Install the driver, enrol the key, and still never ask twice

Phase 3 of the fresh-install spec: the parts of a run that depend on what the
machine actually is. NVIDIA, Secure Boot, Fedora's preinstalled extras, firmware.

Two of these looked like they would force a compromise, and neither did.

sunhat opened an editor in the middle of its run so grub could be hand-corrected,
and that single step is why walking away from an install did not work. The step
existed to delete duplicated kernel arguments -- and grubby replaces an argument
that already exists rather than appending a second copy, so the duplicates cannot
accumulate and there is nothing to correct. The editor was load-bearing for a
problem that a different tool does not have.

MOK enrolment needs a password now and the same password at the next boot's blue
screen, which reads like a prompt that has to happen mid-run. mokutil has
--generate-hash and --hash-file for exactly this: the interview asks, hashes it
on the spot, and records only the hash. The plaintext never reaches the answers
file, the environment, or a command line, and the stage runs without asking.

The stage runs last rather than fourth as the spec's table had it. The constraint
was always "late" and fourth of eight is not late: enrolment arms a prompt for the
next boot and firmware may want a reboot, so a machine that reboots out of this
stage should already be completely configured.

Every question names what was found -- the card, the packages actually installed
-- and is not asked at all on a machine it would do nothing to. sunhat's debloat
list no longer describes Fedora 44: totem became showtime and LibreOffice is not
preinstalled, so the list is curated and a package that is not installed is never
passed to dnf, which is what lets it outlive a release.

This stage cannot be verified by running it. It installs a proprietary driver and
queues a Secure Boot enrolment, and this machine is an AMD desktop. So every
privileged command is stood in on PATH and the contract asserts which answer led
to which call: that no answers means no commands, that a failed driver install is
not followed by arguments and services for a driver that is not there, that the
hash reaches mokutil through a file and never a command line, and that removal is
offered only for packages that are installed. The contract was checked by breaking
the stage three ways and confirming it caught each. It does not verify that
akmod-nvidia builds, and says so where a reader would otherwise assume it did.

The README's stage table listed three of seven stages; the interview and identity
work never reached it. Corrected rather than extended, since a table that lists
three of seven is worse than one that lists none. The Desktops section still
describes a GNOME session nothing installs -- that is phase 5.

Claude-Session: https://claude.ai/code/session_01NvgBuSWB5sE43yWmg21ozj

docs/superpowers/specs/2026-08-20-panama-fresh-install-design.md

@@ -156,24 +156,39 @@ way. The new order:
 | Stage | Status | Responsibility |
 |---|---|---|
 | `interview` | new | Every prompt, before any work |
-| `install-packages` | edited | Repos, package lists, extras, debloat |
-| `install-cursors` | new | Vendored cursor theme into `~/.local/share/icons` |
-| `install-hardware` | new | NVIDIA, akmods, secure boot, firmware — all conditional |
-| `link-dotfiles` | edited | Adds the wallpaper; drops `forge` |
+| `install-packages` | edited | Repos, package lists, extras |
+| `link-dotfiles` | edited | Adds the wallpaper and the cursor theme; drops `forge` |
 | `change-settings` | edited | Unchanged in substance |
 | `link-vicinae-scripts` | unchanged | |
 | `setup-identity` | new | git config, `gh auth login`, SSH key |
+| `install-hardware` | new | NVIDIA, akmods, secure boot, debloat, firmware — all conditional |
+
+Two things in this table changed while building it, and the reasons are worth
+keeping.
+
+There is no `install-cursors`. The cursor theme is vendored into the repository
+and exposed by the same narrow per-directory symlink `link-dotfiles` already uses
+for icons and Vicinae themes, so it needs no stage of its own — and because
+`link-dotfiles` precedes `change-settings`, the ordering constraint that stage
+was invented to satisfy holds anyway.
+
+`install-hardware` runs *last*, not fourth. The constraint was always "late", and
+fourth of eight is not late: MOK enrolment arms a prompt consumed at the next
+boot and a firmware update may ask for a reboot, so a machine that reboots out of
+this stage should already be completely configured — dotfiles linked, settings
+applied, identity set. Placing it after `setup-identity` costs nothing, since
+nothing later depends on it.
 
