backlog(B-0792 P1): iter-5 wifi-credentials injection via USB ESP — homelab persona has NO ethernet; cluster must remember wifi on setup (Aaron 2026-05-26)

[AceHack]

Summary

Aaron 2026-05-26 surfaced the load-bearing substrate gap during iter-4.2 PC1 empirical test:

"we won't have ethernet for most machines it needs to remember the wifi on setup"

Today's NixOS install enables NetworkManager but bakes ZERO wifi credentials → first boot has no network on wifi-only mini-PCs (the homelab persona's default hardware). Defeats zero-typing discipline.

Five sub-targets

1. zflash extension — write `zeta-wifi-credentials.json` to ESP from operator's `~/.zeta/wifi-credentials.json` (or CLI flags / env vars)
2. zeta-install.sh extension — read ESP creds + write NetworkManager profile to `/etc/NetworkManager/system-connections/zeta-wifi.nmconnection` (chmod 0600)
3. NixOS config — NetworkManager wireless backend verify + Avahi mDNS publishing (so `ssh zeta@control-plane.local` resolves from operator Mac)
4. Multi-node hostname selection — `--host` flag → `zeta-hostname.txt` on ESP → install picks per-host config
5. Worker cluster join token (deferred; downstream of B-0776)

Empirical anchor

Aaron's PC1 booted iter-4.2-flashed USB; installed; rebooted; came up on console with no wifi configured (NetworkManager + zero creds = no network). `ssh zeta@control-plane.local` from operator Mac failed to resolve (no mDNS publishing). Cluster-side workaround would be `nmtui` on console (defeats zero-typing). Aaron's call: "lets just create another usb we are having cascading failures no need to continue" — fix substrate, re-flash with iter-5, retry.

Composes with

• B-0789 (iter-4 SSH+password substrate; depends_on; iter-5 extends ESP-injection pattern)
• B-0754 / B-0759 / B-0770 / B-0778 / B-0790
• `.claude/rules/human-audit-and-legal-risk-acceptance-pattern-in-settings.md` (potential `_wifi_credentials_acceptance` block if cluster goes beyond personal homelab)

Security framing

Wifi password on ESP = plaintext to anyone who can read the partition. Acceptance: homelab + maintainer persona under physical-USB-control assumption. NOT acceptable for shared infrastructure / multi-tenant. Future hardening (encrypted creds + Touch ID gate at boot) out-of-scope this row.

Out of scope

• Cluster orchestration substrate (k3s vs Talos vs whatever) — B-0776
• Worker join token / control-plane discovery — sub-target 5; deferred
• Encrypted credentials / Touch ID gate — future hardening
• WPA-Enterprise / 802.1X / corporate wifi — not homelab scope

Test plan

• Backlog row scoped + filed
• iter-5.1 PR: Avahi mDNS publishing + zflash wifi-creds injection + zeta-install.sh wifi-creds read (next; same session)
• Empirical: wifi-only mini-PC boots → joins wifi via injected creds → ssh-able via `.local` with NO console intervention

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.