Update ISO installer tiers and backend deployment

autoinstall/build-iso.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # ─────────────────────────────────────────────────────────────
-# Cezen AI Suite — Custom ISO Builder
+# Nexus One AI — Custom ISO Builder
 # Runs directly on Ubuntu 22.04 (run on the server)
 #
 # Usage:
@@ -20,7 +20,7 @@ OUTPUT_ISO="$SCRIPT_DIR/cezen-ai-ubuntu2204.iso"
 UBUNTU_URL="https://releases.ubuntu.com/22.04.5/ubuntu-22.04.5-live-server-amd64.iso"
 
 echo "╔══════════════════════════════════════════╗"
-echo "║   Cezen AI — ISO Builder                 ║"
+echo "║   Nexus One AI — ISO Builder                 ║"
 echo "╚══════════════════════════════════════════╝"
 echo ""
 
@@ -56,15 +56,10 @@ cp "$SCRIPT_DIR/user-data" "$WORK_DIR/nocloud/user-data"
 cp "$SCRIPT_DIR/meta-data" "$WORK_DIR/nocloud/meta-data"
 echo "✓ user-data and meta-data injected"
 
-# Keep the installer payload on the ISO so first boot does not depend on a
-# private Git server being reachable before the setup UI can start.
-echo "→ Bundling Cezen AI installer payload..."
-mkdir -p "$WORK_DIR/cezen-aipackage"
-rsync -a --delete \
-  --exclude 'autoinstall/cezen-ai-ubuntu2204.iso' \
-  --exclude '*.iso' \
-  "$PACKAGE_DIR/" "$WORK_DIR/cezen-aipackage/"
-echo "✓ Installer payload bundled"
+# Keep this as an online installer ISO. The installed system pulls the current
+# Nexus One AI package from cgit during first boot, which keeps the ISO small and
+# avoids shipping stale backend/portal code inside the image.
+echo "✓ Online installer mode: package will be pulled from cgit on first boot"
 
 # ── Patch GRUB ────────────────────────────────
 echo "→ Patching GRUB config..."
@@ -82,20 +77,6 @@ sed -i "s/set timeout_style=.*/set timeout_style=countdown/" "$GRUB_CFG"
 sed -i '/^\s*linux.*vmlinuz/s|---|autoinstall ds=nocloud\\;s=/cdrom/nocloud/ ---|' "$GRUB_CFG"
 echo "✓ GRUB patched"
 
-# ── Refresh installer checksum manifest ─────────────────
-echo "→ Refreshing md5sum.txt..."
-(
-  cd "$WORK_DIR"
-  rm -f md5sum.txt
-  find . -type f \
-    ! -path './md5sum.txt' \
-    ! -path './boot.catalog' \
-    -print0 \
-    | sort -z \
-    | xargs -0 md5sum > md5sum.txt
-)
-echo "✓ md5sum.txt refreshed"
-
 # ── Extract MBR and EFI partition from original ISO ────
 echo "→ Extracting boot data from original ISO..."
 MBR_TEMPLATE=$(mktemp)
@@ -119,7 +100,7 @@ dd if="$ORIGINAL_ISO" bs=512 skip="$EFI_START" count="$EFI_SIZE" \
 echo "✓ EFI partition extracted (start=$EFI_START, size=$EFI_SIZE)"
 
 # ── Repack ISO ─────────────────────────────────
-echo "→ Repacking ISO (this takes ~2 minutes)..."
+echo "→ Repacking ISO (pass 1)..."
 xorriso -as mkisofs \
   -r \
   -V "Cezen_AI_Ubuntu2204" \
@@ -141,6 +122,64 @@ xorriso -as mkisofs \
   -no-emul-boot \
   "$WORK_DIR"
 
+echo "→ Refreshing md5sum.txt from pass-1 ISO contents..."
+FINAL_DIR=$(mktemp -d)
+VERIFY_DIR=$(mktemp -d)
+trap 'rm -rf "$WORK_DIR" "$MBR_TEMPLATE" "$EFI_IMG" "$FINAL_DIR" "$VERIFY_DIR"' EXIT
+xorriso -osirrox on \
+  -indev "$OUTPUT_ISO" \
+  -extract / "$FINAL_DIR" >/dev/null 2>&1
+chmod -R u+w "$FINAL_DIR"
+(
+  cd "$FINAL_DIR"
+  rm -f md5sum.txt
+  find . -type f \
+    ! -path './md5sum.txt' \
+    ! -path './boot.catalog' \
+    -print0 \
+    | sort -z \
+    | xargs -0 md5sum > md5sum.txt
+)
+echo "✓ md5sum.txt refreshed"
+
+echo "→ Repacking ISO (pass 2 with final manifest)..."
+xorriso -as mkisofs \
+  -r \
+  -V "Cezen_AI_Ubuntu2204" \
+  -o "$OUTPUT_ISO" \
+  --grub2-mbr "$MBR_TEMPLATE" \
+  -partition_offset 16 \
+  --mbr-force-bootable \
+  -append_partition 2 28732ac11ff8d211ba4b00a0c93ec93b "$EFI_IMG" \
+  -appended_part_as_gpt \
+  -iso_mbr_part_type a2a0d0ebe5b9334487c068b6b72699c7 \
+  -c "/boot.catalog" \
+  -b "/boot/grub/i386-pc/eltorito.img" \
+  -no-emul-boot \
+  -boot-load-size 4 \
+  -boot-info-table \
+  --grub2-boot-info \
+  -eltorito-alt-boot \
+  -e "--interval:appended_partition_2:::" \
+  -no-emul-boot \
+  "$FINAL_DIR"
+
+# ── Verify output ISO integrity manifest ─────────────────
+echo "→ Verifying rebuilt ISO manifest..."
+xorriso -osirrox on \
+  -indev "$OUTPUT_ISO" \
+  -extract / "$VERIFY_DIR" >/dev/null 2>&1
+chmod -R u+w "$VERIFY_DIR"
+(
+  cd "$VERIFY_DIR"
+  md5sum -c md5sum.txt >/tmp/cezen-iso-md5check.log 2>&1 || {
+    echo "ERROR: Rebuilt ISO failed its own md5sum.txt verification."
+    sed -n '1,40p' /tmp/cezen-iso-md5check.log
+    exit 1
+  }
+)
+echo "✓ Output ISO manifest verified"
+
 echo ""
 echo "╔══════════════════════════════════════════════════════╗"
 echo "║   Done!                                              ║"