Fork: 0
OpenStack / openstack-caracal-dc-dc
Transfer to URL with SHA Find file
Newer
Older
openstack-caracal-dc-dc / docs / archive / session-ledger-rotated-20260728.md
@JANeumatrix JANeumatrix 1 hour ago 2 KB Session close bookend (GA-R4): bounded ledger summary, rotation, advisory record
Raw Blame History

session-ledger summaries rotated 2026-07-28 (GA-R4 rule 3 / F1 -- oldest-first)

Moved VERBATIM from docs/session-ledger.md at the skill-repackage session close, to restore the 300-line cap (the live ledger reached 310 after that close summary was written). This is the oldest still-live entry -- the 2026-07-26 D-137 post-close addendum. It still points at its own archived full body; only the summary moved. Status is in docs/CURRENT-STATE.md ONLY; this file is history.

POST-CLOSE ADDENDUM 2026-07-26 -- D-137 ADOPTED (GA-R4; 07-18/07-21 addendum precedent)

  • The 2026-07-25 close bookend landed early by design; this addendum records the work that followed it rather than re-opening the entry.
  • Operator asked for a better mint/save method + "a durable rule ... so credentials aren't misplaced or lost". Committee review (5 lenses) run; the operator's own insight drove the design: a discovery sweep can NEVER detect a credential that was never minted -- absence is invisible to discovery -- so an expected-state credential MATRIX is the missing half.
  • D-137 ADOPTED 2026-07-26, all five sub-rulings RULED individually (GA-R5, each pushed before the next was asked): enforcement = blocking in preflight; manifests DERIVED from the matrix; --remote bounded to declared locations; D-137 is the policy authority (SEC-009 demotes to a pointer); identity conflation FOLDED IN as the one-identity-one- principal invariant. (SUPERSEDED SAME-DAY: implementation was built, committee-audited and remediated later on 2026-07-26 -- see CURRENT-STATE, which is the status authority. This line is kept as the narrative record of where the session stood at the time.)
  • Research: 3 read-only agents. Capture docs/audit/creds-creation-points-20260725.md -- 55 MINT sites, and 12 declared secrets have NO mint command anywhere (ssh-keygen = ZERO hits repo-wide), plus three credential dirs outside the SEC-009 convention.
  • SEC-021/-022/-023 OPENED (rows 16 -> 19): a consolidated dc0 credential ABSENT from its recorded location; two UNAUDITED shadow *-creds/ stores on the headend; sprawl-glob blind spots incl. a PREDICTED Stage-5 admin-openrc exposure. All logged-not-actioned.
  • NEXT as recorded at the time: build per docs/D-137-implementation-plan.md. THAT HAPPENED in the same-day successor session (tiers 1-3 built, six-lens committee audit, remediation, preflight P5 wired, SEC-009 demoted). Current status: CURRENT-STATE only.
  • Status ONLY in CURRENT-STATE.md. Detail: docs/archive/changelogs/changelog-20260725-maas-admin-recovery.md.