# Guest Payloads

Drop **static musl armv7** binaries in this directory (contents are
gitignored; binaries are never committed); `qemu/mkimage.sh` copies everything
in this directory (except this README) into `/usr/bin/` of both rootfs slots.
Static musl is the same target the device uses for its Rust daemons, so the
exact production binaries run unmodified in the VM.

Typical payload, built in a flare-edge checkout:

```sh
# flared (static musl armv7)
tools/build-flared.sh --local
# warden-modbus and friends: see tools/build-firmware.sh for the recipes
```

Then:

```sh
cp <flare-edge>/target/armv7-unknown-linux-musleabihf/release/warden-flared qemu/payload/
```

Or take them from a panel that already runs them: every daemon is a static
musl binary, so flare-edge `tools/rig-pull-daemons.sh --host <panel>` copies
`/usr/bin/warden-*` straight into this directory (recording the panel's
release and each md5 in `PULLED.txt`), minus `warden-ui`, which the rig
needs as the fbdev+evdev build.

Stage-2 init starts every `warden-*` daemon it finds here, in the panel's
own S-number order (ai, automation, modbus, mikrotik, asic, starlink,
stratum, flared), then `warden-ui` (the UI also needs `--display
on|headless` + the virt.fragment kernel for /dev/fb0). Logs land in
`/tmp/<name>.log` inside the guest, readable over the control bridge with
`ctl @cat /tmp/<name>.log`. An empty payload is valid: the image boots
busybox-only.