Implement reproducible S1 handoff contracts

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018

goss/baseline.yaml.j2

@@ -1,63 +1,42 @@
-# Goss baseline assertions for railiance managed nodes.
-# Derived from spec/server-baseline.yaml — keep in sync.
-# Run: goss -g /etc/goss/baseline.yaml validate
-#
-# THIS IS A TEMPLATE. It is rendered per host from inventory variables, so the
-# firewall assertions below are generated from the SAME declaration that
-# converges the host (k3s_api_allowed_sources, flannel_vxlan_allowed_sources,
-# ufw_extra_allowed in group_vars). That is deliberate: a hand-written
-# assertion drifts from the declaration it is meant to check, which is exactly
-# how RAIL-HO-WP-0009 happened.
+# Rendered from the executable spec/server-baseline.yaml profile selected by
+# inventory/servers.yaml. Package, service, SSH, user, security, and firewall
+# controls below consume baseline_* variables resolved by inventory_from_yaml.py.
 
 package:
-  ufw:
+{% for package_name in baseline_required_packages %}
+  {{ package_name }}:
     installed: true
-  fail2ban:
-    installed: true
-  git:
-    installed: true
-  curl:
-    installed: true
-  vim:
-    installed: true
-  htop:
-    installed: true
-
-# age and sops are binary installs, not apt packages — checked via command below
+{% endfor %}
 
 service:
-  ufw:
-    enabled: true
-    running: true
-  fail2ban:
-    enabled: true
-    running: true
-  # Ubuntu 24.04 uses socket activation: ssh.service is disabled by design,
-  # ssh.socket keeps it running. Assert the socket is enabled.
-  ssh.socket:
+{% for service_name in baseline_required_services %}
+  {{ service_name }}:
     enabled: true
     running: true
+{% endfor %}
 
 file:
   /etc/ssh/sshd_config.d/10-hardening.conf:
     exists: true
     contents:
-      - "PermitRootLogin no"
-      - "PasswordAuthentication no"
-      - "PubkeyAuthentication yes"
+{% for directive in baseline_ssh_directives | dict2items %}
+      - "{{ directive.key }} {{ directive.value }}"
+{% endfor %}
 
 user:
-  tegwick:
+  {{ baseline_user.name }}:
     exists: true
-    # sudo access is via /etc/sudoers.d/tegwick (NOPASSWD), not group membership
-    shell: /bin/bash
+    shell: {{ baseline_user.shell }}
 
 command:
-  "ufw status":
+  "{{ baseline_firewall.verification.command }}":
     exit-status: 0
     stdout:
-      - "Status: active"
-      - /OpenSSH.*ALLOW/
+{% for pattern in baseline_firewall.verification.stdout %}
+      - '/{{ pattern }}/'
+{% endfor %}
+
+{% if baseline_firewall.mode == 'ufw' %}
 {% for src in k3s_api_allowed_sources | default([]) %}
       - '/6443\/tcp\s+ALLOW\s+{{ src.address | regex_escape }}/'
 {% endfor %}
@@ -71,10 +50,6 @@ command:
       - '/{{ port }}\/tcp\s+ALLOW\s+Anywhere/'
 {% endfor %}
 
-  # Exact allowlist size: extra hand grants must fail, not only missing ones.
-  # The previous assertion matched /6443\/tcp.*ALLOW/, which passes identically
-  # whether the API is restricted to one operator address or open to the entire
-  # internet — it asserted that the port was allowed, not from whom.
   "ufw status | grep -Ec '6443/tcp[[:space:]]+ALLOW[[:space:]]+Anywhere' || true":
     exit-status: 0
     stdout:
@@ -93,24 +68,27 @@ command:
       - "{{ flannel_vxlan_allowed_sources | default([]) | length }}"
 
 {% for src in k3s_api_revoked_sources | default([]) %}
-  # Revoked operator source must not retain access: {{ src.comment | default('') }}
   "ufw status | grep -Ec '6443/tcp[[:space:]]+ALLOW[[:space:]]+{{ src.address }}' || true":
     exit-status: 0
     stdout:
       - "0"
 {% endfor %}
-  "grep NOPASSWD /etc/sudoers.d/tegwick":
+{% endif %}
+
+  "grep NOPASSWD /etc/sudoers.d/{{ baseline_user.name }}":
     exit-status: 0
     stdout:
       - "NOPASSWD"
   "grep -r HISTCONTROL /etc/profile.d/":
     exit-status: 0
     stdout:
-      - "ignorespace"
-  "fail2ban-client status sshd":
+      - "{{ baseline_security.histcontrol }}"
+{% for jail in baseline_security.fail2ban_jails %}
+  "fail2ban-client status {{ jail }}":
     exit-status: 0
     stdout:
-      - "Status for the jail: sshd"
+      - "Status for the jail: {{ jail }}"
+{% endfor %}
   "test -x /usr/local/bin/age":
     exit-status: 0
   "test -x /usr/local/bin/sops":