coulomb/railiance-infra
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record green S1 source contract CI
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / source-contract (push) Successful in 9s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018
This commit is contained in:
codex 2026-08-23 12:09:01 +02:00
parent 4f2312a7d7
commit 24b799ec59
2 changed files with 11 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

2
WORK-RECORDS.md
View file

@ -44,7 +44,7 @@
| task | RAIL-HO-WP-0011-T01 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md | | task | RAIL-HO-WP-0011-T01 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |
| task | RAIL-HO-WP-0011-T02 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md | | task | RAIL-HO-WP-0011-T02 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |
| task | RAIL-HO-WP-0011-T03 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md | | task | RAIL-HO-WP-0011-T03 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |
| task | RAIL-HO-WP-0011-T04 | progress | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md | | task | RAIL-HO-WP-0011-T04 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |
| task | RAIL-HO-WP-0011-T05 | wait | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md | | task | RAIL-HO-WP-0011-T05 | wait | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |
| task | RAIL-HO-WP-0011-T06 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md | | task | RAIL-HO-WP-0011-T06 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |
| task | RAIL-HO-WP-0011-T07 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md | | task | RAIL-HO-WP-0011-T07 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |

17
workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md
View file

@ -128,7 +128,7 @@ assertions. No live firewall change occurred.
```task ```task
id: RAIL-HO-WP-0011-T04 id: RAIL-HO-WP-0011-T04
status: progress status: done
priority: high priority: high
``` ```
@ -145,11 +145,13 @@ requiring host access or secrets.
firewall rule, service, or user property fails locally and in CI, while all firewall rule, service, or user property fails locally and in CI, while all
declared profiles pass from a clean checkout. declared profiles pass from a clean checkout.
**Implemented locally 2026-08-23.** The baseline validator enforces governed **Done 2026-08-23.** The baseline validator enforces governed
minimum packages, services, SSH directives, user/sudo posture, both required minimum packages, services, SSH directives, user/sudo posture, both required
profiles, and consumer markers. Unit tests prove deliberate `htop` removal and profiles, and consumer markers. Unit tests prove deliberate `htop` removal and
SSH weakening fail. Forgejo workflow coverage is committed but still needs its SSH weakening fail. Forgejo Actions run 79 passed the source-contract,
post-push green run before this task is done. host-smoke, and container-smoke jobs for revision `4f2312a`; the source job
runs in the repository's disposable `ubuntu-latest` lane and needs no host
access or secret.
## T05 — Provide a fresh green S1 handoff gate ## T05 — Provide a fresh green S1 handoff gate
@ -277,7 +279,7 @@ decryption receipt or recipient change was attempted.
and protected by local and CI checks. and protected by local and CI checks.
- [ ] Provisioning/handoff and rotation paths emit metadata-only receipts with - [ ] Provisioning/handoff and rotation paths emit metadata-only receipts with
reviewed redaction behavior. reviewed redaction behavior.
- [ ] No live provider, firewall, credential, or host mutation occurs without a - [x] No live provider, firewall, credential, or host mutation occurs without a
separately reviewed plan and the required operator approval. separately reviewed plan and the required operator approval.
## Completion Evidence ## Completion Evidence
@ -291,5 +293,6 @@ Current evidence (2026-08-23):
- Both profile-specific Goss templates render and parse as YAML. - Both profile-specific Goss templates render and parse as YAML.
- Inventory, baseline, secret metadata, receipt, shell syntax, Python compile, - Inventory, baseline, secret metadata, receipt, shell syntax, Python compile,
and whitespace checks pass. and whitespace checks pass.
- Pending before finish: green Forgejo CI, an attended fresh all-host handoff - Forgejo Actions run 79 is green for revision `4f2312a` across all three jobs.
receipt, and an attended non-printing SOPS decryption receipt. - Pending before finish: an attended fresh all-host handoff receipt and an
attended non-printing SOPS decryption receipt.