[Tracker] v0.3.0 bare-metal first-boot bug bundle (Silverblue 42, RTX 3050 Ti)

[Moonwolf711]

Summary

After installing v0.3.0 onto bare-metal hardware (ASUS Zephyrus G15, RTX 3050 Ti, Silverblue 42 base), I hit ~10 bugs that prevented the appliance from reaching a working state without manual fixes. This tracker links each individual issue.

I'm filing this in case the maintainers want a single grep-able list. Each linked issue is reproducible and I'm happy to PR fixes for the ones I can.

Environment

• SecAI_OS v0.3.0 ISO (sha256 22a5b18…, cosign-verified)
• Bare metal: ASUS Zephyrus G15 (Ryzen 9 6900HS, RTX 3050 Ti 8GB, 16GB RAM)
• GPU passthrough: N/A (bare metal)
• Profile: offline_private (default — full_lab switching is also broken, see below)

Bugs

Critical — block first-boot

• v0.3.0 bare-metal: detect-vm.sh writes multi-line HYPERVISOR= when systemd-detect-virt exits non-zero #32 — detect-vm.sh multi-line HYPERVISOR= on bare metal
• v0.3.0: detect-tee.sh writes unquoted TEE_DETAIL with spaces; sourcing tee.env errors with 'SEV: command not found' #33 — detect-tee.sh unquoted TEE_DETAIL splits on space
• v0.3.0: select-model.sh shipped without exec bit; secure-ai-inference fails with status=203/EXEC #34 — select-model.sh missing exec bit (status=203/EXEC)
• v0.3.0: secure-ai-inference.service WatchdogSec=30 kills llama-server during model load; infinite crash-loop on 7B Q4 #35 — secure-ai-inference.service watchdog kills llama-server mid-load

High

• v0.3.0: Silverblue base — first-boot group assignment (input/audio/video) doesn't persist; user can't access /dev/input or /dev/video0 #36 — Silverblue /etc/group empty; group assignment doesn't persist (input/audio/video)
• /var/lib/secure-ai/auth/ directory missing on first boot — auth setup writes fail silently
• Profile switch to full_lab fails: secure-ai-boot-verify + secure-ai-health-check exit non-zero (didn't dig deeper; happy to file separately if useful)

Medium

• secure-ai-*.service user units use SupplementaryGroups= which is system-only — systemd refuses to start --user services with this directive.

Notes / context

• Pattern across the detect-* scripts: variables assigned via heredoc using KEY=${VAR} instead of KEY="${VAR}" cause the shell to interpret subsequent words as commands when ${VAR} contains whitespace or newlines.
• || short-circuit error fallbacks in those scripts append a second value to an already-set variable, producing multi-line output that breaks downstream parsers.

I have local fix scripts for the ones above. Happy to PR if you'd like; let me know preferred format (one PR per bug, or a single "0.3.0 bare-metal first-boot fixes" PR).

🤖 Generated with claude-flow