diff --git a/docs/archive/changelogs/changelog-20260727-stage5-grounding-audit.md b/docs/archive/changelogs/changelog-20260727-stage5-grounding-audit.md new file mode 100644 index 0000000..469ee37 --- /dev/null +++ b/docs/archive/changelogs/changelog-20260727-stage5-grounding-audit.md @@ -0,0 +1,134 @@ +# Session changelog -- 2026-07-27 -- Stage-5 grounding audit + +ONE changelog for this session (GA-R2/D1). Branch `dc-dc-stage5-grounding-audit` +off post-merge `main` at `71519a2`. Status claims live ONLY in +`docs/CURRENT-STATE.md`; this file records what CHANGED and how to revert it. + +Operator direction: a full reconciliation and grounding from a fresh session +before Stage 5 opens -- current status, the changes required to reach the +as-built, configuration versus project goal, readiness to enter the next stage +error-free, then a review of the upcoming stages. Run autonomously while the +operator was away, with rulings QUEUED not adopted. + +--- + +## 1. Session-scoped permission expansion (settings.local.json -- GITIGNORED) + +The operator offered a broad exception; a SCOPED READ-ONLY expansion was taken +instead, on the grounds that the task is read-only by construction and the `ask` +rules ARE the enforcement of hard rule 3 (CLAUDE.md says not to work around +them). Design: the allow list enumerates READ verbs, the ask list enumerates +MUTATING verbs, and anything matching neither falls through and FAILS SAFE -- +logged UNMEASURED, never assumed absent. + +Added (allow): read-only shell tooling (`sed -n`, `head`, `tail`, `wc`, `sort`, +`uniq`, `comm`, `diff`, `find`, `stat`, `cut`, `nl`, `file`, `column`, +`tee docs/audit/*`); read-only `virsh` (local + quoted remote variants); +`ssh voffice1 *maas admin * read*` and `query-power-state`; the per-DC artifact +and rack checkers; `Write`/`Edit` on `docs/**`; `git commit`/`git push`; +`WebSearch` + eight upstream doc domains. +Replaced (ask): the five broad `ssh voffice1 "maas admin *` rules, which +walled READ calls because `ask` beats `allow` regardless of specificity, with 23 +verb-scoped MUTATION asks. Quoted variants used throughout, per the 2026-07-26 +finding that a quote breaks pattern matching. +NOT granted and not requested: jumphost `sudo`, `tofu apply|destroy|import|state +rm`, any `maas admin` write, `juju deploy|add-model|bootstrap`, `opnsense-api.sh +POST`, `scripts/* apply|install`, `*--commit*`, `rm *`. `Edit(.claude/settings*.json)` +deliberately LEFT as `ask` so the session could not widen its own permissions +unattended. Deny list and the PreToolUse guard untouched. +Deliberately NOT requested: blanket `Bash(cat *)` -- the guard's NEVER list covers +`vault-init/`, `as-executed/`, `tenant-*/`, `*-cred.txt`, `appcred`, `*.pem` but +NOT the `~/vr1-*-creds/` key files, so a blanket `cat` would open exactly the +hazard CLAUDE.md forbids. + +**REVERT: delete the added allow entries and restore the five original +`ssh voffice1 "maas admin *` ask rules. The file is gitignored, so +`docs/audit/stage5-grounding-audit-scope-20260727.md` section 6 is its only +durable record. REMOVE THE BLOCK AT SESSION CLOSE.** + +Flagged NOT fixed (hard rule 1): `Bash(awk *)`, `Bash(grep *)` and +`Bash(python3 *)` were ALREADY broadly allowed and can each read a `~/*-creds/` +key file without tripping the guard. Pre-existing gap, not introduced here. + +## 2. Deliverables (all new files) + +- `docs/audit/stage5-grounding-audit-scope-20260727.md` -- the charter, committed + BEFORE any agent was spawned so a session that died mid-run still left the plan. +- `docs/audit/stage5-readiness-20260727.md` -- the ordered precondition checklist. +- `docs/audit/stage5-committee-raw-20260727.md` -- all 7 lenses verbatim, kept + separate from synthesis so synthesis cannot quietly reshape a lens's claim. +- `docs/audit/queued-rulings-20260727.md` -- 11 Stage-5-blocking + 4 standing + questions, GA-R5 shape, blank utterance lines. NONE adopted. +- `docs/audit/stage5-live-measurement-20260727.txt` -- this session's measurements. +- `docs/audit/outer-plan-20260727-stage5-audit.txt`, + `docs/audit/preflight-20260727-stage5-audit.txt`, + `docs/audit/stage5-creds-privileged-20260727.txt` -- captures. + +REVERT: `git revert` the three audit commits (`514f0aa`, `6d511e8`, `fb8f6bc`, +`de11bf4`); every file is new. + +## 3. CURRENT-STATE edits (GA-R1 amendment C2 -- measurement corrects the record +in the capture's own commit; also what repo-lint L10 requires) + +- Section 7 pin table: Juju row corrected to the MEASURED 3.6.27 on voffice1 + (was 3.6.25). In-channel patch refresh, which D-071 permits -- policy-compliant + drift, not an incident, but it is the client that will bootstrap the controller. +- Section 7: NEW row recording that the `openstack` client is ABSENT on BOTH + hosts while ten Stage-5/6/7 scripts invoke it. No prior surface carried this. +- Section 5: convergence history extended with the three-root ZERO-DIFF + re-confirmation and the validity proof behind the inner pair. +- D-137 block: the 2026-07-27 privileged re-run recorded as a RE-CONFIRMATION of + the 2026-07-26 run, not a newly-closed item (an overclaim corrected mid-session). +- Section 1: the audit's verdict and pointers to the five artifacts. +- **Gate row G3 CORRECTED** -- the one mechanical fix taken. See below. + +REVERT: each edit is additive except G3; restore G3's prior cell text from +`git show de11bf4^:docs/CURRENT-STATE.md`. + +## 4. The single mechanical fix (deliberately chosen, not opportunistic) + +Gate row G3 read OPEN with "FREEZE holds for un-gated surfaces", contradicted by +its OWN cited evidence file (`docs/audit/phase6-exit-runs-20260719.md:84,91-92` +records the re-signature PASS and "G3 + G11 CLOSED") and by row G11 and section +11. No ruling was required -- two surfaces already declared it closed. The +consequential half was the FREEZE clause, not the state token: left standing it +would have blocked the very DOCFIX batch this audit queues. + +REVERT: restore the prior cell text (see 3). + +## 5. Logged, NOT executed (hard rule 1) + +The 21-item DOCFIX remediation batch in Phase 3 of the readiness doc, and every +gate-integrity fix in Phase 4. Nearly every runbook fix interlocks with an +unanswered ruling, so landing them now would encode assumptions. No D-, DOCFIX- +or BUNDLEFIX- number was assigned; next-free is unchanged at D 138 / DOCFIX 205 / +BUNDLEFIX 053, correctly, because nothing was remediated. + +## 6. Owned errors, recorded rather than quietly corrected + +- The per-DC artifact checkers were first run LOCALLY on vcloud, producing a + comprehensive FAIL with every probe MISS -- output indistinguishable from + "never installed". Both scripts are designed to be PIPED TO THE RACK. Corrected + by direct functional probe; lens 2 independently ran the canonical piped form + and got PASS on all three. The scripts were not at fault. +- The first exit-code reading of those checkers captured `tail`'s status through + a pipe, not the script's. Re-measured: both correctly exit 1. +- The measurement capture initially waved P3's "33 pins, 0 fail, 33 warn" through + as expected. Lens 4 established the CAUSE was a missing `juju` binary, so ZERO + pins are verified against charmhub. The count was expected; the cause was not. + Capture amended. +- The privileged credential sweep was first described as closing an item + outstanding since 2026-07-26. It was not -- that sweep completed on 07-26. + Today's run RE-CONFIRMS it against the current 82-row matrix. + +## 7. Committee mechanics + +Seven read-only lenses, each under a contract requiring: no mutating shape; the +`claim / evidence / blocks-Stage-5 / disposition` schema; and any denied or +prompted tool call reported UNMEASURED with its exact command, never folded into +a negative finding. Lens 5 died on an API error with no output and was relaunched +with the interim findings folded in. Lens 1 hit one classifier denial +(`timeout 240 bash scripts/preflight.sh`) and correctly reported it UNMEASURED; +root cause was a missing `Bash(timeout *)` allow rule -- a failed-to-MATCH, the +same class as 2026-07-26, not a classifier override. The audit session had +measured preflight independently, so that gap was closed. diff --git a/docs/archive/session-ledger-rotated-20260727.md b/docs/archive/session-ledger-rotated-20260727.md index fbb5b41..a15a577 100644 --- a/docs/archive/session-ledger-rotated-20260727.md +++ b/docs/archive/session-ledger-rotated-20260727.md @@ -68,3 +68,33 @@ detached amendments hijack the preceding decision's last-status -- D-132 dropped); FIXED number-keyed + regression cases (48/48), scan re-verified, machine block re-seeded. - Details: docs/archive/changelogs/changelog-20260723-queue-pass.md. Status ONLY in CURRENT-STATE.md. + +--- + +## SECOND ROTATION PASS 2026-07-27 (at the Stage-5 grounding audit close) + +The live ledger reached 305 lines against the 300-line cap after that session's +bookend landed. The oldest remaining live summary moved here VERBATIM, oldest-first +per GA-R4 rule 3 / F1. It still points at its own archived full body. + +## SESSION CLOSE 2026-07-24 -- caveman guardrails + DC1 proxy-build start (bounded, GA-R4) + +- caveman plugin DISABLED (enabled:false both scopes) + SEC-017 + guardrails (repo-lint L11 + *.original.md detector; deny compress; CLAUDE.md norm). commits up to 338c919..d0db020. +- DC-mirror: DC0 full mirror still syncing; DC1 debmirror PAUSED ~330G (bandwidth NOT the + bottleneck, measured) + switched to an INTERIM apt caching proxy (D-135 AMENDED 2026-07-24): + scripts/dc-cache-proxy.sh shipped + INSTALLED on dc1 (serves archive+UCA 200). Two per-DC + Stage-5 test methods (dc0 full-mirror / dc1 proxy) = gates on ONE branch, not sub-branches. +- DC1 Stage-5 deploy STARTED: per-DC MAAS creds (SEC-018/-019); Juju 3.6.25 on voffice1 + (headend, D-128); add-cloud vr1-maas + add-credential both DCs; VIP overlay + overlays/vr1-dc1-vips.yaml; phase-4 Step 2.0 (MAAS-cred task) added. commits ..116e9b2. +- **BLOCKED before bootstrap (committee-reviewed):** committed bundle.yaml is still VR0 4-node + HYPERCONVERGED; VR1 dc1 is 9 ROLE-SEPARATED (D-121 Option C). Architecture DECIDED, deploy + ARTIFACTS not rendered (dc-ha-scaleup.yaml partial/unrendered/dc0-named/stale/unwired; tag/ + placement/num_units unhandled; phase-4 runbook stale). DNS confirmed GREEN for bootstrap + (D-131 forwarder resolves external; hang can't recur) -- but bootstrap needs edge egress OPEN + (juju agents/snaps unmirrored); do NOT narrow egress until after bootstrap. +- OWNED: I fabricated a "D-193" reference in analysis (cardinal sin) -- corrected to D-121; + verified NOT persisted to repo. NEXT SESSION: render vr1-dc1 role-separated HA bundle + + wire overlays + de-stale phase-4, THEN bootstrap. Full detail: CURRENT-STATE Stage-4 bullet. +- Status ONLY in CURRENT-STATE.md. Changelog: docs/archive/changelogs/changelog-20260724-caveman-disable.md. diff --git a/docs/session-ledger.md b/docs/session-ledger.md index 5cdfe30..7e02a07 100644 --- a/docs/session-ledger.md +++ b/docs/session-ledger.md @@ -121,27 +121,11 @@ `docs/archive/session-ledger-rotated-20260727.md`. The live ledger was 317 lines against the 300-line cap. Sessions from 2026-07-24 onward remain live below. -## SESSION CLOSE 2026-07-24 -- caveman guardrails + DC1 proxy-build start (bounded, GA-R4) +## ROTATED 2026-07-27 (second pass, GA-R4 rule 3 / F1 -- cap restored at the grounding-audit close) -- caveman plugin DISABLED (enabled:false both scopes) + SEC-017 + guardrails (repo-lint L11 - *.original.md detector; deny compress; CLAUDE.md norm). commits up to 338c919..d0db020. -- DC-mirror: DC0 full mirror still syncing; DC1 debmirror PAUSED ~330G (bandwidth NOT the - bottleneck, measured) + switched to an INTERIM apt caching proxy (D-135 AMENDED 2026-07-24): - scripts/dc-cache-proxy.sh shipped + INSTALLED on dc1 (serves archive+UCA 200). Two per-DC - Stage-5 test methods (dc0 full-mirror / dc1 proxy) = gates on ONE branch, not sub-branches. -- DC1 Stage-5 deploy STARTED: per-DC MAAS creds (SEC-018/-019); Juju 3.6.25 on voffice1 - (headend, D-128); add-cloud vr1-maas + add-credential both DCs; VIP overlay - overlays/vr1-dc1-vips.yaml; phase-4 Step 2.0 (MAAS-cred task) added. commits ..116e9b2. -- **BLOCKED before bootstrap (committee-reviewed):** committed bundle.yaml is still VR0 4-node - HYPERCONVERGED; VR1 dc1 is 9 ROLE-SEPARATED (D-121 Option C). Architecture DECIDED, deploy - ARTIFACTS not rendered (dc-ha-scaleup.yaml partial/unrendered/dc0-named/stale/unwired; tag/ - placement/num_units