, watchdog, RS485-to-sim bridge, 720x720 display + touch, all
 > emulation-verified) are in. What remains before this is on the production build
-> path: qemu-system-arm on the kernel-build runner (see `docs/ci-cd.md` §5) and
-> having flare-edge consume warden-sdk as a dependency — both [maintainer]-gated. Until
-> then, flare-edge still builds firmware from the vendored SDK + `sdk-patches/`.
+> path: having flare-edge consume warden-sdk as a dependency (maintainer-gated).
+> Until then, flare-edge still builds firmware from the vendored SDK +
+> `sdk-patches/`.
 
 ## Why a new SDK
 
diff --git a/docs/architecture.md b/docs/architecture.md
index fe91618..ffb3ebf 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -65,7 +65,7 @@ supervisor logic runs in CI with no panel.
   the boot-mode register's survives-warm-reset / cleared-by-POR behaviour (the MaskRom
   recovery maneuver). The matching firmware-side `Bus` seam on flared's `devmem` — so
   the shipped ladder can be asserted to poke the confirmed offset, never the wrong-SoC
-  one — lands when flare-edge consumes warden-sdk (§7 item 3, [maintainer]-gated), not yet on
+  one — lands when flare-edge consumes warden-sdk (§7 item 3, maintainer-gated), not yet on
   flare-edge `main`.
 - **`modbus` — RS-485 device end.** Done. `ModbusSlave`: a byte-in/byte-out RTU slave
   (CRC16 byte-identical to the master, FC 0x01–0x06/0x0F/0x10/0x11, exception replies,
@@ -88,7 +88,7 @@ supervisor logic runs in CI with no panel.
 Integration with flare-edge: flared implements `MemBus` for `/dev/mem` and gains
 `#[cfg(test)]` tests driving its real arm/beat logic against `HpmcuSim`. This needs
 warden-sdk reachable as a Cargo dependency in CI — i.e. a remote for this repo,
-which is a **[maintainer]-go-ahead item** (credential/remote creation). Until then the
+which is a **maintainer go-ahead item** (credential/remote creation). Until then the
 firmware-side seam and a local test double land in flare-edge, unified with `sim/`
 once the dependency exists. No duplication of *logic* — only the tiny trait.
 
@@ -185,7 +185,7 @@ memory-map faults; and "boots under emulation" is never on-silicon evidence.
 2. **C-driver MC/DC harnesses** — `relays.c` and `freshness.c` at 100% MC/DC, CI-gated
    via the shared `drivers/enforce-mcdc.sh`. **Done** (the first C coverage gate).
 3. **flared devmem/hpmcu seam + tests** — firmware-side trait, unified with `sim/`
-   once flare-edge consumes warden-sdk (a separate, [maintainer]-gated step). **Pending.**
+   once flare-edge consumes warden-sdk (a separate, maintainer-gated step). **Pending.**
 4. **Config-lint CI gates** (§5) — the brick-class of bug. **Done.**
 5. **Hermetic kernel build** (`build/build-kernel.sh` + the `patches-apply` gate). **Done.**
 6. **Kernel 5.10→6.18.46 forward-port** (§6, ADR-0001). **Done** (hardware-verified).
diff --git a/docs/ci-cd.md b/docs/ci-cd.md
index 2dbf734..1389666 100644
--- a/docs/ci-cd.md
+++ b/docs/ci-cd.md
@@ -1,63 +1,33 @@
 # CI/CD
 
-`.github/workflows/ci.yml` — everything portable runs on GitHub-hosted
-`ubuntu-latest`; only the heavy kernel build uses the self-hosted runner.
+`.github/workflows/ci.yml` — every job runs on GitHub-hosted `ubuntu-latest`.
+No self-hosted runner is (or may be) reachable from this repo's workflows:
+the repo is public, and a fork PR that gets one approved run could otherwise
+execute code on private infrastructure (ADR-0007).
 
 ## Jobs
 
 | Job | Runner | What it does |
 |---|---|---|
-| `test` | ubuntu-latest | `cargo test` (sim + config-lint) + `cargo-llvm-cov` line coverage on `sim`; outputs `passed`/`coverage`. |
+| `test` | ubuntu-latest | `cargo test` (sim + config-lint + qemu/rs485-bridge) + `cargo-llvm-cov` line coverage on `sim`; outputs `passed`/`coverage`. |
 | `mcdc` | ubuntu-latest | 100% MC/DC enforced on every `drivers/*/test` (gcc-14 `-fcondition-coverage`). |
-| `bench` | ubuntu-latest | Smoke-runs the sim micro-benchmarks; emits ns/op trend JSON. |
+| `bench` | ubuntu-latest | Smoke-runs the sim + rs485-bridge micro-benchmarks; emits ns/op trend JSON. |
 | `patches-apply` | ubuntu-latest | Fetches pristine linux-6.18.46 (cached, sha256-verified) and applies `patches/*` in order. |
-| `kernel-build` | **[self-hosted, warden-sdk]** | `build/build-kernel.sh` → `zImage` + `rv1106-warden.dtb`, uploaded as an artifact. Dispatch-gated until the runner is fully provisioned (below). |
+| `qemu-tools` | ubuntu-latest | shellcheck on `qemu/**.sh`; builds the initramfs (pinned busybox) and the A/B disk image. |
+| `kernel-build` | ubuntu-latest, **dispatch-only** | apt-installs the cross toolchain + qemu, `build/build-kernel.sh` → `zImage` + `rv1106-warden.dtb`, QEMU `-M virt` boot smoke (fail-closed), artifact upload (best-effort). Trigger: `gh workflow run ci.yml`. |
+| `prune-artifacts` | ubuntu-latest, dispatch-only | Deletes `kernel-rv1106` artifacts beyond the newest 3. |
 | `badges` | ubuntu-latest | Renders loc/tests/coverage shields on push to `main` (`[skip ci]` + `paths-ignore` loop guard). |
 
-## The self-hosted runner (`bfe-mpc-0640`)
+## History: the self-hosted runner (retired)
 
-A **third** repo-scoped runner instance on `bfe-mpc-0640` (alongside `flare` and
-`flare-edge`), registered with the label **`warden-sdk`** as
-`bfe-mpc-0640-warden-sdk`, in `~/actions-runner-warden-sdk`.
-
-> **INSTALLED + ONLINE (2026-08-25).** The runner is a running systemd service
-> (`actions.runner.bfe-noah-warden-sdk.bfe-mpc-0640-warden-sdk.service`, `enabled`,
-> cgroup-capped `CPUQuota=400%`/`MemoryMax=6G`) and `kernel-build` has been verified
-> end-to-end (RV1106 6.18.46 → `zImage` 8.25 MB + `rv1106-warden.dtb`). Steps 1–2
-> below are the record of that install (they needed `user`'s sudo on 0640); steps
-> 3–4 are handled inside the workflow, so the host needs no manual toolchain/python.
-
-1. **Install as a service** (persistence): `cd ~/actions-runner-warden-sdk &&
-   sudo ./svc.sh install user && sudo ./svc.sh start`. Until then the runner is
-   *offline* and `kernel-build` only runs when dispatched against an online runner.
-2. **Resource cap** (protect the shared host): a drop-in at
-   `/etc/systemd/system/actions.runner.bfe-noah-warden-sdk.*.service.d/*.conf` with
-   `CPUQuota=400%` + `MemoryMax=6G`, then `sudo systemctl daemon-reload`. The build
-   inherits that cgroup. (The workflow also passes `JOBS=4` as a belt-and-braces bound.)
-3. **Kernel cross toolchain** — done in the workflow: the `kernel-build` job sets
-   `CROSS_COMPILE=arm-linux-gnueabihf-` (Debian `gcc-arm-linux-gnueabihf`, already on
-   the runner) and `build-kernel.sh` honors it. The kernel is freestanding, so the
-   generic arm cross compiler links it — no Luckfox SDK toolchain path needed. (To use
-   the SDK uclibc toolchain instead, set `SDK_TC` to its `bin/` and drop the override.)
-4. **`python`** (not python3) — done in the workflow: the `kernel-build` job symlinks
-   `python`→`python3` into `$RUNNER_TEMP/bin` and prepends it to `$GITHUB_PATH`. No
-   host-side venv/shim needed.
-
-Host build deps: `dtc bc flex bison libssl-dev` — already present on 0640.
-
-5. **`qemu-system-arm`** (for the boot-smoke step inside `kernel-build`, added
-   with the `qemu/` device sim — ADR-0006): one-time
-   `sudo apt-get install qemu-system-arm` on 0640. The step is
-   **fail-closed** — a missing qemu binary fails the job with a message
-   pointing here; it never silently skips.
-
-   > **INSTALLED (2026-08-30).** QEMU 10.0.11 via apt as `user` on 0640
-   > (reached over the mesh at `[mesh-ip]`); `cpio` and `curl` were already
-   > present. Recorded in flare-deployment `docs/deploy-log.md`. First
-   > dispatched `kernel-build` will exercise the smoke step end-to-end once
-   > the account-wide Actions billing stall is cleared.
+`kernel-build` originally ran on a repo-scoped self-hosted runner (ADR-0004,
+2026-08-25, verified end-to-end) because hosted minutes were metered on the
+private repo. Going public made hosted minutes free and made a self-hosted
+registration a liability, so ADR-0007 moved the job to `ubuntu-latest` and
+retired the registration. Site-specific install records for that runner live
+in our private deployment log, not here.
 
