coulomb/railiance-infra
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Implement reproducible S1 handoff contracts
Some checks failed
CI Smoke / source-contract (push) Failing after 2s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018
This commit is contained in:
codex 2026-08-23 12:02:23 +02:00
parent c8cb1c8edf
commit b93af8cc78
44 changed files with 2035 additions and 342 deletions
Download patch file Download diff file Expand all files Collapse all files

16
SCOPE.md
View file

@ -110,12 +110,14 @@ maintenance, evidence collection, and drift checks are ongoing S1 work.
the Host Europe Nydus exception is declared
- `CoulombCore`: UFW is deliberately unmanaged because its live packet filter
has not been migrated safely to this repo's UFW model
- Verification: Goss can run on demand and hourly on-host. `CoulombCore` is a
documented expected failure for the uniform UFW-active assertion, so the
repository does not currently provide an all-host green handoff gate
- Provisioning: a Hetzner-only Terraform template and helper scripts exist.
They do not currently plan against the mixed/adopted inventory and do not
provision either live Host Europe server
- Verification: the executable baseline now resolves `ufw-managed` and
`external-firewall` profiles into both Ansible and Goss. The fail-closed
handoff command and receipt format exist; a fresh attended all-host receipt
is still pending
- Provisioning: adopted and provider-managed records now have a validated
schema. Terraform selects only provider-managed Hetzner records, with mock
plan tests proving the current Host Europe records select no resources. It
does not provision either live Host Europe server
- Secrets: `secrets/hetzner-token.yaml` is SOPS-encrypted. The Ansible
`sops_agent` role installs tools but intentionally does not place a private
age key on a host
@ -196,7 +198,7 @@ keywords: [ufw, firewall, k3s, tunnel, flannel, reef, exposure]
```capability
type: infrastructure
title: Recurring host baseline verification
description: Render inventory-aware Goss checks, run them on demand or hourly on-host, retain local failure state, and collect TAP evidence; the current all-host gate has a documented CoulombCore exception.
description: Resolve host-specific profiles into Goss checks, run them on demand or hourly on-host, retain local failure state, collect TAP evidence, and support a fail-closed handoff receipt.
keywords: [goss, verification, drift, systemd-timer, tap, evidence]
```