feat(os): 1bit OS boots Lemonade with the engine as its onebit backend

[bong-water-water-bong]

What

The 1bit OS appliance work: the image boots Lemonade, with the engine as its onebit backend. Recovered from an unreported branch (25 commits) and reduced to the 3 commits that are actually new — the other 22 were the security-audit fixes (now in #322) and the RFC #213 stage-3 strip (already in main via #306).

Stacked on #322 (1bit/security-audit-fixes-r2), because one of these commits supersedes that branch's OS boot config. Retarget to main once #322 lands.

3 commits, 43 files:

1. 1bit OS: boot Lemonade, with the engine as its onebit backend — ships lemond/lemonade/web app, Mesa RADV, CA certs, /etc/hosts; pre-installs Lemonade's backends via lemond's own installer into /data/lemonade/cache; the data partition holds Lemonade's config.json (extra_models_dir=/data/models), lemond.conf and cache; init.sh registers each /data/models/*.gguf and */model.q4nx as <name>-1bit in user_models.json, then starts exec lemond. /data/1bit.conf is no longer read — host, port and API keys are Lemonade's own settings, which is the intended contract (the engine holds no API key). vmtest.sh checks the web app 200, 401 without a key, /api/v1/models, and a onebit chat.
2. 1bit OS: licences for everything on the image — os/LICENSES.md plus os/licenses/<recipe>/SOURCE with a Ship: yes|no gate; mkimage.sh now refuses a backend whose terms aren't cleared and ships /usr/share/licenses/1bit-os. Drops thinksound:vulkan (no licence) and flm:npu (closed NPU binaries + GPL FFTW) from the default backends — both stay downloadable through Lemonade.
3. build-lemonade.sh: LEMONADE_WEB_APP=1 — opt-in build of Lemonade's web app (default off).

Verified on the build box: VMTEST PASS, image 3.33 → 3.07 GB. tools/copyright.py --check passes.

Review notes

• Reverting Core engine: HRX + HIP + NPU only (strip Vulkan, ROCm, ZINC, CUDA, ComfyUI; move site and kernel out) #306 is the trap this PR avoids. 22 of the original branch's 25 commits were the already-merged strip plus the security fixes; keeping them would have re-added ZINC/CUDA/ComfyUI build paths, the deleted docs/scripts/workflows and the --device zinc route that main deliberately refuses. Only the 3 genuinely-new commits are here.
• init.sh sources /data/lemond.conf as root (set -a; . ./lemond.conf) from a user-writable removable partition. The image chmod 600s it, but on the stick it is editable — a USB-trust decision worth stating explicitly rather than a code bug.
• onebit_register() only escapes " and \ when interpolating a filename into user_models.json, so a filename containing a newline yields invalid JSON (DoS, not injection); its grep -q name test is also regex-sensitive.
• Lemonade's default lemond.conf has the API key commented out while host is localhost. Opening host in config.json without setting the key exposes an unauthenticated network service — the docs warn, nothing enforces.
• Only the engine's servers get the Host/Origin guard from fix(serve,npu,laya,moe): the security-audit follow-ups (bounds, Host/Origin, cache, port) #322 (and only when bound loopback); Lemonade's other backends do not, so the appliance's auth story is Lemonade's — as intended, but not uniform.

Not to be merged: the release is on hold until the owner calls it.

[github-actions]

PR Reviewer Guide 🔍

(Review updated until commit 2f25773)

