coulomb/railiance-infra
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record the green S1 handoff after the two-control remediation.
Some checks failed
CI Smoke / host-smoke (push) Waiting to run
Details
CI Smoke / container-smoke (push) Waiting to run
Details
CI Smoke / source-contract (push) Has been cancelled
Details

Browse source 
The founder accepted the review. Both hosts now pass the read-only handoff. T08 stays waiting.

Assistant: grok
Assistant-Session: 01a10938-ab49-7280-877a-c06f64c06ddd
This commit is contained in:
codex 2026-10-06 00:38:53 +02:00
parent 3930f28db6
commit 45000f2d8d
1 changed files with 13 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

20
workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md
View file

@ -163,10 +163,7 @@ access or secret.
```task ```task
id: RAIL-HO-WP-0011-T05 id: RAIL-HO-WP-0011-T05
status: wait status: done
needs_human: true
decision_id: 83263d8d-d6ee-4395-ac84-86b71e967648
blocking_reason: "Attended refresh on 2026-10-05 installed the Goss surface. Railiance01 still lacks ChallengeResponseAuthentication no (1 of 48). CoulombCore lacks executable /usr/local/bin/age and the same SSH line (2 of 28). Opening 83263d8d does not edit sshd or install age."
priority: high priority: high
state_hub_task_id: "ba526585-6141-5df1-9094-a1322394d8b5" state_hub_task_id: "ba526585-6141-5df1-9094-a1322394d8b5"
``` ```
@ -354,9 +351,18 @@ install. Railiance01 failed 1 of 48 checks:
`ChallengeResponseAuthentication no`. CoulombCore failed 2 of 28 checks: `ChallengeResponseAuthentication no`. CoulombCore failed 2 of 28 checks:
`/usr/local/bin/age` is not executable, and the same SSH line is absent. `/usr/local/bin/age` is not executable, and the same SSH line is absent.
Firewall checks passed, including CoulombCore iptables INPUT DROP. A failed Firewall checks passed, including CoulombCore iptables INPUT DROP. A failed
check is not a green handoff. Remediation of those two controls waits on check is not a green handoff.
decision `83263d8d-d6ee-4395-ac84-86b71e967648`. Opening that decision does
not edit sshd, install age, enable UFW, or rerun the refresh. 2026-10-05 later: the founder accepted review
`review-9eb3b31f-cd08-4141-af7f-48e151bdebbf`. The remediation added only
`ChallengeResponseAuthentication no` to `/etc/ssh/sshd_config.d/10-hardening.conf`
on both hosts and reloaded ssh after `sshd -t`. CoulombCore had no
`/usr/local/bin/age` (`/usr/bin/age` was already on PATH, so the role's
install guard would skip it); the pinned age v1.1.1 binary was placed at that
path and is executable. UFW was not enabled and the refresh was not rerun.
`make s1-handoff` then passed for both hosts. Receipt
`reports/s1-handoff-20261005T223719Z.json`, status pass, source revision
`3930f28db6c1978a3b35e1ce1192f83c93189d9d`. T08 remains the live wait.
T08 remains `wait`: source tests and metadata checks pass, but this workstation T08 remains `wait`: source tests and metadata checks pass, but this workstation
has no SOPS executable or approved decryption session for the repository's has no SOPS executable or approved decryption session for the repository's