From 45000f2d8de8fa342f324e6098fb8e6554a5b9d9 Mon Sep 17 00:00:00 2001 From: codex Date: Tue, 6 Oct 2026 00:38:53 +0200 Subject: [PATCH] Record the green S1 handoff after the two-control remediation. The founder accepted the review. Both hosts now pass the read-only handoff. T08 stays waiting. Assistant: grok Assistant-Session: 01a10938-ab49-7280-877a-c06f64c06ddd --- ...reproducible-s1-declaration-and-handoff.md | 20 ++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md b/workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md index 486e071..ea0c54e 100644 --- a/workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md +++ b/workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md @@ -163,10 +163,7 @@ access or secret. ```task id: RAIL-HO-WP-0011-T05 -status: wait -needs_human: true -decision_id: 83263d8d-d6ee-4395-ac84-86b71e967648 -blocking_reason: "Attended refresh on 2026-10-05 installed the Goss surface. Railiance01 still lacks ChallengeResponseAuthentication no (1 of 48). CoulombCore lacks executable /usr/local/bin/age and the same SSH line (2 of 28). Opening 83263d8d does not edit sshd or install age." +status: done priority: high state_hub_task_id: "ba526585-6141-5df1-9094-a1322394d8b5" ``` @@ -354,9 +351,18 @@ install. Railiance01 failed 1 of 48 checks: `ChallengeResponseAuthentication no`. CoulombCore failed 2 of 28 checks: `/usr/local/bin/age` is not executable, and the same SSH line is absent. Firewall checks passed, including CoulombCore iptables INPUT DROP. A failed -check is not a green handoff. Remediation of those two controls waits on -decision `83263d8d-d6ee-4395-ac84-86b71e967648`. Opening that decision does -not edit sshd, install age, enable UFW, or rerun the refresh. +check is not a green handoff. + +2026-10-05 later: the founder accepted review +`review-9eb3b31f-cd08-4141-af7f-48e151bdebbf`. The remediation added only +`ChallengeResponseAuthentication no` to `/etc/ssh/sshd_config.d/10-hardening.conf` +on both hosts and reloaded ssh after `sshd -t`. CoulombCore had no +`/usr/local/bin/age` (`/usr/bin/age` was already on PATH, so the role's +install guard would skip it); the pinned age v1.1.1 binary was placed at that +path and is executable. UFW was not enabled and the refresh was not rerun. +`make s1-handoff` then passed for both hosts. Receipt +`reports/s1-handoff-20261005T223719Z.json`, status pass, source revision +`3930f28db6c1978a3b35e1ce1192f83c93189d9d`. T08 remains the live wait. T08 remains `wait`: source tests and metadata checks pass, but this workstation has no SOPS executable or approved decryption session for the repository's