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 4 🔵🔵🔵🔵⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Incorrect backend installation logic The script attempts to install Lemonade backends ahead of time, but the logic for determining which backends to install and how to handle their dependencies is flawed. Specifically, the check for Ship: yes in os/licenses/<recipe>/SOURCE is performed, but the code does not ensure that the backend's actual dependencies are properly resolved or that the backend is compatible with the target system. This could lead to a partially installed or broken system. grep -q '^Ship: yes' "$licenses/${b%%:*}/SOURCE" 2>/dev/null || { echo " $b: not cleared to ship (os/licenses/${b%%:*}/SOURCE, os/LICENSES.md)"; exit 1; } done Potential race condition in backend installation The script starts lemond in the background and then immediately attempts to install backends via HTTP requests. There is a potential race condition where the installation process may start before lemond is fully initialized, leading to failures or inconsistent states. The script waits for health checks, but this may not be sufficient to ensure full readiness. "$lem/bin/lemond" --port "$port" --host 127.0.0.1 --no-broadcast "$seed/cache" "$seed/config" > "$out/lemond-seed.log" 2>&1 & lemond_pid=$! Insecure model registration The onebit_register function in init.sh does not sanitize or validate the model name or path before adding it to the JSON registry. This could lead to injection attacks or malformed JSON if the input contains special characters or is not properly escaped. case "$1$2" in *'"'*|*'\'*) return ;; esac [ -s "$f" ] || echo '{}' > "$f" grep -q "\"$1\"[[:space:]]*:" "$f" && return e="\"$1\": {\"checkpoint\": \"$2\", \"source\": \"local_path\", \"recipe\": \"onebit\"}" tr '\n' ' ' < "$f" | awk -v e="$e" '{ i = length($0); while (i > 0 && substr($0, i, 1) != "}") i-- head = substr($0, 1, i - 1); inner = head; sub(/^[ \t]*\{/, "", inner); gsub(/[ \t]/, "", inner) print head (inner == "" ? "" : ", ") e "}" }' > "$f.new" && mv "$f.new" "$f" && echo "Lemonade: user.$1 (onebit) -> $2" } Incomplete API key handling The test script generates an API key but does not verify that it is correctly set in the environment file or that Lemonade is actually using it. This could lead to false positives in the test if the API key is not properly enforced. apikey=vmtest-$(od -An -N8 -tx8 /dev/urandom | tr -d ' ') printf '{\n "host": "0.0.0.0",\n "extra_models_dir": "/data/models",\n "models_dir": "/data/lemonade/huggingface"\n}\n' > "$out/config.json" printf 'LEMONADE_API_KEY=%s\n' "$apikey" > "$out/lemond.conf"

---

⚠️ Review coverage: The following files were not included in this review because of the token budget:

• os/README.md
• os/licenses/moonshine/python-LICENSE
• os/LICENSES.md
• os/licenses/llamacpp-hrx/hrx-system-LICENSE
• os/licenses/kokoro/Kokoros-LICENSE-Apache-2.0
• os/licenses/openmoss/LICENSE
• os/licenses/llamacpp-hrx/ROCR-Runtime-LICENSE
• os/licenses/flm/TERMS.md
• os/licenses/flm/SOURCE
• os/licenses/sd-cpp/libwebm-LICENSE.TXT
• os/licenses/sd-cpp/libwebp-COPYING
• os/licenses/kokoro/SOURCE
• os/licenses/sd-cpp/libwebp-PATENTS
• os/licenses/moonshine/certifi-LICENSE
• os/licenses/llamacpp/cpp-httplib-LICENSE
• os/licenses/llamacpp-hrx/aqlprofile-LICENSE
• os/licenses/llamacpp/LICENSE-jsonhpp
• os/licenses/moonshine/charset_normalizer-LICENSE
• os/licenses/acestep/LICENSE
• os/licenses/whispercpp/LICENSE
• os/licenses/flm/LICENSE_RUNTIME.txt
• os/licenses/kokoro/onnxruntime-LICENSE
• os/licenses/trellis/LICENSE
• NOTICE
• os/licenses/sd-cpp/SOURCE
• os/licenses/trellis/SOURCE
• os/licenses/acestep/SOURCE
• os/licenses/llamacpp/SOURCE
• os/licenses/whispercpp/SOURCE
• os/licenses/openmoss/SOURCE
• os/licenses/onnxruntime/SOURCE

[github-actions]

Persistent review updated to latest commit 343e25f

[github-actions]

Persistent review updated to latest commit 09819ec

[github-actions]

Persistent review updated to latest commit ea3d696

[github-actions]

Persistent review updated to latest commit 2f25773