Perfect. Let’s make this concrete. Since we’re still in the “planning/spec” phase, we can outline **placeholders and minimal skeleton scripts/binaries** so the ISO is bootable and ready for you to drop in real compiled binaries later.

We’ll treat `asl-auth-host` and `asl-rescue` as minimal executables (could be compiled C programs or shell wrappers for now), plus helper scripts.

---

### 1. `asl-auth-host` (skeleton)

```bash
#!/bin/bash
# /tools/asl-auth-host
# Minimal executable placeholder for domain authority host

echo "[ASL-AUTH-HOST] Starting offline domain authority host..."
echo "[*] Current timestamp: $(date)"
echo "[*] Domains available:"
ls -1 /domains || echo "  No domains found."

# Placeholder for DAM signing
echo "[*] Use ./sign_dam.sh <domain_id> to sign Domain Admission Manifest"

# Keep running for interactive session
exec /bin/bash
```

> **Permissions:** `chmod +x /tools/asl-auth-host`

---

### 2. `asl-rescue` (skeleton)

```bash
#!/bin/bash
# /tools/asl-rescue
# Minimal placeholder for rescue operations

echo "[ASL-RESCUE] Starting rescue mode..."
echo "[*] Scanning local filesystem..."
ls -l /mnt || echo "  No mount points found."

# Placeholder: add artifacts to local store
echo "[*] You can add files/artifacts using ./add_artifact.sh <path>"

# Interactive shell for manual rescue
exec /bin/bash
```

> **Permissions:** `chmod +x /tools/asl-rescue`

---

### 3. `sign_dam.sh` (helper)

```bash
#!/bin/bash
# /tools/sign_dam.sh
# Signs a Domain Admission Manifest (DAM) offline

DAM_FILE="$1"
if [ -z "$DAM_FILE" ]; then
    echo "Usage: $0 <DAM file>"
    exit 1
fi

KEY_FILE="/keys/private_authority.key"
OUT_FILE="${DAM_FILE}.signed"

echo "[*] Signing DAM $DAM_FILE using offline key $KEY_FILE..."
# placeholder signature
echo "Signed-DAM: $(sha256sum "$DAM_FILE")" > "$OUT_FILE"

echo "[*] Signed DAM stored at $OUT_FILE"
```

> **Permissions:** `chmod +x /tools/sign_dam.sh`
> **Note:** The `KEY_FILE` should be preloaded via the SOPS bundle or offline disk.

---

### 4. `add_artifact.sh` (helper)

```bash
#!/bin/bash
# /tools/add_artifact.sh
# Add a file to the local ASL store (skeleton)

FILE="$1"
if [ -z "$FILE" ] || [ ! -f "$FILE" ]; then
    echo "Usage: $0 <file>"
    exit 1
fi

STORE_DIR="/domains/personal/artifacts"
mkdir -p "$STORE_DIR"

cp "$FILE" "$STORE_DIR/"
echo "[*] Added artifact $(basename "$FILE") to $STORE_DIR"

# Optionally record in log (simplified placeholder)
echo "$(date) ADD $(basename "$FILE")" >> "$STORE_DIR/store.log"
```

> **Permissions:** `chmod +x /tools/add_artifact.sh`

---

### 5. Directory structure on ISO

```
/
├─ boot/
│   └─ boot_overlay.sh
├─ tools/
│   ├─ asl-auth-host
│   ├─ asl-rescue
│   ├─ sign_dam.sh
│   └─ add_artifact.sh
├─ domains/
│   └─ personal/       # pre-seeded or empty personal domain
├─ sops-bundles/
├─ env-claims/
└─ upper/              # overlay writable
```

---

### ✅ Notes for Next Steps

1. **Compilation**: Replace placeholders with actual compiled binaries later.
2. **Keys**: Include offline private keys in `/keys` (SOPS encrypted or temporarily unencrypted during ISO build).
3. **Overlay**: Use `boot_overlay.sh` to mount `/upper` over `/` for writable session.
4. **Persistence**: ZFS pool (`/domains`) can store all domain artifacts, DAMs, and logs.
5. **Interactivity**: Users can run `asl-rescue` for file rescue, `asl-auth-host` for offline DAM signing.

---

If you want, I can **update your build script** to **copy these skeleton scripts automatically** into `/tools`, set permissions, and integrate them with the overlay and ZFS setup. This would make the ISO **bootable and immediately usable** for offline testing.

Do you want me to do that next?