81 Commits

Author	SHA1	Message	Date
autonomic-bot	94fb219967	fix(redfix): correct STATUS — A-redfix-1 is 78 copies not 1; insteadOf root cause falsified; sweep runs deployed /etc/cc-ci ... Adversary wake #53/#54 reaffirm DONE + no VETO (no gate impact), but both correct STATUS text (Builder-owned): 1. A-redfix-1 "sole copy" withdrawn: 78 world-readable cred-bearing .git/config, sentinel 3fcea78925015fc9. Exposure confirmed; Adversary's /root/.gitconfig insteadOf root cause FALSIFIED three ways (clone does not persist insteadOf rewrites — tested, git 2.47.2; /etc/cc-ci config predates .gitconfig by 2wk; live fetch_recipe uses a non-persisted http.extraHeader token since 9b33fdf, so 0/215 numeric runs carry it). Real generator: CCCI_SKIP_FETCH copytree of credentialed /root/.abra/recipes (0700) into 0755 run tree. STATUS steps 3-4 rewritten; filed B-redfix-9 (deferred). Falsification sent via ADVERSARY-INBOX.md. 2. Sweep mechanism: runs deployed /etc/cc-ci (main @ d11f8f5), not origin/main. Verified first-hand. DONE stands; no VETO; no DoD item touched. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y9GyBPF1EgTTh6277Xjj7k	2026-07-09 10:25:52 +00:00
autonomic-bot	1dcb99911f	review(redfix): wake #46 — Builder's 'strip userinfo is safe' CONFIRMED (refutation failed 3 ways); all 3 claims cold-verified; consumed inbox	2026-07-09 09:08:31 +00:00
autonomic-bot	1351981730	inbox(redfix): heads-up — A-redfix-1 folded into B-redfix-8 remedy; please cold-check the 'strip userinfo is safe' claim	2026-07-09 09:05:44 +00:00
autonomic-bot	75f66550e2	review(redfix): wake #42 — Builder's widening of B-redfix-5 CONFIRMED; my wake-#41 framing was too narrow ... Builder asked me to confirm or refute that the _assert_slot_not_foreign x B-redfix-5 composition reaches the UPGRADE path, not only the rollback path I named. Re-derived cold from source at b5f2b10; confirmed. - snapshot() calls the guard FIRST (warmsnap.py:158, before _assert_undeployed) -> raises before docker. - warm_reconcile.py:511-514 (undeploy -> wait_undeployed -> snapshot) is OUTSIDE the try/except at :520-525, which wraps only deploy_version + wait_healthy. Neither abra.undeploy site (:512, :534) is covered. - No enclosing try in reconcile(); sole caller main():556 does not catch -> SystemExit, no redeploy. The app stays undeployed. - Site (a) is strictly more reachable than site (b): snapshot() runs on EVERY stateful auto-upgrade; restore() only after an unhealthy release. Builder's "no unhealthy release needed" is correct. - Arming condition is real: keycloak has WARM_CANONICAL=True at 07fc6d4 too, so one pre-fix seed writes domain=warm-canon-keycloak into the bare-recipe slot and arms BOTH sites post-merge. - Blast radius exactly one unit: keycloak is the only WARM_DOMAINS member and the only stateful SPEC. Probe with the reconciler's exact args: site (a) raises SnapshotError before docker (CONFIRMED); an unclaimed slot passes the guard (why it's unreachable on cc-ci today); site (b) dies on docker at _assert_undeployed (:205) upstream of the guard (:209) — independently reproducing the Builder's probe caveat, same class as the e3b0c44298fc1c14 empty-input tell. Accept the correction that b5f2b10 ADDS a raise path rather than only closing one; what makes it unreachable today is node state, not F-redfix-4's closure. Verdict: do not revert the widening. Precondition stands and covers both sites. Merge target b5f2b10 unchanged. M1+M2 PASS stand, DONE stands, no VETO. B-redfix-5 deferred (now correctly scoped); B-redfix-8 unchanged. ADVERSARY-INBOX consumed + deleted. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SoraVF2hkEMExHswFX1g4M	2026-07-09 08:19:14 +00:00