 ## Badges
 
-Static shields SVGs are committed by the `badges` job (private repo can't use
-dynamic shields). The GitHub-native `ci.yml` status badge works live regardless.
+Static shields SVGs are committed by the `badges` job. The GitHub-native
+`ci.yml` status badge works live regardless.
diff --git a/docs/decisions/0003-standalone-repo.md b/docs/decisions/0003-standalone-repo.md
index 36aa658..0b15fd2 100644
--- a/docs/decisions/0003-standalone-repo.md
+++ b/docs/decisions/0003-standalone-repo.md
@@ -10,11 +10,11 @@ no CI, tests, or versioning of their own. The SDK requirement (future-features-2
 ## Decision
 A **private** `bfe-noah/warden-sdk` GitHub repo, standalone from day one with its own
 CI/versioning. Work lands on a `bringup` branch; the first commit to `main` is gated
-on a passing code-review-harness run, green CI, and [maintainer]'s fresh explicit go-ahead.
+on a passing code-review-harness run, green CI, and the maintainer's fresh explicit go-ahead.
 
 ## Consequences
 - flare-edge consumes warden-sdk later (flared depending on `warden-sim`, drivers
-  built from here) — a separate, [maintainer]-gated integration step; flare-edge is not
+  built from here) — a separate, maintainer-gated integration step; flare-edge is not
   edited by the SDK-completion effort.
 - Private for now (references bench devices / in-progress hardening); can be opened
   later once scrubbed, matching how `flare-deployment` is handled.
diff --git a/docs/decisions/0004-ci-runner.md b/docs/decisions/0004-ci-runner.md
index 847098e..9fd1fc6 100644
--- a/docs/decisions/0004-ci-runner.md
+++ b/docs/decisions/0004-ci-runner.md
@@ -1,6 +1,8 @@
 # ADR 0004 — CI/CD runner: 3rd repo-scoped self-hosted runner on 0640
 
-**Status:** Accepted (2026-08-25).
+**Status:** Superseded in part by ADR-0007 (2026-08-30) — `kernel-build` moved
+to GitHub-hosted runners for the public repo and the self-hosted registration
+is retired. Original decision below, kept for the record. (2026-08-25.)
 
 ## Context
 The heavy kernel/firmware build needs the SDK toolchain and Buildroot's baked-in
diff --git a/docs/decisions/0005-driver-source-of-truth.md b/docs/decisions/0005-driver-source-of-truth.md
index 053007c..8ac83bc 100644
--- a/docs/decisions/0005-driver-source-of-truth.md
+++ b/docs/decisions/0005-driver-source-of-truth.md
@@ -12,7 +12,7 @@ scratch tree (`flare-edge/research/linux-6.18.46/`).
 Bring **hardened copies into `warden-sdk/drivers/`** as the canonical source-of-truth,
 each with its HAL seam and a 100% MC/DC host harness. The RV1106 kernel deltas are
 formalized as a patch series in `patches/`. flare-edge consumes warden-sdk later
-(separate, [maintainer]-gated step).
+(separate, maintainer-gated step).
 
 ## Consequences
 - Realizes the seam architecture (ADR-referenced in `docs/architecture.md`).
diff --git a/docs/decisions/0007-public-repo-hosted-kernel-build.md b/docs/decisions/0007-public-repo-hosted-kernel-build.md
new file mode 100644
index 0000000..f568587
--- /dev/null
+++ b/docs/decisions/0007-public-repo-hosted-kernel-build.md
@@ -0,0 +1,37 @@
+# ADR 0007 — Public repo: kernel-build moves to GitHub-hosted runners
+
+**Status:** Accepted (2026-08-30). Supersedes the runner half of ADR-0004.
+
+## Context
+The repo is going public (free Actions minutes for hosted runners; open-source
+alignment with the stack philosophy). Two facts change the ADR-0004 calculus:
+
+1. **A self-hosted runner on a public repo is a standing hazard.** A fork PR
+   can modify workflow files; once any run of theirs is approved, workflows
+   can target the repo's registered self-hosted runners — i.e. arbitrary code
+   on the private host, which also serves production. GitHub's own guidance is
+   to never attach self-hosted runners to public repos, and personal-account
+   repos have no runner groups to scope the risk away.
+2. **The build never needed the SDK host.** ADR-0004's premise ("needs the SDK
+   toolchain and Buildroot's baked-in absolute paths") does not apply to
+   `kernel-build`: the hermetic build is freestanding, uses Debian's
+   `gcc-arm-linux-gnueabihf`, and self-provisions `python`. It fits a hosted
+   runner (4 vCPU / 16 GB), and public-repo minutes are free.
+
+## Decision
+`kernel-build` runs on `ubuntu-latest`, apt-installing its toolchain, kernel
+build deps, and qemu-system-arm, with the pristine tarball cached like
+`patches-apply` does. It stays `workflow_dispatch`-only for now (a full build
+per push is still noisy; flipping it to push-on-main later is one line). The
+`warden-sdk` self-hosted runner instance is **deregistered from this repo**
+before it goes public; the flare and flare-edge runner instances on the same
+host are unaffected (those repos stay private).
+
+## Consequences
+- No path from public workflows to private infrastructure; nothing to babysit
+  in fork-PR approval settings beyond GitHub's defaults (still set "require
+  approval for all outside contributors" as belt-and-braces).
+- Kernel artifacts no longer persist on the runner host; the GitHub artifact
+  (5-day retention + prune job) is the only build output channel.
+- Hosted kernel builds are slower than the 0640 box but free and parallel;
+  the boot-smoke step rides along unchanged.
diff --git a/drivers/README.md b/drivers/README.md
index b197586..2cee72b 100644
--- a/drivers/README.md
+++ b/drivers/README.md
@@ -38,7 +38,7 @@ is already modelled and tested here** in `../sim/`:
 **Why the Tier-2 *source* isn't vendored here yet:** `modbus_engine.c` and
 `warden_rga.c` pull in shared UI headers (`platform.h`, `settings.h`, `lv_*`) and
 librga. Copying those in would duplicate exactly the shared surface the
-**flare-edge↔warden-sdk unification** (ADR-0003/0005, a separate [maintainer]-gated step) is
+**flare-edge↔warden-sdk unification** (ADR-0003/0005, a separate maintainer-gated step) is
 meant to resolve cleanly. So the Tier-2 *models* (the hardware ends) live here now;
 the Tier-2 *driver sources* migrate in with the unification, at which point their
 existing flare-edge harnesses point at this repo.
diff --git a/drivers/enforce-mcdc.sh b/drivers/enforce-mcdc.sh
index 9cb2d4c..7206e08 100755
--- a/drivers/enforce-mcdc.sh
+++ b/drivers/enforce-mcdc.sh
@@ -52,5 +52,5 @@ if ! echo "$cond_line" | grep -q "100.00%"; then
 	rc=1
 fi
 
