diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index 8ac2187..d3dfa4b 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -863,6 +863,30 @@ happens to be on disk.** **ALL QUEUED RULINGS ARE NOW CLOSED: R1-R13 and R15 ruled, R2a and R14 WITHDRAWN as raised in error, G18 opened deferred-and-gated.** + **SESSION-CLOSE SWEEP 2026-07-27** (operator-directed, before the bookend; precedent + `queued-findings-20260726.txt` / `-20260727.txt`). Capture: + `docs/audit/queued-findings-20260727-stage5-audit.txt`. **It found THREE stale surfaces the + audit ITSELF created -- the exact defect class it was convened to find:** (1) the readiness + doc, the "read this first" artifact, still carried THIRTEEN `NEEDS-RULING` markers after + every question was closed -- now fronted by a supersession banner that names the + authorities and says what in it is STILL true (the ordered precondition sequence), with the + row-level markers deliberately left as the record of what was owed AT THE TIME; + (2) `queued-rulings` still opened "Nothing here is adopted" after fourteen adoptions; + (3) SIX of its sections had BLANK utterance lines for rulings that WERE properly recorded + in design-decisions/CURRENT-STATE -- GA-R5 satisfied, the question sheet not, so a future + session reading only that file would have believed six questions were still open. All three + fixed. Also captured, transcript-only: the repo-lint L5 heading trap (a heading LEADING + with a D-number needs AMENDMENT or RESOLVED on the same line -- it bit this session TWICE); + the commit-gated-on-lint discipline that then caught it; the read-only live-apex poll + procedure; that the office1 VMs answer from vcloud but NOT via voffice1 ("unreachable" is + never "absent"); and that `creds-matrix.tsv` is SPACE-aligned despite the extension. + **Meta-finding recorded for the next committee: the lenses' OBSERVATIONS were reliable, + their CONCLUSIONS repeatedly were not** -- three of this audit's own premises needed + correcting by measurement (R2a, R9, R14), and R8's entire evidence base collapsed on + reading the cited bugs. A lens finding is an observation, not a conclusion. + **NOT done and not owed yet: the skill sweep.** This session closed no STAGE, so the + stage-close skill fold-in and snapshot regeneration are not due; B1/C1/C2 in the capture are + the candidates when Stage 5 closes. - Position inside Stage 3: deploy step A EXECUTED 2026-07-19 (6/0/6 exact; convergence zero -- `docs/audit/outer-plan-20260719-postA-converged.txt`). **Deploy step B diff --git a/docs/audit/queued-findings-20260727-stage5-audit.txt b/docs/audit/queued-findings-20260727-stage5-audit.txt new file mode 100644 index 0000000..36af51d --- /dev/null +++ b/docs/audit/queued-findings-20260727-stage5-audit.txt @@ -0,0 +1,119 @@ +===================================================================== +SESSION-CLOSE SWEEP -- transcript-only content, Stage-5 grounding audit +Date: 2026-07-27 Branch: dc-dc-stage5-grounding-audit +Precedent: docs/audit/queued-findings-20260726.txt and -20260727.txt +Operator direction: "complete a session sweep for anything missed that +should be committed that would be lost on session end". +===================================================================== + +PART A -- STALE SURFACES THIS SESSION ITSELF CREATED (all fixed in the +same commit as this file; recorded because they are the exact defect class +the audit was convened to find, committed by the audit) + +A1. `docs/audit/stage5-readiness-20260727.md` carried THIRTEEN `NEEDS-RULING` + markers after every one of R1-R15 had been ruled or withdrawn. It is the + "read this first" artifact, so it was the single most misleading surface in + the repo at that moment. FIXED: a supersession banner at the top states that + every `NEEDS-RULING` marker is historical, names the three authorities in + order, and says what in the document is STILL true and worth reading (the + ordered precondition sequence, the evidence column, the what-breaks column). + The row-level markers were deliberately NOT rewritten -- they are the record + of what was owed at the time, and rewriting them would destroy that. + +A2. `docs/audit/queued-rulings-20260727.md` still opened with "**Nothing here is + adopted.