33 lines
1.1 KiB
Markdown
33 lines
1.1 KiB
Markdown
|
# Human approval — privileged remediation batch
|
||
|
|
|
||
|
|
**Engagement:** eng-coulomb-railiance01-ho-001
|
||
|
|
**Date:** 2026-07-16
|
||
|
|
**Approver:** Bernd (operator) — via session instruction: *“approve the suggested tasks… implement them”*
|
||
|
|
**Agent:** host-operator (grok session)
|
||
|
|
|
||
|
|
## Approved items
|
||
|
|
|
||
|
|
| ID | Action | Class |
|
||
|
|
|----|--------|--------|
|
||
|
|
| P1 | Emergency swap file (~4G) on root FS | privileged_ops |
|
||
|
|
| P2 | journald vacuum to ~500M | privileged_ops |
|
||
|
|
| P3 | OS package upgrades (apt) + needrestart awareness | package_upgrade |
|
||
|
|
| P4 | Tighten UFW: remove world-open 6443/8472; allow k3s API from known operator IPs | firewall_change |
|
||
|
|
|
||
|
|
## Explicit non-goals
|
||
|
|
|
||
|
|
- Hardware RAM upgrade (provider console — not shell-implementable here)
|
||
|
|
- Unilateral workload kill / pod deletion
|
||
|
|
- Reboot unless needrestart shows kernel requires it **and** operator re-confirms mid-session
|
||
|
|
|
||
|
|
## Rollback notes
|
||
|
|
|
||
|
|
- P1: `swapoff` + remove swapfile + fstab line
|
||
|
|
- P2: logs not recoverable
|
||
|
|
- P3: package-specific rollback / restore
|
||
|
|
- P4: re-add `ufw allow 6443/tcp` and `8472/udp` if access breaks
|
||
|
|
|
||
|
|
## Status
|
||
|
|
|
||
|
|
Approved for immediate implementation under host_observe + gated classes above.
|