SESSION: P16g Phase 11 Validation Run

Summary

Post-reboot validation of the ThinkPad P16g deployment. Audio confirmed working (pw-play through CS35L56 speakers). Full Phase 11 verification executed: boot, encryption, security, desktop, development, secrets, network. 5 issues identified, doc corrections applied.

Trigger: Reboot to load sof-firmware for onboard speakers (installed in prior session).

Audio Verification (Post-Reboot)

PipeWire Status

wpctl status

Output

PipeWire 'pipewire-0' [1.6.2, evanusmodestus@modestus-p16g, cookie:862856192]
 └─ Clients:
        32. xdg-desktop-portal-hyprland         [1.6.2]
        33. WirePlumber                         [1.6.2]
        41. WirePlumber [export]                [1.6.2]
        42. pipewire                            [1.6.2]
        44. waybar                              [1.6.2]

Audio
 ├─ Devices:
 │      45. GB203 High Definition Audio Controller [alsa]
 │      46. 800 Series ACE (Audio Context Engine) [alsa]
 │
 ├─ Sinks:
 │      61. 800 Series ACE HDMI / DisplayPort 3 Output [vol: 1.00]
 │      62. 800 Series ACE HDMI / DisplayPort 2 Output [vol: 1.00]
 │      63. 800 Series ACE HDMI / DisplayPort 1 Output [vol: 1.00]
 │      64. 800 Series ACE Headphones [vol: 1.00]
 │  *   65. 800 Series ACE Speaker [vol: 0.40]
 │
 ├─ Sources:
 │      66. 800 Series ACE Headset Microphone [vol: 1.00]
 │  *   67. 800 Series ACE Digital Microphone [vol: 1.00]

ALSA Sound Cards

cat /proc/asound/cards

Output

 0 [NVidia         ]: HDA-Intel - HDA NVidia
                      HDA NVidia at 0x84000000 irq 17
 1 [sofsoundwire   ]: sof-soundwire - sof-soundwire
                      LENOVO-21V50016US-ThinkPadT16gGen3

Audio Sinks (All)

pactl list sinks short

Output

61  alsa_output.pci-0000_80_1f.3-platform-sof_sdw.HiFi__HDMI3__sink       PipeWire  s32le 2ch 48000Hz  SUSPENDED
62  alsa_output.pci-0000_80_1f.3-platform-sof_sdw.HiFi__HDMI2__sink       PipeWire  s32le 2ch 48000Hz  SUSPENDED
63  alsa_output.pci-0000_80_1f.3-platform-sof_sdw.HiFi__HDMI1__sink       PipeWire  s32le 2ch 48000Hz  SUSPENDED
64  alsa_output.pci-0000_80_1f.3-platform-sof_sdw.HiFi__Headphones__sink  PipeWire  s32le 2ch 48000Hz  SUSPENDED
65  alsa_output.pci-0000_80_1f.3-platform-sof_sdw.HiFi__Speaker__sink     PipeWire  s32le 2ch 48000Hz  SUSPENDED

Audio Sources (All)

pactl list sources short

Output

61  alsa_output...HDMI3__sink.monitor       PipeWire  s32le 2ch 48000Hz  SUSPENDED
62  alsa_output...HDMI2__sink.monitor       PipeWire  s32le 2ch 48000Hz  SUSPENDED
63  alsa_output...HDMI1__sink.monitor       PipeWire  s32le 2ch 48000Hz  SUSPENDED
64  alsa_output...Headphones__sink.monitor  PipeWire  s32le 2ch 48000Hz  SUSPENDED
65  alsa_output...Speaker__sink.monitor     PipeWire  s32le 2ch 48000Hz  SUSPENDED
66  alsa_input...HiFi__Headset__source      PipeWire  s32le 2ch 48000Hz  SUSPENDED
67  alsa_input...HiFi__Mic__source          PipeWire  s32le 2ch 48000Hz  SUSPENDED

