diff --git a/docs/archive/changelogs/changelog-20260727-skill-repackage.md b/docs/archive/changelogs/changelog-20260727-skill-repackage.md index 42a328b..1043e84 100644 --- a/docs/archive/changelogs/changelog-20260727-skill-repackage.md +++ b/docs/archive/changelogs/changelog-20260727-skill-repackage.md @@ -128,3 +128,71 @@ names a repo that is not this one" was the reliable OBSERVATION; "therefore it is a stale name for this repo" was an unmeasured CONCLUSION, and one grep of `docs/design-decisions.md` inverted it. + +## Item 4 -- ADVISORY (no repo change): devteam TestCluster resize, `openstack-caracal-ipv4` + +Recorded here as SESSION NARRATIVE, not as an adopted finding. The cloud in +question is `openstack-caracal-ipv4` -- per D-110 a SEPARATE, still-live source +project with its own D-0NN series -- so nothing here is imported into this repo's +decision record. What is captured is the research, because it was expensive to +derive and was otherwise transcript-only. + +Symptom, operator-reported: signed into Horizon as `devteam-cluster`, +`Project > Container Infra > Clusters > TestCluster > Resize Cluster` returns +`Error: Unable to get cluster's working nodes.` TestCluster is single-node; the +goal is three. That cloud runs Magnum with the `magnum-capi-helm` CAPI driver. + +MEASURED (upstream source, not inferred): + +- The string is raised in magnum-ui's `magnum.service.js`, in the `.catch()` of + `getClusterNodes(id)`, which wraps + `GET /api/container_infra/clusters//resize`. +- That URL is Horizon's OWN `ClusterResize.get()` view in + `magnum_ui/api/rest/magnum.py`, which only POPULATES the dialog. It has exactly + three failure exits, ALL of which surface as this one toast: `cluster_show()` + raising `AttributeError` -> 404; `nodegroup_list()` raising `AttributeError` -> + 404; any other exception -> 500 (a 403 from `nodegroup_list` is NOT caught by + that `except AttributeError`, so authz failures land in the 500 branch). +- **Therefore the resize call is never made.** This is a READ failure populating + the dialog, BEFORE any resize is attempted -- so it is not the resize action + being denied. Authz remains a candidate CAUSE, but of reading nodegroups. +- Launchpad **#2054444** ("Cluster Resize is failing in UI") is **Invalid** + (2024-03-01, Ubuntu-focal-specific) and carries a DIFFERENT string + (`Unable to resize given cluster id`). Do not cite it as the cause. Checked + per the skill's own rule: a citation is an existence claim, only its content + is evidence. +- `magnum-capi-helm` DOES support nodegroups, so a driver gap is not the + explanation. + +In-repo prior art that bears on it: D-063's C3 verification resized `beta-cluster` +1->2 AS THE TENANT to `UPDATE_COMPLETE / HEALTHY`, which is why the CLI +(`openstack coe cluster resize`) was recommended as the unblock -- with the +qualifier that C3 was on THIS project's cloud, not on ipv4. `clientdocs/jenkins- +kubernetes-guide.md` documents both the CLI and the dashboard path; the dashboard +line is a DOCFIX candidate IN THE IPV4 REPO if the dialog is broken there. + +A self-contained diagnostic prompt for the dev-cloud Code agent was delivered to +the operator as a FILE (environment-scoped against VR1 value bleed, four phases, +report-before-acting, resize gated as an approved mutation). It is deliberately +NOT committed here: it is an ipv4-directed operational document, and importing +one is the boundary D-110 draws. + +Escalation path if it matters to VR1: should the root cause prove ARCHITECTURAL +(a genuine magnum-ui/CAPI-driver incompatibility rather than something local to +that cloud), it would also affect the DC-DC deployment, and the correct move is a +PROPOSED D-1NN in THIS repo that CITES the ipv4 finding by its original id -- +never a merge of ipv4-derived commits. + +## Item 5 -- authoring trap found this session (logged, not executed) + +`.claude/hooks/guard-destructive.py` inspects the Bash COMMAND STRING, so it +blocks a `git commit` whose MESSAGE TEXT merely contains a force-push string -- +the message was being