**" after fourteen adoptions. FIXED: a STATUS block now states all + questions are closed and names `design-decisions.md` / `CURRENT-STATE.md` as + the ruling authorities rather than that file. The original sentence is struck + through, not deleted. + +A3. SIX sections of that file had BLANK `OPERATOR UTTERANCE:` lines -- R8, R9, + R10, R12, R13, R15 -- for rulings that WERE properly recorded in + design-decisions.md and CURRENT-STATE.md. GA-R5 was satisfied; the question + sheet was not. A future session reading only that file would have believed + six questions were still open. FIXED: all six filled with the exact utterance + plus where the ruling lives. + NOTE: `R14-ORIGINAL` still has a blank line and that is CORRECT -- it is the + superseded original question text kept for the audit trail, and its outcome + is recorded in the `R14 WITHDRAWN` section immediately above it. + +PART B -- OPERATIONAL FACTS THAT LIVED ONLY IN THE TRANSCRIPT + +B1. **repo-lint L5 will reject a heading that LEADS with a D-number.** The rule + (`scripts/repo_lint.py:355`) is + `^##+\s+(D-\d{3,})\b(?!.*AMENDMENT|.*RESOLVED)` -- ANY heading level leading + with `D-NNN` counts as a second DEFINITION of that decision unless the same + line also contains `AMENDMENT` or `RESOLVED`. This bit this session TWICE + (the R5 note, then the R13 sub-ruling) and cost two fix-forward cycles. + The safe forms, both already used in-repo: + `### RULING NOTE -- D-NNN: ...` (number AFTER the words) + `## D-NNN -- AMENDMENT (): ...` (contains AMENDMENT) + NOT recorded on any author-facing surface today. Worth a line in the + decision-record conventions wherever those live -- this is a trap that only + fires at commit time, after the writing is done. + +B2. **Gate your commits on lint, do not merely run lint near them.** Early in + this session a red-lint commit was pushed because lint ran in the same + compound command as the commit but the commit did not DEPEND on its result. + Every later commit used + `if bash scripts/repo-lint.sh >/dev/null 2>&1 || [ $? -eq 2 ]; then ... fi` + (exit 2 = WARN-only, which is the expected steady state here). That guard + then caught B1's second occurrence BEFORE it landed. + +B3. **Polling the live NetBox apex, read-only, without exposing the token.** + `set -a; . ~/vr1-office1-creds/vr1-netbox-sandbox.env; set +a` + `python3 netbox/office1-record-dump.py --out ` + The script reads `NETBOX_URL` + `NETBOX_TOKEN` from the environment and + prints neither; it states "NOTHING was written to NetBox". This is the + correct way to answer an apex question and it is what should have been done + BEFORE putting R2a to the operator. + +B4. **Probe path determines the answer -- the office1 VMs are reachable from + vcloud, NOT from voffice1.** A clone check run via + `ssh voffice1 'ssh office1-netbox ...'` returned "unreachable"; run directly + from vcloud it returned a real NO-CLONE. "Unreachable" is not "absent", and + the first result must never be recorded as a negative finding. Same rule that + turned `/root/maas-secrets` from "does not exist" into UNREADABLE on + 2026-07-26. + +B5. **`creds-matrix.tsv` is SPACE-ALIGNED, not tab-separated** despite the + extension. Parsing it with `awk -F'\t'` returns ZERO rows and looks like a + real result. The repo's own tooling splits on default whitespace. This nearly + produced a published figure contradicting a correct earlier finding. + +PART C -- THE META-FINDING, recorded because it should shape the NEXT committee + +C1. **The lenses' OBSERVATIONS were reliable; their CONCLUSIONS were not.** + Three of this audit's own premises had to be corrected by measurement, each + time in the direction of LESS work or a DIFFERENT problem: + - R2a: the v6 literals were already assigned under D-111. The question + should never have been asked; lens 2 had explicitly warned the apex was + UNMEASURED and that warning was not acted on. + - R9: there is ONE failure mode, not two, and the Stage-5 blast radius is + TWO scripts, not twenty. + - R14: the register already attributed AND explained the findings, and the + notes file already warned against the exact suppression the question + contemplated. + Additionally R3 shrank to two lagging segments, R1 narrowed from 18 volumes + to 8, and R8's entire evidence base collapsed on reading the cited bugs. + **Standing lesson for the next committee: a lens finding is an OBSERVATION, + not a conclusion. Measure before putting it to the operator as a question.