coulomb/kaizen-agentic
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ops: complete host-operator ramp-up on railiance01 (WP-0009 T10)
Some checks failed
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 36s
Details
ci / test (push) Failing after 3m41s
Details

Browse source 
Live observe session verified SSH access, captured baseline and Critical
health/load findings (memory pressure, k3s API unavailable). RU checklist
closed; engagement phase operating; schedule enabled; no privileged changes.
This commit is contained in:
tegwick 2026-07-16 12:43:00 +02:00
parent 7257e62dba
commit 6ca167ce19
15 changed files with 334 additions and 90 deletions
Download patch file Download diff file Expand all files Collapse all files

22
engagements/pilots/eng-coulomb-railiance01-ho-001/access-plan.md
View file

@ -9,14 +9,28 @@
| Step | Action | Owner |
|------|--------|-------|
| 1 | Inventory / facts from `railiance-hosts` (read-only) | operator |
| 2 | SSH cert via ops-warden (`warden sign` / `cert_command`) identity hint `agt` | operator |
| 2 | SSH as workstation user (tegwick) or cert via ops-warden | operator |
| 3 | Tunnel if needed (`ops-bridge`, e.g. state-hub-railiance01) | operator |
| 4 | Observe session: non-destructive health/load/os checks | host-operator agent |
| 5 | Privileged ops only after human approval recorded in vault | human + agent |
## Working path (verified 2026-07-16)
| Item | Detail |
|------|--------|
| SSH Host alias | `railiance01` in `~/.ssh/config` |
| HostName | 92.205.62.239 |
| User | tegwick |
| IdentityFile | `~/.ssh/id_custodian_agent` (also works with `id_ops` in this environment) |
| Verify command | `ssh -o BatchMode=yes railiance01 'hostname; uptime'` |
| Inventory | `railiance-hosts/inventory/servers.yaml` |
| Bridge | `state-hub-railiance01`, `issue-core-railiance01`, `state-hub-primary` **connected** (static-key) |
| Sudo | passwordless `sudo -n` available for read-only admin inspect (k3s, ufw status, needrestart) |
## Credential routing
- SSH certificates → **ops-warden**
- SSH certificates → **ops-warden** when using cert_command actors
- This pilot used **existing workstation SSH key** path (static key) for observe
- API keys / DB passwords → **OpenBao** via `warden route` (not this agent)
- Do **not** message ops-warden for secret values
@ -24,10 +38,10 @@
| Date | Result | Notes |
|------|--------|-------|
| _pending_ | | RU-01 not yet complete |
| 2026-07-16 | **OK** | ICMP OK; `ssh railiance01` interactive-non-batch shell OK; host_observe assessment completed (RU-01) |
## Revocation
| Date | Action |
|------|--------|
| _open_ | On ramp-down: stop renewing agent certs; set schedule disabled; mark here |
| _open_ | On ramp-down: stop renewing agent certs/keys used for this engagement; set schedule disabled; mark here |