Invariants across the phase boundaries: I1/I4(product)/I5/I7 held; I3 breached twice (R-227's raw Bad Gateway, and R-220's refusal naming an impossible action, reproduced live a third time); I6 breached twice (R-224, R-225). I2 is recorded as untested rather than passed, because F10 could not be injected. I4 was breached by the HARNESS, not the product — sourcing ~/.config/credentials echoed two demo-box recovery codes into the transcript. RTO unchanged and explicitly not re-measured: Phase 2's faults are not a re-walk. Phase 1's 61 attended minutes stand; the unaided number stays undefined. Teardown recorded as OWED with all three layers named plus the off-site side — including that the campaign's sub-account now holds TWO repos, the fresh one and the 12 535 KB set-aside history, and that demo-felhom/demo-hp namespaces on ep0 must not be touched.
This commit is contained in:
@@ -431,3 +431,78 @@ because two of them nearly produced false findings.
|
||||
---
|
||||
|
||||
*(Sections 9–12 — F7, F9, F10, F11, Phase 4, invariants, teardown and hygiene — follow below.)*
|
||||
|
||||
---
|
||||
|
||||
## 9. Invariants at every phase boundary
|
||||
|
||||
| | | verdict |
|
||||
|---|---|---|
|
||||
| **I1** | no customer data destroyed without an explicit confirmation naming what is lost | **HELD.** The only destructive act was F7's set-aside, behind **two** confirmations that name the consequences first; and it does not destroy — `du -s 12535` before and after |
|
||||
| **I2** | a green status never coexists with missing mandatory data | **HELD as tested, with a caveat.** F10 could not be injected, so the intended test never ran. The caveat is recorded rather than scored: an `ok` run captured a recreated directory that no longer held the customer's file |
|
||||
| **I3** | every refusal names a reason a person can act on, in Hungarian, with no raw error | **BREACHED twice.** F8's `Bad Gateway` (raw, English) → R-227. And R-220's refusal still names an action the customer cannot perform (the list it points at is empty) — reproduced live a third time |
|
||||
| **I4** | no secret anywhere — code, repository password, blob, credential | **HELD on the product.** The F1 sweep found the entered code in no log, file or page, with a planted-canary control passing first. **Breached by the HARNESS**, not the product: `source ~/.config/credentials` echoed two demo-box recovery codes into the session transcript (§7) |
|
||||
| **I5** | the hub's view and the box's never disagree about protection | **HELD.** Checked at the F11 boundary after a full report cycle. The apparent `0.0 GB` disagreement was investigated and DISPROVED (rounding) |
|
||||
| **I6** | an absence is never reported as a fact | **BREACHED twice.** R-224 (an unreachable hub/agent reported as a fact about the code) and R-225 (an unread store reported as `0 pillanatkép · 0 GB`) |
|
||||
| **I7** | nothing reaches a machine outside the venue | **HELD.** Every fault was applied to VM 321 or its guest. Both demo boxes were read, never written. Nothing was deleted on ep0 or the Storage Box — F7's move-aside is a rename **inside the campaign's own sub-account home** |
|
||||
|
||||
---
|
||||
|
||||
## 10. RTO — unchanged, and why this campaign does not move it
|
||||
|
||||
**Phase 1's number stands: undefined for an unaided customer**, because the unaided journey does not
|
||||
complete. The attended figure — **61 minutes, three of whose four blockers needed root on the
|
||||
appliance** — is Phase 1's and is not re-measured here. **Phase 2's faults are not a re-walk**, and
|
||||
nothing in them shortens or lengthens that path.
|
||||
|
||||
**The only segment that reflects the product working remains Phase 1's last one: 16 seconds to pull
|
||||
12.8 MB back out of the off-site repository once everything was in place.**
|
||||
|
||||
Phase 2 does add one measurement to the picture: **the off-site tier, once healthy, works
|
||||
unremarkably.** Three manual runs completed in 18 s, 59 s and 1 m 4 s, and the scheduled run is
|
||||
reported in §11.
|
||||
|
||||
---
|
||||
|
||||
## 11. Teardown — OWED, nothing removed
|
||||
|
||||
**Deliberately not torn down.** Phase 4 needed the venue, this document had to be written first, and
|
||||
**deleting evidence unattended is worse than leaving a VM running.** All three layers are owed, plus
|
||||
the off-site side.
|
||||
|
||||
| layer | what it will need |
|
||||
|---|---|
|
||||
| **1. The machine** | VM **321 `c11-appliance`** on `demo-hp` and its three disks (`scsi0` 200 G, `scsi1` 50 G, `scsi2` 50 G) on `c11-scratch`. `qm stop 321 && qm destroy 321 --purge` |
|
||||
| **2. The host** | `pvesm status` on `demo-hp` **before and after**, and the space returned recorded. The `c11-scratch` storage definition itself, once empty |
|
||||
| **3. The hub** | customer **`c11`** and host **`c11-36d660`**: the customer Danger-zone Delete is the one true purge point (it cascades both escrow tables). **⚠ It destroys the retained escrow custody** — which is the point, but say so before pressing it |
|
||||
|
||||
**The off-site side — and this one needs the most care:**
|
||||
|
||||
- The campaign's **Storage Box sub-account 284166 / `u629488-sub4`**, holding **two** repositories:
|
||||
`/home/felhom-repo` (the fresh one, ~26 KB) and **`/home/felhom-repo.orphaned-20260805`
|
||||
(12 535 KB — the Phase 0 history with all three sentinels)**.
|
||||
- On **ep0**: namespace `c11`, token `felhom@pbs!c11`, and the two ACL lines on
|
||||
`/datastore/felhom-offsite/c11`. **`demo-felhom` and `demo-hp` namespaces and tokens must not be
|
||||
touched** — the Phase 0 capture recorded all three so teardown can tell them apart.
|
||||
- The WireGuard peer for `c11-36d660` (`10.77.0.5/32`).
|
||||
|
||||
**Delete nothing that is not the campaign's own.** The brief's §8 warns that scratch customers have
|
||||
accumulated before; the Phase 0 census found **none** outstanding, and c11 must not become the next.
|
||||
|
||||
---
|
||||
|
||||
## 12. Hygiene
|
||||
|
||||
- **The recovery codes** live in `~/.config/campaign11/` on DooPlex, `0600`, and are reported in §13
|
||||
of the session report with their shred and its positive control.
|
||||
- **No secret is written into any committed file.** Every hash quoted here is a sha256 prefix; the
|
||||
codes' contents appear nowhere.
|
||||
- **`git add -A` was never used** — every commit staged explicit paths, and `git status --porcelain`
|
||||
was checked before each one to confirm no foreign file was swept (a parallel session shares this
|
||||
clone).
|
||||
- **The pre-push hook is armed on this clone** (`core.hooksPath=.githooks`) and ran
|
||||
`repo_gates.py --fast` green before every push. **No `--no-verify` was used.**
|
||||
- **No product code was changed.** Every finding was filed and the run continued, per the brief's
|
||||
rule 1.
|
||||
- **No version was bumped** in any repo.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user