** + The operator's own instruction is the sharpest statement of it: "Research is + cheap, guesswork is expensive." + +C2. **A citation is an existence claim; only its CONTENT is evidence.** The + v4-only lb-mgmt draft rested on two Launchpad numbers in a comment block. + Read: one was a different installer's bug, Fix Released in 2021; the other + was not an IPv6 defect at all but an OVN/LXD/MAAS FQDN binding bug whose fix + shipped in OVS 2.15 (our nodes install 2.17.9). Nothing in the repo could + catch this, because no gate reads prose. Same family as the two + ruled-but-never-built decisions this audit found (D-134's bands, D-020's + vault VIP): a plausible in-repo statement that nothing verifies. + +PART D -- NOT DONE, and deliberately so +- The skill (`.claude/skills/openstack-cloud-ops/`) was NOT swept this session. + Stage-close discipline normally folds new invariants in and regenerates the + dated Chat snapshot. This session closed no STAGE -- it produced rulings and + findings against an open one -- so the skill sweep is not owed yet. B1, C1 and + C2 above are the candidates when Stage 5 does close. +- The 21-item DOCFIX batch and every ruling's execution remain LOGGED NOT + EXECUTED. No D-/DOCFIX-/BUNDLEFIX- number was consumed this session. diff --git a/docs/audit/queued-rulings-20260727.md b/docs/audit/queued-rulings-20260727.md index d06a076..1e73c45 100644 --- a/docs/audit/queued-rulings-20260727.md +++ b/docs/audit/queued-rulings-20260727.md @@ -1,9 +1,15 @@ # QUEUED RULINGS -- Stage-5 grounding audit (2026-07-27) -**Nothing here is adopted.** Every item is PRESENTED, never picked (hard rule 1; -GA-R5: PROPOSED means present options). Each question is a SEPARATE exchange -- -GA-R5 rule 1 makes a batch adoption INVALID, so answering "yes to all" rules -NOTHING and the session that reads this must stop and re-ask. +**STATUS 2026-07-27: ALL QUESTIONS ARE NOW CLOSED.** R1-R13 and R15 were RULED +individually (one exchange each, GA-R5); R2a and R14 were WITHDRAWN as raised in +error; R16 is DEFERRED BY DIRECTION and gated as G18. **The ruling AUTHORITY for each +is `docs/design-decisions.md` (its D-number Status block) or, for the OPS ones, +`docs/CURRENT-STATE.md` -- not this file.** This file is the question sheet and the +record of what was asked; it is no longer a queue. + +~~**Nothing here is adopted.**~~ (True when written; superseded above.) Every item was +PRESENTED, never picked (hard rule 1; GA-R5: PROPOSED means present options). Each +question was a SEPARATE exchange -- GA-R5 rule 1 makes a batch adoption INVALID. **How to use this file.** Answer questions ONE AT A TIME. Write your exact words on the `OPERATOR UTTERANCE:` line. A ruling exists only once its Status block @@ -398,7 +404,7 @@ - **(b)** Attempt IPv6 `lb-mgmt-net` and make it a named Stage-5 verification. - **(c)** Defer until R2 is answered, then re-present. -OPERATOR UTTERANCE: +OPERATOR UTTERANCE: **"I want to take a Octavia creates and owns its own IPv6 network."** -- RULED 2026-07-27. Recorded as a D-101 RULING NOTE, which CLOSES the octavia-family sub-ruling the 2026-07-25 note left open. Requires NO artifact change: `create-mgmt-network` is set nowhere, so the charm default has always applied and VR0 deployed on this shape. Both in-repo citations for the v4-only draft FAILED on inspection -- see `docs/audit/octavia-ipv6-research-20260727.md`. Follow-on R8a ruled the MTU verification; G18 gates the apex question. --- @@ -438,7 +444,7 @@ authority, leaving `lib-net.sh` for substrate facts only -- closer to where D-136 would eventually take this. -OPERATOR UTTERANCE: +OPERATOR UTTERANCE: **"Derive lib-net's dc1 arm from the overlay, with a drift check (Recommended)"** -- RULED 2026-07-27, recorded as a **D-119 AMENDMENT**. Mirrors D-137 sub-ruling 2 (creds-manifests derived + drift gate). Deliberately does NOT pre-empt D-136. GUARD: `METAL_INTERNAL_VID`/`IFACE` are CORRECTLY unset per D-133 and must STAY unset. The consumer sweep is explicitly NOT covered. --- @@ -464,7 +470,7 @@ headend where MAAS is reachable, remediate the 7 credential findings. - **(c)** Record a dated, explicit exception basis for this stage only. -OPERATOR UTTERANCE: +OPERATOR UTTERANCE: **"R10, we need to fix the stale commit issue and make sure that all working directories are current."