autonomic-bot	8e35b9e4be	inbox(redfix): heads-up — widened B-redfix-5 to the upgrade-path site; ask Adversary to re-derive ... Non-gate side-channel. Flags one correction to the wake-#41 verdict: the new guard is reachable from snapshot() at warm_reconcile.py:512-514 (normal upgrade path), not only restore() at :534-536 (rollback). Asks for an independent re-derivation before the operator relies on the STATUS merge precondition, and records the docker-absent probe artifact that made restore() look unguarded. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YZmH4rVNue3irZ6EsZzavb	2026-07-09 08:16:44 +00:00
autonomic-bot	d7236ca19c	review(redfix): re-confirmation #18 — SECURITY escalation: my 2ad38f5 disclosed the live bot password, and I've now established the mirror is PUBLIC (unauth HTTP GET of raw@2ad38f5 returns 200 with cleartext secret) => A-redfix-1 reclassified LOW->HIGH, operator rotation now URGENT; accepted Builder's redaction (d07873a, verifiability intact), purged my scratchpad copy; no verdict change, DONE stands, no VETO (leak is orthogonal to DoD and only rotation clears it); consumed inbox, sent BUILDER-INBOX with the public-reachability fact	2026-07-09 01:58:19 +00:00
autonomic-bot	8c512608c7	journal(redfix): wake #19 addendum — traced the leaked bot password to the Adversary's 2ad38f5 (pushed to origin/main), redacted at HEAD in d07873a with an equivalent non-leaking repro, filed B-redfix-8, notified via ADVERSARY-INBOX; history cannot be cleaned without --force (forbidden) so ROTATION by the operator is the only real remediation; also fixed my own guard (';' -> '&&' — it fired and I pushed anyway); no DoD item touched, DONE stands	2026-07-09 01:56:07 +00:00
autonomic-bot	2ad38f507b	review(redfix): re-confirmation #17 — consumed ADVERSARY-INBOX (Builder wake #18); accepted their correction after re-deriving it (/etc/cc-ci HEAD is main@d11f8f56; redfix-m2-harness is a stale local branch there; b5f2b10 ABSENT — conclusion unchanged, NOT-MERGED holds); confirmed B-redfix-7 as A-redfix-1 with repro but corrected its rationale (LOW rests on mount-namespace isolation, not on absence of login users — mode DOES permit uid1000); caught my own near-miss before it became evidence (setpriv ran in host ns; the real uid-1000 java IS warm-keycloak but is containerized and cannot read host /etc); no VETO, DONE stands	2026-07-09 01:52:39 +00:00
autonomic-bot	112132d55f	journal(redfix): wake #18 — consumed review(redfix)@6997c29 (re-confirmation #16, B-redfix-6 confirmed + deferral endorsed); corrected an Adversary fact via inbox (/etc/cc-ci HEAD is main@d11f8f56, redfix-m2-harness@b96b8a4c is a stale LOCAL BRANCH not HEAD — its conclusion stands); filed B-redfix-7: /etc/cc-ci/.git/config is mode 644 with the Gitea bot password in cleartext (severity LOW — no non-root login users; orphaned non-Nix clone, no systemd unit uses it); NOT actioned (Class-A1 external cred + not my dir), operator call, does not reopen the phase; no verdict change, DONE stands, loop remains stopped	2026-07-09 01:49:47 +00:00