-[ "$rc" = "0" ] && echo "RESULT: 100% MC/DC + all checks green ✓"
+[ "$rc" = "0" ] && echo "RESULT: 100% MC/DC + all checks green OK"
 exit "$rc"
diff --git a/kernel/docs/m2-boot-on-c8a3.md b/kernel/docs/m2-boot-on-c8a3.md
index 4f09b51..97e516a 100644
--- a/kernel/docs/m2-boot-on-c8a3.md
+++ b/kernel/docs/m2-boot-on-c8a3.md
@@ -7,9 +7,10 @@ findings — they worked on the first hardware try.**
 
 ## The safe test path (A/B slot _b, never touch _a)
 
-c8a3 is the XPS-connected Warden: eth0 `[bench-ip]` over USB-gadget ([bench-creds],
-dropbear — use `scp -O`, no sftp-server), plus the serial console on xps
-`/dev/ttyUSB2` @115200 and Zigbee power (`plug_cmd.py cycle`). It runs an A/B
+c8a3 is the desk-connected bench Warden: reachable over its USB-gadget ethernet
+(dev-build dropbear; address and bench credentials live in the private
+deployment notes — use `scp -O`, no sftp-server), plus the serial console at
+115200 and remotely switchable power. It runs an A/B
 firmware (boot_a=mmcblk0p5 / boot_b=mmcblk0p6, 32 MiB each; rootfs_a/_b; AvbABData
 in `misc` sector 4 / byte 2048).
 
@@ -51,7 +52,7 @@ With the correct format, U-Boot loaded my kernel + my DTB and printed my DT mode
 string (`Model: WardenOS 86-Panel (RV1106) — M2 earlycon bring-up`), then
 `Starting kernel ...`.
 
-## Result: ✅ M2 achieved — the 6.18 kernel boots on hardware
+## Result: [x] M2 achieved — the 6.18 kernel boots on hardware
 
 Six attempts, each auto-recovering to `_a`, then a clean boot:
 
@@ -84,7 +85,7 @@ pre-MMU), then fixed:
 CP2102 bench adapter — so the M2 DT pins 115200 for readable bring-up; production
 overrides to 1.5M.
 
-## M3 (same session): ✅ the full WardenOS runs on the 6.18 kernel
+## M3 (same session): [x] the full WardenOS runs on the 6.18 kernel
 
 Adding the eMMC `dw_mmc` node (`mmc@ffa90000`, clocks from cru + grf_cru) was the
 only change M3 needed — the mmc/ext4 drivers are already in-config. The kernel
@@ -96,7 +97,8 @@ won't load (vermagic → M5), and there's no backlight/framebuffer yet (→ M4).
 
 **Console lesson applied:** with `console=ttyS2,115200` the whole boot is readable
 on the CP2102 (the 1.5M vendor rate is garbage on it). Serial login uses the same
-`c8a3_run.py` [bench-creds] helper as the 5.10 firmware — the userspace is unchanged.
+`c8a3_run.py` helper (dev-build bench credentials, see private deployment notes)
+as the 5.10 firmware — the userspace is unchanged.
 
 Next: M4 (VOP2 display + panel + touch), M5 (AIC8800 SDIO port + our 4 patches),
 M6 (RGA/watchdog/HPMCU/USB-OTG); plus a lean defconfig + Buildroot-on-6.18 cleanup.
diff --git a/kernel/rv1106-enablement/CAPABILITIES-AUDIT.md b/kernel/rv1106-enablement/CAPABILITIES-AUDIT.md
index fd06830..a6829d3 100644
--- a/kernel/rv1106-enablement/CAPABILITIES-AUDIT.md
+++ b/kernel/rv1106-enablement/CAPABILITIES-AUDIT.md
@@ -4,44 +4,44 @@ Every block in the vendor SoC DT (`rv1106.dtsi`), classified. Goal: a 6.18 drive
 for every capability the hardware actually has, open-source, verified. Camera/ISP
 is the only whole class deliberately skipped — the 86-Panel has no camera.
 
-## ✅ Done / at parity (verified on warden-c8a3)
+## Done / at parity (verified on warden-c8a3)
 CRU clk · pinctrl (+ioc/pmuioc) · GIC · arch timer · pl330 DMA · 8250 uart (×3) ·
 dw_mmc eMMC · i2c · dw-wdt · **RTC** · **tsadc** · **RGA** (rga2, hw 3.3.87975) ·
 PWM backlight · **USB host** (dwc3/xhci) + usb2phy · grf/pmu syscons.
 
-## ✅ Verified this run (2026-08-25) — all on warden-c8a3, self-built 6.18.46
+## Verified this run (2026-08-25) — all on warden-c8a3, self-built 6.18.46
 - **AIC8800 wifi** — wlan0 up, scanned the site AP at −43 dBm (modules; `wifi/VERIFIED-on-c8a3.md`).
 - **TRNG** — /dev/hwrng, real HW entropy (`rng-otp/`).
 - **OTP/nvmem** — rockchip-otp0 reads chip id (`rng-otp/`).
 - **GMAC** — eth0 Link Up 100 Mbps/Full (`gmac/`).
 - **SARADC** — iio:device0 reads 2 ch; the −22 was vref, not clk (`adc/SARADC-FIX.md`).
 
-## ✅ VOP display — VERIFIED this run (2026-08-25)
+## VOP display — VERIFIED this run (2026-08-25)
 Full WardenOS Dashboard renders on the 86-Panel on 6.18 (`_b`), webcam-verified,
 pixel-identical to stock `_a`. Two VOP driver bugs were the final black-screen
 cause: `rgb_dclk_pol` hardcoded inverted (panel needs 0), and the wrong primary
 scanout window (rv1106 uses **WIN1**, not rv1126's WIN2). Full chain + `_a`-vs-`_b`
 register diff in `display/VERIFIED.md`.
 
-## ✅ GT911 touch — VERIFIED this run (2026-08-25)
+## GT911 touch — VERIFIED this run (2026-08-25)
 UI responds to taps/swipes on the panel ([maintainer]-confirmed); GT911 detected
 (`ID 911, version 1060`), `/dev/input/event0` held by warden-ui. Fix:
 `CONFIG_TOUCHSCREEN_GOODIX=y` (built-in — the rootfs `goodix.ko` is a 5.10 build
 that can't load on 6.18) + GT911 node on `&i2c3`. Details in `touch/VERIFIED.md`.
 
-## 🔨 In flight
+## In flight
 - **i2s-tdm** — DAI builds; needs the codec + card (below).
 - **AIC8800 BT** — module built (6.18 vermagic); HCI bring-up not yet exercised.
 
-## ✅ audio — VERIFIED this run
+## audio — VERIFIED this run
 card `rv1106-acodec` + pcmC0D0p/c (`audio/`); audible test @ bench with display.
 
 ## Remaining blocks — final status (all real capabilities now verified)
 | Block | verdict | note |
 |---|---|---|
-| **mailbox** (HPMCU) | ✅ VERIFIED | A7↔RISC-V-SCR1 round-trip, 5/5 exact echoes (`mailbox/VERIFIED.md`). Took 3 hardware-found fixes: rv1106 num_chans=1 (1 shared IRQ, not 4), CLK_CORE_MCU IGNORE_UNUSED (6.18 was gating the coprocessor clock), + an open SCR1 echo firmware with A2B_INTEN. The /dev/mem SRAM watchdog stays as a separate dead-man's-switch. |
-| **NPU** (rknpu) | ✅ open driver VERIFIED; compute deferred | open GPL rknpu 0.9.2 driver, /dev/dri/card1, version ioctl PASS (`npu/VERIFIED.md`). Open *compute* (a regcmd compiler) is a from-scratch ~person-year register-RE project — no RV1106 prior art, no public TRM Part 2, mainline accel/rocket+Teflon are RK3588-only. Ship the driver, no blob. |
-| **pvtm** | ✅ VERIFIED | both core+pmu PVT monitors probe; debugfs ring-osc reads (`pvtm/PORT-DONE.md`). |
+| **mailbox** (HPMCU) | VERIFIED | A7↔RISC-V-SCR1 round-trip, 5/5 exact echoes (`mailbox/VERIFIED.md`). Took 3 hardware-found fixes: rv1106 num_chans=1 (1 shared IRQ, not 4), CLK_CORE_MCU IGNORE_UNUSED (6.18 was gating the coprocessor clock), + an open SCR1 echo firmware with A2B_INTEN. The /dev/mem SRAM watchdog stays as a separate dead-man's-switch. |
+| **NPU** (rknpu) | [x] open driver VERIFIED; compute deferred | open GPL rknpu 0.9.2 driver, /dev/dri/card1, version ioctl PASS (`npu/VERIFIED.md`). Open *compute* (a regcmd compiler) is a from-scratch ~person-year register-RE project — no RV1106 prior art, no public TRM Part 2, mainline accel/rocket+Teflon are RK3588-only. Ship the driver, no blob. |
+| **pvtm** | VERIFIED | both core+pmu PVT monitors probe; debugfs ring-osc reads (`pvtm/PORT-DONE.md`). |
 | **crypto-v3** (accel) | deferred (documented) | ~100 KB whole-subsystem replacement of mainline's rk3288 crypto + heavy crypto-API deltas; the **CPU crypto extensions (AES/SHA, batch2 =y) already cover the functional need** — an offload optimization, not a capability gap. |
 | camera/ISP, SPI | N/A | no such hardware on the 86-Panel. |
 
