coulomb/railiance-infra
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Make S1 handoff read-only by default
All checks were successful
CI Smoke / source-contract (push) Successful in 8s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018
This commit is contained in:
codex 2026-08-23 12:41:23 +02:00
parent 24b799ec59
commit 40e295e3bd
16 changed files with 637 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

18
docs/s1-handoff.md
View file

@ -23,11 +23,19 @@ The current profiles are:
- `CoulombCore`: `external-firewall`, which verifies the declared iptables
INPUT default-drop replacement control
The verification play installs or refreshes the Goss check surface before it
runs. Treat the first run after source changes as an attended host change:
review the rendered contract and access path first. The command does not run
Terraform, change provider resources, rotate credentials, or converge the base
role.
The gate is read-only on managed hosts. Before connecting,
`scripts/handoff_contract.py` proves that its playbook contains only remote
`stat`, `assert`, and the fixed Goss validation command, and pins the Goss
assertion commands themselves to a reviewed read-only set. It renders each
selected profile locally and fails if the installed
`/etc/goss/baseline.yaml` digest differs, instead of refreshing it implicitly.
TAP and the aggregate receipt are written only beneath the controller's
ignored `reports/` path.
If a surface is stale, the operator must review it and separately approve
`make verify-refresh-host`; that change cannot be smuggled through a handoff
run. The handoff command does not run Terraform, change provider resources,
rotate credentials, converge a role, write remote files, or change services.
Receipts validate with: