nordisk/holger

Tasks for Henrik

Status 2026-10-31. Base: holger main at 8cf62bd2, holger-ui main at 17ed50ab. Fetch and merge main often: other work lands every day.

Rules for all tasks:

• Work on branches henrik/<task> and open a pull request into main on gunnar.rs. Rickard merges after the gate is green.
• Test-first where it is code. Run cargo xtask ci --quick before each push.

Read first

All of these are in this repository and render on gunnar.rs: https://gunnar.rs/nordisk/holger/blob/

• The plan: docs/ROADMAP.md. It covers the next release, the smart flow, NCSC, the supply chain, Heimdall, speed and the appliance.

• The manual, docs v2 (it describes only what is built): docs/v2/README.md. For these tasks:

  • 01-what-holger-is.md: the installation picture, the 12 formats, the four products;
  • 02-install.md: cargo install and the features (all-formats, online, federation, full);
  • 03-three-products.md: server + UI + downstream by hand; task 2 follows it;
  • 06-pairing.md: front, main, twin and downstreams, the signed invites, the WireGuard pre-shared key;
  • 08-supply-chain.md: DSSE/SLSA/Sigstore, SBOM, the signed bundle, the one-way downstream, untrusted work as jobs;
  • 10-security.md and threat-model.md: post-quantum TLS, the crafted-bundle guard, the OpenZL cap;
  • 04, 05, 09 and 11 are the outlines task 3 fills in.

• The README section "Three products by hand" (the guide, which cargo xtask products runs as a test).

• Releases and signing: slsa/README.md (the YubiKey release key, and how to verify a release) and docs/v2/07-build-thing.md.

• How to contribute: CONTRIBUTING.md, CLA.md (accept it with one line in CLA-SIGNATURES.md in your first pull request) and SECURITY.md.

• The smart flow: docs/tasks/HOL-FLOW-SMART.md.

The first task is in its own file: the smart flow, docs/tasks/HOL-FLOW-SMART.md. The three below are independent of it and of each other.

1. The console menus (holger-ui)

What is wrong today (seen on holger.rs and test2.holger.rs):

• The Admin tabs run together ("DisksTwinSyncGrowthClockPlugins / MonetizeLogs…"), with no gap and no wrapping on a phone.
• There are too many top items: console, Overview, Repositories, Search, Security, Operations, Mine, Account, Admin. "Mine" and "Operations" do not say what they are.
• Admin opens on disk detail and red "sits on no mount" lines for store folders that are only created at the first upload, not on what an admin needs first.

The goal:

• Separate tabs that wrap on a phone.
• A shorter top menu matching Gunnar's console: Overview, Repositories, Security, Account, Admin. Search goes in the header, and Operations moves inside Admin.
• Admin opens on its switches, with Public site first; the disk detail gets its own tab; there are no false red lines (a folder that does not exist yet says "created at the first upload").
• The console stays a thin layer: it shows what holger answers, with no logic of its own.

Where: holger-ui src/ (the nav and the admin page), tests/ and browser-tests/tests/console.rs. Check the result in a browser at desktop and phone width.

2. Field test: Holger on-prem, end to end (the airgap story)

Nobody has yet run the by-hand guide on real machines. Use two Linux machines, or VMs, at Vetra:

1. Upstream: cargo install holger and cargo install holger-ui, a minimal RON with passkey sign-in, then pip packages and an OCI image pulled through Holger, scanned and approved by 2 people.
2. Downstream, online: cargo install holger-downstream --features fetch, enrolled with a signed invite (holger-cli downstream invite), then pip install and podman pull through it.
3. Downstream, one-way (CDS): the default holger-downstream, with boundary: OneWay. The upstream exports a signed bundle (export: (push_to: …) or holger-cli bundle), you carry it on a USB stick, the admin allows the first import (holger bundle allow-first-import …), and then it imports and serves.
4. Verify through Holger: cosign verify on the image, and the SBOM and scan evidence as referrers.

Write down every step that is unclear, missing from the README or broken, with the exact command and output, as issues on gunnar.rs/nordisk/holger/issues (they are public) or in one file docs/tasks/field-test-results.md on your branch.

3. Docs v2: chapters 4, 5, 9 and 11

docs/v2 describes only what is built, and no text is copied from the old docs. These chapters are outlines today; fill them with real, checked examples:

• 4, The RON: sources, steps, rules, gates, repositories, and boundary/domain/trust/export. Use one complete example RON that boots, and the flow picture of it.
• 5, The intake chain: incoming → quarantine → approved → production, each scanner, approvals (default 2), refusals by name, and the audit queries (holger-cli audit query).
• 9, The estate: an OS-less Holger sold through the ONE box: front, main, twin, updates (front first), backup and growth. Ask Rickard about what is not obvious.
• 11, Reference: the CLI verbs (--help output), the HTTP/gRPC doors, the metrics and counters, and the error codes (holger-*).

Every claim must match the code on main. Run nornir docs check holger before you push (README.md is generated from .nornir/README.md).