unhandled; phase-4 runbook stale). DNS confirmed GREEN for bootstrap - (D-131 forwarder resolves external; hang can't recur) -- but bootstrap needs edge egress OPEN - (juju agents/snaps unmirrored); do NOT narrow egress until after bootstrap. -- OWNED: I fabricated a "D-193" reference in analysis (cardinal sin) -- corrected to D-121; - verified NOT persisted to repo. NEXT SESSION: render vr1-dc1 role-separated HA bundle + - wire overlays + de-stale phase-4, THEN bootstrap. Full detail: CURRENT-STATE Stage-4 bullet. -- Status ONLY in CURRENT-STATE.md. Changelog: docs/archive/changelogs/changelog-20260724-caveman-disable.md. +The oldest remaining live summary (2026-07-24, caveman guardrails + DC1 proxy-build start) +moved VERBATIM to `docs/archive/session-ledger-rotated-20260727.md`. The live ledger was 305 +lines against the 300-line cap. Sessions from 2026-07-25 onward remain live below. ## SESSION CLOSE 2026-07-25 -- handoff-pack execution + recon + Chat D-136 coupling (bounded, GA-R4) - ~~**IMMEDIATE NEXT (do FIRST):** MAAS WEB-GUI login does NOT exist -- SEC-018/019 are API/Juju-only @@ -267,3 +251,39 @@ already failed twice here). - Gauntlet ALL GREEN (81), repo-lint 0-fail. Full body: `docs/archive/changelogs/changelog-20260727-creds-consolidation.md`; stage record `docs/archive/stage-records/vr1-stage4-record.md`. Status ONLY in CURRENT-STATE.md. + +## SESSION CLOSE 2026-07-27 -- STAGE-5 GROUNDING AUDIT (bounded, GA-R4) + +- Operator-directed reconciliation before Stage 5 opens; ran AUTONOMOUSLY while they were + away, read-only, rulings QUEUED not adopted. Branch `dc-dc-stage5-grounding-audit` off + `main` at `71519a2`; 4 commits `514f0aa..de11bf4` pushed. NO stage opened or closed. +- **VERDICT: Stage 5 would NOT run error-free today and would fail early.** SUBSTRATE is + excellent -- all THREE tofu roots ZERO DIFF (first time in one session), 18 nodes Ready + exact to D-121 C, MACs/power/statics/fabrics/interfaces all verified, both artifact + paths serving, gauntlet 81 GREEN. The gap is the layer between substrate and deploy. +- Blockers, each measured: **voffice1 -- the D-128 host Stage 5 RUNS FROM -- is 105 commits + behind on a retired branch**, both dc1 overlays ABSENT, bundle still VR0 4-node; NO + `openstack` client on either host (10 scripts need it); 10th controller VM UNAUTHORED + + no tag, and dc1 has exactly 9 nodes for a 9-machine bundle; `osd-devices=/dev/vdb` but + every node has only `vda`; per-role tags authored nowhere; ZERO IPv6 vs D-101's RULED + dual-stack; and phase-01, which Step 4 delegates to "verbatim", ABORTS on dc1. +- **Gates that should have caught these cannot fail:** repo-lint PASSES over ZERO files on + a one-char typo; `cluster_count` checked nowhere so decorative HA passes; preflight + ignores any sub-gate rc not in {1,2}; P3 verified ZERO of 33 channel pins (no `juju` on + PATH). Three Stage-5 gate commands cannot execute on juju 3.6.27; four of five owed + VERIFY-LIVE gates have no runbook step at all. +- Deliverables: `docs/audit/stage5-readiness-20260727.md` (READ FIRST), + `stage5-committee-raw-20260727.md` (7 lenses verbatim), **`queued-rulings-20260727.md` + -- 11 blocking + 4 standing questions, ONE exchange each, NONE adopted**, + `stage5-live-measurement-20260727.txt`, charter `stage5-grounding-audit-scope-*.md`. +- 21-item DOCFIX batch LOGGED NOT EXECUTED (interlocks with unanswered rulings); next-free + unchanged D 138 / DOCFIX 205 / BUNDLEFIX 053. ONE mechanical fix: G3's stale FREEZE + clause, which would have blocked the remediation batch itself. +- OWNED: ran the rack checkers locally and got a false FAIL (they pipe to the rack); read + `tail`'s exit code not the script's; waved P3's 33 warns through as expected when the + CAUSE was a missing binary; called the privileged creds sweep a newly-closed item when + 07-26 had already done it. All four corrected in place, not silently. +- **A SESSION-SCOPED PERMISSION BLOCK IS LIVE in the gitignored settings.local.json -- + REMOVE IT.** Its only durable record is scope-doc section 6. SEC 21 open, unchanged. +- Full body: `docs/archive/changelogs/changelog-20260727-stage5-grounding-audit.md`. + Status ONLY in CURRENT-STATE.md.