Build the Debian open-world lab

[skjshr]

What changed

• Reframed the target as a dedicated Debian 13 machine with three entrances, three footholds, and three independent root paths for nine viable routes.
• Added deterministic live guidance with EASY/NORMAL/HARD controls, staged hints, silhouettes, and route unlock achievements without profiles, quizzes, AI chat, or manual flag submission.
• Expanded Kazekiri Motors into a realistic multi-page motorcycle business site with inventory filters, vehicle details, service records, shop information, FAQ, contact flow, staff diagnostics, and 16 photoreal WebP assets.
• Made 13 optional flags and the synthetic sales credential fresh build-time material, excluded answers and verifiers from public source, and kept flag text outside telemetry and cloud projections.
• Added guarded USB recovery plus clean-Debian reconstruction from a pinned public GitHub commit using an ephemeral Codex CLI home and post-build hygiene checks.
• Removed the legacy Windows and dual-boot contract.

Why

The project goal is a finished beginner Boot2Root product rather than a demo: the target should feel like a living business site, the learner should actively choose how to proceed, and the operator should be able to rebuild or recover the dedicated target without publishing valid exercise secrets.

Validation

• npm run check
  • repository contracts: 5 passed
  • telemetry: 44 passed, 1 Linux-only skip
  • bridge: 19 passed
  • platform: 58 passed, 2 Linux/WSL-only skips
  • operator: 13 passed
  • guide: 32 Vitest + 19 Node tests passed
  • TypeScript and production guide build passed
• Target site HTTP checks: 35/35 passed
• PHP lint: 12/12 passed
• Desktop and 360 px guide browser QA passed with no horizontal overflow or console warnings
• Gitleaks 8.30.1 scanned 25 commits and the full worktree with no leaks found
• git diff --check passed

Physical release gates still open

The dedicated Debian/Kali hardware run, all nine real exploit routes, two-second live-update timing, trusted USB recovery, clean public-clone reconstruction, and production guide deployment remain NOT RUN. This PR does not claim those physical gates have passed.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
examserver-lab-origin	Ready	Preview	Jul 31, 2026 5:17am

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a7f83e610b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Attribute completion to the foothold that launched the root path

When a learner acquires more than one foothold before escalating, activeFootholdId contains only the most recently reported foothold, regardless of which shell actually executes the root path. For example, acquiring www-data, then sales, and later using the original Web shell for the sudo route records smb-sudo instead of web-sudo. Because the root-path event carries no foothold provenance, deriving the achievement from this mutable field makes multi-entrance sessions report the wrong completed route.

Useful? React with 👍 / 👎.