55 lines
2.8 KiB
Markdown
55 lines
2.8 KiB
Markdown
|
# Existing workplan closeout review — 2026-09-27
|
||
|
|
|
||
|
|
Reviewed all root and archived workplans. The only unfinished plans are
|
||
|
|
RAIL-HO-WP-0011, 0012 and 0013; all now have state `blocked`, with eight
|
||
|
|
remaining tasks in `wait`. No new task or workplan was opened. No residual task
|
||
|
|
has been marked done without its required live acceptance evidence.
|
||
|
|
|
||
|
|
## Implemented under WP-0011 T06/T08
|
||
|
|
|
||
|
|
- Rotation dry-run output exposes the exact metadata-only review plan.
|
||
|
|
- Approval binds each changed ciphertext's SHA-256 as well as recipients/path.
|
||
|
|
- Applied receipts retain the original and resulting recipient/hash evidence.
|
||
|
|
- Unrelated Make targets no longer eagerly decrypt the Hetzner token or read
|
||
|
|
and export the local age private key.
|
||
|
|
|
||
|
|
Validation: 54 Python unit tests pass, including three new rotation regression
|
||
|
|
tests. Inventory, baseline parity, read-only handoff contract, protected secret
|
||
|
|
paths, SOPS recipient metadata and whitespace checks pass. Ansible-core 2.17.13
|
||
|
|
host-time playbook syntax check passes in a disposable controller environment.
|
||
|
|
No production decryption, recipient rotation or credential retrieval occurred.
|
||
|
|
|
||
|
|
## Read-only host verification
|
||
|
|
|
||
|
|
`ansible-playbook playbooks/verify.yaml`, Ansible-core 2.17.13, reached both hosts:
|
||
|
|
|
||
|
|
| Host | Checks completed | Blocking assertion | Changes |
|
||
|
|
| --- | --- | --- | --- |
|
||
|
|
| CoulombCore | Executable and baseline stat | `/usr/local/bin/goss` absent | 0 |
|
||
|
|
| Railiance01 | Executable and baseline stat | Installed baseline digest differs from source render | 0 |
|
||
|
|
|
||
|
|
The initial sandboxed attempt failed writing Ansible's connection cache; the
|
||
|
|
rerun with that access produced the host findings above. Neither attempt is a
|
||
|
|
passing handoff. Host refresh includes installation/configuration and an hourly
|
||
|
|
timer, so the concrete rendered diff must be reviewed before that separate
|
||
|
|
mutation; subsequent baseline failures must also be resolved before T05 closes.
|
||
|
|
|
||
|
|
## Backup dependency correction
|
||
|
|
|
||
|
|
The exact S1 offsite contract remains pending:
|
||
|
|
`d150eb3e6a19d658aa76c930b32fc20ef75ffa399558fc193fbde0738551ee62`.
|
||
|
|
Warden's route reports unknown execution workload identity. Platform WP-0029's
|
||
|
|
September 15 closure resolves the old upload-share incident, but does not accept
|
||
|
|
this contract or prove S1 transfer/restore. Keep WP-0012 T05/T06 waiting for those
|
||
|
|
specific owner and recovery receipts.
|
||
|
|
|
||
|
|
## Clock dependency check
|
||
|
|
|
||
|
|
The existing railiance-clock collector produced
|
||
|
|
`2026-09-27-railiance01-clock-inventory.json`. Read-only `dpkg-query -W systemd
|
||
|
|
systemd-timesyncd` returned `255.4-1ubuntu8.17` for both. Effective source/poll
|
||
|
|
observations and configuration hashes are recorded in the receipt and WP-0013.
|
||
|
|
RCLK-WP-0002 still lacks completed policy review; no disposable Ubuntu VM is
|
||
|
|
declared here for reboot/outage/rollback testing. The already deployed authority
|
||
|
|
does not close those gates. No clocks or services were changed.
|