passed via a heredoc, and the hook matched the literal +inside it. The block is correct behaviour (fail-closed on a substring match) and +should NOT be loosened; the authoring workaround is to write the message to a +file and use `git commit -F `. + +Worth folding into `references/script-authoring.md` at the next stage close, as +it will recur for anyone documenting the force-push ban in a commit or changelog. +Not done here: editing the authoritative skill is a stage-close activity and this +session closed no stage. diff --git a/docs/archive/session-ledger-rotated-20260728.md b/docs/archive/session-ledger-rotated-20260728.md new file mode 100644 index 0000000..e30ad8b --- /dev/null +++ b/docs/archive/session-ledger-rotated-20260728.md @@ -0,0 +1,33 @@ +# session-ledger summaries rotated 2026-07-28 (GA-R4 rule 3 / F1 -- oldest-first) + +Moved VERBATIM from `docs/session-ledger.md` at the skill-repackage session close, to +restore the 300-line cap (the live ledger reached 310 after that close summary was +written). This is the oldest still-live entry -- the 2026-07-26 D-137 post-close +addendum. It still points at its own archived full body; only the summary moved. +Status is in `docs/CURRENT-STATE.md` ONLY; this file is history. + +## POST-CLOSE ADDENDUM 2026-07-26 -- D-137 ADOPTED (GA-R4; 07-18/07-21 addendum precedent) +- The 2026-07-25 close bookend landed early by design; this addendum records the work that + followed it rather than re-opening the entry. +- Operator asked for a better mint/save method + "a durable rule ... so credentials aren't + misplaced or lost". Committee review (5 lenses) run; the operator's own insight drove the + design: a discovery sweep can NEVER detect a credential that was never minted -- absence + is invisible to discovery -- so an expected-state credential MATRIX is the missing half. +- **D-137 ADOPTED 2026-07-26**, all five sub-rulings RULED individually (GA-R5, each pushed + before the next was asked): enforcement = blocking in preflight; manifests DERIVED from + the matrix; --remote bounded to declared locations; D-137 is the policy authority + (SEC-009 demotes to a pointer); identity conflation FOLDED IN as the one-identity-one- + principal invariant. (SUPERSEDED SAME-DAY: implementation was built, committee-audited and + remediated later on 2026-07-26 -- see CURRENT-STATE, which is the status authority. This + line is kept as the narrative record of where the session stood at the time.) +- Research: 3 read-only agents. Capture `docs/audit/creds-creation-points-20260725.md` -- + 55 MINT sites, and **12 declared secrets have NO mint command anywhere** (`ssh-keygen` + = ZERO hits repo-wide), plus three credential dirs outside the SEC-009 convention. +- **SEC-021/-022/-023 OPENED** (rows 16 -> 19): a consolidated dc0 credential ABSENT from + its recorded location; two UNAUDITED shadow *-creds/ stores on the headend; sprawl-glob + blind spots incl. a PREDICTED Stage-5 admin-openrc exposure. All logged-not-actioned. +- NEXT as recorded at the time: build per `docs/D-137-implementation-plan.md`. THAT HAPPENED + in the same-day successor session (tiers 1-3 built, six-lens committee audit, remediation, + preflight P5 wired, SEC-009 demoted). Current status: CURRENT-STATE only. +- Status ONLY in CURRENT-STATE.md. Detail: docs/archive/changelogs/changelog-20260725-maas-admin-recovery.md. + diff --git a/docs/session-ledger.md b/docs/session-ledger.md index b1de5a6..18d6f10 100644 --- a/docs/session-ledger.md +++ b/docs/session-ledger.md @@ -135,30 +135,13 @@ the 300-line cap; one pass left it at 3 work appends a POST-CLOSE ADDENDUM. Details: docs/archive/changelogs/changelog-20260725-maas-admin-recovery.md. -## POST-CLOSE ADDENDUM 2026-07-26 -- D-137 ADOPTED (GA-R4; 07-18/07-21 addendum precedent) -- The 2026-07-25 close bookend landed early by design; this addendum records the work that - followed it rather than re-opening the entry. -- Operator asked for a better mint/save method + "a durable rule ... so credentials aren't - misplaced or lost". Committee review (5 