diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index 74b7bec..52cf29f 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -209,7 +209,7 @@ |---|------|----------------|-------|---------------------------| | G1 | Audit Phase 3: fresh-agent grounding test | 3 clean-context probes score the 7-question set against this doc; holes map made | session | CLOSED 2026-07-18: 3 probes, 21/21 PASS, holes H1 (amended into G9) + H2 (no action) -- `docs/audit/phase3-grounding-test-20260718.md` | | G2 | Audit Phase 4: GA-R1..R7 structural rulings + the stage-status vocabulary A/B | ruling-type gate (GA-R6 rule 6): closes when every item carries a GA-R5 Status block | operator | CLOSED 2026-07-18: all seven GA-R + vocabulary (Option A + H1) RATIFIED, utterances quoted (`docs/audit/ga-rulings.md`, through commit `fe4f1c4` + this one) | -| G3 | Audit Phase 5: repair sweep of GA-F01..F15 (incl. memory hygiene GA-F05..F08, skill sweep) | operator-gated fix batches, each commit naming its GA-F | operator + session | FREEZE in effect; zero fixes applied; sweep plan DRAFTED awaiting external review (`docs/audit/phase5-sweep-plan.md`); executes in a FRESH session | +| G3 | Audit Phase 5: repair sweep of GA-F01..F15 (incl. memory hygiene GA-F05..F08, skill sweep) | operator-gated fix batches, each commit naming its GA-F | operator + session | FREEZE in effect; zero fixes applied; sweep plan REVIEWED (PASS, amendments S1-S5 applied -- `docs/audit/phase5-sweep-plan.md`); batches await per-batch operator gates | | G4 | The two D-130 verifications (charter-exempt, read-only/throwaway): (v7) v0.9.8 volume-replace-under-running-domain on a throwaway domain; (v8) lifecycle ignore_changes suppression of the forced replacement | run them, capture output | session | TO RUN (`docs/audit/env-snapshot-20260718.md:47-49`) | | G5 | D-130 mechanism ruling (seed-volume durable fix) | operator rules in Phase 5, quoting G4's captured output | operator | D-130 unassigned; next-free D confirmed 130 (`ledger-scan` run 2026-07-18; no `^## D-130` in design-decisions.md) | | G6 | State reconcile of autostart + seed WITHOUT bouncing guests | gated mechanism per the finding: `tofu import` (reads autostart back) or state surgery, or an operator-scheduled maintenance-window apply; `-refresh-only` is PROVEN a no-op | operator | Operator earlier selected reconcile-first (finding doc:136); superseded into audit sequencing by `2b718f5`; nothing reconciled yet | diff --git a/docs/audit/phase5-sweep-plan.md b/docs/audit/phase5-sweep-plan.md index 41702df..4eadeb1 100644 --- a/docs/audit/phase5-sweep-plan.md +++ b/docs/audit/phase5-sweep-plan.md @@ -1,7 +1,9 @@ -# Phase-5 sweep plan -- DRAFT for external review (authored 2026-07-18) +# Phase-5 sweep plan -- REVIEWED (authored 2026-07-18; external review PASS +with amendments S1-S5, applied 2026-07-18) -STATUS: DRAFT. No fix in this plan executes until the plan is externally -reviewed AND each batch is operator-gated at its stated gate point. Authored +STATUS: REVIEWED. External review PASSED with five amendments (S1-S5), +folded in below and diffable against the reviewed draft (`687dfa8`). No fix +executes until each batch is operator-gated at its stated gate point. Authored at the close of the grounding-audit session (Phases 1-4 complete, all GA-R rulings ratified -- `docs/audit/ga-rulings.md`). The executing session is a FRESH normal operator session (auto-memory ENABLED per GA-R7 rule 8) whose @@ -14,7 +16,11 @@ commit touches CURRENT-STATE.md (GA-R1 rule 8); one changelog for the whole session (GA-R2 rule 5/D1); revert path = the per-batch commits are individually revertable, each commit message carrying its own revert note. -The session ends with a GA-R4 close. +The session ends with a GA-R4 close. Mid-sweep session breaks happen ONLY +at batch boundaries, each with a GA-R4 close; the successor session +re-reads this plan and CURRENT-STATE.md before its first gate (S5a). +Per-batch completion reports carry the batch verification output + the +ls-remote proof-of-push hash. ## Batch 0 -- tooling first (so later batches run under the new checks) @@ -43,7 +49,12 @@ 2. **v7 (gated mutation):** v0.9.8 volume-replace-under-running-domain exercised on a THROWAWAY domain (create -> observe replace behavior -> destroy). Presented as an individually gated block; touches nothing - live. Output captured to a dated file. Traces: GA-F01, G4. + live. Per S4: every created object uses the collision-proof name + prefix `throwaway-v7-*`; volumes live in scratch/named storage (never + a live pool path); the closing checks VERIFY destroy + undefine + the + deletion of every `throwaway-v7-*` volume (virsh list --all + pool + listing show zero residue). Output captured to a dated file. + Traces: GA-F01, G4. 