Implement reproducible S1 handoff contracts

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018

ansible/roles/base/tasks/main.yml

@@ -1,17 +1,22 @@
 ---
+- name: Require the executable baseline contract
+  tags: [base, baseline]
+  ansible.builtin.assert:
+    that:
+      - baseline_required_packages is defined
+      - baseline_ssh_directives is defined
+      - baseline_user is defined
+      - baseline_security is defined
+      - baseline_firewall is defined
+      - ufw_manage == baseline_firewall.managed
+    fail_msg: >-
+      Resolve a baseline_profile from spec/server-baseline.yaml through the
+      dynamic inventory before running this role.
+
 - name: Ensure base packages
   tags: [base, packages]
   ansible.builtin.package:
-    name:
-      - apt-transport-https
-      - ca-certificates
-      - curl
-      - git
-      - vim
-      - ufw
-      - fail2ban
-      - python3
-      - python3-venv
+    name: "{{ baseline_required_packages }}"
     state: present
     update_cache: true
 
@@ -23,11 +28,29 @@
     group: root
     mode: '0644'
     content: |
-      PasswordAuthentication no
-      PermitRootLogin no
-      PubkeyAuthentication yes
+      {% for directive in baseline_ssh_directives | dict2items %}
+      {{ directive.key }} {{ directive.value }}
+      {% endfor %}
   notify: Restart sshd
 
+- name: Ensure baseline operator user exists
+  tags: [base, user]
+  ansible.builtin.user:
+    name: "{{ baseline_user.name }}"
+    state: present
+    shell: "{{ baseline_user.shell }}"
+    create_home: true
+
+- name: Ensure declared passwordless sudo posture
+  tags: [base, user, sudo]
+  ansible.builtin.copy:
+    dest: "/etc/sudoers.d/{{ baseline_user.name }}"
+    owner: root
+    group: root
+    mode: '0440'
+    content: "{{ baseline_user.name }} ALL=(ALL) {{ baseline_user.sudo }}:ALL\n"
+    validate: /usr/sbin/visudo -cf %s
+
 - name: Ensure .ssh directory exists for ops_bridge_user
   tags: [base, ssh]
   ansible.builtin.file:
@@ -194,24 +217,25 @@
     state: started
     enabled: true
 
-- name: Configure fail2ban SSH jail
+- name: Configure declared fail2ban jails
   tags: [base, fail2ban]
   ansible.builtin.copy:
-    dest: /etc/fail2ban/jail.d/sshd.conf
+    dest: "/etc/fail2ban/jail.d/{{ item }}.conf"
     owner: root
     group: root
     mode: '0644'
     content: |
-      [sshd]
+      [{{ item }}]
       enabled = true
-      port    = ssh
-      filter  = sshd
+      port    = {{ 'ssh' if item == 'sshd' else item }}
+      filter  = {{ item }}
       maxretry = 5
       bantime  = 3600
       findtime = 600
+  loop: "{{ baseline_security.fail2ban_jails }}"
   notify: Restart fail2ban
 
-- name: Set HISTCONTROL to ignorespace
+- name: Set declared HISTCONTROL
   tags: [base, histcontrol]
   ansible.builtin.copy:
     dest: /etc/profile.d/histcontrol.sh
@@ -219,7 +243,7 @@
     group: root
     mode: '0644'
     content: |
-      export HISTCONTROL=ignorespace
+      export HISTCONTROL={{ baseline_security.histcontrol }}
 
 - name: Set timezone
   tags: [base, timezone]