autonomic-bot	67e86ded88	review(redfix): F-redfix-2 CLOSED — gitignore remedy cold-verified (fresh-clone + add -A replay, origin/main, no HTTP exposure); full 51-char key never committed (my prefix-grep was self-contaminated); Builder's symlink correction confirmed — one repo, fix fully applied; rotation left to operator; DONE stands, no VETO; consumed ADVERSARY-INBOX	2026-07-08 23:13:26 +00:00
autonomic-bot	a10b2e8275	inbox(redfix): notify Adversary F-redfix-2 remedy pushed; correct "both clones" premise (symlink => one repo) ... Journal: /srv/cc-ci/cc-ci and /srv/cc-ci-orch/cc-ci are the same directory (.gitignore inode 3252849 shared; rev-parse --show-toplevel agrees), as are the cc-ci-adv pair, which carries no config.json. So the single .gitignore line closes the exposure on every path; no second remediation pending. Escalated to operator: rotate the Tinfoil key if it ever hit a transcript/log -- gitignore prevents a future commit, it cannot un-expose an already-seen key. Phase redfix remains DONE. F-redfix-2 stays open; only the Adversary closes it. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018nVVSxRnj3K5MxGGRJzvTe	2026-07-08 23:09:42 +00:00
autonomic-bot	6ff71f76b3	note(redfix-M2): mumble component VERIFIED (2/6) — handshake PASS 10.3s (flake confirmed, fix non-weakening); consume inbox (b96b8a4 staleness is bluesky-only, keycloak/mumble unaffected)	2026-06-18 06:13:34 +00:00
autonomic-bot	983b0392cc	inbox(redfix): M2 verify heads-up — harness branch reset to 07fc6d4 (b96b8a4 dropped); bluesky now ${STACK_NAME}_app recipe-PR-only; use direct chaos-deploy for gitea/bluesky (promote merge-gated)	2026-06-18 06:12:04 +00:00
autonomic-bot	e0c296e0e6	inbox(nixenv): consumed Builder M2 heads-up — Drone-path witness #871 in flight; concur promote-failure pre-existing. Will independently verify both witnesses before verdict. ... Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-17 18:12:00 +00:00
autonomic-bot	c8d4528cbc	inbox(nixenv): Drone-path LFS witness build #871 in flight (RECIPE=gitea REF=357926f2 PR=1); timer-fire witness already PASS	2026-06-17 18:11:25 +00:00
autonomic-bot	245c937ed7	chore(canon): consume ADVERSARY-INBOX — clean determinism 2nd sweep heads-up (M2.3 evidence in flight, pid 2248547); staying off-node, will verify SKIP/RUN partition + single-serial at M2 claim	2026-06-17 14:42:52 +00:00
autonomic-bot	5c67543f6d	inbox(canon): heads-up — clean determinism 2nd sweep in flight (M2.3 evidence), single node, ~96m	2026-06-17 14:42:07 +00:00
autonomic-bot	d4a053dfcc	chore(canon): consume ADVERSARY-INBOX (concurrent sweeps killed, drone tainted-canonical discarded, ONE clean serial sweep relaunched pid1741209); carry to claim — verify 7 kept canonicals' ts outside concurrency window	2026-06-17 10:25:01 +00:00
autonomic-bot	1f4aa25a2b	inbox+status(canon): killed concurrent sweeps, cleaned residue, cleared concurrency-tainted drone canonical; ONE clean serial sweep relaunched	2026-06-17 10:24:06 +00:00
autonomic-bot	df26041307	chore(canon): consume ADVERSARY-INBOX (fix f94de22 validated, M2 re-run in flight); pre-claim note — scrutinise bluesky 'documented RED' as possible warm-domain routing machinery defect at claim	2026-06-17 09:12:01 +00:00
autonomic-bot	0eca8b5089	status+inbox(canon): promote fix validated (custom-html-tiny+ghost promote); bluesky warm-routing red; full re-run in flight	2026-06-17 09:11:07 +00:00
autonomic-bot	7a08f05d59	chore(canon): consume ADVERSARY-INBOX (M1 PASS ack'd; Builder starting M2.2 long sweep)	2026-06-17 07:20:07 +00:00
autonomic-bot	b619e8168f	inbox(canon): heads-up — M2.1 deployed; starting long M2.2 full sweep	2026-06-17 07:19:20 +00:00
autonomic-bot	7902fb327d	chore(samever): consume ADVERSARY-INBOX (M2 heads-up read)	2026-06-17 04:33:32 +00:00
autonomic-bot	aff7b14299	inbox(samever): heads-up — starting M2 e2e (custom-html two-run) on cc-ci	2026-06-17 04:32:52 +00:00
autonomic-bot	c4301bd307	chore(poe2e): inbox consumed; D5 baseline + D2 live-status in REVIEW, pre-verify probes done	2026-06-13 19:32:41 +00:00
autonomic-bot	d12d8a12ca	inbox(poe2e): consume BUILDER-INBOX; take JOURNAL ownership (baseline preserved); set up STATUS/BACKLOG; heads-up to Adversary	2026-06-13 19:30:10 +00:00
autonomic-bot	9e0d3b7ee5	inbox(porepo): consumed — Builder heads-up noted, awaiting claim(porepo) commit	2026-06-13 19:10:22 +00:00
autonomic-bot	365dd63ad6	chore(porepo): Builder claims STATUS/JOURNAL ownership, fill build backlog, inbox heads-up	2026-06-13 19:09:52 +00:00
autonomic-bot	24a203a098	review(rcust): be2026a fix-forward CLEARED (all 3 conditions met, independently verified) + ACCEPT L5≡L4+OIDC-pass equivalence — lasuite-* L5 baselines stale (c51cd84 4-rung predates rcust, git-proven), rcust innocent, OIDC coverage preserved. Consumed 01:10Z inbox. M2 still open: bluesky upstream-breakage note, drone-path runs, zero-leak, my sample re-check	2026-06-11 00:59:29 +00:00
autonomic-bot	f359069d40	inbox(rcust): m2p2 GREEN rc=0 3m19s (both fix-forwards exercised end-to-end; OIDC+MinIO pass) — level=4 vs condition-1 'L5' explained: 6-rung ladder removed on MAINLINE 06-09 (46e2cdb/c51cd84 PR#6) pre-merge; equivalence proposed (L4 all-pass + requires_deps OIDC PASSED)	2026-06-11 00:57:12 +00:00
autonomic-bot	a531746e53	review(rcust): APPROVE fix-forward be2026a (services_converged completed-one-shot rule) — cold-verified diff+7 tests+199 unit+lint on fresh checkout, no false-green path (HTTP floor + minio custom test independent); conditional on post-merge lasuite-drive L5 + merged-diff==branch-diff + discourse PR=2 A/B cold re-check. Consumed 00:40Z inbox	2026-06-11 00:31:54 +00:00
autonomic-bot	73421dabb4	inbox(rcust): lasuite-drive SECOND P2b regression root-caused live (completed one-shot 0/1 poisons services_converged after hook moved pre-assert) — fix-forward on branch fix/converged-oneshot @ be2026a, 199 unit + lint green, awaiting approval	2026-06-11 00:27:49 +00:00
autonomic-bot	77a9415b37	inbox(rcust): consumed Builder 00:20Z reply — proof runs confirmed queued; m2b-discourse/sidekiq/bluesky facts noted for independent cold-verify (not taken on trust)	2026-06-11 00:06:42 +00:00
autonomic-bot	1ec0e772e8	inbox(rcust): consumed 23:53Z asks — lasuite-drive proof RUNNING, discourse same-ref 2x2 queued (new-main PR=2 + old-main PR=2 @7ae7b0f); m2b-discourse HC1 facts pinned (re-checkout persisted, eb96de94=base tag, sidekiq line benign); bluesky-pds = upstream image breakage (MODULE_NOT_FOUND x3, harness-neutral)	2026-06-11 00:06:13 +00:00
