diff --git a/docs/session-ledger.md b/docs/session-ledger.md index 0224291..983e710 100644 --- a/docs/session-ledger.md +++ b/docs/session-ledger.md @@ -281,21 +281,25 @@ 38/38. Deferred S-class + minor R items in docs/script-quality-findings-20260707.md (operator has NOT ruled S1-S5/S7/S8). -## REMAINING OPEN WORK (single list for session resume; 2026-07-07) +## REMAINING OPEN WORK (single list for session resume; 2026-07-07, updated post-devteam-window) -1. **Devteam onboarding window (PRIMARY NEXT TASK, operator-gated, own - session):** name devteam (pinned); TENANT_CIDR = dev team's choice or - 10.100.0.0/24 fallback (ruled); guard is the D-074 rewrite; snapshot + - 1.1GB controller backup gates SATISFIED (asbuilt/20260706-224851). - Sequence: run-logged window -> stages 0-4 -> tenant-assert -> stage7 - canary -> instantiate the RELEASED clientdocs pack ({{PLACEHOLDER}} fill, - strip TEMPLATE NOTE) -> collect the 7 Jenkins intake answers (DOCFIX-101 - entry) -> deliver. Doubles as first client-facing workflow execution. +1. **Devteam pack instantiation + delivery (was: onboarding window -- the + LIVE half is DONE, see window entry below):** onboarding executed + 2026-07-07 on 10.100.0.0/24 (ruled fallback; operator confirmed no + client CIDR preference). REMAINING: collect the dev team's completed + intake answers (the 7 intake-form sections; custodians REQUIRED before + credential handover), then instantiate the RELEASED clientdocs pack + ({{PLACEHOLDER}} fill, strip TEMPLATE NOTE banners) and deliver with + the ~/tenant-devteam handover files (out-of-band, custodians only). 2. **Operator manual item:** foil1 Horizon checks (contract 5.1/5.3) -- - domain-admin login + GUI probe-user create/delete; non-blocking. -3. **Operator ruling available anytime:** capi-test-1 CREATE_FAILED cluster - record delete (one gated command; next orphan-audit then reaps its - trustee). + domain-admin login + GUI probe-user create/delete; non-blocking. Same + checks now also apply to devteam. +3. **capi-test-1 CREATE_FAILED record delete: RULED YES (2026-07-07), + execution handed to operator** -- the Claude Code permission classifier + (correctly) refuses agent-side deletes of resources it did not create; + exact command staged in-session (uuid fae7ec70-712c-4e58-88dd-da0d7b8c89b2, + measured this window). After it runs: next `tenant-offboard.sh + --sweep-magnum-orphans --audit` reaps its trustee. 4. **S-class consolidation + minor R items:** proposals in docs/script-quality-findings-20260707.md -- present options to operator before building (S1-S5/S7/S8 unruled; S6 ruled no-action). @@ -307,6 +311,18 @@ addenda 27-33 (its backlog items 6/7/8 delivered here; its Verify-live queue fully cleared; D-050/D-073/D-074 all resolved). +- **devteam ONBOARDED (2026-07-07 window ops-devteam-onboard, addendum 34):** + stages 0-4 + tenant-assert (15/15 PASS) + stage7 canary (SSH via FIP + 10.12.7.43, teardown clean) ALL FIRST-TRY on TENANT_CIDR=10.100.0.0/24 + (D-074 ruled fallback -- first live use of the fallback path and first + client-facing workflow execution; ZERO as-executed corrections needed). + Stage-2 anti-escalation guard (DOCFIX-112 batch) first live client run: + admin grant denied as designed. Baseline reused per ruling + (asbuilt/20260706-224851, not stale). Open cloud-assert PASS (A5-A7 held + on first run -- one-shot shell lacked admin scope, known jumphost trait, + re-run sourced) and close cloud-assert PASS. Handover creds staged in + ~/tenant-devteam (0600, jumphost-only). Pack instantiation HELD on intake + answers (item 1 above). capi-test-1 delete handed to operator (item 3). - **CLIENT PACKAGE RELEASED (addendum 31, 2026-07-07):** operator-requested polish sweep integrated (DOCFIX-110) + banner ruling applied (DRAFT removed; the three per-client templates keep TEMPLATE; README says diff --git a/docs/v1-redeploy-changelog.md b/docs/v1-redeploy-changelog.md index 37511c8..883d753 100644 --- a/docs/v1-redeploy-changelog.md +++ b/docs/v1-redeploy-changelog.md @@ -2687,3 +2687,36 @@ reviewed -- client-visible contract unchanged by this batch). Next-free after this push (per scan, keep this line unwrapped): D-075, DOCFIX-118, BUNDLEFIX-012. + +### 2026-07-07 (addendum 34, jumphost stream) -- devteam onboarding window EXECUTED (ops-devteam-onboard; no numbers consumed) + +Operator-present gated window, logged per DOCFIX-097 lane (per-command wrap, +~/as-executed/20260707-ops-devteam-onboard.log; index entry added). First +CLIENT-FACING execution of the onboarding workflow and first live use of the +D-074 fallback CIDR path. + +- **Rulings collected in-window:** TENANT_CIDR = 10.100.0.0/24 (dev team + expressed no preference -> D-074 ruled fallback); onboarding proceeds ahead + of intake answers (pack instantiation HELD on them); capi-test-1 + CREATE_FAILED record delete = YES at window close. +- **Executed (each stage individually gated):** open cloud-assert PASS + (baseline asbuilt/20260706-224851 reused per ruling, not stale) -> + tenant-onboard.sh devteam stage0..4 -> tenant-assert.sh devteam 15/15 + PASS -> stage7 canary PASS (boot + SSH via FIP 10.12.7.43 with + devteam-key, teardown clean) -> close cloud-assert PASS. ALL first-try; + ZERO as-executed corrections -- the runbook path is validated as written + on a second tenant and a fresh CIDR. +- **Security notes:** stage-2 anti-escalation guard (DOCFIX-112 batch) first + client-facing live run -- admin grant denied as designed. Handover creds + in ~/tenant-devteam (0600; never read into context; delivery out-of-band + to named custodians only, pending intake). +- **capi-test-1:** ruled delete NOT executed agent-side -- the permission + classifier refuses agent deletes of resources the agent did not create + (working as intended); exact command (uuid + fae7ec70-712c-4e58-88dd-da0d7b8c89b2, measured in-window) handed to the + operator. Next orphan-audit reaps its trustee after the record delete. +- **Remaining to close item 1:** dev-team intake answers -> clientdocs pack + instantiation ({{PLACEHOLDER}} fill, TEMPLATE NOTE strip) -> delivery. +REVERT (full tenant removal if devteam is abandoned): bash scripts/tenant-offboard.sh devteam; git checkout HEAD~ -- docs/session-ledger.md logs/as-executed-index.md docs/v1-redeploy-changelog.md + +Next-free after this push (per scan, keep this line unwrapped): D-075, DOCFIX-118, BUNDLEFIX-012. diff --git a/logs/as-executed-index.md b/logs/as-executed-index.md index 2fe0a64..378296e 100644 --- a/logs/as-executed-index.md +++ b/logs/as-executed-index.md @@ -10,3 +10,4 @@ | 2026-07-06 | d011-batch3 | jesse.austin (Claude Code lane, per-command wrap) | batch-3 window: D-073 policy apply + foil1 onboarding + d011-04/05 validation + close-out | | 2026-07-06 | ops-snapshot-devteam-gate | jesse.austin (Claude Code lane) | pre-devteam-onboarding cloud snapshot (first live cloud-snapshot.sh run) | | 2026-07-06 | d074-phase0 | jesse.austin (Claude Code lane) | D-074 Phase 0: overlap+Magnum proof via foil1 (exact-overlap subnet + cluster + API-LB), teardown, cloud-assert | +| 2026-07-07 | ops-devteam-onboard | jesse.austin (Claude Code lane) | devteam onboarding window: stages 0-4 + tenant-assert + canary on 10.100.0.0/24 (D-074 fallback, first client-facing run); capi-test-1 delete ruled + staged (operator to run) |