fix(galactica): load Kyber writer key without login passphrase
Summary
Galactica's system agenix job stops at its existing passphrase-protected GPG/SSH secrets when launchd has no terminal. A manual activation prompted for that passphrase and installed the Kyber writer key, but the headless job kept exiting 1. This change gives only the writer key an independent root launchd job that decrypts its host-key-encrypted ciphertext and atomically installs a user-owned 0400 key file.
The existing GPG and Git SSH secret recipients are unchanged. The old agenix job remains responsible for those secrets; its headless passphrase issue is separate.
Before / after
| Surface | Before | After |
|---|---|---|
| Writer key at boot | Shared agenix job stops on an earlier passphrase-protected secret. | A scoped RunAtLoad job decrypts only the writer ciphertext with Galactica's SSH host key. |
| Key installation | A manual agenix run creates a link into its RAM disk. | The job atomically replaces the key path with a regular file owned by the user at mode 0400. |
| Other secrets | Existing recipients and agenix service. | Same recipients and service. |
Validation
- The final pushed head b7df6308ad516a0e7465db81fa2ef519f6499e1b includes current main.
make build HOST=galacticaandnix build --no-link .#checks.aarch64-darwin.eval-darwin-galacticapassed on that head. - Nix evaluation confirms the writer job runs at load, retries a failed decrypt with a 60-second throttle, logs failures, and stays outside the passphrase-dependent agenix secret set.
- The built job passed
bash -n;nixfmt --checkandgit diff --check origin/main...HEADpassed. The first PR head passed six GitHub checks; checks for the final head are pending readback. - Review follow-up: the three Cubic findings were addressed by updating the evaluation assertion, adding a launchd log, and retrying failures. Commit 98afb6d7e8439fc847344f16da6189668ef320f2.
Activation and rollback
After review and merge, build/switch Galactica from the merged revision with local sudo. Read back the launchd job result, key owner/mode and regular-file type, then prove that pinned BatchMode SSH reaches Kyber's restricted command. The current key already authenticated after a manual agenix run; this PR needs a live headless activation readback to prove boot durability.
Rollback by reverting this daemon and restoring the writer's prior agenix mapping. Keep the restricted Kyber public key in place until a working writer identity has been verified, then remove it if the feature is retired.
Bead: df-mh4q3