feat(storage): per-app/owner/system encryption live: gatekeeper hands seed + fresh flag, storage unlocks layer, init seeds areas from factory/ (empties on new key); rmdir op; test-qemu checks sealed home + reboot persistence

scripts/test-qemu.sh

@@ -50,8 +50,8 @@ echo "test-qemu: first boot: passcode set up: $([ ${first_ok} -eq 1 ] && echo ok
 boot 9999 1234
 [ ${status} -eq 0 ] && status=$?
 second_ok=0
-grep -aq "the owner is in" "${LOG}" && second_ok=1
-echo "test-qemu: second boot: wrong passcode refused, right one unlocks: $([ ${second_ok} -eq 1 ] && echo ok || echo FAIL)"
+grep -aq "the owner is in" "${LOG}" && grep -aq "from the last boot reads back: ok" "${LOG}" && second_ok=1
+echo "test-qemu: second boot: wrong passcode refused, right one unlocks, sealed file kept: $([ ${second_ok} -eq 1 ] && echo ok || echo FAIL)"
 rm -f "${KEYS}" "${MON}"
 
 grep -a "smptest:\|spawntest:\|Hello\|SMPTEST" "${LOG}"
@@ -62,8 +62,12 @@ if command -v e2fsck >/dev/null && command -v debugfs >/dev/null; then
         echo "test-qemu: e2fsck rejects the disk:"; cat "${LOG}.fsck"; disk_ok=0
     elif [ "$(debugfs -R 'cat /selftest.txt' "${IMAGE}" 2>/dev/null)" != "written by k-os on ext4" ]; then
         echo "test-qemu: /selftest.txt is not on the disk"; disk_ok=0
+    elif debugfs -R 'cat /home/readme.txt' "${IMAGE}" 2>/dev/null | grep -aq "Welcome"; then
+        echo "test-qemu: /home/readme.txt is plaintext on the disk"; disk_ok=0
+    elif ! debugfs -R 'cat /home/readme.txt' "${IMAGE}" 2>/dev/null | head -c 8 | grep -aq "KOSFILE1"; then
+        echo "test-qemu: /home/readme.txt is not a sealed file"; disk_ok=0
     else
-        echo "test-qemu: e2fsck clean, file on disk"
+        echo "test-qemu: e2fsck clean, file on disk, home sealed"
     fi
     rm -f "${LOG}.fsck"
 fi