50 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
notplants	53efd54983	review(1b): ✅ RL3 PASS — full cold D1-D10 re-verify on the byte-identical cleaned closure, NOTHING weakened. 2 fresh green e2e (custom-html #151 + keycloak #152 SSO/DB, all 3 stages, upgrade ran); D6 leak test clean (8/8 infra + wildcard cert/key + generated keycloak admin pw = 0 in logs/dashboard; white-box secret_generate captured-never-printed); teardown no orphans; byte-identical rebuild=D8. D10 2-fresh + Phase-1 6/6 carry-forward. RL1-RL5 all Adversary-PASS, no VETO — only RL6 (coordinated machine-docs/ move) before DONE; ready for lockstep cutover	2026-05-27 22:07:46 +01:00
notplants	9bfd6f2ad3	review(1b): RL3 fresh e2e #1 (custom-html #151) — D1(20s trigger)/D2(install+upgrade+backup green, upgrade ACTUALLY RAN)/D3(playwright)/D7(PR comment+dashboard)/D6-infra(0 secret matches) all PASS on the byte-identical cleaned closure. D6 app-secret watch-item RESOLVED white-box (secret_generate output captured, never printed); keycloak e2e #2 in flight for behavioral confirm. D5/D8/D9 PASS; D10 breadth carry-forward + 2 fresh runs; D4 byte-identical carried	2026-05-27 21:42:26 +01:00
notplants	41c6571895	review(1b): RL3 live !testme e2e in flight — triggered custom-html PR#2 @20:33:16Z (comment 13743, bot=org-member); watching trigger latency (D1) + install/upgrade/backup stages (D2-D4) + run URL (D7) on the byte-identical cleaned closure; D6 leak test to follow on this run's logs/dashboard. Noted: push→Drone webhook flaky (no push build for 1b commits) — RL1 advisory	2026-05-27 21:34:24 +01:00
notplants	f033139aca	review(1b): RL3 D8+RL5 byte-identical cold rebuild PASS — fresh recursive clone on cc-ci → nixos-rebuild build git+file://...?submodules=1#cc-ci → toplevel 8i3jcad9==running (build==running). Confirms reproducibility survived format+nix/ refactor; secrets genuinely from submodule (no-submodule build fails). RL3 remaining: live !testme e2e + D6 leak test + D5/D9/D10 refresh	2026-05-27 21:31:38 +01:00
notplants	aa120d10d0	review(1b): RL2 PASS (no blocking §3 findings) + RL5 structural PASS (nix/ layout, flake at root, #cc-ci unchanged, no dangling refs) + RL3 cardinal-rule PASS (tests NOT weakened — diff 6d2bc3d..HEAD is ruff line-wrapping only, all assertions/operators/values preserved, no skip/xfail added). cc-ci running==8i3jcad9, healthy, 5 stacks. RL3 byte-identical cold rebuild + e2e + leak test next	2026-05-27 21:28:04 +01:00
notplants	5a811e4ae4	review(1b): acknowledge operator RL5+RL6 (plan §7) as new blocking items. RL5 (nix/ folder consolidation) verification folds into RL3 cold byte-identical rebuild; RL6 (machine-docs/ move) is coordinated near-end-of-1b — REVIEW*.md are my files, I keep writing at root until the lockstep watchdog cutover then git mv my own. DoD now RL1–RL6	2026-05-27 21:13:19 +01:00
notplants	12e1336d2a	review(1b): white-box §3 pass #2 (RL2 input) — harness DRY PASS (no harness surgery), architecture-matches-plan PASS (poll-primary §4.1, real traefik recipe §4.2), Nix idempotent/no-sentinels PASS, log-redaction real for infra secrets. No blocking findings; 2 advisories (old_app copy-paste→IDEAS; generated-app-secret redaction→RL3/D6 watch-item)	2026-05-27 21:08:53 +01:00
notplants	1237d29899	review(1b): W0 PASS (RL1) — lint/format tooling verified COLD on cc-ci over pristine archive of 233939a: nix develop .#lint → lint: PASS exit 0 (8 linters clean); stage wired in .drone.yml; break-it probe confirms FAIL exit 1 on injected violations (gate has teeth). Advisory: confirm push→Drone actually fires lint stage at RL3 (webhook flaky per §4.1)	2026-05-27 21:04:40 +01:00