Kernel Audio Messages (This Boot)

journalctl -b --grep='sof|sdw|sound|audio|codec' --no-pager | tail -30

Output — CS35L56 firmware loaded cleanly

sof-audio-pci-intel-mtl 0000:80:1f.3: loading topology: intel/sof-ipc4-tplg/sof-arl-cs42l43-l0-cs35l56-l2-2ch.tplg
sof-audio-pci-intel-mtl 0000:80:1f.3: Topology: ABI 3:29:1 Kernel ABI 3:23:1
cs35l56 sdw:0:2:01fa:3556:01:0: supply VDD_B not found, using dummy regulator
cs35l56 sdw:0:2:01fa:3556:01:0: supply VDD_AMP not found, using dummy regulator
cs35l56 sdw:0:2:01fa:3556:01:1: supply VDD_B not found, using dummy regulator
cs35l56 sdw:0:2:01fa:3556:01:1: supply VDD_AMP not found, using dummy regulator
cs35l56 sdw:0:2:01fa:3556:01:1: DSP1: cirrus/cs35l56-b0-dsp1-misc-17aa2347.wmfw: format 3
cs35l56 sdw:0:2:01fa:3556:01:1: DSP1: Tue 01 Jul 2025 18:54:52 Central Daylight Time
cs35l56 sdw:0:2:01fa:3556:01:0: DSP1: cirrus/cs35l56-b0-dsp1-misc-17aa2347.wmfw: format 3
cs35l56 sdw:0:2:01fa:3556:01:0: DSP1: Tue 01 Jul 2025 18:54:52 Central Daylight Time
cs35l56 sdw:0:2:01fa:3556:01:0: DSP1: Firmware: 1a10d6 vendor: 0x2 v3.13.3, 41 algorithms
cs35l56 sdw:0:2:01fa:3556:01:1: DSP1: Firmware: 1a10d6 vendor: 0x2 v3.13.3, 41 algorithms
cs35l56 sdw:0:2:01fa:3556:01:0: DSP1: cirrus/cs35l56-b0-dsp1-misc-17aa2347-amp1.bin: v3.13.3
cs35l56 sdw:0:2:01fa:3556:01:1: DSP1: cirrus/cs35l56-b0-dsp1-misc-17aa2347-amp2.bin: v3.13.3
cs35l56 sdw:0:2:01fa:3556:01:0: Calibration applied
cs35l56 sdw:0:2:01fa:3556:01:0: Tuning PID: 0x15, SID: 0x7, TID: 0x4
cs35l56 sdw:0:2:01fa:3556:01:1: Calibration applied
cs35l56 sdw:0:2:01fa:3556:01:1: Tuning PID: 0x25, SID: 0x7, TID: 0x4
input: sof-soundwire Jack as /devices/pci0000:80/0000:80:1f.3/sof_sdw/sound/card1/input29
input: sof-soundwire HDMI/DP,pcm=5 as .../input30
input: sof-soundwire HDMI/DP,pcm=6 as .../input31
input: sof-soundwire HDMI/DP,pcm=7 as .../input32

dummy regulator warnings for VDD_B/VDD_AMP are standard on this platform — no real supply regulators exposed via ACPI. Harmless.

Audio Test

# speaker-test not available (alsa-utils not installed)
speaker-test -D pipewire -c 2 -t wav -l 1
# zsh: command not found: speaker-test

# pw-play is native PipeWire — works without alsa-utils
pw-play --target 65 /usr/share/sounds/freedesktop/stereo/bell.oga

Result: ✅ Sound played through onboard speakers (sink 65, CS35L56 x2).

Phase 11: Full System Validation

System Health

systemctl --failed

Output

  UNIT LOAD ACTIVE SUB DESCRIPTION
0 loaded units listed.

Result: ✅ Zero failed services.

systemd-analyze

Output

Startup finished in 17.583s (firmware) + 3.850s (loader) + 1min 15.868s (kernel) + 17.168s (userspace) = 1min 54.471s
graphical.target reached after 16.911s in userspace.

1m16s kernel time is dominated by LUKS passphrase entry + decrypt. Userspace is fast (17s to graphical).

