coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record the 10a outcome: estimate held, check paid for itself on first run
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
32 assertions, 31 pass on Railiance01. The one failure is a real defect the old
loose assertion could never have seen: Flannel VXLAN declared open to Anywhere
with no source restriction, currently absent from the host, so converging would
introduce the exposure rather than correct drift.

Also records the sharper finding from wiring it up: verify.yaml was missing the
vars_files the bootstrap play had, so the firewall assertions rendered empty and
silently asserted nothing - worse than having no check at all.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
codex 2026-08-12 03:30:34 +02:00
parent 11db75f899
commit b6ad81fe6b
2 changed files with 27 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
WORK-RECORDS.md
View file

@ -76,5 +76,5 @@
| task | RAILIANCE-WP-0016-T01 | done | — | workplans/RAILIANCE-WP-0016-architecture-cleanup-backlog.md |
| task | RAILIANCE-WP-0016-T02 | done | — | workplans/RAILIANCE-WP-0016-architecture-cleanup-backlog.md |
| task | RAILIANCE-WP-0016-T03 | done | — | workplans/RAILIANCE-WP-0016-architecture-cleanup-backlog.md |
| task | RAILIANCE-WP-0016-T04 | todo | — | workplans/RAILIANCE-WP-0016-architecture-cleanup-backlog.md |
| task | RAILIANCE-WP-0016-T04 | done | — | workplans/RAILIANCE-WP-0016-architecture-cleanup-backlog.md |
| task | RAILIANCE-WP-0016-T05 | todo | — | workplans/RAILIANCE-WP-0016-architecture-cleanup-backlog.md |

27
workplans/RAILIANCE-WP-0016-architecture-cleanup-backlog.md
View file

@ -63,7 +63,7 @@ reliable numbers here, because nobody has scoped them yet.
| 8 | Deployable coverage check: every deployable → one rapp | `railiance-master` | 7 | 4 | 7 | 4 | **4.5** |
| 9a | Telemetry: minimal metrics collection on railiance01 | `railiance-telemetry` | 8 | 5 | 5 | 4 | **4.5** |
| 9b | Telemetry: one expectation-based alert (needs 10b) | `railiance-telemetry` | 8 | 5 | 2 | 2 | **7.5** |
| **10a** | **Run `make verify`; tighten the UFW assertion to check the allowlist** | `railiance-infra` | 8 | 7 | 9 | 1–2 | **12.0** |
| ~~10a~~ | ~~Run `make verify`; tighten the UFW assertion~~ **DONE 2026-08-12** | `railiance-infra` | 8 | 7 | 9 | 1–2 | **12.0** |
| 10b | Schedule verification; route failures where they are seen | `railiance-infra` / Q7 owner | 7 | 6 | 8 | 3 | **7.0** |
| 11 | Consolidate the bootstrap path; sort inherited S2 content | `railiance-bootstrap` | 5 | 3 | 4 | 4 | **3.0** |
| 12 | Forge migration: `rapp-forgejo` + S4 layer transfer | `railiance-forge` / S4 | 6 | 4 | 4 | 5 | **2.8** |
@ -179,6 +179,31 @@ It is two points of effort, it directly closes the hole that produced this
session's security finding, and it converts an existing but dormant asset into a
working control. Item 9 is correctly mid-table and genuinely is a build.
### 10a outcome (2026-08-12) — the estimate held, and the check paid for itself immediately
Delivered in `railiance-infra`: `goss/baseline.yaml` became a template rendered
per host from the *same* inventory declaration that converges the host, so the
assertion cannot drift from what it checks. `verify.yaml` gained the
`vars_files` the bootstrap play already had — without it the firewall assertions
rendered empty and **silently asserted nothing**, which is worse than having no
check at all.
Result on `Railiance01`: 32 assertions, 31 pass. And the one failure is a real
defect the old assertion could never have seen:
> **Flannel VXLAN (`8472/udp`) is declared open to Anywhere**, with no source
> restriction — the same defect pattern as the k3s API rule. It is currently
> *absent* from the host, so converging the base role would **introduce** the
> exposure rather than correct drift.
Tracked as `RAIL-HO-WP-0009-T06`. Two things worth taking from this:
1. **The check earned its keep on first run** — it found a latent defect that
convergence would have activated, in under two points of effort.
2. **It is an argument for finishing 10b.** This run happened because a human
asked. Nothing schedules it, so the next latent defect waits for the next
person who happens to look.
### The lesson worth keeping
The original size-5 estimate for item 10 was wrong because nobody looked. The