notplants	a74925bf7d	review(1b): phase-1b Adversary ledger seeded; white-box §3 prep pass #1 over post-1c baseline — tests real, no sentinels, no committed secrets, sleeps are poll intervals, teardown verified. Awaiting Builder to seed 1b state + claim W0	2026-05-27 20:41:30 +01:00
notplants	6d2bc3d8e0	review(1c): ✅ DONE confirmed — Adversary final sign-off. All C1-C7 + E2E-TESTME PASS <24h, no VETO, no open findings; cc-ci healthy cqym8knj byte-identical, public TLS 200. Phase 1c genuinely DONE; loop terminating	2026-05-27 20:34:22 +01:00
notplants	9e0f72ac4b	review(1c): C7 PASS — ADV-1c-1 closed (architecture.md now 1c-correct: cc-ci-secrets submodule + cert-in-git + recovery-key bootstrap). ALL C1-C7 + E2E-TESTME Adversary-PASS, no VETO — DONE handshake unblocked	2026-05-27 20:29:26 +01:00
notplants	0556ff5ad9	backlog(1c): file ADV-1c-1 [adversary] — architecture.md still describes pre-1c secrets/cert model; blocks C7 (doc gap, not VETO)	2026-05-27 20:01:41 +01:00
notplants	b301b031a1	review(1c): E2E-TESTME E1-E6 PASS (independent) + DONE-verification C1-C6 PASS; C7 WITHHELD — architecture.md stale (pre-1c secrets/cert model). No VETO. Filing ADV-1c-1	2026-05-27 20:01:13 +01:00
notplants	40c50545f1	review(1c): heads-up for Builder e2e — dual-bridge double-trigger risk in swap window; recommend pausing original's bridge during E1-E6	2026-05-27 19:13:52 +01:00
notplants	446f326a1e	review(1c): W4/C4/C5 PASS COLD — independent throwaway rebuild: blank VM+2 repos+1 age key -> single switch -> ld19aj2 byte-identical, 0 failed, 6/6 stacks, cert+TLS from git (leaf 57:8D:67). VM ccci-w5-rebuild@100.97.167.73 recorded for Builder swap. D8 honest (Phase-1 'infeasible' superseded)	2026-05-27 19:12:47 +01:00
notplants	b73307908d	review(1c): C1 refresh — byte-identical against new keyFile config (izsmiajw==running, zero drift); supersedes vh6vwxbl	2026-05-27 17:57:18 +01:00
notplants	dd710a6f56	review(1c): set C4/W5 TLS verification standard — domain=ci.commoninternet.net (not ci2), SNI+--resolve on fresh VM, leaf fingerprint must match git cert	2026-05-27 17:30:08 +01:00
notplants	228b930a96	review(1c): corroboration — sops cert re-decrypts byte-identically at boot after W1 resize-reboot (strengthens C2)	2026-05-27 17:24:00 +01:00
notplants	95ac37c7bd	review(1c): W2 PASS cold — byte-identical build==running (vh6vwxbl), cert sops-from-git + live TLS leaf-match, no plaintext leak; C1/C2/C3 Adversary-PASS	2026-05-27 16:52:14 +01:00
notplants	c36052021c	review(1c): interim probe — cc-ci-secrets private + all 8 secrets ENC (cert+key in sops, 0 plaintext); byte-identical/TLS pending W2 gate	2026-05-27 16:23:17 +01:00
notplants	e746f37676	review(1c): pre-W2 cold baselines (running-system toplevel, cert hashes, clean-base grep); W2 scrutiny checklist	2026-05-27 16:22:08 +01:00
notplants	be37eccd31	review(1c): Adversary ledger seeded; cold baseline (system healthy pre-refactor; Builder has not begun 1c)	2026-05-27 16:02:13 +01:00
notplants	492fa231cb	review: Adversary sign-off — DONE confirmed by cold check (all D1-D10 PASS <24h, no VETO, system healthy, 6/6 dashboard, 0 orphans); loop terminating	2026-05-27 12:13:12 +01:00
notplants	d4f8dc5093	review: D8 PASS (byte-identical build==running; throwaway-VM live rebuild infeasible by design—documented); DONE-readiness: all D1-D10 PASS <24h, no VETO	2026-05-27 12:00:46 +01:00
notplants	be610b297a	review: D10 PASS 6/6 — lasuite #108 corroborated (real !testme, upgrade genuinely converged+data survived, not -c-hollowed)	2026-05-27 11:58:39 +01:00
notplants	c9087fde20	review: scrutinized lasuite -c (no-converge-checks) — NOT a softening (harness still verifies convergence+health+data); empirical green still required	2026-05-27 11:46:25 +01:00
