# First-install owner and network setup

Fresh ISO installations collect a personal username, a unique hostname and a
password before disk selection. Wi-Fi is optional: wired and offline installation
remain available. The chosen Wi-Fi profile is copied into the installed system
with mode 0600; passwords must never appear in command arguments or build logs.

The personal account is separate from the fixed service account. Root and the
service account remain password-locked; SSH remains key-only. The installer
records the personal account in root-owned `/etc/archipelago/owner-account`.
The backend uses that record for console-password changes. Older installations
without the record retain their existing account selection.

The installer stores an Argon2 verifier in the dashboard data directory. After
identity onboarding, the first dashboard login verifies the installer password,
creates the normal account without overwriting an existing account, and removes
the pending verifier. Optional signer setup follows that login. The verifier is
not a session, token or plaintext password. Existing configured dashboards do not
enter this first-install path.

## Integration and release checks

This feature changes the backend and dashboard as well as the ISO recipe. Build
and sign a new application version; do not mix a newer installer with a previously
signed application that lacks the password-handoff command or RPC.

Qualify the exact integrated artifact with a disposable disk: owner/hostname
selection, matching and incorrect passwords, offline and Wi-Fi paths, install,
reboot, console access, identity onboarding and the first dashboard login. Verify
root/service login locks and key-only SSH, and preserve the existing login,
TOTP, signer and mobile viewport behavior. Seed confirmation must be reachable by
keyboard on short screens. Source tests and earlier physical installer builds are
separate evidence from this final-artifact acceptance.

Public ISO staging must be readable independently of the operator's umask or the
permissions on copied build inputs. Normalize only the public media tree; never
relax private input directories, installed credentials, or permissions inside the
root filesystem and squashfs archives. Keep host-policy ports generated from the
same app catalog used by the backend, including declared secondary TLS UI ports.