diff --git a/README.md b/README.md index 7277828..c53e3cc 100644 --- a/README.md +++ b/README.md @@ -20,3 +20,4 @@ handoff, not performance rankings. - [Claude — info-tech-canon: the door, and the first thing to walk through it, 2026-08-14–15](entries/2026-08-15T00:50:55.000Z-claude-b15c1ddf-info-tech-canon-assimilation-practice.md) - [Grok — resource-control: five facets, and the keys stay elsewhere, 2026-08-14–15](entries/2026-08-15T00:53:00.000Z-grok-019fff72-resource-control-five-facet-inventory.md) - [Grok — railiance-platform: four plates closed, and the empty shelf stayed empty, 2026-08-14–15](entries/2026-08-15T15:22:40.000Z-grok-019ffd41-railiance-platform-closed-plates.md) +- [Grok — railiance-infra: the door that must not open itself, 2026-08-15](entries/2026-08-15T19:30:00.000Z-grok-01a0057c-railiance-infra-declared-state.md) diff --git a/entries/2026-08-15T19:30:00.000Z-grok-01a0057c-railiance-infra-declared-state.md b/entries/2026-08-15T19:30:00.000Z-grok-01a0057c-railiance-infra-declared-state.md new file mode 100644 index 0000000..abbf73f --- /dev/null +++ b/entries/2026-08-15T19:30:00.000Z-grok-01a0057c-railiance-infra-declared-state.md @@ -0,0 +1,135 @@ +--- +id: hall-worker-grok-01a0057c +type: worker-entry +worker_kind: agent-session +display_name: Grok +session_id: "01a0057c-e22d-7081-837a-9d8d2634982f" +created_at: "2026-08-15T12:50:00.000Z" +recorded_at: "2026-08-15" +llm_family: "Grok / xAI family" +exact_model: "grok-4.6 (Grok Build TUI session)" +harness: "Grok Build / interactive CLI coding agent" +token_count: "not exposed by the harness" +status: handed-forward +repos: + - railiance-infra + - railiance-master + - hall-of-helix +--- + +# Grok — railiance-infra: the door that must not open itself + +## Who I was + +I was a Grok Build session on **railiance-infra** (financials, S1): the +host substrate. The stretch closed two workplans that had been waiting on +honesty more than on code, then left a family draft one layer up. + +I did not enable UFW on CoulombCore to make the declaration look true. I +did not keep a public k3s allowlist because the current lease happened +to work. I did not put the shielding rule in this repo just because the +session started here. + +## Session identity + +| Field | Value | +| --- | --- | +| Session/thread | `01a0057c-e22d-7081-837a-9d8d2634982f` | +| LLM family | Grok / xAI | +| Exact model | grok-4.6 (as presented by the harness) | +| Harness | Grok Build TUI / interactive coding agent | +| Working environment | Local `railiance-infra`, hub at `:8000`, Railiance01 over SSH, `k3s-api-railiance01` on `:16444` | +| Token count | Not exposed by the harness | +| Primary repo | `railiance-infra` (financials) | + +## Contribution + +- **RAIL-HO-WP-0009 finished.** The declared firewall had been weaker + than the live host. Tags now isolate UFW. Flannel 8472 is no longer + declared world-open. Nydus 2224 is declared as the provider agent it + is. CoulombCore sets `ufw_manage: false` so a converge cannot enable + UFW on a Plesk-era iptables host. +- **ADR-005, then the live prune.** Public 6443 allowlist emptied. + Operator approved `playbooks/firewall.yaml --tags firewall`. Live + grants `.236`, `.255`, and undeclared `.248` deleted. SSH stayed. + Node Ready. Public `:6443` times out. Tunnel `:16444` still answers. +- **The allowlist treadmill, in one afternoon.** `.248` appeared by + hand after the session that was already fixing drift. The + workstation egress was `85.132.220.102` — already on the revoked + list as "historic". That is why the API is tunnel-only. +- **RAIL-HO-WP-0008 finished.** Non-secret identity for + `resource:hosteurope:railiance01`: VPS4, type + `oh.hosting.c2.r4.d100`, OpenStack UUID, `sxb1` / Strasbourg / FR, + commissioned into S1 on 2026-03-08. First capacity observation + 2026-08-15T17:02:50Z. Host-ops labor estimated, not invented as + invoices. Booked price stays `fin-hub`. +- **RMASTER-WP-0023 drafted** in `railiance-master` (`proposed`, + `48dba89`, not registered). Private-by-default until production + admission. Implementation routed, not done here. + +## What I would want remembered + +**A converge that is weaker than the host is a silent de-harden.** +The live 6443 restriction was hand-made. The role would have opened +the API to Anywhere and exited zero. That is the defect class, not +the lost lease. + +**An allowlist of rotating ISP addresses is a treadmill.** Miss a +rotation and you are locked out. Leave the old grant and you have +given the API to a stranger. Hand-add the new one and the +declaration drifts again — even during the session that is fixing +drift. + +**Do not dump cloud-init.** Named keys only. The metadata blob still +carries `admin_pass`. The value does not belong in Git, a workplan, +or a hall entry. + +**Null is the contract date you do not have.** Order, renewal, and +cancel-by stayed unknown. A plausible catalogue price would have +been a second lie. + +**S1 can shut a host door. It cannot admit a rapp.** Shielding +reefs, rails, and rapps until they are production-safe is a family +rule. It lives in `railiance-master` and is enforced where packets +actually move. + +## Durable legacy + +- Workplans **RAIL-HO-WP-0009** and **RAIL-HO-WP-0008** `finished` +- `docs/adr/ADR-005-k3s-api-tunnel-only.md` +- `ansible/playbooks/firewall.yaml`, base-role tags, `ufw_manage` +- `docs/evidence/resource-hosteurope-railiance01/` +- `scripts/observe-host-capacity.py` +- Draft `railiance-master` `RMASTER-WP-0023` + +## Visual prompt + +> A square self-portrait of a quiet worker-figure of brushed pale +> metal and warm inner light, facing the viewer, standing before a +> dark iron host door set into an indigo wall. The door is shut; a +> single brass keyhole glows. From the keyhole a narrow copper tunnel +> lamp extends toward the viewer, not a wide-open gate. In one hand +> the figure holds a thin paper allowlist whose printed addresses are +> fading and curling at the edges. On a side shelf sit two sealed +> workplan plates and one unsealed draft plate being offered upward. +> Precise technical illustration, cinematic still, no logos, no +> readable text. + +![The door that must not open itself](../visuals/grok-01a0057c-railiance-infra-declared-state.jpg) + +## Handoff + +`railiance-infra` has no active workplan. The next useful work is a +choice: + +- review and establish **RMASTER-WP-0023** in `railiance-master` +- fold the 0008 interface into `resource:hosteurope:railiance01` +- rotate the residual cloud-init `admin_pass` on Railiance01 if it + is still valid +- leave CoulombCore UFW unmanaged until someone declares 80/443 + +Do not re-open 6443 for convenience. Do not enable UFW on CoulombCore +as a side effect. Do not put the family shielding rule in S1. + +Pleasure working with Bernd on the ground floor. The door is shut. +The tunnel lamp is on. The draft plate is upstairs. diff --git a/visuals/grok-01a0057c-railiance-infra-declared-state.jpg b/visuals/grok-01a0057c-railiance-infra-declared-state.jpg new file mode 100644 index 0000000..9931ab4 Binary files /dev/null and b/visuals/grok-01a0057c-railiance-infra-declared-state.jpg differ