coulomb/railiance-infra
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record green S1 source contract CI
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / source-contract (push) Successful in 9s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018
This commit is contained in:
codex 2026-08-23 12:09:01 +02:00
parent 4f2312a7d7
commit 24b799ec59
2 changed files with 11 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

2
WORK-RECORDS.md
View file

@ -44,7 +44,7 @@
| task | RAIL-HO-WP-0011-T01 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |
| task | RAIL-HO-WP-0011-T02 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |
| task | RAIL-HO-WP-0011-T03 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |
| task | RAIL-HO-WP-0011-T04 | progress | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |
| task | RAIL-HO-WP-0011-T04 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |
| task | RAIL-HO-WP-0011-T05 | wait | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |
| task | RAIL-HO-WP-0011-T06 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |
| task | RAIL-HO-WP-0011-T07 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |

17
workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md
View file

@ -128,7 +128,7 @@ assertions. No live firewall change occurred.
```task
id: RAIL-HO-WP-0011-T04
status: progress
status: done
priority: high
```
@ -145,11 +145,13 @@ requiring host access or secrets.
firewall rule, service, or user property fails locally and in CI, while all
declared profiles pass from a clean checkout.
**Implemented locally 2026-08-23.** The baseline validator enforces governed
**Done 2026-08-23.** The baseline validator enforces governed
minimum packages, services, SSH directives, user/sudo posture, both required
profiles, and consumer markers. Unit tests prove deliberate `htop` removal and
SSH weakening fail. Forgejo workflow coverage is committed but still needs its
post-push green run before this task is done.
SSH weakening fail. Forgejo Actions run 79 passed the source-contract,
host-smoke, and container-smoke jobs for revision `4f2312a`; the source job
runs in the repository's disposable `ubuntu-latest` lane and needs no host
access or secret.
## T05 — Provide a fresh green S1 handoff gate
@ -277,7 +279,7 @@ decryption receipt or recipient change was attempted.
and protected by local and CI checks.
- [ ] Provisioning/handoff and rotation paths emit metadata-only receipts with
reviewed redaction behavior.
- [ ] No live provider, firewall, credential, or host mutation occurs without a
- [x] No live provider, firewall, credential, or host mutation occurs without a
separately reviewed plan and the required operator approval.
## Completion Evidence
@ -291,5 +293,6 @@ Current evidence (2026-08-23):
- Both profile-specific Goss templates render and parse as YAML.
- Inventory, baseline, secret metadata, receipt, shell syntax, Python compile,
and whitespace checks pass.
- Pending before finish: green Forgejo CI, an attended fresh all-host handoff
receipt, and an attended non-printing SOPS decryption receipt.
- Forgejo Actions run 79 is green for revision `4f2312a` across all three jobs.
- Pending before finish: an attended fresh all-host handoff receipt and an
attended non-printing SOPS decryption receipt.