diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index bd68395..ad59fa5 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -2167,6 +2167,35 @@ means the credential half of the Stage-5 entry gate must be read on the headend, which is the same host P3/P4 already require. That is a narrowing of where preflight is authoritative, not a widening, and it is the direct consequence of the ruled generation host. +- **F7 2026-07-29 -- `office1-tailscale` is LABELLED a subnet router and advertises NO ROUTES; + the workstation path is RULED to ProxyJump instead.** Raised from an operator report of + `Permission denied (publickey)` reaching `voffice1` "from my workstation via tailscale". + Measured: **`tailscale` is absent from BOTH `voffice1` and `vcloud`** (explicit path probes, + no state dir, no interface, service not running -- checked beyond `command -v`, because + tool-absent-from-PATH reported as feature-absent is a trap this repo has hit repeatedly). The + tailnet node is a separate LXD guest INSIDE voffice1 -- `office1-tailscale`, RUNNING, + `100.64.0.53`, site leg `10.10.1.11` -- and its `tailscale status --json` reports + **`AdvertisedRoutes: `**. So nothing on the tailnet can reach `10.10.0.20`; there is no + route and there never was. + **TWO RECORDS MADE THE FALSE BELIEF LOOK SUPPORTED:** the ssh stanza labels it "Office1 + subnet router (D-107)", and the operating skill's routing table says "the workstation reaches + the same over the tailnet (D-107)" -- while **D-107 is titled "Airgap posture, per-DC artifact + mirror, and NTP (VR1)"** and rules nothing of the sort. A real citation that does not support + its claim. + **RULED (operator, 2026-07-29): option (a), ProxyJump** -- the workstation reaches voffice1 + through vcloud. Option (b), advertising `10.10.0.0/24` onto the tailnet, was presented and NOT + taken: it exposes the isolated site net, a posture change against the airgap subject D-107 + actually governs, and would need its own ruling. + **FIXED operationally (outside the repo):** vcloud's `~/.ssh/config.d/vr1-sites` now matches + `Host voffice1 10.10.0.20`, so the raw IP resolves to the office1 service key with + `IdentitiesOnly yes` rather than falling through to `~/.ssh/id_*` -- the actual cause of the + denial. Both forms verified connecting, with a NEGATIVE CONTROL (`ssh -G 10.10.0.99` still + reads `identitiesonly no`) proving the key is not offered to unrelated hosts. + **QUEUED to the deferred skill sweep:** correct the routing-table citation and the + "subnet router" label. **THIS IS THE THIRD WRONG RECORD OF THE SESSION** (D-124's MAC-sourcing + instruction, the skill's tailnet citation, this label), and two of the three surfaced only + because something adjacent was being fixed -- nothing here gates prose, so no check could have + caught any of them. **F3 -- both `~/octavia-pki/` and `overlays/octavia-pki.yaml` are ABSENT here** (existence checked, no contents read). So this is generation FROM SCRATCH for both DCs: there is nothing to reuse, which retires the reuse-vs-regenerate choice diff --git a/docs/audit/stage5-findings-20260729-successor.md b/docs/audit/stage5-findings-20260729-successor.md index 23f8e72..94900df 100644 --- a/docs/audit/stage5-findings-20260729-successor.md +++ b/docs/audit/stage5-findings-20260729-successor.md @@ -198,3 +198,54 @@ Also note `preflight.sh:102` hardcodes `overlays/octavia-pki.yaml` in P2's overlay assembly loop, so it inherits F1's rename and must change with it. +--- + +## F7 -- `office1-tailscale` is labelled a SUBNET ROUTER and advertises NO ROUTES + +**Class: RULED-IS-NOT-BUILT / wrong record.** Severity: MEDIUM operationally, but it is the +THIRD instance in one session of a record that points somewhere real and says something false. + +Raised because the operator reported `Permission denied (publickey)` when trying to reach +`voffice1` "directly from my workstation via tailscale". Measured rather than assumed: + +- **`tailscale` is absent from `voffice1` AND from `vcloud`** -- no binary in any standard + location, no `/var/lib/tailscale`, no interface, service not running. Checked with explicit + path probes after an initial `command -v`, because "tool absent from PATH" reported as + "feature absent" is a trap this repo has hit repeatedly. +- The tailnet node is a SEPARATE LXD guest INSIDE voffice1: `office1-tailscale`, RUNNING, + `100.64.0.53` / `fd7a:115c:a1e0::35`, site leg `10.10.1.11`. +- **`tailscale status --json` -> `AdvertisedRoutes: `.** So nothing on the tailnet can + reach `10.10.0.20` at all. There is no route, and there never was one. + +**The two records that made the belief look supported:** + +1. `~/.ssh/config.d/vr1-sites` labels the stanza `Host office1-tailscale # Office1 subnet + router (D-107)`. It is not routing anything. +2. The operating skill's routing table states "This is the vcloud path; the workstation reaches + the same over the tailnet (D-107)". **D-107 is titled "Airgap posture, per-DC artifact + mirror, and NTP (VR1)"** and rules nothing about a workstation tailnet path -- the citation + is real but does not support the claim. Exactly the "a citation is an existence claim; only + its CONTENT is evidence" rule. + +**FIXED (operational, outside the repo):** `~/.ssh/config.d/vr1-sites` on vcloud now matches +`Host voffice1 10.10.0.20`, so the raw IP resolves to the office1 service key with +`IdentitiesOnly yes` instead of falling through to the `~/.ssh/id_*` defaults -- which was the +whole cause of the original denial. Verified both forms connect, with a NEGATIVE CONTROL +(`ssh -G 10.10.0.99` still reads `identitiesonly no`) proving the key is not offered to +unrelated hosts. + +**RULED (operator, 2026-07-29): option (a), ProxyJump.** The workstation reaches `voffice1` +through `vcloud` rather than over the tailnet. Making `office1-tailscale` advertise +`10.10.0.0/24` was presented as option (b) and NOT taken -- it exposes the isolated site net +onto the tailnet, which is a posture change against the airgap subject D-107 actually governs, +and would need its own ruling. + +**QUEUED, NOT EXECUTED:** correct the skill's routing-table citation, and correct or remove the +"subnet router" label in the ssh stanza. The skill sweep is deferred to the Stage-5 close by +standing operator direction, so this is input to it. + +**WORTH A TARGETED SWEEP:** three wrong records in one session (D-124's MAC sourcing +instruction, the skill's tailnet citation, this label), and two of the three were found only +because something adjacent was being fixed. Nothing in this repo gates prose, so none of them +could have been caught by a check. +