[tulik]

Purpose

Turn the notebook-first SC Linux project into a navigable Jupyter Book 2 tutorial, with one bounded, verifiable action per code cell rather than a single opaque OS-build walkthrough.

Implementation

• New myst.yml, a nine-chapter book in book/, and pinned requirements-book.txt.
• Chapters: host readiness, image inputs and partitions, FreeIPA public CA, Docker/mkosi builder, RAW+UKI+ISO assembly, artifact hashes and footprint, QEMU boot, per-host NoCloud provisioning, and unsigned reproducibility comparison.
• The image-build chapter distinguishes ten ordered construction phases and independently checks RAW, compressed payload, manifest, installer UKI, ISO, and evidence.
• Refactor scripts/build-inside.sh into named, logged functions while retaining the existing atomic mkosi build transaction and outputs.
• Add local make book-lab working copies and make book-html / make book for static site builds; notebook execution is excluded when publishing.
• Add Jupyter Book CI (pinned book version) plus source tests for chapter structure, code syntax, navigation, tags, and links.
• Avoid injecting ignored site outputs or virtualenv files into mkosi's copied source tree.

Safety and verification

• Notebook pages are tagged skip-execution: building HTML must never build images or run privileged Docker.
• Canonical operations remain in notebooks/ and scripts/; the installed OS has no Jupyter dependency.
• Source validation and static book builds run on pushes and pull requests, separate from the existing manual privileged Build Linux workflow.
• Not yet verified: an actual newly built RAW/ISO, successful QEMU installation on this branch, or live FreeIPA enrollment. Those require operator acceptance on supported amd64 Linux.