diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index e7f887c..4afa146 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -2550,6 +2550,18 @@ settled solution must absorb: per-DC issuing CA and controller CA (key, passphrase, cert), the controller LEAF key/cert/bundle, the CA serial state, and the deploy overlay, at BOTH DCs. **The jumphost creds folder is the INTERIM home only.** + - **Q2 IN `docs/audit/queued-findings-20260730.txt` IS ALSO WITHDRAWN** (appended correction, + same precedent as Q1 -- this is the THIRD stale-premise item in that one file). It opens + "D-137 OPEN FORK 1 (enforcement strength) -- still unruled". **It is ruled:** sub-ruling 1, + 2026-07-25, operator's exact utterance **"Blocking in preflight"** (option b), whose + CONSEQUENCE block explicitly declines option (c): *"NOT adopted: the PreToolUse guard (so an + agent is not constrained at write time, only at the deploy gate)."* So + `guard-destructive.py` is a SEPARATE, older mechanism (CLAUDE.md secrets norms / + DOCFIX-006), and hardening it needs no D-137 ruling. The misfire evidence Q2 gathered stays + valuable -- **the tally is now SEVEN**, the two newest being the guard blocking a command + whose only purpose was to TEST it, and then blocking the heredoc writing the correction that + documents its own misfires. Both are the established class: the matcher cannot tell reading + secret material from merely naming it. - The certs remain INERT by design -- `os-public-hostname` is still set nowhere (R5 refused setting it at Stage 5 as a D-019 repeat). The names are now correct IN ADVANCE of D-106's Stage-7 work arming them. diff --git a/docs/audit/queued-findings-20260730.txt b/docs/audit/queued-findings-20260730.txt index 4899921..48963e3 100644 --- a/docs/audit/queued-findings-20260730.txt +++ b/docs/audit/queued-findings-20260730.txt @@ -145,3 +145,53 @@ Evidence: docs/audit/docfix205-d117-annotation-20260730.txt; changelog docs/changelog-20260730-docfix205-d117-annotation.md. Status ONLY in CURRENT-STATE.md. + +-------------------------------------------------------------------------- +APPENDED CORRECTION 2026-07-30 (part 2) -- Q2's PREMISE IS ALSO STALE +-------------------------------------------------------------------------- +Appended, not rewritten, same precedent as the Q1 correction above. + +Q2 above opens "D-137 OPEN FORK 1 (enforcement strength) -- still unruled". IT IS RULED. +D-137 sub-ruling 1, RULED 2026-07-25, selected option (b), operator's exact utterance +**"Blocking in preflight"**, and its CONSEQUENCE block explicitly records what was declined: +"NOT adopted: the PreToolUse guard (so an agent is not constrained at write time, only at the +deploy gate)". So fork 1 is closed, and it is closed AGAINST option (c). + +CONSEQUENCE FOR THE MISFIRE EVIDENCE Q2 COLLECTED: it is still worth keeping, but it is not +evidence for an open fork. `.claude/hooks/guard-destructive.py` is a SEPARATE, older mechanism +(CLAUDE.md's secrets norms / DOCFIX-006), not D-137's enforcement point. Improving it is +ordinary hardening of that hook, not a D-137 ruling -- and it needs no ruling to proceed. + +MEASURED 2026-07-30, and it matters for anyone reasoning about what the guard protects: +the hook is registered "matcher": "Bash" and inspects ONLY tool_input.command, keyed on a +small token set (private-key file suffix, vault-init/, as-executed/, tenant dirs, -cred.txt, +appcred). Empirically: + + ALLOWED openssl genpkey -algorithm EC ... -out controller.key + ALLOWED bash scripts/octavia-pki.sh reissue vr1-dc0 + ALLOWED bash scripts/octavia-pki.sh generate vr1-dc0 + BLOCKED openssl x509 -req ... -out + +So it does not block "minting"; it blocks a FILENAME PATTERN, and it has no opinion on any +script that wraps openssl. It is also blind to Write/Edit entirely. + +TWO FURTHER MISFIRE DATAPOINTS COLLECTED THE SAME DAY, bringing the tally to seven: + 6. It blocked a command whose ONLY purpose was to TEST the guard. The command read nothing; + it merely contained the token. + 7. It blocked the shell heredoc that was writing THIS VERY CORRECTION into the audit file -- + documentation prose, no file read at all. The text had to be landed with the file tools + instead. A guard that blocks the record of its own misfires is worth noting precisely. +Both are the same class as the earlier five (prose, a posture-IMPROVING chmod, awk reading a +runbook): the matcher cannot distinguish reading secret material from merely naming it. + +Because fork 1 already ruled that agents are NOT constrained at write time, shipping +`scripts/octavia-pki.sh reissue` as a full minter (operator: "Full script minter now", +2026-07-30) is CONSISTENT with the ruling rather than a side-effect decision on it. That was +verified BEFORE the tool was built, not after. + +`octavia-pki.sh generate` remains deliberately unimplemented -- but note the reason has now +narrowed: it is NOT blocked on a D-137 ruling. What it is blocked on is that nothing has ruled +whether a first-generation mint should move out of the runbook, and `reissue` REFUSES on a +missing certificate specifically so it cannot become a `generate` backdoor by accident. + +Evidence: docs/changelog-20260730-octavia-reissue-tool.md; docs/CURRENT-STATE.md.