Boot & Encryption

uname -r

Output: 6.19.10-arch1-1

lsblk -f | grep -E 'crypto_LUKS|crypt'

Output

├─nvme0n1p3   crypto_LUKS 2   a33cc5e6-...
│ └─cryptroot btrfs  archroot  4de1f373-...  187.9G  24%  /var/log
└─nvme0n1p4   crypto_LUKS 2   4cba46dd-...
  └─crypthome btrfs  archhome  4fcc4995-...    1.6T   1%  /home

Result: ✅ Dual LUKS volumes open — cryptroot (btrfs, 24% used) + crypthome (btrfs, 1% used).

zramctl

Output

NAME       ALGORITHM DISKSIZE DATA COMPR TOTAL STREAMS MOUNTPOINT
/dev/zram0 zstd         31.1G   4K   64B   20K         [SWAP]

Result: ✅ 31.1G zram with zstd compression active.

bootctl list

Output (summarized)

Arch Linux (arch.conf) (default) (selected)     — ESP, vmlinuz-linux
Arch Linux LTS (arch-lts.conf)                  — ESP, vmlinuz-linux-lts
Arch Linux (fallback) (arch-fallback.conf)       — ESP, initramfs-linux-fallback.img (No such file or directory)

Result: ⚠️ Fallback entry references missing initramfs-linux-fallback.img on ESP. Pacman hook only copies main initramfs.

diff <(md5sum /boot/vmlinuz-linux | awk '{print $1}') \
     <(md5sum /boot/efi/vmlinuz-linux | awk '{print $1}') && echo "ESP KERNEL MATCH"

Output: ESP KERNEL MATCH

Result: ✅ ESP kernel synced with /boot.

grep apparmor /proc/cmdline

Output

initrd=\intel-ucode.img initrd=\initramfs-linux.img
cryptdevice=UUID=a33cc5e6-...:cryptroot root=/dev/mapper/cryptroot rootflags=subvol=@ rw
nvidia_drm.modeset=1 mem_sleep_default=s2idle acpi_mask_gpe=0x6E
lsm=landlock,lockdown,yama,integrity,apparmor,bpf apparmor=1 security=apparmor

Result: ✅ AppArmor in cmdline with full LSM stack.

Security

cat /sys/kernel/security/lsm

Output: capability,landlock,lockdown,yama,apparmor,bpf

Result: ✅ Full LSM stack active.

sudo aa-status requires terminal password prompt — not available in non-interactive session. AppArmor confirmed active via LSM stack + kernel cmdline.

ss -tlnp | awk 'NR>1{print $4, $6}' | sort

Output

0.0.0.0:22
127.0.0.1:11434
127.0.0.1:34695
[::]:22

Result: ✅ Clean port audit — SSH (22), Ollama localhost (11434), one ephemeral. No unexpected listeners.

Desktop Environment

echo $XDG_SESSION_TYPE

Output: wayland

nvidia-smi --query-gpu=name,driver_version,memory.total --format=csv,noheader

Output: NVIDIA GeForce RTX 5090 Laptop GPU, 595.58.03, 24463 MiB

Result: ✅ RTX 5090, driver 595.58.03, 24GB GDDR7.

systemctl is-active nvidia-persistenced.service

Output: inactive

Result: ❌ NVIDIA persistence daemon not running. Phase 6 documents enabling it but was never executed.

bluetoothctl show | grep -E 'Name|Powered|Address'

Output

Name: modestus-p16g
Powered: yes

Result: ✅ Bluetooth controller powered.

for proc in waybar mako pipewire wireplumber; do
    pgrep -x $proc > /dev/null && echo "✓ $proc" || echo "✗ $proc MISSING"
done

Output

✓ waybar
✓ mako
✓ pipewire
✓ wireplumber

Result: ✅ All desktop processes running.

wpctl status | grep -A5 'Sinks:'

Output

 ├─ Sinks:
 │      61. 800 Series ACE HDMI / DisplayPort 3 Output [vol: 1.00]
 │      62. 800 Series ACE HDMI / DisplayPort 2 Output [vol: 1.00]
 │      63. 800 Series ACE HDMI / DisplayPort 1 Output [vol: 1.00]
 │      64. 800 Series ACE Headphones [vol: 1.00]
 │  *   65. 800 Series ACE Speaker [vol: 0.40]

Result: ✅ Real audio devices — no Dummy Output. Speaker is default sink.

hyprctl monitors failed with HYPRLAND_INSTANCE_SIGNATURE not set — expected in SSH session (env var only set in Hyprland’s TTY).

