# Human approval — privileged remediation batch

**Engagement:** eng-coulomb-railiance01-ho-001
**Date:** 2026-07-16
**Approver:** Bernd (operator) — via session instruction: *“approve the suggested tasks… implement them”*
**Agent:** host-operator (grok session)

## Approved items

| ID | Action | Class |
|----|--------|--------|
| P1 | Emergency swap file (~4G) on root FS | privileged_ops |
| P2 | journald vacuum to ~500M | privileged_ops |
| P3 | OS package upgrades (apt) + needrestart awareness | package_upgrade |
| P4 | Tighten UFW: remove world-open 6443/8472; allow k3s API from known operator IPs | firewall_change |

## Explicit non-goals

- Hardware RAM upgrade (provider console — not shell-implementable here)
- Unilateral workload kill / pod deletion
- Reboot unless needrestart shows kernel requires it **and** operator re-confirms mid-session

## Rollback notes

- P1: `swapoff` + remove swapfile + fstab line
- P2: logs not recoverable
- P3: package-specific rollback / restore
- P4: re-add `ufw allow 6443/tcp` and `8472/udp` if access breaks

## Status

Approved for immediate implementation under host_observe + gated classes above.