From b1bf1f271ccb7d5f9f2f7ac0277ae35bcdf7e65a Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Thu, 6 Aug 2026 11:50:28 +0200 Subject: [PATCH] REPORT + STATUS: instruction arc close-out Operator line for the one change with real-world consequence: the runbook that says which machine may be wrecked claimed the HP box keeps no off-site copy, and it keeps two. Checked against the machine, not corrected from memory. --- REPORT-instruction-closeout-2026-08-06.md | 147 ++++++++++++++++++++++ STATUS.md | 9 ++ 2 files changed, 156 insertions(+) create mode 100644 REPORT-instruction-closeout-2026-08-06.md diff --git a/REPORT-instruction-closeout-2026-08-06.md b/REPORT-instruction-closeout-2026-08-06.md new file mode 100644 index 0000000..47f0017 --- /dev/null +++ b/REPORT-instruction-closeout-2026-08-06.md @@ -0,0 +1,147 @@ +# REPORT — instruction arc close-out, 2026-08-06 + +Six items. Closes **R-229(b)** and **R-230(b)**; part-actions **R-230(a)**. +Full accounting: `documentation/audits/LEDGER-instruction-closeout-2026-08-06.md`. + +> Second session in this repo, so this is a `REPORT-.md`; the shared `REPORT.md` was not +> touched. + +## 1. Baselines and commits + +Reconfirmed live, all clean and synced: `felhom.eu` `92a076c239b9`, `felhom-controller` +`66d80efb9f20`, `felhom-agent` `5b2666e3a2ae`, `app-catalog` `459766cb1639`. + +| Push | Repo | What | +|---|---|---| +| `aa74294` | felhom-agent | core + 4 rule files | +| `15fa527` | felhom.eu | checks 6-content and 7 | +| `f49b1f3` | felhom.eu | symlink + check 5 two shapes | +| `5ca5082` | felhom.eu | t740, registers, ledger, S-37 | + +## 2. `felhom-agent/CLAUDE.md` + +**175 → 99 effective lines** (207 → 103 raw; 14,093 → 6,267 B). Measured 175, not the spec's 173 — +part 2's CI correction added two. Four new `paths:`-scoped rule files, all ≤46 effective, beside the +existing `health-checks.md`. + +**Glob overlap, stated not silently resolved:** `health-checks.md` already covered +`internal/{storage,localapi,guesthook}/**`, which `storage.md` and `localapi.md` now also cover. Both +load; neither supersedes. Each new file says so in its own text. + +## 3. Hook evidence — fresh sessions, both directions + +Agent rules (`claude -p`, timestamps from the log): + +``` +2026-08-06T09:46:15Z path_glob_match .../rules/proxmox.md trigger=client.go +2026-08-06T09:46:23Z path_glob_match .../rules/backup.md trigger=doc.go +``` + +Negative control — reading `go.mod`, which matches no rule glob: **no rule fired at all**. And each +positive fired *only* its own rule. + +Symlink — all three fresh sessions logged +`session_start Project /mnt/5_hdd/felhom.eu/git/CLAUDE.md` (Claude Code reports the **link** path, +not the resolved one). Because a logged path proves discovery and not delivery, a fourth fresh +session **with no tools at all** was asked for standing rule 1 and returned it verbatim: +*"Never combine a test run and a commit in one command…"*. **The content reaches the model. The link +stays.** + +## 4. Memory — three false statements, and a corrected premise + +Backup: `/mnt/5_hdd/felhom.eu/backups/claude-memory-20260806-112853` (158 files). **158 before, 158 +after. Nothing deleted. Only three lines edited.** + +**The premise was wrong and the error was mine.** Part 2 reported "3 expired statements"; re-run with +the cause printed, **all three matched an ISO date inside a markdown link target — a filename** — +while the one real expired claim was written `~08-02`, carried no ISO date, and was never matched. + +The three genuinely false statements, each falsified by evidence: + +| Line | Was | Falsified by | +|---|---|---| +| 17 | `R-193 decision open` | row reads `**CLOSED 2026-08-05 — controller v0.200.0**` | +| 34 | `demo boxes REMOTE till ~08-02` | `ssh felhom-pve` answers, holding `192.168.0.162/24` on `vmbr0` | +| 68 | `OPEN R-25b` | `**SHIPPED hub v0.69.0 (2026-07-21)**` | + +Line 34 kept its durable half — `ssh felhom-pve` still resolves to the **tailnet** address. + +## 5. Gate: check 6 content WARNings + check 7 + +First run over the real index: **32 version literals, 4 host addresses, 0 expired, 0 stale +citations**. The 32 and the 4 are **deliberately left** for the loop to work on. + +**Check 7 finds nothing across the four repos right now** — 19 citations, 0 failures — because part 2 +already fixed the four stale sentences. The red-proof, not the zero, is what shows it works: + +``` +CLAUDE.md:90: claims R-168 is still open, but the register says it is closed. … + report when you use it.