coulomb/railiance-infra
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Make S1 handoff read-only by default
All checks were successful
CI Smoke / source-contract (push) Successful in 8s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018
This commit is contained in:
codex 2026-08-23 12:41:23 +02:00
parent 24b799ec59
commit 40e295e3bd
16 changed files with 637 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

30
Makefile
View file

@ -74,10 +74,13 @@ validate-inventory: ## Validate adopted/provider-managed host declarations witho
validate-baseline: ## Validate the executable baseline and its Ansible/Goss consumers
python3 scripts/baseline_contract.py --check-repo
validate-handoff-readonly: ## Prove the live S1 handoff playbook has no remote mutation surface
python3 scripts/handoff_contract.py
validate-receipts: ## Validate committed metadata-only S1 receipt examples
python3 scripts/s1_receipt.py docs/evidence/s1-receipts/*.json
s1-handoff: ## Run the live fail-closed S1 verification gate and emit a receipt
s1-handoff: ## Run the read-only live S1 verification gate and emit a receipt
python3 scripts/s1_handoff.py
s1-handoff-dry-run: ## Validate handoff inputs without host access; receipt is not-run
@ -254,7 +257,8 @@ ansible-help: ## Show common Ansible commands
@echo " make converge-firewall HOST=Railiance01 # UFW only (RAIL-HO-WP-0009)"
@echo " make converge-check # dry-run (check mode)"
@echo " make converge-diff # show config diffs"
@echo " make verify-host HOST=Railiance01"
@echo " make verify-host HOST=Railiance01 # read-only host verification"
@echo " make verify-refresh-host HOST=Railiance01 APPROVE_VERIFY_REFRESH=REFRESH-GOSS-Railiance01"
@echo " make goss-status # last on-host timer result"
ansible-inventory: ## Print the dynamic inventory Ansible will use
@ -275,14 +279,11 @@ status: ## Show live security state of all hosts (UFW, fail2ban, SSH hardening)
@echo ""
@echo "--- Hint: run 'make verify' for a structured pass/fail report ---"
verify: ## Run Goss test suite against all hosts, commit TAP reports — exits non-zero on failure
@echo "Running Goss baseline assertions..."
verify: validate-handoff-readonly ## Read-only Goss verification of all hosts; writes TAP only on controller
@echo "Running read-only Goss baseline assertions..."
@cd $(ANS_DIR) && ansible-playbook playbooks/verify.yaml $(ANSIBLE_USER_FLAG) || \
(echo "One or more assertions FAILED — see reports/ for TAP output." && exit 1)
@echo "All assertions passed."
@git add reports/ && \
git diff --cached --quiet && echo "No new reports to commit." || \
git commit -m "chore: Goss verification reports $$(date -u +%Y-%m-%dT%H%M%SZ)"
observe-railiance01: ## Timestamped host capacity observation for resource-control
@mkdir -p docs/evidence/resource-hosteurope-railiance01/observations
@ -294,12 +295,23 @@ observe-railiance01: ## Timestamped host capacity observation for resource-contr
ln -sfn $$stamp.json docs/evidence/resource-hosteurope-railiance01/observations/latest.json; \
echo "wrote $$dest"
verify-host: ## Run Goss against one host: make verify-host HOST=Railiance01
verify-host: validate-handoff-readonly ## Read-only Goss verification: make verify-host HOST=Railiance01
@test -n "$(HOST)" || (echo "Usage: make verify-host HOST=Railiance01"; exit 1)
@echo "Running Goss baseline assertions on $(HOST)..."
@echo "Running read-only Goss baseline assertions on $(HOST)..."
@cd $(ANS_DIR) && ansible-playbook playbooks/verify.yaml $(ANSIBLE_USER_FLAG) -l $(HOST) || \
(echo "One or more assertions FAILED — see reports/ for TAP output." && exit 1)
verify-refresh: ## Refresh Goss on all hosts after review (exact approval required)
@test "$(APPROVE_VERIFY_REFRESH)" = "REFRESH-GOSS-ALL" || \
(echo "Refusing host mutation: set APPROVE_VERIFY_REFRESH=REFRESH-GOSS-ALL after review"; exit 1)
cd $(ANS_DIR) && ansible-playbook playbooks/verify-refresh.yaml $(ANSIBLE_USER_FLAG)
verify-refresh-host: ## Refresh one host: HOST=... APPROVE_VERIFY_REFRESH=REFRESH-GOSS-<HOST>
@test -n "$(HOST)" || (echo "Usage: make verify-refresh-host HOST=Railiance01 APPROVE_VERIFY_REFRESH=REFRESH-GOSS-Railiance01"; exit 1)
@test "$(APPROVE_VERIFY_REFRESH)" = "REFRESH-GOSS-$(HOST)" || \
(echo "Refusing host mutation: set APPROVE_VERIFY_REFRESH=REFRESH-GOSS-$(HOST) after review"; exit 1)
cd $(ANS_DIR) && ansible-playbook playbooks/verify-refresh.yaml $(ANSIBLE_USER_FLAG) -l $(HOST)
goss-status: ## Fetch last on-host Goss timer result (fails if FAILED flag present)
cd $(ANS_DIR) && ansible-playbook playbooks/goss-status.yaml $(ANSIBLE_USER_FLAG)