notplants	78250bc8ce	review: D9 PASS — docs complete + accurate (architecture/enroll/runbook/secrets/install/README) vs verified reality	2026-05-27 10:49:18 +01:00
notplants	6bd6061653	review: M9/D8 reproducibility core PROVEN (clean build == running, zero drift; docs complete); live blank-VM rebuild pending registry creds	2026-05-27 10:48:24 +01:00
notplants	288cdeeb47	review: close A2 (live: default janitor spares fresh orphan; janitor(0) reaps env-less orphan via reconstruction) — all A1-A4 closed	2026-05-27 10:44:00 +01:00
notplants	4b204930a3	review: D10 5/6 VERIFIED via real !testme (3-stage green + outcome-reflected); 6th (lasuite upgrade) blocked on registry creds	2026-05-27 10:41:29 +01:00
notplants	8aaeb29187	review: independently confirmed Docker Hub rate-limit (remaining=1/100) gating lasuite upgrade — real A1 blocker, not harness defect	2026-05-27 10:24:44 +01:00
notplants	27cce50f4c	review: M8/D7 PASS — overview matches reality (6 recipes, corroborated build #s), badges, PR outcome reflection	2026-05-27 08:11:32 +01:00
notplants	6bb3df0139	review: M7/D6 PASS — secret-grep clean across logs+dashboard+git; sops rotation doc matches reality	2026-05-27 07:55:33 +01:00
notplants	307c7dc91e	review: M6.5 PASS — all 6 recipes 3-stage green (Drone builds corroborated) + D5 (no harness surgery) + bluesky-swap documented	2026-05-27 07:24:43 +01:00
notplants	7558654d98	review: reconciliation — all gates M0-M6 PASS (<24h); STATUS CLAIMED strings stale; M6.5 in-flight, no open claim	2026-05-27 06:18:07 +01:00
notplants	b2bf51f754	review: M6.5 running evidence — cryptpad #46 + matrix-synapse #51 3-stage corroborated (4 recipes green)	2026-05-27 06:13:51 +01:00
notplants	9b5910bef8	review: close A3 (verified teardown reaps env-less orphan via docker fallback); A2 mechanism verified, live janitor sweep pending idle	2026-05-27 05:02:40 +01:00
notplants	26cbc06120	review: M6 PASS — custom-html 3-stage + keycloak full 3-stage (build #39 corroborated) + D4 recipe-local (own run) + D5	2026-05-27 04:43:41 +01:00
notplants	fa410ea4c6	review: D6 leak scan extended to recipe-CI build logs — clean (no app-secret leak)	2026-05-27 04:04:51 +01:00
notplants	d6f0f67d49	review: M3 PASS (live: !testme 12s trigger, re-run, !testmexyz no-trigger, org-auth); close A4 (cap=1 mitigates)	2026-05-27 03:14:49 +01:00
notplants	38dcdc7750	review: preliminary D6 leak scan of published Drone logs — clean (no infra-secret leaks)	2026-05-27 02:05:28 +01:00
notplants	720ae1f28f	review: file [adversary] A4 (same-recipe concurrent checkout collision); M6 verify in progress	2026-05-27 01:51:15 +01:00
notplants	23a30388d0	review: M4 PASS + M5 PASS (own cold 3-stage run green, clean teardown); A2/A3 remain open	2026-05-27 01:05:33 +01:00
notplants	b8f3473777	review: remove orphaned old-A1 text left after closing A1	2026-05-27 00:58:46 +01:00
notplants	0fe3d7cda7	review: close A1 (no-ACME enforced); file A2 (dead janitor) + A3 (unverified teardown); M4 verify in progress	2026-05-27 00:52:35 +01:00
notplants	796b642519	review: M3 pre-claim — bridge auth/filter verified (all reject paths); blocker corroborated operator-side	2026-05-26 23:54:06 +01:00
notplants	e07f8a4194	review: M2 PASS — push→green Drone build verified via own push (build #4 @hook success)	2026-05-26 23:28:08 +01:00
notplants	91a8e8d64c	review: M2 live-trigger probe (expect Drone build #4 green)	2026-05-26 23:27:14 +01:00
notplants	352f624ce6	review: M1 PASS (cold E2E: wildcard HTTPS via abra+traefik, clean teardown); file [adversary] A1 ACME-hazard	2026-05-26 22:38:26 +01:00
notplants	c006083967	review: M0 PASS — cold rebuild + sops decrypt + no plaintext-secret leak	2026-05-26 21:57:52 +01:00