diff --git a/docs/archive/changelogs/changelog-20260727-stage5-grounding-audit.md b/docs/archive/changelogs/changelog-20260727-stage5-grounding-audit.md index 469ee37..cd8bb8d 100644 --- a/docs/archive/changelogs/changelog-20260727-stage5-grounding-audit.md +++ b/docs/archive/changelogs/changelog-20260727-stage5-grounding-audit.md @@ -50,6 +50,13 @@ `Bash(python3 *)` were ALREADY broadly allowed and can each read a `~/*-creds/` key file without tripping the guard. Pre-existing gap, not introduced here. +**Known remaining wall for a future session: there is no `Bash(timeout *)` allow +rule.** Lens 1's `timeout 240 bash scripts/preflight.sh` fell through to the +auto-mode classifier and was denied, even though bare `bash scripts/preflight.sh` +is allowed -- the `timeout` prefix means no rule MATCHES. Same failed-to-match +class as the 2026-07-26 quoted-`sudo` finding, NOT a classifier override. Add +`Bash(timeout * bash scripts/*)` (or drop the prefix) if a future session needs it. + ## 2. Deliverables (all new files) - `docs/audit/stage5-grounding-audit-scope-20260727.md` -- the charter, committed diff --git a/docs/audit/queued-rulings-20260727.md b/docs/audit/queued-rulings-20260727.md index 051c891..1d47cdf 100644 --- a/docs/audit/queued-rulings-20260727.md +++ b/docs/audit/queued-rulings-20260727.md @@ -260,6 +260,14 @@ ## R9. Where do dc1's OpenStack-layer network literals live? +> **ANSWER R2 FIRST.** R2 decides what the VIP literals ARE, and this question only +> asks where they live. If R2 goes v4-only, `overlays/dc-dc-ipv6-family-matrix.yaml` +> drops out of the deploy input and this becomes materially simpler. If it goes +> dual-stack, the per-key `vip:` REPLACE collision that L3-9 measured -- one overlay +> order hard-fails with ten "vip not a triple" errors, the reverse order silently +> drops EVERY v6 leg and still reports PASS -- has to be solved BEFORE either +> authority location is populated, or you will populate it with the wrong values. + **Finding:** L1-1 (with an explicit guard), extended by L7-10 and L7-3. `scripts/lib-net.sh`'s `vr1-dc1` arm `unset`s `VIP_PREFIX_*`, `FIP_POOL_*`, @@ -318,6 +326,11 @@ ## R11. Vault and Designate both have HA intent and no VIP +> **ANSWER R2 FIRST.** Whether the VIPs you add here are single-family or +> dual-family follows directly from R2. Adding v4-only VIPs and then re-doing them +> as dual-family means re-issuing certificate SANs against changed endpoints on a +> live cloud. + **Finding:** the vault half was already recorded; L3-2 found the SECOND case. `grep -n 'vip' bundle.yaml` returns exactly 11 lines -- none for vault, none for diff --git a/docs/audit/stage5-readiness-20260727.md b/docs/audit/stage5-readiness-20260727.md index 611f17e..be223f0 100644 --- a/docs/audit/stage5-readiness-20260727.md +++ b/docs/audit/stage5-readiness-20260727.md @@ -33,6 +33,13 @@ dc1 proxy 200 for archive and UCA). Both D-131 forwarders answer. - Gauntlet ALL GREEN (81); repo-lint 0 fail; preflight red for exactly the known reasons with nothing new joined. +- **The dc1 edge's egress is MEASURED OPEN right now** (probed directly from the + rack, bypassing the apt proxy so a cache hit could not fake it): + `streams.canonical.com/juju/tools/` -> 200 -- the juju agent stream bootstrap + actually needs -- plus `api.snapcraft.io` reachable, `archive.ubuntu.com` -> 200 + direct, and `ping 1.1.1.1` 0% loss, with the default route via `10.12.64.1`. + This was previously carried as a record, not a measurement. It means the + bootstrap window is open today (see 5.2). **What blocks it** -- in the order