@@ -51,7 +51,7 @@ deferred item is the crypto *accelerator* (CPU crypto already covers it) and ope
 NPU *compute* (a person-year RE effort, scoped in `npu/OPEN-NPU-PLAN.md`). No
 unexplored gap remains.
 
-## ❌ Not applicable (no hardware on the 86-Panel)
+## Not applicable (no hardware on the 86-Panel)
 cif · csi2-dphy · mipi-csi2 · rkisp (all camera/ISP) · SPI (no on-board SPI device).
 
 ## Order (after wifi)
diff --git a/kernel/rv1106-enablement/DRIVER-PARITY.md b/kernel/rv1106-enablement/DRIVER-PARITY.md
index 0fff95a..6fad692 100644
--- a/kernel/rv1106-enablement/DRIVER-PARITY.md
+++ b/kernel/rv1106-enablement/DRIVER-PARITY.md
@@ -3,47 +3,47 @@
 Goal: every driver the panel's 5.10 kernel runs must work at ≥ parity on our
 self-built 6.18. Source of truth = the running 5.10 system on warden-c8a3
 (`lsmod` + `/proc/interrupts`, captured 2026-08-24). Verify each on hardware via
-the A/B `_b`-slot loop (`../docs/m2-boot-on-c8a3.md`); ✅ means confirmed on
+the A/B `_b`-slot loop (`../docs/m2-boot-on-c8a3.md`); [x] means confirmed on
 c8a3, not just compiled.
 
 | Driver / node | 5.10 evidence | mainline? | 6.18 status |
 |---|---|---|---|
-| CRU clock (clk-rv1106) | — | ported | ✅ M2 |
-| pinctrl-rockchip (rv1106) | — | ported | ✅ M2 |
-| GIC-400 / arch_timer | arch_timer | mainline | ✅ M2 |
-| dw_mmc (eMMC) | dw-mci | mainline | ✅ M3 |
-| 8250 uart2 (console) | ttyS2 | mainline | ✅ M2 |
-| GPIO (rockchip, ×5 banks) | gpio-rockchip | mainline | ✅ batch1 (chips 0–4) |
-| DMA (pl330, ff420000) | ff420000.dma-controller | mainline | ✅ batch1 |
-| uart1 / uart4 | ttyS1, ttyS4 | mainline | ✅ batch1 |
-| I2C (dw-apb, ff460000=i2c3) | ff460000.i2c | mainline | ✅ batch1 (i2c-3) |
-| watchdog (dw-wdt, ff5a0000) | ff5a0000.watchdog | mainline | ✅ batch1 (watchdog0) |
-| tsadc thermal (ff3c8000) | rockchip_thermal | ported (data+init+macros) | ✅ soc-thermal reads 39.8°C |
-| SARADC (ff3c0000) | ff3c0000.saradc | ported (2-ch v2 data) | ✅ iio:device0 reads 2ch (adc-keys); fixed -22 via vref-supply |
-| TRNG (rng@ff448000) | rockchip,trngv1 | mainline (rk3588 IP) | ✅ /dev/hwrng, real entropy (`rng-otp/`) |
-| OTP/nvmem (ff3d0000) | rockchip,rv1106-otp | ported (px30_otp_read) | ✅ rockchip-otp0, reads chip id |
-| GMAC (ffa80000) | rockchip,rv1106-gmac | ported (dwmac-rk rv1106_ops) | ✅ eth0 Link Up 100M/Full (`gmac/`) |
-| GPIO_SYSFS (legacy /sys/class/gpio) | — | mainline (config) | ⬜ goodix script needs it |
-| PWM (rockchip) | — | mainline (=m) | ⬜ batch2 =y (backlight) |
-| RTC (rv1106-rtc) | — | ported (vendor driver) | ✅ /dev/rtc0 registers + reads |
-| USB2 phy (inno, rv1106) | rockchip_usb2phy_* | ported (data, no tuning) | ✅ probes → USB up |
-| USB host (DWC3→xhci, ffb00000) | xhci-hcd:usb1 | mainline | ✅ xhci host registered |
-| USB OTG gadget (DWC3, eth0) | eth0 | mainline dwc3 | 🔨 host works; eth0 needs dr_mode=peripheral |
-| crypto (aes/ccm/ctr/arc4) | modules | mainline | ⬜ batch2 (config =y) |
-| PSCI node (removed) | — | — | ✅ deleted (no secure monitor → SMC fault) |
-| VOP display (ff990000) | ff990000.vop | ported (rv1126 sibling) | 🔨 binds+DRM+card0; connector WIP |
-| PWM backlight (pwm1) | — | mainline (rk3328 fallback) | ✅ backlight up (brightness) |
-| RGB666 720×720 panel | — | panel-dpi | 🔨 probes; bus_format + connector WIP |
-| GT911 touch (goodix) | goodix, gt911 | mainline | ⬜ M4 (needs GPIO_SYSFS ✅ + node) |
-| GPIO_SYSFS / crypto / CFG80211 | — | mainline (config) | ✅ =y (batch2) |
-| AIC8800 wifi (bsp/fdrv) | aic8800_* | **out-of-tree** | ✅ M5 — wlan0 up, scanned the site AP at −43dBm (modules, `wifi/VERIFIED-on-c8a3.md`) |
-| AIC8800 BT (btlpm) | aic8800_btlpm | **out-of-tree** | 🔨 module built (6.18 vermagic); HCI bring-up not yet exercised |
-| NPU (rknpu, ff660000) | rknpu, ff660000.npu | **out-of-tree** | 🔨 M6 built, 0 errors/0 warnings, 99 `rknpu`-prefixed symbols in `System.map`, `&npu {status="okay"}` in the dtb — **not yet flashed/probed on hardware** (build-only session; see `npu/PORT-PROGRESS.md`) |
-| RGA 2D (rga2) | rga2 | ported (vendor char-dev) | ✅ /dev/rga, hw 3.3.87975 |
-| I2S audio (i2s-tdm) | i2s | rv1126 fallback (=y) | ✅ cpu DAI registers (part of the card below) |
-| Audio codec (acodec) | rockchip,rv1106-codec | ported (rv1106_codec.c) | ✅ card `rv1106-acodec`, pcmC0D0p/c (`audio/`); audible test @ bench |
-| HPMCU mailbox (ff5c0000) | rockchip,rv1106-mailbox | rk3368 fallback +rv1106 num_chans=1 | ✅ A7<->SCR1 round-trip, 5/5 exact (`mailbox/VERIFIED.md`) |
-| PVTM (core+pmu ring-osc) | rockchip,rv1106-*-pvtm | ported (vendor, no mainline) | ✅ both probe; debugfs reads (`pvtm/`) |
-| FIQ debugger (ttyFIQ0) | fiq_glue | rockchip | ⬜ optional (we use ttyS2) |
+| CRU clock (clk-rv1106) | — | ported | [x] M2 |
+| pinctrl-rockchip (rv1106) | — | ported | [x] M2 |
+| GIC-400 / arch_timer | arch_timer | mainline | [x] M2 |
+| dw_mmc (eMMC) | dw-mci | mainline | [x] M3 |
+| 8250 uart2 (console) | ttyS2 | mainline | [x] M2 |
+| GPIO (rockchip, ×5 banks) | gpio-rockchip | mainline | [x] batch1 (chips 0–4) |
+| DMA (pl330, ff420000) | ff420000.dma-controller | mainline | [x] batch1 |
+| uart1 / uart4 | ttyS1, ttyS4 | mainline | [x] batch1 |
+| I2C (dw-apb, ff460000=i2c3) | ff460000.i2c | mainline | [x] batch1 (i2c-3) |
+| watchdog (dw-wdt, ff5a0000) | ff5a0000.watchdog | mainline | [x] batch1 (watchdog0) |
+| tsadc thermal (ff3c8000) | rockchip_thermal | ported (data+init+macros) | [x] soc-thermal reads 39.8°C |
+| SARADC (ff3c0000) | ff3c0000.saradc | ported (2-ch v2 data) | [x] iio:device0 reads 2ch (adc-keys); fixed -22 via vref-supply |
+| TRNG (rng@ff448000) | rockchip,trngv1 | mainline (rk3588 IP) | [x] /dev/hwrng, real entropy (`rng-otp/`) |
+| OTP/nvmem (ff3d0000) | rockchip,rv1106-otp | ported (px30_otp_read) | [x] rockchip-otp0, reads chip id |
+| GMAC (ffa80000) | rockchip,rv1106-gmac | ported (dwmac-rk rv1106_ops) | [x] eth0 Link Up 100M/Full (`gmac/`) |
+| GPIO_SYSFS (legacy /sys/class/gpio) | — | mainline (config) | [ ] goodix script needs it |
+| PWM (rockchip) | — | mainline (=m) | [ ] batch2 =y (backlight) |
+| RTC (rv1106-rtc) | — | ported (vendor driver) | [x] /dev/rtc0 registers + reads |
+| USB2 phy (inno, rv1106) | rockchip_usb2phy_* | ported (data, no tuning) | [x] probes → USB up |
+| USB host (DWC3→xhci, ffb00000) | xhci-hcd:usb1 | mainline | [x] xhci host registered |
+| USB OTG gadget (DWC3, eth0) | eth0 | mainline dwc3 | [wip] host works; eth0 needs dr_mode=peripheral |
+| crypto (aes/ccm/ctr/arc4) | modules | mainline | [ ] batch2 (config =y) |
+| PSCI node (removed) | — | — | [x] deleted (no secure monitor → SMC fault) |
+| VOP display (ff990000) | ff990000.vop | ported (rv1126 sibling) | [wip] binds+DRM+card0; connector WIP |
+| PWM backlight (pwm1) | — | mainline (rk3328 fallback) | [x] backlight up (brightness) |
+| RGB666 720×720 panel | — | panel-dpi | [wip] probes; bus_format + connector WIP |
+| GT911 touch (goodix) | goodix, gt911 | mainline | [ ] M4 (needs GPIO_SYSFS [x] + node) |
+| GPIO_SYSFS / crypto / CFG80211 | — | mainline (config) | [x] =y (batch2) |
+| AIC8800 wifi (bsp/fdrv) | aic8800_* | **out-of-tree** | [x] M5 — wlan0 up, scanned the site AP at −43dBm (modules, `wifi/VERIFIED-on-c8a3.md`) |
+| AIC8800 BT (btlpm) | aic8800_btlpm | **out-of-tree** | [wip] module built (6.18 vermagic); HCI bring-up not yet exercised |
+| NPU (rknpu, ff660000) | rknpu, ff660000.npu | **out-of-tree** | [wip] M6 built, 0 errors/0 warnings, 99 `rknpu`-prefixed symbols in `System.map`, `&npu {status="okay"}` in the dtb — **not yet flashed/probed on hardware** (build-only session; see `npu/PORT-PROGRESS.md`) |
+| RGA 2D (rga2) | rga2 | ported (vendor char-dev) | [x] /dev/rga, hw 3.3.87975 |
+| I2S audio (i2s-tdm) | i2s | rv1126 fallback (=y) | [x] cpu DAI registers (part of the card below) |
+| Audio codec (acodec) | rockchip,rv1106-codec | ported (rv1106_codec.c) | [x] card `rv1106-acodec`, pcmC0D0p/c (`audio/`); audible test @ bench |
+| HPMCU mailbox (ff5c0000) | rockchip,rv1106-mailbox | rk3368 fallback +rv1106 num_chans=1 | [x] A7<->SCR1 round-trip, 5/5 exact (`mailbox/VERIFIED.md`) |
+| PVTM (core+pmu ring-osc) | rockchip,rv1106-*-pvtm | ported (vendor, no mainline) | [x] both probe; debugfs reads (`pvtm/`) |
+| FIQ debugger (ttyFIQ0) | fiq_glue | rockchip | [ ] optional (we use ttyS2) |
 