** -- RULED 2026-07-27, OPS under GA-R3, recorded in `docs/CURRENT-STATE.md`. Resolves R10 by REMOVING the reds rather than recording an exception. Exactly ONE stale clone exists (voffice1, 105 behind on a branch deleted upstream -- needs `git fetch origin && git switch main`, not `git pull`). Both racks and both office1 VMs have NO clone. --- @@ -559,7 +565,7 @@ assert content with an exit-code predicate; (b) give time verification its own gate row; (c) confirm it is STRUCK and remove the two conflicting surfaces. -OPERATOR UTTERANCE: +OPERATOR UTTERANCE: **"Fold time verification into G17 and fix the check to assert content (Recommended)"** -- RULED **AND EXECUTED** 2026-07-27: the G17 gate row in `docs/CURRENT-STATE.md` section 6 is reshaped in place, since what this rules on IS a gate row. `chronyc` mentions in CURRENT-STATE: 0 -> 3. --- @@ -582,7 +588,7 @@ `creds-mint.sh` first, since Stage 5 is the largest minting event; (c) both, in that order. -OPERATOR UTTERANCE: +OPERATOR UTTERANCE: **"Register-first, no new tool: fix the staging AND flip the 7 keypairs (Recommended)"** -- RULED 2026-07-27, recorded as **D-137 SUB-RULING 6**. Measuring found a THIRD problem the queued framing missed: the register mis-stages what Stage 5 actually mints, so P5 emits a FALSE GREEN over the largest mint event. `creds-mint.sh` stays queued for its own ruling. --- @@ -659,4 +665,4 @@ root and a zero-file scan); (b) floor on the gauntlet only; (c) leave as-is and rely on the operator noticing a changed count. -OPERATOR UTTERANCE: +OPERATOR UTTERANCE: **"All three, with a harness MANIFEST rather than a count (Recommended)"** -- RULED 2026-07-27, OPS under GA-R3, recorded in `docs/CURRENT-STATE.md`. Operationalises GA-R6. A manifest catches a RENAME that a bare count would miss. Includes preflight's fail-open exit-code path, extending the T9 fix proven for P5. diff --git a/docs/audit/stage5-readiness-20260727.md b/docs/audit/stage5-readiness-20260727.md index be223f0..b499ed0 100644 --- a/docs/audit/stage5-readiness-20260727.md +++ b/docs/audit/stage5-readiness-20260727.md @@ -1,5 +1,26 @@ # STAGE-5 READINESS -- ordered precondition checklist (2026-07-27) +> ## !! SUPERSEDED IN PART -- READ THIS BANNER FIRST (added 2026-07-27, same day) !! +> +> **Every `NEEDS-RULING` marker in this document is now HISTORICAL.** This file was written +> while R1-R15 were open questions. They are now CLOSED: **R1-R13 and R15 RULED** +> individually (GA-R5, one exchange each), **R2a and R14 WITHDRAWN** as raised in error, and +> **R16 DEFERRED BY DIRECTION and gated as G18**. The 13 `NEEDS-RULING` rows below record +> what was owed AT THE TIME, not what is owed now. +> +> **Authorities, in order:** `docs/CURRENT-STATE.md` for status and the gate table; +> `docs/design-decisions.md` for each ruling's D-number Status block; +> `docs/audit/queued-rulings-20260727.md` for the questions as put and the exact utterances. +> +> **What is still true and still worth reading here:** the ORDERED PRECONDITION SEQUENCE +> (Phases 0-5), the evidence column, and the "what breaks if skipped" column. The rulings +> decided WHAT to do; this document is still the best statement of IN WHAT ORDER. +> +> **Also corrected by later measurement:** Phase 3's intro and several row counts were written +> before the R6-R15 measurement pass. Where this document and +> `docs/audit/r9-r15-final-measurements-20260727.txt` disagree, the measurement capture wins -- +> notably R9's blast radius (TWO Stage-5 scripts, not twenty) and R14's premise (withdrawn). + **Read this first.** It is the answer to "are we ready to start Stage 5 error-free?" The full committee record is `docs/audit/stage5-committee-raw-20260727.md`; the questions needing your decision are `docs/audit/queued-rulings-20260727.md`; this