From 016047f81e1f15f0f2979d2afb7afbce4ce6f7f1 Mon Sep 17 00:00:00 2001 From: codex Date: Sun, 11 Oct 2026 23:30:09 +0200 Subject: [PATCH] Close evening session: assessment closing note and checklist results Co-Authored-By: Claude Opus 5.5 --- docs/attended-window/2026-10-11-checklist.md | 7 +++++-- ...netkingdom-security-progress-assessment.md | 19 +++++++++++++++++++ 2 files changed, 24 insertions(+), 2 deletions(-) diff --git a/docs/attended-window/2026-10-11-checklist.md b/docs/attended-window/2026-10-11-checklist.md index 1f2d8ae..c5795f6 100644 --- a/docs/attended-window/2026-10-11-checklist.md +++ b/docs/attended-window/2026-10-11-checklist.md @@ -78,7 +78,10 @@ Argo adoption. This has not been executed. users.coulomb.social. coulomb.social stays password-only by intent. **U08 is blocked** by a recovery-preview defect (key-cape KEY-WP-0040-T01) and will be re-run after the fix with platform-root as operator. Evidence: user-engine `docs/evidence/2026-10-11-mfa-attended-u05-u08.md`. -- **Item 2 (signed-in access readback, USER-WP-0026-T03):** not done tonight. -- **Item 3 (CoulombCore ArgoCD read-only):** not done tonight. +- **Item 2 (signed-in access readback, USER-WP-0026-T03):** deny path accepted (tegwick → Informed + Decision "Not available", correct). Optional 2-minute positive check: sign in as platform-root (an admin + with OTP) and expect "Informed Decision - Available". +- **Item 3 (CoulombCore ArgoCD read-only):** no longer needed. k3s certificates expired on 2026-08-31, + so the old ArgoCD is frozen. The founder retires coulombcore and reuses the machine (NK-WP-0022-T08). - Findings filed: F1 → coulomb-social CSOC-WP-0016; F3 → key-cape KEY-WP-0040-T02 + user-engine wording; F6 → KEY-WP-0040-T01. diff --git a/history/20261011-netkingdom-security-progress-assessment.md b/history/20261011-netkingdom-security-progress-assessment.md index b169fd3..0728cba 100644 --- a/history/20261011-netkingdom-security-progress-assessment.md +++ b/history/20261011-netkingdom-security-progress-assessment.md @@ -247,3 +247,22 @@ Rules: Report daily: steps proven, tasks closed, new ATTENDED items. Not commit counts. Stop when steps 1–4 are proven or nothing in READY/UNBLOCKED remains. ``` + +--- + +# Closing note — 2026-10-11 late evening + +- **Sol re-engaged** with the renewed goal (CUST-WP-0079-T07 is effectively done; the founder started + it). Within hours it had added the generated-only commit guard (CUST-WP-0079-T05, + `scripts/check_generated_only_commit.py`). The guard also classes `docs/attended-window/` as + generated, which blocks standalone edits to the founder checklist. Consider narrowing it. +- **State Hub:** the C-07 checker fix was pushed (state-hub `5830ba3`). railiance-platform syncs clean. +- **Founder choke points:** the attended list went from 14 to 3 through round-3/4 decisions, + agent-run read-only checks, and items returned to owners. MFA U05–U07 were accepted. U08 is blocked + by KEY-WP-0040-T01. The signed-in readback deny path was accepted. CoulombCore was found frozen + (k3s certs expired 2026-08-31) and will be retired for machine reuse. +- **Open hub decisions:** 22 after round 2, 21 at close (`e1868a8d` synced as already done). None + of them is on the security critical path. +- **Next founder acts:** the U08 re-run after KEY-WP-0040-T01; the RPF-WP-0044-T04 OpenBao issuer + login once Sol's prerequisites are sealed; the CoulombCore wipe after the drill; optionally the + platform-root "Available" readback check.