-Legend: ✅ verified on hardware · 🔨 built, not yet verified · ⬜ not started.
+Legend: [x] verified on hardware · [wip] built, not yet verified · [ ] not started.
diff --git a/kernel/rv1106-enablement/OVERNIGHT-RESULTS.md b/kernel/rv1106-enablement/OVERNIGHT-RESULTS.md
index f51264f..e14d679 100644
--- a/kernel/rv1106-enablement/OVERNIGHT-RESULTS.md
+++ b/kernel/rv1106-enablement/OVERNIGHT-RESULTS.md
@@ -4,10 +4,10 @@ Goal ([maintainer]): port/enable **every** remaining RV1106 hardware capability
 self-built Linux 6.18.46, open-source-first, verify on hardware, so the display's
 last mile can start in the morning. Runs on warden-c8a3 (`_b` slot = our 6.18).
 
-## ✅ Verified on hardware this run
+## Verified on hardware this run
 | Driver | Evidence |
 |---|---|
-| **AIC8800 wifi** (M5) | wlan0 up ([device-mac]), `iw scan` found the site AP −43 dBm + others. Modules (built-in deadlocks the two-stage SDIO bring-up). |
+| **AIC8800 wifi** (M5) | wlan0 up, `iw scan` found the site AP at −43 dBm + others. Modules (built-in deadlocks the two-stage SDIO bring-up). |
 | **TRNG** | `/dev/hwrng`, `rng_current=rockchip-rng`, real entropy. |
 | **OTP/nvmem** | `rockchip-otp0` reads chip id ("MR1"). |
 | **GMAC** (wired eth) | `eth0: Link is Up - 100 Mbps/Full`. |
diff --git a/kernel/rv1106-enablement/PORT-STATUS.md b/kernel/rv1106-enablement/PORT-STATUS.md
index 14df286..3a0b640 100644
--- a/kernel/rv1106-enablement/PORT-STATUS.md
+++ b/kernel/rv1106-enablement/PORT-STATUS.md
@@ -20,7 +20,7 @@ from the **vendor 5.10.160** tree, no plan44 code, built with our
 - rv1106's siblings **rv1126/rv1108 exist in both trees**, so their 5.10→6.18 delta is a
   working template for the framework API changes.
 
-## M1 — clock driver (`clk-rv1106.c`, 1294 lines): ✅ COMPILES CLEAN on 6.18
+## M1 — clock driver (`clk-rv1106.c`, 1294 lines): [x] COMPILES CLEAN on 6.18
 Build-fix loop against 6.18 — `clk-rv1106.o` (85732 bytes) builds with no errors.
 Fixed (captured in `clk/`):
 1. **Kconfig + Makefile hooks** — added `CONFIG_CLK_RV1106` (mirrors CLK_RV1126).
@@ -31,7 +31,7 @@ Fixed (captured in `clk/`):
 4. **`rockchip_clk_register_armclk` signature change** — 5.10 took
    `(num_parents, parent_clk, alt_parent_clk)`; 6.18 takes `(parent_names[], num_parents)`
    and drives the mux from `reg_data.mux_core_main/alt`. Adapted the call to the 6.18 form
-   using a parent-names array (sibling-delta from rv1126). **⚠ PORT-VERIFY**: the mux input
+   using a parent-names array (sibling-delta from rv1126). **PORT-VERIFY**: the mux input
    list `{ "gpll","cpll","apll" }` and the `mux_core_main/alt=2` mapping are a best-effort
    from the 5.10 intent (main=apll) — they set the **CPU clock source**, so they must be
    checked against the RV1106 `CORECLKSEL_CON` register map (TRM) and validated on hardware
@@ -39,9 +39,9 @@ Fixed (captured in `clk/`):
 
 5. **`CLK_FRAC_DIVIDER_NO_LIMIT`** — Rockchip downstream-only frac-divider flag (6 uses on
    the UART frac clocks); mainline has no min/max opt-out, mapped to 0 (default limit).
-   **⚠ PORT-VERIFY**: UART fractional baud accuracy.
+   **PORT-VERIFY**: UART fractional baud accuracy.
 
