Harden OpenZero production service and privilege boundaries

[ResearchForumOnline]

Outcome

Moves the supported OpenZero service path to loopback-only Gunicorn with a hardened systemd envelope and removes legacy model-to-root execution paths.

Security and operations

• production WSGI/Gunicorn entrypoint; direct Werkzeug startup fails closed
• systemd NoNewPrivileges, strict filesystem protection, empty capability sets and bounded address families
• removes hardcoded/default sudo passwords and automatic privilege escalation
• retires legacy direct model-output shell and tmux execution
• keeps governed actions behind the existing fingerprint/confirmation gate
• prevents duplicate PM2/systemd brain, vision and Ollama processes
• makes doctor/watchdog report required administrator actions instead of self-escalating
• keeps hf.co/... Ollama model IDs local and prefers the configured Ministral model
• uses writable security state for SSH known hosts and explicit model mount permissions

Verification

• 74/74 Python unit tests pass
• Python compileall passes
• Bash syntax passes locally and with the live Linux shell
• live preflight confirms Gunicorn 23, app and stats routes, venv, Node and model mount
• git diff --check passes

Assurance boundary

This materially hardens the public runtime but is not a claim of government certification. Remaining higher-assurance work includes signed/SBOM-backed packages, immutable code/state separation, Chromium sandboxing and dedicated restricted SSH credentials.