 Ordering constraints that are not obvious and must not be broken:
 
-- `install-cursors` precedes `change-settings`, because `change-settings` sets a
+- `link-dotfiles` precedes `change-settings`, because `change-settings` sets a
   gsettings value naming a cursor theme. Setting it before the theme exists is not
   an error, but it does mean the first session renders with a fallback. Fonts are
   installed by `install-packages`, which already runs first.
 - `setup-identity` follows `install-packages`, because `gh` is installed there.
-- `install-hardware` runs late; MOK enrollment sets a password consumed at the next
-  boot, and firmware updates may prompt for a reboot. Neither should sit in front of
-  twenty minutes of package work.
+- `install-hardware` is last, for the reason above. It also has to follow its own
+  driver install: akmods generates the certificate that MOK enrolment enrols, so
+  there is nothing to enrol until `akmod-nvidia` is on the machine.
 
 Every stage stays independently re-runnable and independently failable, which is
 the existing contract and the reason Panama exists.
@@ -297,12 +312,30 @@ hostname and it was one of the things that made sunhat unmaintainable.
 
 Everything below blocks sunhat's deletion.
 
-- **NVIDIA and secure boot** — `akmod-nvidia`, `xorg-x11-drv-nvidia-cuda`, MOK
-  enrollment via `mokutil --import`, and the `rebuild_nvidia_kmod` helper. sunhat's
-  version opened an editor to hand-edit grub; the replacement does not, because a
-  step that requires a human mid-run is the failure this repository exists to avoid.
-- **Fedora debloat** — removing `gnome-contacts`, `gnome-tour`, `gnome-maps`,
-  `totem` and the LibreOffice components, behind an interview question.
+- **NVIDIA and secure boot** — `akmod-nvidia`, `xorg-x11-drv-nvidia-cuda` and MOK
+  enrolment via `mokutil --import`. sunhat's version opened an editor to hand-edit
+  grub; the replacement does not, because a step that requires a human mid-run is
+  the failure this repository exists to avoid. It turned out not to need one:
+  sunhat's editor step existed to delete duplicated kernel arguments, and `grubby
+  --update-kernel=ALL --args=` replaces an argument that already exists rather than
+  appending a second copy, so the duplicates cannot accumulate.
+
+  Enrolment is likewise non-interactive, and did not need a compromise either.
+  `mokutil --generate-hash` and `--hash-file` are exactly the pair for this: the
+  interview asks for the password, hashes it immediately, and records only the
+  hash — so the plaintext never reaches the answers file, the environment, or a
+  command line, and the stage still runs without prompting.
+
+  `rebuild_nvidia_kmod` was not ported. akmods already rebuilds on kernel updates
+  through its own systemd unit, and a helper that duplicates that is one more
+  thing to keep true.
+- **Fedora debloat** — behind an interview question. sunhat's list was
+  `gnome-contacts`, `gnome-tour`, `gnome-maps`, `totem` and three LibreOffice
+  components; on Fedora 44 `totem` has been replaced by `showtime` and LibreOffice
+  is not preinstalled at all, so the list is `gnome-contacts`, `gnome-tour`,
+  `gnome-maps` and `showtime`. A package that is not installed is never passed to
+  dnf, which is what lets the list outlive a Fedora release rather than starting to
+  fail on one.
 - **Firmware** — `fwupdmgr refresh` and `update`, behind an interview question.
   Panama's Updates page covers this after installation; the installer covers the
   first run.
@@ -370,6 +403,13 @@ three places instead:
 
 - **The assets contract**, which encodes each gap found here as a test that fails on
   the broken tree.
+- **The hardware contract**, for the one stage that cannot be verified by running
+  it. `install-hardware` installs a proprietary driver and queues a Secure Boot
+  enrolment, and the machine Panama is developed on is an AMD desktop; so every
+  privileged command is stood in on `PATH` and the contract asserts which answer
+  led to which call. That covers the decisions, which is the part that can be
+  wrong. It does not cover whether `akmod-nvidia` builds, and does not claim to —
+  the first real NVIDIA machine is still the first real test.
 - **`panama doctor` at the end of every install**, which reports what is actually
   running rather than what was attempted.
 - **`panama test`**, which makes the existing 119 contracts runnable in one command