As-found state · 2026-09-09 09:30 CDT · before any build work

System Audit

Baseline captured over SSH from the operator's admin node before the first change. Raw evidence: 9 command-output captures archived with this build (~/vault-ashborn/audits/frame-serv-2-2026-09-09/). Machine was freshly installed (Fedora, 2026-09-06), uptime 44 minutes at audit time.

Hardware

Component	Detail
Chassis	Framework Desktop, rev A6, SKU FRAMDACP06, serial FRAMDACPA65494004B
BIOS	INSYDE 03.03 (2025-09-16)
CPU	AMD Ryzen AI MAX+ 395 (Strix Halo) — 16C/32T, max 5.187 GHz, 64 MiB L3
GPU	Radeon 8060S integrated — driver `amdgpu` in use
NPU	Strix Halo NPU — `amdxdna` loaded, `/dev/accel0`
RAM	128 GiB LPDDR5X unified (1 NUMA node)
Swap	8 GiB zram (zstd)
SSD 1	Samsung 970 EVO Plus 1TB — OS disk, SMART PASS
SSD 2	Samsung 970 EVO Plus 2TB — as-found: ext4 formatted, NOT mounted, ~77 GB stale `.cache` from a prior OS (uid 989)
Ethernet	Realtek RTL8126 5GbE (r8169) — active
Wi-Fi	MediaTek MT7925 Wi-Fi 7 — down/unused
USB	USB4 host routers ×2, multiple xHCI controllers

GPU memory note: the 8060S is an iGPU with no dedicated VRAM — it draws from the 128G unified pool. Realistic weight budget ≈ 96–110 GiB with headroom for OS and KV cache.

OS / Kernel / Boot

Fedora Linux 44 (support ends 2027-05-19), kernel 6.19.10-300 at audit time
GRUB 2.12, BLS entries, Secure Boot disabled
TPM2 present; no LUKS disk encryption on either NVMe
CPU governor powersave; amd_pstate active
Large pending update set (systemd 259.8, kernel/firmware 20260810, sudo, …)

Drivers & Accelerator Stack

ROCm 7.1.1 toolchain installed as RPMs: hipcc, rocm-clang, comgr, device-libs, runtime, llvm, rocblas, hipblas
ROCm diagnostics (rocminfo, rocm-smi) were absent; Mesa RADV Vulkan ICD present
llama.cpp b6153 (Fedora RPM, HIP/ROCm build) — verified live: initializes Device 0: Radeon 8060S, gfx1151 via ggml_cuda_init
NPU driver loaded, /dev/accel0 0666 — no NPU runtime installed (not needed for LLM serving)
No CUDA (correct — no NVIDIA device), no DKMS modules

Software Inventory (as found)

691 RPM packages — minimal install
llama-cpp b6153 + full llama tool suite in /usr/bin (server, cli, bench, quantize, mtmd)
Python 3.14.3 with no pip, no uv, no venvs, no ML packages
No containers (no docker/podman), no node/npm, no model weights anywhere on disk
Has: git 2.55, gcc/make/cmake, jq, curl/wget, nvme-cli, smartmontools, vulkaninfo

Services & Network (as found)

Listening: sshd :22 (all interfaces), tailscaled, resolved stub, chronyd — no inference service
Standard Fedora services; zero failed units; no crontabs; oomd enabled
Network: enp191s0 = 10.141.47.130/24 via DHCP (owner's LAN, domain weiseguy.net); Wi-Fi down
Tailscale 1.102.3 joined to the dxverm tailnet as frame-serv-2 (100.126.153.18), installed and enrolled 2026-09-09 by the owner

Security Posture (as found)

Item	Finding	Assessment
SELinux	Enforcing, targeted	good
firewalld	Running; zone `public` allows ssh + mdns only	acceptable
SSH	Password auth on, root key-only, all interfaces	harden
Sudo	dan + wg both in wheel (full sudo)	informational
`/etc/sudoers.d/dan`	Syntax error — `dan (ALL) ALL=ALL`; sudo warned on every invocation	fixed
Disk encryption	None; Secure Boot off; no measured boot	owner decision
Password expiry	Effectively disabled (99999 days)	informational
Failed logins	3 attempts for root/wg from the owner's own workstation IP (192.168.0.51)	benign

Storage Layout (as found)

nvme1n1  1TB  p1 vfat 1G (spare, unmounted) · p2 EFI · p3 /boot xfs · p4 / ext4 (8.9G used)
nvme0n1  2TB  single ext4, unmounted, not in fstab — 77G stale .cache only

No LVM, no RAID, no zfs/btrfs. The 2TB disk was repurposed for model weights (see change log).

Audit Method

Read-only SSH probes over Tailscale; the only side effects were a read-only temporary mount of the 2TB disk (immediately unmounted) and creation of its mountpoint directory. All claims link to raw captures. Nothing was modified during the audit itself; subsequent changes are on the change log.