coulomb/railiance-infra
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record the green S1 handoff after the two-control remediation.
Some checks failed
CI Smoke / host-smoke (push) Waiting to run
Details
CI Smoke / container-smoke (push) Waiting to run
Details
CI Smoke / source-contract (push) Has been cancelled
Details

Browse source 
The founder accepted the review. Both hosts now pass the read-only handoff. T08 stays waiting.

Assistant: grok
Assistant-Session: 01a10938-ab49-7280-877a-c06f64c06ddd
This commit is contained in:
codex 2026-10-06 00:38:53 +02:00
parent 3930f28db6
commit 45000f2d8d
1 changed files with 13 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

20
workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md
View file

@ -163,10 +163,7 @@ access or secret.
```task
id: RAIL-HO-WP-0011-T05
status: wait
needs_human: true
decision_id: 83263d8d-d6ee-4395-ac84-86b71e967648
blocking_reason: "Attended refresh on 2026-10-05 installed the Goss surface. Railiance01 still lacks ChallengeResponseAuthentication no (1 of 48). CoulombCore lacks executable /usr/local/bin/age and the same SSH line (2 of 28). Opening 83263d8d does not edit sshd or install age."
status: done
priority: high
state_hub_task_id: "ba526585-6141-5df1-9094-a1322394d8b5"
```
@ -354,9 +351,18 @@ install. Railiance01 failed 1 of 48 checks:
`ChallengeResponseAuthentication no`. CoulombCore failed 2 of 28 checks:
`/usr/local/bin/age` is not executable, and the same SSH line is absent.
Firewall checks passed, including CoulombCore iptables INPUT DROP. A failed
check is not a green handoff. Remediation of those two controls waits on
decision `83263d8d-d6ee-4395-ac84-86b71e967648`. Opening that decision does
not edit sshd, install age, enable UFW, or rerun the refresh.
check is not a green handoff.
2026-10-05 later: the founder accepted review
`review-9eb3b31f-cd08-4141-af7f-48e151bdebbf`. The remediation added only
`ChallengeResponseAuthentication no` to `/etc/ssh/sshd_config.d/10-hardening.conf`
on both hosts and reloaded ssh after `sshd -t`. CoulombCore had no
`/usr/local/bin/age` (`/usr/bin/age` was already on PATH, so the role's
install guard would skip it); the pinned age v1.1.1 binary was placed at that
path and is executable. UFW was not enabled and the refresh was not rerun.
`make s1-handoff` then passed for both hosts. Receipt
`reports/s1-handoff-20261005T223719Z.json`, status pass, source revision
`3930f28db6c1978a3b35e1ce1192f83c93189d9d`. T08 remains the live wait.
T08 remains `wait`: source tests and metadata checks pass, but this workstation
has no SOPS executable or approved decryption session for the repository's