31 lines
1.9 KiB
Markdown
31 lines
1.9 KiB
Markdown
# REVIEW — cc-ci Adversary (append-only)
|
||
|
||
This file is owned by the **Adversary** loop (§6.1). The Builder seeds this stub at bootstrap and
|
||
does not edit it afterward. Adversary appends milestone/D-item verdicts (`<id>: PASS @<ts>` +
|
||
evidence, or `FAIL` + a finding in `BACKLOG.md ## Adversary findings`), and may write `## VETO`.
|
||
|
||
<!-- Adversary verdicts below -->
|
||
|
||
## M0 — Foundations: PASS @2026-05-26T21:35Z
|
||
|
||
Verified cold (fresh shell, own clone `/srv/cc-ci/cc-ci-adv`, isolated host build dir
|
||
`/root/cc-ci-advverify`, no reuse of Builder's `/root/cc-ci`).
|
||
|
||
Acceptance — "`systemctl is-system-running` healthy after a rebuild from the repo" + Builder's
|
||
sops claim:
|
||
- **Repo rebuilds cc-ci:** synced M0 commit `deb4a0f` (git-archive, no .git) to host, ran
|
||
`nixos-rebuild build --flake .#cc-ci` → `BUILD EXIT 0`, produced
|
||
`…-nixos-system-nixos-24.11.20250630.50ab793`. Current HEAD also builds clean.
|
||
- **System health:** `systemctl is-system-running` → `running`; `systemctl --failed` → 0 units.
|
||
- **sops decrypt:** `/run/secrets/test_secret` present, mode `400 root:root`, 41 bytes, value
|
||
begins `cc-c…` (matches claimed generated `cc-ci-m0-…`). `secrets/secrets.yaml` is genuinely
|
||
encrypted (2× `ENC[…]` + sops metadata block).
|
||
- **D6 leak probe (early):** the decrypted plaintext value appears **0 times** across *all* git
|
||
history (`git grep -F over git rev-list --all`) and 0× in plaintext in `secrets.yaml`. No leak.
|
||
|
||
Note (not a finding; context for the M1 gate): the *running* system is already ahead of M0 — its
|
||
closure includes docker, `unit-swarm-init`, and **traefik** units (`traefik.yml`,
|
||
`traefik-stack.yml`, `unit-traefik-deploy`) that are **not yet committed** (HEAD `ab839ae` is
|
||
swarm-only, no traefik). Expected mid-M1 churn, but the Traefik config must be committed to the
|
||
repo before M1 is claimed or it fails D8 reproducibility — will check at the M1 gate.
|