docs(wiki): appliance provisioning runbook — booth unit 1 hardened (LUKS+TPM+SecureBoot+GRUB)

New wiki/decisions/appliance-provisioning.md: the hardware-verified step-by-step for
provisioning a booth PC (Dell OptiPlex 7070, i5-8500, discrete Nuvoton TPM 2.0) from
factory Windows to a hardened Ubuntu 26.04 LTS appliance. Every command was run on the
first real unit (2026-06-23). Captures the firmware-specific gotchas: Ventoy → 0x1A under
Secure Boot (flash ISO directly); the 7070 BIOS can't view db (verify via live USB); the
installer's hardware-backed encryption fails with PCR_UNUSABLE/dbt (use passphrase LUKS +
manual systemd-cryptenroll PCR-7 seal); GRUB password must be edit-only (--unrestricted)
to keep unattended boot.

OS hardening on unit 1 is COMPLETE + verified: LUKS FDE + TPM auto-unlock (PCR 7,
unattended) + Secure Boot (Deployed) + GRUB edit-lock (closes the init=/bin/bash root-shell
hole that PCR-7 sealing does not cover). Resolves the implementation half of
open-questions #12 for unit 1.

Cross-linked from disk-os-hardening; index + log updated. Still TODO on the box: Docker +
run the stack.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/log.md

@@ -1484,3 +1484,35 @@ insecure/change-me). VERIFIED: server image builds + runs — migrates, SPA serv
 / + /booth serve HTML, /api/nope JSON 404, no sqlite outside /data. Vision image build + smoke in
 progress. New page [[container-deployment]]; updated [[vision-service-packaging]] (resolved its two
 open Qs), index. Server tests stay 141 green (SPA serving guarded on dist existence).
+
+## [2026-06-23] provision | First booth appliance — Dell OptiPlex 7070, Win11 → Ubuntu 26.04 LTS, encrypted + TPM-sealed
+Provisioned the first real booth PC. Hardware: Dell OptiPlex 7070, i5-8500, 238GB SSD, discrete
+Nuvoton TPM 2.0 (NOT Intel PTT — Get-Tpm ManufacturerIdTxt NTC). Formatted Win11 → Ubuntu 26.04 LTS
+(the decided platform). Gotchas hit + resolved, in order: (1) Ventoy USB → 0x1A Security Violation
+under Secure Boot (Ventoy's loader not in db) → flash the ISO directly; (2) the 7070 BIOS Expert Key
+Management is edit-only, no "View Key" → can't inspect db, so the live-USB boot IS the verification
+(it reached the installer with Secure Boot ON → MS 3rd-party UEFI CA confirmed present); (3) the
+installer's "Use hardware-backed encryption" FAILED with PCR_UNUSABLE / "secure boot policy (PCR7) …
+timestamp revocation (dbt) … not supported" — Ubuntu's automated FDE profiler can't model PCR7 on
+Dell firmware with a dbt; NOT a TPM/SB fault. Workaround: "Encrypt with a passphrase" (plain LUKS) +
+MANUAL TPM seal after boot via systemd-cryptenroll --tpm2-pcrs=7 /dev/sda3 (PCR 7 only — avoids
+kernel-churned 4/8/9 that would drop every boot to the passphrase). Two LUKS slots kept (0 password =
+recovery, 1 tpm2 = auto-unlock); crypttab gets tpm2-device=auto; update-initramfs; reboot → BOOTS
+STRAIGHT TO LOGIN, no passphrase → TPM auto-unlock VERIFIED (unattended reboot achieved). New runbook
+page [[appliance-provisioning]] (every command verified on hardware); cross-linked from
+[[disk-os-hardening]] (resolves impl half of open-questions #12 for unit 1) + index. REMAINING on the
+box: GRUB password, Docker install, run the parking-server/parking-vision stack.
+
+## [2026-06-23] provision | First booth appliance — GRUB edit-lock added; OS hardening COMPLETE
+Added the GRUB password (edit-only mode via --unrestricted) to the first booth unit. WHY it matters
+specifically: the PCR-7 TPM seal does NOT cover the GRUB-cmdline attack (editing the kernel line to
+init=/bin/bash doesn't change PCR 7, so the TPM still releases the LUKS key → root shell on the
+decrypted disk). Edit-only mode keeps unattended boot (the box still boots password-free; the
+password is required only to EDIT entries / open the GRUB shell) — the right config for an unattended
+booth. Verified BOTH halves in /boot/grub/grub.cfg before rebooting (password_pbkdf2 ≥1, unrestricted
+≥1) and on reboot: boots straight to login (no GRUB prompt, TPM auto-unlock intact) AND pressing `e`
+prompts for admin+password. OS hardening on unit 1 is now COMPLETE: LUKS FDE + TPM auto-unlock (PCR 7)
++ Secure Boot (Deployed) + GRUB edit-lock. Updated [[appliance-provisioning]] (§5 GRUB now a verified
+step, §5b further-hardening TODO: SSH key-only, kiosk lockdown, signing key→TPM, autoremove old
+kernel) + [[disk-os-hardening]]. STILL TODO on the box: Docker install + run the parking stack (needs
+the images pushed — dev push + registry secrets pending).