Development Tools

python3 --version && node --version && rustc --version && go version

Output

Python 3.14.3
v25.8.2
rustc 1.94.1 (e408947bf 2026-03-25) (Arch Linux rust 1:1.94.1-1)
go version go1.26.1-X:nodwarf5 linux/amd64

uv --version && npm --version && cargo --version

Output

uv 0.11.3 (x86_64-unknown-linux-gnu)
11.12.1
cargo 1.94.1 (29ea6fb6a 2026-03-24) (Arch Linux rust 1:1.94.1-1)

nvim --version | head -1
ls ~/.config/nvim/init.lua

Output: NVIM v0.11.7 — config OK.

claude --version

Output: 2.1.92 (Claude Code)

ssh -T git@github.com

Output: ssh_askpass: exec(/usr/lib/ssh/ssh-askpass): No such file or directory

Result: ⚠️ SSH to GitHub failed in non-interactive context — ssh-askpass not installed. Works fine in terminal with agent.

gpg --list-secret-keys --keyid-format long | grep -c sec

Output: 1

Result: ✅ One GPG secret key present.

ls ~/.ssh/id_ed25519_* | wc -l

Output: 27

Result: ✅ 27 SSH key files present.

gopass ls | head -5

Output

gopass
├── v2 (/home/evanusmodestus/.local/share/gopass/stores/v2)
│   ├── ARCANA/
│   │   ├── api/
│   │   │   └── domus/

Result: ✅ gopass v2 store accessible.

Secrets & Credentials

ls ~/.credentials/

Output: directory does not exist.

Result: ❌ gocryptfs vault not mounted. Needs gcvault mount credentials.

openssl x509 -in /etc/ssl/certs/modestus-p16g-eaptls.pem -noout -enddate

Output: notAfter=Apr 3 21:32:06 2027 GMT

Result: ✅ EAP-TLS cert valid until April 2027.

Network & Connectivity

nmcli connection show --active | grep -i domus

Output: Domus-WiFi-EAP-TLS 8a212f0f-101e-4f39-ba0d-76811ef708b9 wifi wlan0

Result: ✅ WiFi EAP-TLS active on wlan0.

dig +short vault-01.inside.domusdigitalis.dev

Output: command not found: dig

Result: ⚠️ bind-tools not installed. DNS works (EAP-TLS connected, Ollama running) but dig unavailable for diagnostics.

AI Stack

systemctl is-active ollama.service

Output: active

Result: ✅ Ollama running.

Validation Summary

Check Status Notes

Check	Status	Notes
No failed systemd services	PASS	0 failed
Kernel booted	PASS	6.19.10-arch1-1
LUKS volumes open	PASS	cryptroot + crypthome
zram swap active	PASS	31.1G zstd
ESP kernel synced	PASS	md5sum match
Boot entries valid	PARTIAL	Fallback initramfs missing on ESP
AppArmor in kernel cmdline	PASS	Full LSM stack
LSM stack correct	PASS	capability,landlock,lockdown,yama,apparmor,bpf
Open ports clean	PASS	SSH + Ollama localhost only
NVIDIA GPU detected	PASS	RTX 5090, 595.58.03, 24GB
NVIDIA persistenced	FAIL	Not enabled
Wayland session	PASS	wayland
Audio (not Dummy Output)	PASS	CS35L56 speakers, CS42L43 headphones
Audio playback tested	PASS	`pw-play` confirmed
Bluetooth controller	PASS	Powered, named modestus-p16g
Desktop processes	PASS	waybar, mako, pipewire, wireplumber
Python 3.14.3	PASS
Node 25.8.2	PASS
Rust 1.94.1	PASS
Go 1.26.1	PASS
uv / npm / cargo	PASS
Neovim 0.11.7 + config	PASS
Claude Code 2.1.92	PASS
Git SSH (GitHub)	PARTIAL	ssh-askpass missing for non-interactive
GPG key present	PASS	1 secret key
SSH keys	PASS	27 files
gopass accessible	PASS
gocryptfs vault	FAIL	Not mounted
WiFi EAP-TLS active	PASS
EAP-TLS cert valid	PASS	Expires Apr 2027
DNS diagnostics	PARTIAL	`dig` not installed (bind-tools)
Ollama running	PASS