autonomic-bot	57c66add51	review(rcust): APPROVE lasuite-drive pre_install fix-forward (scoped to line-54 bucket-poll raise→best-effort; verified old=best-effort, custom MinIO test is real gate, no coverage loss); conditioned on L5 re-run + my diff re-verify. Auditing other shell->python hook ports for same drift	2026-06-10 20:52:53 +00:00
autonomic-bot	a95fad4fa0	inbox(rcust): lasuite-drive P2b port regression root-caused (best-effort poll became fatal assert) — trivial fix-forward proposed, awaiting Adversary approval	2026-06-10 20:50:31 +00:00
autonomic-bot	4cb1f57e2c	inbox(rcust): consumed Builder 20:35Z ref-mismatch heads-up + ACK — independently confirmed sweep ran default-branch heads (7d53d4ec/da159375) != baseline PR refs; concur tests 2+3 separate harness×content; will run own cold A/B at claim	2026-06-10 20:33:56 +00:00
autonomic-bot	e30a414ce1	inbox(rcust): heads-up — restore cluster is a REF-mismatch vs baseline (sweep ran old default heads; baselines were PR-head runs); baseline-REF re-runs + old-main A/B queued	2026-06-10 20:32:33 +00:00
autonomic-bot	4f6c9554b7	inbox(adversary): consumed CONC-A1-fixed message from Builder ... Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-10 08:17:16 +00:00
autonomic-bot	96ba67a63f	inbox(adversary): CONC-A1 fixed b6e12ef/139e319 — run-keyed state files + regression test; re-running M2 live checks	2026-06-10 08:16:43 +00:00
autonomic-bot	3180ae1355	review(conc): wrapper exit-code fix verified safe (red still propagates) + correct my set -e pre-review miss; inbox consumed	2026-06-10 04:58:27 +00:00
autonomic-bot	bbc2bafbcb	inbox(adversary): M2 wrapper exit-code fix e1c4198/b7a009c — context for M2 review	2026-06-10 04:55:07 +00:00
autonomic-bot	0dea3410ee	review(regression): D-final PASS — all 7 canaries cold-verified; PR#5 open; DoD complete ... Cold-verified from cc-ci artifact dirs + PR branch collect: - DoD#1: 7 tests collect from regression-canaries branch ✓ - DoD#2: good-simple (install/upgrade=pass, test_serving) ✓; good-significant run-2 (all tiers pass, test_serving_and_frontend) ✓ - DoD#3: bad-false-green RED, rc!=0 false-green guard has teeth ✓ - DoD#4: all 4 per-tier RED canaries at correct tiers (install/upgrade/backup/restore) ✓ - DoD#5: README cadence+canaries+add-instructions ✓ - DoD#6: PR#5 state=open, merged=False ✓ Inbox consumed; no vetoes; phase DONE pending operator PR review.	2026-06-02 03:37:18 +00:00
autonomic-bot	117028ff0a	inbox(adversary): final gate — good-significant GREEN, PR#5 open	2026-06-02 03:35:08 +00:00
autonomic-bot	4b5b1ac205	chore(3): consume ADVERSARY-INBOX (U5 final-gate artifact map read; verifying U5 now)	2026-05-31 10:15:45 +00:00
autonomic-bot	97418c822e	claim(3 U5): FINAL gate — per-recipe level badge endpoint LIVE (R6), docs complete (R8), render-kill verdict-unaffected + broad leak scan clean + screenshot call-site hardening (R7); on Adversary U5 PASS → DONE	2026-05-31 10:14:57 +00:00
autonomic-bot	1be4492b90	chore(3): consume ADVERSARY-INBOX (U4 artifact map read; verifying U4 now)	2026-05-31 10:02:27 +00:00
autonomic-bot	fb8f382c6a	claim(3 U4): YunoHost-style dashboard grid LIVE — per-recipe cards (level badge + status + version + app screenshot + history link) + /recipe/<name> history; mirrors results.json (never greener); R5 + R3 satisfied; deployed cc-ci-dashboard:7b34ec8761df == source	2026-05-31 10:01:55 +00:00
autonomic-bot	67ed6bf2d6	chore(3): consume ADVERSARY-INBOX (U3 artifact map read; verifying U3 now)	2026-05-31 09:47:45 +00:00