coulomb/railiance-infra
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Make S1 handoff read-only by default
All checks were successful
CI Smoke / source-contract (push) Successful in 8s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018
This commit is contained in:
codex 2026-08-23 12:41:23 +02:00
parent 24b799ec59
commit 40e295e3bd
16 changed files with 637 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

5
README.md
View file

@ -116,3 +116,8 @@ baseline state.
This includes admin user setup, SSH hardening, firewall rules, essential tooling, and secret handling.
📖 See the full guide here: [Convergence Documentation](docs/convergence.md)
Routine `make verify` and `make s1-handoff` runs are read-only on managed
hosts. Updating the installed Goss surface is deliberately separate and
requires an exact `APPROVE_VERIFY_REFRESH` value; see
[Server Verification](docs/verification.md).