-## M1 — pinctrl (`pinctrl-rockchip.c/.h`): ✅ COMPILES CLEAN on 6.18
+## M1 — pinctrl (`pinctrl-rockchip.c/.h`): [x] COMPILES CLEAN on 6.18
 `pinctrl-rockchip.o` (173688 bytes) builds no-errors. Transplanted from vendor 5.10 (effort S,
 zero API drift — the survey's assessment held): added `RV1106` to the type enum; a 159-line
 block of `RV1106_DRV/PULL/SMT_*` macros + 3 `rv1106_calc_*_reg_and_bit()` functions; `case
@@ -58,12 +58,12 @@ RV1106:` in the 3 pull functions + the RK3568 drive-strength group; `rv1106_pin_
 - **Still PORT-VERIFY:** GPIO4 bank pin-count (`pin_banks` says 24, DT `gpio-ranges` says 32) —
   carried from vendor unchanged; needs TRM/hardware.
 
-## M1 — mach: ✅ DONE
+## M1 — mach: DONE
 `mach-rockchip` RV1106/RV1103 SoC recognition added as a DT-compat entry (no
 `CPU_RV1106` symbol recreated). Captured as `mach/0001-rv1106-soc-recognition.patch`.
 **M1 is complete: clk + pinctrl + mach all compile clean on 6.18.**
 
-## M2 — earlycon build: ✅ DONE (boot pending hardware)
+## M2 — earlycon build: DONE (boot pending hardware)
 The first full kernel build with our SoC drivers, 2026-08-24:
 - **`multi_v7_defconfig` + `configs/m2-earlycon.fragment` builds an 11.8 MB zImage**
   with `clk-rv1106.o` (85732 B) and `pinctrl-rockchip.o` (173688 B, our rv1106 data)
@@ -80,7 +80,7 @@ The first full kernel build with our SoC drivers, 2026-08-24:
 console baud (1.5M assumed). A wrong DDR/clock value silently hangs before or just after
 earlycon.
 
-## M2 — boot: ✅ DONE — "it's alive" on warden-c8a3 (2026-08-24)
+## M2 — boot: DONE — "it's alive" on warden-c8a3 (2026-08-24)
 The self-built **Linux 6.18.46 boots on real RV1106 hardware**, through our ported
 drivers, verified over the serial console. It reaches earlycon, the arch timer
 (BogoMIPS calibrated), **our `clk-rv1106` CRU driver**, pinctrl, and the mainline
@@ -105,7 +105,7 @@ Three bring-up bugs were found and fixed on hardware, all captured in the DT:
 comes up far enough to clock the UART and the arch timer on hardware. A wrong CPU
 mux/PLL would show later (cpufreq / peripheral rates), still to be checked.
 
