Persistent Wi-Fi on the physical board

Host date: 2026-09-22 America/Chicago (2026-09-23 UTC).

The image record identifies the declarative service image built from 45e5e1a. UMS wrote 2,308,751,360 bytes successfully in 186.5 seconds. No full-image readback was requested. The flashing harness ended with status 143 during Linux startup, so its own final boot verdict is incomplete; the independent fresh-boot console record confirms the new system, boot ID, and active shell, seatd and firewall.

That fresh image contained no Wi-Fi credential. The service condition skipped startup as intended; its state was inactive, not failed. The driver log level was 0, and the persistent directories were root-owned mode 0700.

The operator-authorized credential was transferred through non-echoing serial input into a mode-0600 runtime source, then installed root-owned mode 0600 at /var/lib/k230/wifi/wpa_supplicant.conf. The runtime source was removed. The credential never entered Git, argv, Nix expressions or the Nix store. The image supplies the service; systemd LoadCredential supplies the private runtime copy. The existing dhcpcd service remains the only DHCP client.

Before reboot, association, address assignment, default route, resolver route, DNS lookup and interface-bound outbound ping all passed. The first immediate check raced association and also exposed the pinned wpa_cli client’s separate default socket path. The documented -s option now selects the service’s private client directory explicitly; this is a diagnostic command fix, not a service or connection change.

A real warm reboot on USB power followed. No credential was re-provisioned and no manual supplicant start or DHCP request was issued after it. Sanitized post-reboot results and identity are recorded alongside this note. The board is left connected for the operator.

The source credential is intentional, root-controlled persistent state; application defaults still come from the image. Reboot retains it. Replacing the whole SD image does not retain it. Removal instructions are in the credential procedure.