3. **D-130 DECISION POINT (operator, GA-R5 format).** The operator's recorded contingent lean (charter 1a, GA-F01): (a) `ignore_changes` -- in-repo, environment-independent, the Roosevelt-shaped property -- @@ -52,9 +63,12 @@ path + a runbook-enforced env guard, with the fragility concern stated and accepted. The decision text quotes the captured v7/v8 output. 4. **Implement the ruled mechanism** (gated; module edit + harness). -5. **G6 state reconcile** (gated; operator picks mechanism): `tofu - import` / state surgery / maintenance-window apply -- autostart + seed - reconciled WITHOUT bouncing guests (`-refresh-only` is a proven no-op). +5. **G6 state reconcile -- OPERATOR RULING in GA-R5 format (S3):** the + mechanism choice (`tofu import` / state surgery / maintenance-window + apply) is presented as a single question with per-option captured + evidence; the ruling records the paired question and utterance. + Outcome: autostart + seed reconciled WITHOUT bouncing guests + (`-refresh-only` is a proven no-op). 6. **CURRENT-STATE section 5 update:** record the new expected triple and WHY, in the SAME commit as the capture that evidences it (C2). 7. **Re-plan to a dated capture; must equal the recorded triple (G7).** @@ -74,10 +88,11 @@ | 2.3 skill references: OPNsense 26.1 rows -> 26.7 or pointer to CURRENT-STATE pin table | GA-F04 | | 2.4 hostname: CLAUDE.md:4, SKILL.md:46 -> vcloud | GA-F05 | | 2.5 H1 token migration: extractor scan lists EVERY distinct status token; each mapped per the vocabulary ruling (TO RUN/RUNNING -> OPEN etc.); no token survives unmapped; gate rows gain their GA-R6/E1 type tag | GA-F10, vocab H1, GA-R6/E1 | -| 2.6 GA-R1 rule-3 demotions: workflow stage table -> identity + links; README pin drops | GA-R1 | +| 2.6 GA-R1 rule-3 demotions: workflow stage table -> identity + links; README pin drops; CLAUDE.md's embedded expectation line ("expect 0 fail / 1 legacy WARN") demoted to a pointer under GA-R1 rule 1 (S5b) | GA-R1 | | 2.7 D-number class tags: register template + one-time D-121..129 review (tags proposed to operator as a ruling-type item; D-129 ARCH fragment split per GA-R3/A1) | GA-R3 | | 2.8 D-127 changelog: stale-claim banner added (points at GA-F14; content preserved for history) | GA-F14 | -| 2.9 GA-F11/GA-F12 adjudication: live-surface version rows and broken refs on NON-changelog surfaces fixed or pointed; changelog-class rows left to Batch 3 consolidation | GA-F11, GA-F12 | +| 2.9 GA-F11/GA-F12 adjudication: live-surface version rows and broken refs on NON-changelog surfaces fixed or pointed; changelog-class rows left to Batch 4 consolidation | GA-F11, GA-F12 | +| 2.10 (S1) R3-F residual disposition: every open item from the 2026-07-16 adversarial review (R3-F12 Octavia transient headroom, the netem D-100 sub-item, any other open R3-F) -- verify current state, then CLOSE with evidence or route into CURRENT-STATE's open-decision queue; none may remain unaccounted | R3-F register, GA-F, charter Phase 5 | Post-batch verification: extractor re-run -- contradiction groups on counted non-changelog surfaces reach ZERO; broken-ref count on live surfaces reported and reviewed. @@ -136,7 +151,11 @@ (GA-R7 rule 8): 7/7 on at least two of three, no question failed by all three. 4. Captured outer plan reads EXACTLY the section-5 recorded triple. -5. Operator reads CURRENT-STATE.md top to bottom and re-signs (signature +5. (S2) Before G9 is declared open: confirm G9's gate row names the + SEC-010 pre-apply dependency (`site-headend-install.sh --host-nodes + --check` on vvr1-dc0 at deploy step B) and any other SEC row gated on + apply, so the sweep-to-apply gap cannot swallow a security gate. +6. Operator reads CURRENT-STATE.md top to bottom and re-signs (signature REPLACES section 11 per GA-R1 rule 7). Then, and only then, the DC0 apply path resumes from its gate (G9).