Headless Pis lose /root/.ssh/authorized_keys to imaging, first-boot tooling,
or config management, which locks out the only SSH account that can fix it.
- ensure-root-ssh-key: idempotent POSIX sh installer. Appends managed public
keys from /usr/local/share/root-ssh-keys/authorized_keys, never removes or
rewrites foreign keys, skips lines whose first field is not a known key
algorithm, and enforces 0700 / 0600 root:root on the key dir and file.
- ensure-root-ssh-key.service: oneshot, ordered Before=ssh.service so the key
lands before the daemon starts; ConditionPathExists skips it when the
managed keys file is absent.
- ensure-root-ssh-key.path: PathChanged= + PathModified= on authorized_keys so
deletes, renames, and in-place edits are healed at runtime, not just at boot.
Writes only when a key is missing, so the unit settles after one no-op run.
- authorized_keys.example: template with commented placeholder keys only; the
real file stays on the host.
- root-ssh-key.md: runbook with deploy, verification, revocation steps, and
the gotcha that systemd has no PathMissing= key.
LLM-Generated: true
Documents the single-GPU (TP1) vllm-radiance deployment on
driveripper-ai, measured KV capacity analysis for the 154K config, and
the full FP8-KV calibration workflow (host prep through runtime
verification) including quadlet changes, deployment steps, and the
remaining matched-control quality gate.
LLM-Generated: true
Passwordless sudo access scoped to specific commands (dnf, systemctl,
firewall-cmd, ansible, qemu/virt, btrfs, acl) for ansible and
maintenance automations on the fedora host.
LLM-Generated: true
Documents the thinkingLevelMap for the juggernaut and turbo models in
the ~/.pi/agent/models.json example, and lowers maxTokens from 128000
to 32000 to match the working configuration.
LLM-Generated: true
Add documentation for installing a specific Flatpak commit version, including listing available commits and downgrading to a previous one.
LLM-Generated: true