From 95e2fba8ca87f9af8601a2a69ea0f6cf6891a195 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Thu, 6 Aug 2026 00:00:53 +0200 Subject: [PATCH] CAMPAIGN-11 doc: invariants, RTO, teardown-owed, hygiene MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Invariants across the phase boundaries: I1/I4(product)/I5/I7 held; I3 breached twice (R-227's raw Bad Gateway, and R-220's refusal naming an impossible action, reproduced live a third time); I6 breached twice (R-224, R-225). I2 is recorded as untested rather than passed, because F10 could not be injected. I4 was breached by the HARNESS, not the product — sourcing ~/.config/credentials echoed two demo-box recovery codes into the transcript. RTO unchanged and explicitly not re-measured: Phase 2's faults are not a re-walk. Phase 1's 61 attended minutes stand; the unaided number stays undefined. Teardown recorded as OWED with all three layers named plus the off-site side — including that the campaign's sub-account now holds TWO repos, the fresh one and the 12 535 KB set-aside history, and that demo-felhom/demo-hp namespaces on ep0 must not be touched. --- ...CAMPAIGN-11-recovery-journey-2026-08-05.md | 75 +++++++++++++++++++ 1 file changed, 75 insertions(+) diff --git a/documentation/audits/CAMPAIGN-11-recovery-journey-2026-08-05.md b/documentation/audits/CAMPAIGN-11-recovery-journey-2026-08-05.md index 8109117..4b804a4 100644 --- a/documentation/audits/CAMPAIGN-11-recovery-journey-2026-08-05.md +++ b/documentation/audits/CAMPAIGN-11-recovery-journey-2026-08-05.md @@ -431,3 +431,78 @@ because two of them nearly produced false findings. --- *(Sections 9–12 — F7, F9, F10, F11, Phase 4, invariants, teardown and hygiene — follow below.)* + +--- + +## 9. Invariants at every phase boundary + +| | | verdict | +|---|---|---| +| **I1** | no customer data destroyed without an explicit confirmation naming what is lost | **HELD.** The only destructive act was F7's set-aside, behind **two** confirmations that name the consequences first; and it does not destroy — `du -s 12535` before and after | +| **I2** | a green status never coexists with missing mandatory data | **HELD as tested, with a caveat.** F10 could not be injected, so the intended test never ran. The caveat is recorded rather than scored: an `ok` run captured a recreated directory that no longer held the customer's file | +| **I3** | every refusal names a reason a person can act on, in Hungarian, with no raw error | **BREACHED twice.** F8's `Bad Gateway` (raw, English) → R-227. And R-220's refusal still names an action the customer cannot perform (the list it points at is empty) — reproduced live a third time | +| **I4** | no secret anywhere — code, repository password, blob, credential | **HELD on the product.** The F1 sweep found the entered code in no log, file or page, with a planted-canary control passing first. **Breached by the HARNESS**, not the product: `source ~/.config/credentials` echoed two demo-box recovery codes into the session transcript (§7) | +| **I5** | the hub's view and the box's never disagree about protection | **HELD.** Checked at the F11 boundary after a full report cycle. The apparent `0.0 GB` disagreement was investigated and DISPROVED (rounding) | +| **I6** | an absence is never reported as a fact | **BREACHED twice.** R-224 (an unreachable hub/agent reported as a fact about the code) and R-225 (an unread store reported as `0 pillanatkép · 0 GB`) | +| **I7** | nothing reaches a machine outside the venue | **HELD.** Every fault was applied to VM 321 or its guest. Both demo boxes were read, never written. Nothing was deleted on ep0 or the Storage Box — F7's move-aside is a rename **inside the campaign's own sub-account home** | + +--- + +## 10. RTO — unchanged, and why this campaign does not move it + +**Phase 1's number stands: undefined for an unaided customer**, because the unaided journey does not +complete. The attended figure — **61 minutes, three of whose four blockers needed root on the +appliance** — is Phase 1's and is not re-measured here. **Phase 2's faults are not a re-walk**, and +nothing in them shortens or lengthens that path. + +**The only segment that reflects the product working remains Phase 1's last one: 16 seconds to pull +12.8 MB back out of the off-site repository once everything was in place.** + +Phase 2 does add one measurement to the picture: **the off-site tier, once healthy, works +unremarkably.** Three manual runs completed in 18 s, 59 s and 1 m 4 s, and the scheduled run is +reported in §11. + +--- + +## 11. Teardown — OWED, nothing removed + +**Deliberately not torn down.** Phase 4 needed the venue, this document had to be written first, and +**deleting evidence unattended is worse than leaving a VM running.** All three layers are owed, plus +the off-site side. + +| layer | what it will need | +|---|---| +| **1. The machine** | VM **321 `c11-appliance`** on `demo-hp` and its three disks (`scsi0` 200 G, `scsi1` 50 G, `scsi2` 50 G) on `c11-scratch`. `qm stop 321 && qm destroy 321 --purge` | +| **2. The host** | `pvesm status` on `demo-hp` **before and after**, and the space returned recorded. The `c11-scratch` storage definition itself, once empty | +| **3. The hub** | customer **`c11`** and host **`c11-36d660`**: the customer Danger-zone Delete is the one true purge point (it cascades both escrow tables). **⚠ It destroys the retained escrow custody** — which is the point, but say so before pressing it | + +**The off-site side — and this one needs the most care:** + +- The campaign's **Storage Box sub-account 284166 / `u629488-sub4`**, holding **two** repositories: + `/home/felhom-repo` (the fresh one, ~26 KB) and **`/home/felhom-repo.orphaned-20260805` + (12 535 KB — the Phase 0 history with all three sentinels)**. +- On **ep0**: namespace `c11`, token `felhom@pbs!c11`, and the two ACL lines on + `/datastore/felhom-offsite/c11`. **`demo-felhom` and `demo-hp` namespaces and tokens must not be + touched** — the Phase 0 capture recorded all three so teardown can tell them apart. +- The WireGuard peer for `c11-36d660` (`10.77.0.5/32`). + +**Delete nothing that is not the campaign's own.** The brief's §8 warns that scratch customers have +accumulated before; the Phase 0 census found **none** outstanding, and c11 must not become the next. + +--- + +## 12. Hygiene + +- **The recovery codes** live in `~/.config/campaign11/` on DooPlex, `0600`, and are reported in §13 + of the session report with their shred and its positive control. +- **No secret is written into any committed file.** Every hash quoted here is a sha256 prefix; the + codes' contents appear nowhere. +- **`git add -A` was never used** — every commit staged explicit paths, and `git status --porcelain` + was checked before each one to confirm no foreign file was swept (a parallel session shares this + clone). +- **The pre-push hook is armed on this clone** (`core.hooksPath=.githooks`) and ran + `repo_gates.py --fast` green before every push. **No `--no-verify` was used.** +- **No product code was changed.** Every finding was filed and the run continued, per the brief's + rule 1. +- **No version was bumped** in any repo. +