you would hit it: @@ -70,8 +77,14 @@ says Stage 5 owes have no step in the runbook at all** -- including the keystone policyd-override check, which is a RULED gate. -Eleven decisions are yours and are queued in `queued-rulings-20260727.md`. -Everything else on this list is mechanical. +**Fifteen decisions are yours**, queued in `queued-rulings-20260727.md`: **11 in +Part A that block Stage 5 (R1-R11)** and **4 in Part B that do not (R12-R15)**. +Answer them ONE AT A TIME -- GA-R5 makes a batch answer invalid, so "yes to all" +rules nothing. Everything else on this list is mechanical. + +**Answer R1, R2 and R3 first.** They change what gets deployed, and several later +questions have different right answers depending on them -- R2 in particular feeds +R8, R9 and R11. **Two convergent confirmations worth noting**, because they raise confidence in the whole set: the Ceph OSD blocker was found INDEPENDENTLY by two lenses using @@ -135,8 +148,11 @@ ## Phase 3 -- Deploy-artifact and runbook corrections (all DOCFIX, no choice required) -The Stage-5 runbook is the single most defective surface found. Following it -verbatim today fails or misdeploys in at least five distinct ways. +The Stage-5 runbook is the single most defective surface found. **Twenty-one +corrections are listed below**; following the runbook verbatim today fails or +misdeploys in at least nine independent ways (3.1, 3.2, 3.4, 3.5, 3.11, 3.12, +3.13, 3.14, 3.15), and three of its named gate commands cannot execute at all +against the juju that is actually installed. | # | Correction | Finding | If skipped | |---|---|---|---| @@ -186,7 +202,7 @@ | # | Precondition | Status | Note | |---|---|---|---| | 5.1 | Stage-5 entry basis against a red preflight | **NEEDS-RULING** | **R10**. Preflight exits 1 for exactly the known reasons; "PASS" is unreachable as written | -| 5.2 | Edge egress OPEN at bootstrap | **DONE / standing caveat** | `juju bootstrap` fetches the agent stream and juju/juju-db SNAPS pre-apt, which the dc1 apt proxy does not cover and D-135 items 2-3 do not exist. **Do not narrow egress until after bootstrap** | +| 5.2 | Edge egress OPEN at bootstrap | **MEASURED OPEN 2026-07-27** | Probed directly from the dc1 rack, bypassing the apt proxy so a cache hit could not fake it: `streams.canonical.com/juju/tools/` -> **200** (the agent stream bootstrap needs), `api.snapcraft.io` reachable, `archive.ubuntu.com` -> 200, `ping 1.1.1.1` 0% loss, default route via `10.12.64.1`. Previously carried as a record only. **STANDING CAVEAT UNCHANGED: `juju bootstrap` fetches the agent stream and the juju/juju-db SNAPS pre-apt, which the dc1 apt proxy does NOT cover and D-135 items 2-3 do not exist -- so do not apply the egress narrowing until after bootstrap.** Re-probe immediately before bootstrap; this is a measurement with a shelf life | | 5.3 | `juju bootstrap` with the controller-tag constraint | blocked on 2.1 | No target machine exists yet | | 5.4 | `juju deploy` with the three ruled overlays and `--dc vr1-dc1` | blocked on Phase 1 + 3 | The runbook's current command is 3.2 | | 5.5 | Pre-allocation power-state refresh | **MECHANICAL -- add as a one-line check** | L5-15: all nine dc1 nodes read a CACHED `power_state=error` until `maas admin machine query-power-state` was run explicitly, which returned `{"state":"off"}` on 9/9 and cleared it. A stale `error` immediately before deploy reads as a hard blocker and will stall Juju provisioning. **The remedy is a query-power-state refresh, not a rebuild** -- worth a runbook line so nobody diagnoses a phantom fault mid-deploy |