Record the operator's rulings of 2026-10-01: decisions 54-56 (monthly re-test owner and scope, two controller versions per box)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-10-01 07:16:08 +02:00
parent 3159892fab
commit 2076bf9b36
2 changed files with 22 additions and 0 deletions
@@ -16,6 +16,12 @@
 > and holds nothing of its own; this file does hold its own content, namely the standing rulings below.


+> **Rulings 2026-10-01 (operator) — `09` §3 decisions 54–56, recorded before the work.** **54 (R-743 1A):** the monthly
+> re-test is run by a CC session the operator starts with the standing brief `claude/MONTHLY-security-retest.md` (project);
+> STATUS carries "Monthly security re-test: last run <date>, next due <date>". **55 (R-743 2A):** it covers every app with a
+> proven ladder; `--engines-only` is a switch, not the default. **56 (R-745 3A):** a box keeps the controller image it runs
+> and the one before it; older controller images are deleted by decision 53's in-use rule; registry tags never.
+
 > **2026-09-30 (late evening) — both rulings built.** Decision 52: catalog `6a3ead9` (re-test entries `from` == `to` +
 > `digest_from` + `box_evidence`, gated with decoys; `upgrade-test.py --retest`; the monthly command
 > `scripts/retest-floating.py`; runbook `runbooks/monthly-floating-retest.md`; proven end to end on 9202 through the leg).
@@ -605,6 +605,22 @@ R-636's louder repeated alarm.
    faults found live on 9202). The one-time sweep: 9202 26.6 → 5.7 GB, demo-hp 24.3 → 13.5 GB, the N100 6.15 → 6.07 GB,
    every app healthy. Old CONTROLLER images are outside this decision and stay (R-745).

+### 2026-10-01 — three operator rulings (recorded before the work)
+
+54. **The monthly re-test (decision 52) is run by a CC session the operator starts** with the standing brief
+    `claude/MONTHLY-security-retest.md` (in the planning project) — not by an unattended job — *operator ruling
+    2026-10-01 (R-743, option 1A).* **Why:** the runbook's reasons hold (a fresh bench, 9202 on the drill catalog, a drill
+    reset, pushes to the live catalog — nothing of that should run with nobody watching). STATUS carries a standing line:
+    "Monthly security re-test: last run <date>, next due <date>".
+55. **The monthly re-test covers every app with a proven ladder, not only the database and redis lines** — *operator
+    ruling 2026-10-01 (R-743, option 2A).* `--engines-only` stays as a switch, not the default. **Why:** the database
+    containers are not reachable from the internet; the web apps are — a same-name fix to an exposed app matters at least
+    as much. **Cost, stated:** linuxserver images are rebuilt weekly under the same tag, so their apps come up most months.
+56. **A box keeps the controller image it runs and the one before it** (the self-update's roll-back target); older
+    controller images are deleted by the same in-use rule as decision 53 — *operator ruling 2026-10-01 (R-745, option 3A).*
+    **Why:** about 50 old controller versions sat on each demo box (R-745); a release is ~400 MB unpacked and several ship
+    a day. Registry tags are never deleted by this.
+
 ### 2026-09-30 (day) — operator notes, recorded before the work

 - **The day brief runs by day.** Every backup and automatic-update test is started by hand — the night chain's debug