diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index d263de9..5774dbf 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -815,8 +815,24 @@ `chronyc` appeared ZERO times in this document; (3) an unrecognised or unreachable result REFUSES rather than defaulting to success. Fixed in ONE edit because both defects share the same ONE-TIME first-boot window and splitting them risked one landing without the other. - Remaining: R13, R15 standing; G18 deferred-and-gated. **All Stage-5 BLOCKING rulings - (R1-R11) are closed.** + **R13 RULED 2026-07-27 -- exact utterance "Register-first, no new tool: fix the staging AND + flip the 7 keypairs (Recommended)"**, recorded as **D-137 SUB-RULING 6**. TWO parts, both + using mechanisms that already exist. **(1) Re-stage what Stage 5 ACTUALLY mints:** the + vault-init / Octavia-PKI / `admin-openrc` rows are `singleton` under `vr0-phase0N` + mint-stages that `stages-reached` marks `pending`, so P5 emits `[ok] E1 18 expected + artifact(s) deferred as not-yet-minted` -- **a FALSE GREEN over the largest minting event of + the deployment**, and R7's per-DC Octavia PKI ruling means TWO CA mints where the register + expects none. **(2) Converge the provenance debt via `runbook:` refs:** 30 rows / 16 ids are + `mint-ref=operator-terminal` and `grep -rnI "ssh-keygen"` returns ZERO hits repo-wide; + because **S4 already resolves `runbook::`**, recording each mint as a numbered + runbook step and flipping the ref makes the debt convergent with NO new tooling. Priority + within (2) is the SEVEN unrecoverable-in-place keypairs -- both edge keys (SEC-007/-015 make + edge SSH the ONLY management path), both svc keys, both power keys, `office1-svc-key`. + **`creds-mint.sh` STAYS QUEUED for its own ruling** -- orthogonal, since it prevents the NEXT + unregistered mint but makes no existing key reproducible and fixes no staging; bundling it + would have made urgent no-tool work wait on unscoped tooling work. + Remaining: R15 standing; G18 deferred-and-gated. **All Stage-5 BLOCKING rulings (R1-R11) are + closed.** - Position inside Stage 3: deploy step A EXECUTED 2026-07-19 (6/0/6 exact; convergence zero -- `docs/audit/outer-plan-20260719-postA-converged.txt`). **Deploy step B diff --git a/docs/design-decisions.md b/docs/design-decisions.md index 2876e0a..d48b134 100644 --- a/docs/design-decisions.md +++ b/docs/design-decisions.md @@ -5994,3 +5994,54 @@ 2026-07-26 and are not reproduced. The rehearsal-scoped posture it recorded still holds -- real credential hardening (rotation, revocation, non-shared tokens) remains deferred to post-teardown cycles per SEC-009's original rationale, while consolidation happens NOW. + +### SUB-RULING 6 (D-137) -- RULED 2026-07-27: the register is staged to what a stage ACTUALLY mints, and provenance debt converges via `runbook:` refs, not a new tool + +**Status:** RULED 2026-07-27 (operator, GA-R5). Question as presented, verbatim: "R13 -- +credential reproducibility. Three distinct problems: 30 rows at `mint-ref=operator-terminal` +(7 of them unrecoverable-in-place keypairs); `creds-mint.sh` unbuilt; and the register +mis-stages what Stage 5 actually mints (vault init, per-DC Octavia PKI, admin-openrc) so P5 +goes green through the biggest mint event. What is the scope before Stage 5?" Options +presented: (a) register-first with no new tool -- fix the staging AND flip the 7 keypairs; +(b) build `creds-mint.sh` first; (c) all three now. Operator selection, exact utterance: +**"Register-first, no new tool: fix the staging AND flip the 7 keypairs (Recommended)"**. + +**PART 1 -- RE-STAGE WHAT STAGE 5 ACTUALLY MINTS.** Measured (audit finding L7-2): the +register carries ZERO rows for Stage 5's real mint output. The vault-init, Octavia-PKI and +`admin-openrc` rows are `cardinality=singleton` with `mint-stage` in +{`vr0-phase01`,`vr0-phase02`,`vr0-phase03`}, and `creds-manifests/stages-reached` marks all +three `pending` -- so flipping `stage5` to `reached` never makes them expected. The measured +consequence is a FALSE GREEN over the largest minting event of the deployment: +`[ok] E1 18 expected artifact(s) deferred as not-yet-minted per +creds-manifests/stages-reached`. **R7 made this MORE urgent, not less:** ruling per-DC +independent Octavia PKI means TWO CA mints where the register expects none. Re-stage those +rows so they are EXPECTED at Stage 5 and P5 can actually fail on their absence. + +**PART 2 -- CONVERGE THE PROVENANCE DEBT WITHOUT NEW TOOLING.** 30 rows across 16 ids carry +`mint-ref=operator-terminal`, and `grep -rnI "ssh-keygen" .` returns ZERO hits repo-wide, so +those credentials are not reproducible from the repo. The checker currently reports this as +`[ok] S4 provenance debt: 30 row(s) ... Admitted by design`. **The S4 check ALREADY resolves +`runbook::` references**, so recording each mint as a numbered runbook step and +flipping `mint-ref` from `operator-terminal` to `runbook:` makes the debt CONVERGENT using +machinery that already exists and is already tested. + +**PRIORITY ORDER within Part 2 -- the SEVEN unrecoverable-in-place keypairs first.** Loss of +any of these means losing the only access path, so they are the ones where irreproducibility +is an operational risk rather than hygiene: +`dc0-edge-key`, `dc1-edge-key` (edge SSH -- SEC-007/-015 make this the ONLY management path +to the DC edges), `dc0-svc-key`, `dc1-svc-key` (rack service access), `dc0-maas-power-key`, +`dc1-maas-power-key` (MAAS -> libvirt power control), `office1-svc-key` (headend access). +The remaining rows (`office1-edge-root` password+hash, netbox, vault-ca-root, +rgw-multisite-system-key, `office1-env`, tailscale authkey, `maas-region-operator`) follow. + +**`creds-mint.sh` STAYS QUEUED for its own ruling and is NOT built here.** It is orthogonal: +it would prevent the NEXT unregistered mint but does not make any existing key reproducible +and does not fix the staging. Bundling it would have made the urgent no-tool work wait on +unscoped tooling work -- it needs its own decision about what it mints, where it writes and +how it registers. D-137 proposal 2(a) remains the reference. + +**Execution is a SEPARATE gated step.** Matrix edits ship with `creds-matrix.py` clean or +its findings explained, harness green, gauntlet ALL GREEN, repo-lint 0-fail, and a changelog +entry carrying a revert. NOTE the T24 caveat carried from the 2026-07-27 close: the +finding-class baseline covers TIER 1 ONLY, so a tier-2/3 regression introduced by these edits +would not turn the gauntlet red on its own.