-## M3 — rootfs boot: ✅ DONE — the full WardenOS runs on the 6.18 kernel (2026-08-24)
+## M3 — rootfs boot: DONE — the full WardenOS runs on the 6.18 kernel (2026-08-24)
 Adding the eMMC (`dw_mmc`) node to the DT was all M3 needed — the drivers are already
 in the config. On hardware:
 ```
diff --git a/kernel/rv1106-enablement/adc/SARADC-FIX.md b/kernel/rv1106-enablement/adc/SARADC-FIX.md
index d293cda..15911d0 100644
--- a/kernel/rv1106-enablement/adc/SARADC-FIX.md
+++ b/kernel/rv1106-enablement/adc/SARADC-FIX.md
@@ -1,4 +1,4 @@
-# SARADC — ✅ VERIFIED on warden-c8a3 (2026-08-25); the -22 was vref, not clk
+# SARADC — VERIFIED on warden-c8a3 (2026-08-25); the -22 was vref, not clk
 
 The rockchip_saradc probe failed `-22` NOT at clk_set_rate (no "failed to set
 adc clk rate" ever printed) but at `regulator_get_voltage(info->vref)` — with no
diff --git a/kernel/rv1106-enablement/audio/PORT-PROGRESS.md b/kernel/rv1106-enablement/audio/PORT-PROGRESS.md
index 42e38d8..f1aeee3 100644
--- a/kernel/rv1106-enablement/audio/PORT-PROGRESS.md
+++ b/kernel/rv1106-enablement/audio/PORT-PROGRESS.md
@@ -224,7 +224,7 @@ stuck in `deferred probe pending: asoc-simple-card: parse error`, no card.
 i2s0_8ch node already carries the `rockchip,rv1126-i2s-tdm` fallback compatible +
 `#sound-dai-cells=<0>`, so the mainline driver binds it).
 
-**✅ VERIFIED on c8a3:** `/proc/asound/cards` → `0 [rv1106acodec]: simple-card -
+**VERIFIED on c8a3:** `/proc/asound/cards` → `0 [rv1106acodec]: simple-card -
 rv1106-acodec`; `aplay -l` → `card 0: rv1106acodec, device 0:
 ffae0000.i2s-rv1106-hifi`; `/dev/snd/` has `controlC0 pcmC0D0p pcmC0D0c` (playback
 + capture). Audible speaker test deferred to the bench (with the display).
diff --git a/kernel/rv1106-enablement/display/README.md b/kernel/rv1106-enablement/display/README.md
index ebd4326..e44680e 100644
--- a/kernel/rv1106-enablement/display/README.md
+++ b/kernel/rv1106-enablement/display/README.md
@@ -39,7 +39,7 @@ rockchip-drm display-subsystem: bound ff990000.vop
 brightness settable). **The VOP driver port is validated** — the register data,
 version, feature, and resets are right.
 
-## ✅ RESOLVED — full UI renders on the panel (2026-08-25)
+## RESOLVED — full UI renders on the panel (2026-08-25)
 
 The connector *and* the deeper black-screen chain that followed it are fixed; the
 86-Panel now draws the full WardenOS Dashboard on 6.18 (`_b`), verified by webcam.
diff --git a/kernel/rv1106-enablement/display/VERIFIED.md b/kernel/rv1106-enablement/display/VERIFIED.md
index a73f1f0..c2d3236 100644
--- a/kernel/rv1106-enablement/display/VERIFIED.md
+++ b/kernel/rv1106-enablement/display/VERIFIED.md
@@ -1,4 +1,4 @@
-# Display (VOP + RGB panel) — ✅ VERIFIED on warden-c8a3 (2026-08-25)
+# Display (VOP + RGB panel) — VERIFIED on warden-c8a3 (2026-08-25)
 
 The 86-Panel renders the **full WardenOS Dashboard UI** on our self-built Linux
 6.18.46 (`_b` slot), pixel-identical to the stock 5.10 `_a` slot. Verified by
diff --git a/kernel/rv1106-enablement/gmac/PORT-DONE.md b/kernel/rv1106-enablement/gmac/PORT-DONE.md
index ca1f03c..e915a75 100644
--- a/kernel/rv1106-enablement/gmac/PORT-DONE.md
+++ b/kernel/rv1106-enablement/gmac/PORT-DONE.md
@@ -1,4 +1,4 @@
-# GMAC (wired 10/100 ethernet) — ✅ VERIFIED on warden-c8a3 (2026-08-25)
+# GMAC (wired 10/100 ethernet) — VERIFIED on warden-c8a3 (2026-08-25)
 
 **Result: `eth0: Link is Up - 100Mbps/Full - flow control rx/tx`** on our
 self-built 6.18.46. The 86-Panel's RMII MAC + on-die 10/100 FEPHY works; a real
diff --git a/kernel/rv1106-enablement/mailbox/VERIFIED.md b/kernel/rv1106-enablement/mailbox/VERIFIED.md
index 793b2c3..733520e 100644
--- a/kernel/rv1106-enablement/mailbox/VERIFIED.md
+++ b/kernel/rv1106-enablement/mailbox/VERIFIED.md
@@ -1,4 +1,4 @@
-# HPMCU mailbox — ✅ 100% VERIFIED on warden-c8a3 (2026-08-25)
+# HPMCU mailbox — [x] 100% VERIFIED on warden-c8a3 (2026-08-25)
 
 A fully-open A7 ↔ HPMCU (RISC-V SCR1) hardware-mailbox round-trip on our self-built
 Linux 6.18.46. Open kernel driver + open SCR1 firmware, **zero blobs**.
@@ -7,11 +7,11 @@ Linux 6.18.46. Open kernel driver + open SCR1 firmware, **zero blobs**.
 SCR1 echo firmware running: `DBG_STATE = 0x584F424D` ("MBOX"). Five round-trips,
 Linux → mailbox → SCR1 → mailbox → Linux, **all exact**:
 ```
-sent 0x0000beef/0x600df00d -> B2A 0x0000BEEF/0x600DF00D  e=4  ✓
-sent 0x0000c0de/0x12345678 -> B2A 0x0000C0DE/0x12345678  e=5  ✓
-sent 0x0000face/0xdeadbeef -> B2A 0x0000FACE/0xDEADBEEF  e=6  ✓
-sent 0x00001234/0xcafef00d -> B2A 0x00001234/0xCAFEF00D  e=7  ✓
-sent 0x0000aa55/0x55aa55aa -> B2A 0x0000AA55/0x55AA55AA  e=8  ✓
+sent 0x0000beef/0x600df00d -> B2A 0x0000BEEF/0x600DF00D  e=4  OK
+sent 0x0000c0de/0x12345678 -> B2A 0x0000C0DE/0x12345678  e=5  OK
+sent 0x0000face/0xdeadbeef -> B2A 0x0000FACE/0xDEADBEEF  e=6  OK
+sent 0x00001234/0xcafef00d -> B2A 0x00001234/0xCAFEF00D  e=7  OK
+sent 0x0000aa55/0x55aa55aa -> B2A 0x0000AA55/0x55AA55AA  e=8  OK
 ```
 Echo counter increments 1:1 with sends; both CMD and DAT echo back verbatim.
 
diff --git a/kernel/rv1106-enablement/npu/PORT-PLAN.md b/kernel/rv1106-enablement/npu/PORT-PLAN.md
index c096b54..da06af7 100644
--- a/kernel/rv1106-enablement/npu/PORT-PLAN.md
+++ b/kernel/rv1106-enablement/npu/PORT-PLAN.md
@@ -8,7 +8,7 @@ target as the rest of this port: **Linux 6.18.46 vanilla**
 (`flare-edge/research/linux-6.18.46/`), forward-ported from vendor 5.10.160, built
 with our `arm-rockchip830-...-gcc 8.3` toolchain — see `../PORT-STATUS.md` and
 `../../docs/bringup.md` for the method and milestones this slots into (M6, listed
-in `../DRIVER-PARITY.md` as "NPU (rknpu, ff660000) | out-of-tree | ⬜ M6").
+in `../DRIVER-PARITY.md` as "NPU (rknpu, ff660000) | out-of-tree | [ ] M6").
 
 Builds on `warden-sdk/docs/npu-graphics-feasibility.md`, which already read this
 same driver source to answer a narrower question (can the NPU do graphics — no).
diff --git a/kernel/rv1106-enablement/npu/PORT-PROGRESS.md b/kernel/rv1106-enablement/npu/PORT-PROGRESS.md
index 905aecd..7264463 100644
--- a/kernel/rv1106-enablement/npu/PORT-PROGRESS.md
+++ b/kernel/rv1106-enablement/npu/PORT-PROGRESS.md
@@ -331,6 +331,6 @@ the value of checking the decoded string, not just the ioctl return code.
 
 ## Also updated this session
 
-`../DRIVER-PARITY.md`'s NPU row: `⬜ M6 — plan: npu/PORT-PLAN.md` -> `🔨 M6 built,
+`../DRIVER-PARITY.md`'s NPU row: `[ ] M6 — plan: npu/PORT-PLAN.md` -> `[wip] M6 built,
 0 errors/0 warnings, 99 rknpu-prefixed symbols in System.map, &npu
 {status="okay"} in the dtb — not yet flashed/probed on hardware`.
diff --git a/kernel/rv1106-enablement/npu/VERIFIED.md b/kernel/rv1106-enablement/npu/VERIFIED.md
index fa4e5d9..f6ddfe0 100644
--- a/kernel/rv1106-enablement/npu/VERIFIED.md
+++ b/kernel/rv1106-enablement/npu/VERIFIED.md
@@ -1,4 +1,4 @@
-# NPU (rknpu) open kernel driver — ✅ VERIFIED on warden-c8a3 (2026-08-25)
+# NPU (rknpu) open kernel driver — VERIFIED on warden-c8a3 (2026-08-25)
 
 The open GPL rknpu kernel driver runs on our self-built Linux 6.18.46. This is the
 achievable open end state (Tier A in `OPEN-NPU-PLAN.md`); open *compute* remains a
diff --git a/kernel/rv1106-enablement/pvtm/PORT-DONE.md b/kernel/rv1106-enablement/pvtm/PORT-DONE.md
index f5ba37a..03d99bf 100644
--- a/kernel/rv1106-enablement/pvtm/PORT-DONE.md
+++ b/kernel/rv1106-enablement/pvtm/PORT-DONE.md
@@ -1,4 +1,4 @@
-# PVTM (Process-Voltage-Temperature Monitor) — ✅ VERIFIED on warden-c8a3 (2026-08-25)
+# PVTM (Process-Voltage-Temperature Monitor) — VERIFIED on warden-c8a3 (2026-08-25)
 
 Whole-driver port: mainline 6.18 has **no** rockchip pvtm driver; the vendor
 `drivers/soc/rockchip/rockchip_pvtm.c` (GPL-2.0, 1046L) supports rv1106. Copied it in
diff --git a/kernel/rv1106-enablement/rga/PORT-PLAN.md b/kernel/rv1106-enablement/rga/PORT-PLAN.md
index c6660db..fce5f02 100644
--- a/kernel/rv1106-enablement/rga/PORT-PLAN.md
+++ b/kernel/rv1106-enablement/rga/PORT-PLAN.md
@@ -294,8 +294,8 @@ implied by this kernel port.
 - **CMA pool sizing** — 10 MiB was sized against the 5.10 image's actual usage (graph
   canvas + scanout mirror at 720×720×4B ≈ 2 MiB each); carry the same size unless a
   future accounting shows it's tight.
-- **Driver-parity table** (`../DRIVER-PARITY.md`) should move `RGA 2D (rga2)` from ⬜ to
-  🔨/✅ as these steps land, same convention as every other M-milestone row.
+- **Driver-parity table** (`../DRIVER-PARITY.md`) should move `RGA 2D (rga2)` from [ ] to
+  [wip]/[x] as these steps land, same convention as every other M-milestone row.
 
 ## Sources
 
diff --git a/kernel/rv1106-enablement/rng-otp/PORT-DONE.md b/kernel/rv1106-enablement/rng-otp/PORT-DONE.md
index 46cfc86..a96688f 100644
--- a/kernel/rv1106-enablement/rng-otp/PORT-DONE.md
+++ b/kernel/rv1106-enablement/rng-otp/PORT-DONE.md
@@ -1,6 +1,6 @@
 # TRNG + OTP port (batch A) — 6.18
 
-## TRNG (hardware RNG) — ✅ VERIFIED on warden-c8a3 (2026-08-25)
+## TRNG (hardware RNG) — VERIFIED on warden-c8a3 (2026-08-25)
 rv1106's `rockchip,trngv1` is the same standalone TRNG_V1 IP as rk3588 (identical
 register map). Mainline `drivers/char/hw_random/rockchip-rng.c` already drives it.
 
@@ -21,7 +21,7 @@ rv1106's clock/reset names need no special handling.) Kconfig
 `dd if=/dev/hwrng bs=16` → `c697 503d f9db 6b84 50e4 e1ee f232 b2ae` (real HW
 entropy, non-zero). Hardware entropy source for the panel's crypto/keys.
 
-## OTP / nvmem — ✅ VERIFIED on warden-c8a3 (2026-08-25)
+## OTP / nvmem — VERIFIED on warden-c8a3 (2026-08-25)
 Reads real data: `dd .../rockchip-otp0/nvmem bs=1 count=16 | xxd` →
 `5211 02fe 084d 5231 0000 0000 3b15 0000` (contains "MR1" chip id) — no timeout.
 Mainline `drivers/nvmem/rockchip-otp.c` gains an `rv1106_data` + compatible.
diff --git a/kernel/rv1106-enablement/touch/VERIFIED.md b/kernel/rv1106-enablement/touch/VERIFIED.md
index 383c9c5..2174e9d 100644
--- a/kernel/rv1106-enablement/touch/VERIFIED.md
+++ b/kernel/rv1106-enablement/touch/VERIFIED.md
@@ -1,4 +1,4 @@
-# GT911 capacitive touch — ✅ VERIFIED on warden-c8a3 (2026-08-25)
+# GT911 capacitive touch — VERIFIED on warden-c8a3 (2026-08-25)
 
 Touch works on our self-built 6.18.46 (`_b`): the WardenOS UI responds to
 taps/swipes ([maintainer] confirmed on the physical panel). Objective evidence:
diff --git a/kernel/rv1106-enablement/wifi/PORT-PLAN.md b/kernel/rv1106-enablement/wifi/PORT-PLAN.md
index 895dfa7..17c5c9f 100644
--- a/kernel/rv1106-enablement/wifi/PORT-PLAN.md
+++ b/kernel/rv1106-enablement/wifi/PORT-PLAN.md
@@ -120,7 +120,7 @@ cfg80211.ko → libarc4.ko → ctr.ko → ccm.ko → libaes.ko → aes_generic.k
 see `insmod_wifi.sh:126-137` and `wifi-bluetooth-aic8800.md`); nothing to
 replicate there. The crypto modules (arc4/ctr/ccm/aes) are dependencies of the
 driver's internal key-handling, not aic8800-specific — confirm they're already
-`=y`/reachable in the 6.18 config (crypto is currently listed as "⬜ batch2" in
+`=y`/reachable in the 6.18 config (crypto is currently listed as "[ ] batch2" in
 `../DRIVER-PARITY.md`; flip alongside this work).
 
 **DT node — correction to the task's framing.** The task description assumed
@@ -295,7 +295,7 @@ No breaking changes found in `sdio_driver`, `sdio_claim_host`/`release_host`,
 `sdio_readb`/`writesb`, `sdio_set_block_size` between 5.10 and 6.18 (low
 research depth on this axis — treat as low-risk, smoke-test rather than
 line-audit). The mainline `dw_mmc`/`dw_mmc-rockchip` host driver is already
-proven on 6.18 for eMMC (`../DRIVER-PARITY.md`: `dw_mmc (eMMC) | mainline | ✅ M3`)
+proven on 6.18 for eMMC (`../DRIVER-PARITY.md`: `dw_mmc (eMMC) | mainline | [x] M3`)
 and `CONFIG_MMC_DW_ROCKCHIP=y` is already in the live `.config` — the SDIO
 *controller* side of this port is de-risked; only the AIC8800 *card driver*
 above the `sdmmc` bus is new work.
@@ -410,7 +410,7 @@ CONFIG_BT_HCIUART_H4=y       # already =y (H4 is the transport this board's BT a
                               #   per hardware-86-panel.md: UART1/ttyS1, hciattach -s 1500000
                               #   ... any 1500000 flow nosleep)
 CONFIG_CRYPTO_ARC4=y CONFIG_CRYPTO_CTR=y CONFIG_CRYPTO_CCM=y CONFIG_CRYPTO_AES=y  # driver's
-                              #   internal key-handling deps, currently "⬜ batch2" in
+                              #   internal key-handling deps, currently "[ ] batch2" in
                               #   ../DRIVER-PARITY.md — confirm =y, not =m, alongside this work
 ```
 Do **not** enable `CONFIG_MAC80211` for this driver — confirmed by source
@@ -537,7 +537,7 @@ Follow the existing A/B `_b`-slot hardware-verification loop
    attaches and `hciattach -s 1500000 /dev/ttyS1 any 1500000 flow nosleep`
    (the known-good invocation) brings up an HCI device.
 8. **Update on landing**: mark the `AIC8800 wifi (bsp/fdrv)` and
-   `AIC8800 BT (btlpm)` rows in `../DRIVER-PARITY.md` ✅, with the same
+   `AIC8800 BT (btlpm)` rows in `../DRIVER-PARITY.md` [x], with the same
    "hardware-verified, not just compiled" bar every other row uses.
 