lenses) run; the operator's own insight drove the - design: a discovery sweep can NEVER detect a credential that was never minted -- absence - is invisible to discovery -- so an expected-state credential MATRIX is the missing half. -- **D-137 ADOPTED 2026-07-26**, all five sub-rulings RULED individually (GA-R5, each pushed - before the next was asked): enforcement = blocking in preflight; manifests DERIVED from - the matrix; --remote bounded to declared locations; D-137 is the policy authority - (SEC-009 demotes to a pointer); identity conflation FOLDED IN as the one-identity-one- - principal invariant. (SUPERSEDED SAME-DAY: implementation was built, committee-audited and - remediated later on 2026-07-26 -- see CURRENT-STATE, which is the status authority. This - line is kept as the narrative record of where the session stood at the time.) -- Research: 3 read-only agents. Capture `docs/audit/creds-creation-points-20260725.md` -- - 55 MINT sites, and **12 declared secrets have NO mint command anywhere** (`ssh-keygen` - = ZERO hits repo-wide), plus three credential dirs outside the SEC-009 convention. -- **SEC-021/-022/-023 OPENED** (rows 16 -> 19): a consolidated dc0 credential ABSENT from - its recorded location; two UNAUDITED shadow *-creds/ stores on the headend; sprawl-glob - blind spots incl. a PREDICTED Stage-5 admin-openrc exposure. All logged-not-actioned. -- NEXT as recorded at the time: build per `docs/D-137-implementation-plan.md`. THAT HAPPENED - in the same-day successor session (tiers 1-3 built, six-lens committee audit, remediation, - preflight P5 wired, SEC-009 demoted). Current status: CURRENT-STATE only. -- Status ONLY in CURRENT-STATE.md. Detail: docs/archive/changelogs/changelog-20260725-maas-admin-recovery.md. +## ROTATED 2026-07-28 (GA-R4 rule 3 / F1 -- oldest-first, cap restored at the skill-repackage close) + +The oldest remaining live summary -- the 2026-07-26 POST-CLOSE ADDENDUM recording D-137's +adoption and its five sub-rulings -- moved VERBATIM to +`docs/archive/session-ledger-rotated-20260728.md`. Writing this session's close summary took +the live ledger to 310 lines against the 300-line cap; one pass restores it. Sessions from +2026-07-26 (the D-137 build close) onward remain live below. ## SESSION CLOSE 2026-07-26 -- D-137 build + committee audit + remediation (bounded, GA-R4) @@ -290,3 +273,21 @@ - **Session-scoped permission block REMOVED at close.** Full body: `docs/archive/changelogs/changelog-20260727-stage5-grounding-audit.md`. Status ONLY in CURRENT-STATE.md. + +## SESSION CLOSE 2026-07-27/28 -- .skill repackage + ipv4 resize advisory (bounded, GA-R4) + +- Packaging + advisory only; no cloud mutation, no stage moved, CURRENT-STATE untouched. Branch + `skill-repackage-20260727` off `main`, `9ffc904`+`fb8b328` pushed. **Entry lands only at MERGE; + the GitBucket PR is NOT OPENED (no `gh` here) -- the one blocking item this session leaves.** +- `.claude/` verified ALREADY PUSHED at open (clean tree, local==origin on both branches, + `39e8988` an ancestor of `origin/main`) -- nothing was pending. +- `.skill` REGENERATED after 22 days: SKILL.md was 129 lines vs 325 authoritative, platform-traps + + opentofu-provider-docs ABSENT. Now deterministic; round-trip IDENTICAL; gauntlet 81, 0-fail. +- OWNED: called its frontmatter literal a "pre-D-110 repo NAME"; D-110 makes ipv4 a SEPARATE live + SOURCE project. Corrected append-only -- forced push is denied by rule AND by the guard hook. +- ADVISORY, no repo change -- devteam TestCluster 1->3 resize fails in Horizon. magnum-ui + `getClusterNodes` -> `GET .../clusters//resize`; its 3 exits all yield one toast = a READ + failure BEFORE any resize, NOT a permission denial. Findings stay in the ipv4 repo per D-110. +- LOGGED-NOT-EXECUTED: `.gitattributes` misses `*.skill`; nothing GATES .skill freshness; guard hook + blocks a commit whose MESSAGE contains a force-push string. GA-R7: 2 memories current, none added, + one intent-shaped clause FLAGGED not edited. Body: `docs/archive/changelogs/changelog-20260727-skill-repackage.md`.