From 24b799ec5973aaa1c0e9d482579ba73295493970 Mon Sep 17 00:00:00 2001 From: codex Date: Sun, 23 Aug 2026 12:09:01 +0200 Subject: [PATCH] Record green S1 source contract CI Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018 --- WORK-RECORDS.md | 2 +- ...1-reproducible-s1-declaration-and-handoff.md | 17 ++++++++++------- 2 files changed, 11 insertions(+), 8 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 16a4dc0..73c076b 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -44,7 +44,7 @@ | task | RAIL-HO-WP-0011-T01 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md | | task | RAIL-HO-WP-0011-T02 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md | | task | RAIL-HO-WP-0011-T03 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md | -| task | RAIL-HO-WP-0011-T04 | progress | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md | +| task | RAIL-HO-WP-0011-T04 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md | | task | RAIL-HO-WP-0011-T05 | wait | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md | | task | RAIL-HO-WP-0011-T06 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md | | task | RAIL-HO-WP-0011-T07 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md | diff --git a/workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md b/workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md index bc68caf..ba76c73 100644 --- a/workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md +++ b/workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md @@ -128,7 +128,7 @@ assertions. No live firewall change occurred. ```task id: RAIL-HO-WP-0011-T04 -status: progress +status: done priority: high ``` @@ -145,11 +145,13 @@ requiring host access or secrets. firewall rule, service, or user property fails locally and in CI, while all declared profiles pass from a clean checkout. -**Implemented locally 2026-08-23.** The baseline validator enforces governed +**Done 2026-08-23.** The baseline validator enforces governed minimum packages, services, SSH directives, user/sudo posture, both required profiles, and consumer markers. Unit tests prove deliberate `htop` removal and -SSH weakening fail. Forgejo workflow coverage is committed but still needs its -post-push green run before this task is done. +SSH weakening fail. Forgejo Actions run 79 passed the source-contract, +host-smoke, and container-smoke jobs for revision `4f2312a`; the source job +runs in the repository's disposable `ubuntu-latest` lane and needs no host +access or secret. ## T05 — Provide a fresh green S1 handoff gate @@ -277,7 +279,7 @@ decryption receipt or recipient change was attempted. and protected by local and CI checks. - [ ] Provisioning/handoff and rotation paths emit metadata-only receipts with reviewed redaction behavior. -- [ ] No live provider, firewall, credential, or host mutation occurs without a +- [x] No live provider, firewall, credential, or host mutation occurs without a separately reviewed plan and the required operator approval. ## Completion Evidence @@ -291,5 +293,6 @@ Current evidence (2026-08-23): - Both profile-specific Goss templates render and parse as YAML. - Inventory, baseline, secret metadata, receipt, shell syntax, Python compile, and whitespace checks pass. -- Pending before finish: green Forgejo CI, an attended fresh all-host handoff - receipt, and an attended non-printing SOPS decryption receipt. +- Forgejo Actions run 79 is green for revision `4f2312a` across all three jobs. +- Pending before finish: an attended fresh all-host handoff receipt and an + attended non-printing SOPS decryption receipt.