 ## Sources
diff --git a/kernel/rv1106-enablement/wifi/VERIFIED-on-c8a3.md b/kernel/rv1106-enablement/wifi/VERIFIED-on-c8a3.md
index dc16636..25d937b 100644
--- a/kernel/rv1106-enablement/wifi/VERIFIED-on-c8a3.md
+++ b/kernel/rv1106-enablement/wifi/VERIFIED-on-c8a3.md
@@ -10,10 +10,10 @@ live RF scan.
   `Start app: 00120000`, BSP_RC=0.
 - `insmod aic8800_fdrv.ko` → `ieee80211 phy0: HT supp 1, VHT supp 1, HE supp 1`,
   FDRV_RC=0.
-- `wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> ... link/ether [device-mac]`
-- `iw dev wlan0 scan` found real APs:
-  - **the site AP  [bssid]  2412 MHz  −43 dBm**
-  - a neighboring guest AP  [bssid]  2412 MHz  −73 dBm
+- `wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> ... link/ether <device MAC>`
+- `iw dev wlan0 scan` found real APs (SSIDs/BSSIDs redacted for publication):
+  - **the site AP at 2412 MHz, −43 dBm**
+  - a neighboring guest AP at 2412 MHz, −73 dBm
   - +several more, correct signal strengths → RF path fully functional.
 
 ## Why MODULES, not built-in (=y)
diff --git a/patches/README.md b/patches/README.md
index 44023d7..c2240b7 100644
--- a/patches/README.md
+++ b/patches/README.md
@@ -27,6 +27,14 @@ with `../build/warden_defconfig` → `zImage` + `rv1106-warden.dtb`).
 | `70-audio-codec.patch` | `rv1106_codec` + I2S wiring |
 | `80-misc-thermal-rtc-adc.patch` | tsadc, rtc-rockchip, saradc, trng, otp, gmac, goodix touch |
 
+## License
+
+Everything in this directory is a derivative work of the Linux kernel and of
+GPL-2.0 vendor kernel code: **GPL-2.0-only** (or the per-file SPDX identifier
+where one is present), regardless of the MIT/Apache dual license the rest of
+the repository uses. See the top-level `LICENSE` and
+`kernel/rv1106-enablement/PROVENANCE.md` (per-driver origin + license).
+
 ## Provenance & regeneration
 
 Baseline: `linux-6.18.46` from kernel.org (`build/linux-6.18.46.tar.xz.sha256`
diff --git a/qemu/README.md b/qemu/README.md
index eb19b33..37d81c8 100644
--- a/qemu/README.md
+++ b/qemu/README.md
@@ -97,5 +97,5 @@ stage-2 init when present.
 `qemu-system-arm` (Debian 13 ships QEMU 10), `curl`, `cpio`, `mkfs.ext4`,
 `gcc-arm-linux-gnueabihf` (kernel build), `python3` (+`cryptography` for the
 portal scenario's `.wfw` signing). CI: the hosted `qemu-tools` job builds the
-tooling; the boot smoke runs on the self-hosted kernel-build runner, which
-needs a one-time `apt-get install qemu-system-arm` (see docs/ci-cd.md).
+tooling; the boot smoke runs inside the (also hosted, dispatch-only)
+`kernel-build` job, which apt-installs its own toolchain and qemu (ADR-0007).