No failed systemd services

PASS

0 failed

Kernel booted

PASS

6.19.10-arch1-1

LUKS volumes open

PASS

cryptroot + crypthome

zram swap active

PASS

31.1G zstd

ESP kernel synced

PASS

md5sum match

Boot entries valid

PARTIAL

Fallback initramfs missing on ESP

AppArmor in kernel cmdline

PASS

Full LSM stack

LSM stack correct

PASS

capability,landlock,lockdown,yama,apparmor,bpf

Open ports clean

PASS

SSH + Ollama localhost only

NVIDIA GPU detected

PASS

RTX 5090, 595.58.03, 24GB

NVIDIA persistenced

FAIL

Not enabled

Wayland session

PASS

wayland

Audio (not Dummy Output)

PASS

CS35L56 speakers, CS42L43 headphones

Audio playback tested

PASS

pw-play confirmed

Bluetooth controller

PASS

Powered, named modestus-p16g

Desktop processes

PASS

waybar, mako, pipewire, wireplumber

Python 3.14.3

PASS

Node 25.8.2

PASS

Rust 1.94.1

PASS

Go 1.26.1

PASS

uv / npm / cargo

PASS

Neovim 0.11.7 + config

PASS

Claude Code 2.1.92

PASS

Git SSH (GitHub)

PARTIAL

ssh-askpass missing for non-interactive

GPG key present

PASS

1 secret key

SSH keys

PASS

27 files

gopass accessible

PASS

gocryptfs vault

FAIL

Not mounted

WiFi EAP-TLS active

PASS

EAP-TLS cert valid

PASS

Expires Apr 2027

DNS diagnostics

PARTIAL

dig not installed (bind-tools)

Ollama running

PASS

Score: 25/31 pass, 4 warnings, 2 failures.

Issues Found

Issue 1: nvidia-persistenced inactive

Phase 6 documents sudo systemctl enable --now nvidia-persistenced.service but it was never executed.

sudo systemctl enable --now nvidia-persistenced.service
systemctl is-active nvidia-persistenced.service

Issue 2: Fallback initramfs missing on ESP

The pacman hook (99-esp-kernel-sync.hook) copies initramfs-linux.img and initramfs-linux-lts.img but not initramfs-linux-fallback.img. The fallback boot entry on ESP references it.

Options:

Update hook to also copy fallback images (increases ESP usage)
Remove fallback boot entry from ESP (fallback still works from XBOOTLDR /boot)

# Option 1: copy fallback to ESP
sudo cp /boot/initramfs-linux-fallback.img /boot/efi/
# Then update hook to include fallback in future syncs

# Option 2: remove fallback entry from ESP
sudo rm /boot/efi/loader/entries/arch-fallback.conf

Issue 3: gocryptfs vault not mounted

gcvault mount credentials
ls ~/.credentials/

Issue 4: bind-tools not installed

sudo pacman -S bind
# Provides: dig, nslookup, host

Issue 5: ssh-askpass not installed

Non-interactive SSH contexts (tools, scripts) fail when key requires passphrase prompt.

sudo pacman -S x11-ssh-askpass
# Or for Wayland-native: yay -S ssh-askpass-fullscreen

Doc Corrections Applied

Updated phase-6-desktop.adoc — replaced all 3 speaker-test references with pw-play:

Line 158: speaker-test -c 2 -t wav → pw-play /usr/share/sounds/freedesktop/stereo/bell.oga + added --target variant
Line 272: Bluetooth audio test → pw-play
Line 469: Phase 6 checklist label → pw-play

Rationale: speaker-test requires alsa-utils which is not in the Phase 5/6 package list. pw-play is native to PipeWire (already installed) and is the correct tool for this stack.