** Both facts are why CI is still owed (`OPEN-ITEMS.md` R-168). +``` + +Restored; gate green again. **Suite 39 → 68 assertions, 0 failures.** + +**Two bugs found by the check's own red-proofs, both of which would have shipped.** The state marker +is not self-closing (`**SHIPPED — …**`), so the first parser read **R-168, its own founding case, as +OPEN**; and the CLOSED exemption was line-wide, so "shipped" in a title pardoned `OPEN R-25b`. The +second was found *only* because the red-proof failed to go red. + +**Deviation from the task's literal wording, stated:** check 7 triggers on an **openness claim**, not +on every citation of a non-open item. The literal rule fires on ~30 legitimate provenance citations +(`(R-161)`, `R-117 spike §6.3`); a gate that noisy gets switched off, which is R-29's own lesson. The +spec's required pass case (`R-168, CLOSED 2026-08-02`) is tested and green. + +## 6. Symlink + +Live root file → relative symlink; backup `workspace-CLAUDE.md.bak-20260806-113952`. Check 5 asserts +per shape: link → resolves to the versioned copy (dangling case red-proofed, since a dangling link +loads **nothing**); two files → byte-identity as before. Installer links by default, **migrates** an +existing regular file after backing it up and says so if it differed, and keeps `--copy`. + +## 7. t740 — measured, then corrected + +`target-selection.md` said the off-site tier is the N100's and **"(demo-hp has none)"**. Measured: + +``` +demo-hp# LC_ALL=C pvesm list felhom-pbs + felhom-pbs:backup/ct/9201/2026-07-28T19:19:45Z pbs-ct 6264034048 9201 + felhom-pbs:backup/ct/9201/2026-08-04T19:24:16Z pbs-ct 4637840512 9201 +ep0:/mnt/pbs-datastore/ns/ → c11 demo-felhom demo-hp rewalk +``` + +Two snapshots in demo-hp's **own namespace**, newest two days old. **The claim is false — and it was +true when written**, going stale when F10 resolved 2026-07-23 (first snapshot 2026-07-28). Corrected +with the measurement kept beside it. It mattered because the sentence was the stated reason for +steering backup-disturbing tests at the other box. + +## 8. context7 — nothing written + +**No Node.js exists on DooPlex**: `npx`, `node`, `npm` all absent from `PATH`, no package installed, +no runtime directory. The manifest is `{"command": "npx", "args": ["-y", "@upstash/context7-mcp"]}`, +so `ENOENT` is literal. + +The fix is one package install away, **but that is not this task's call**: DooPlex is Tier 2 and *is* +the recovery chain, and adding a language runtime to it deserves its own review. Measured surface, so +the recommendation is evidence-based: **1 direct third-party dependency in the agent, 3 in the hub, 6 +in the controller** — ~8 distinct, small, stable packages. Per §6, nothing was written. + +## 9. Registers + +**R-229(b) CLOSED** · **R-230(b) CLOSED** · **R-230(a)** part-actioned, **bulk-correction ruling +still owed and still yours** · **R-230(c)** (spec-as-failing-test pilot) untouched · **R-231** +untouched. **S-37** added to `CONTEXT.md`. + +## 10. Observations — not acted on + +1. **R-129 has a second dated observation.** A key authenticated to demo-hp non-interactively today, + 2026-08-06 — that is how §7's evidence was gathered. The row is still right to be open. +2. **`~/.ssh/config` carries the same expired vacation claim** the index did ("at the VACATION site + until ~2026-08-02"). Host state, outside every repo and outside scope — the same statement in a + third place. +3. **The hub operator UI did not answer over its ClusterIP** this session (hung, 2-min timeout); the + off-site evidence came from the boxes instead. The memory note describing that access path may + need re-checking. +4. **`MEMORY.md`'s header still says "felhom-controller Project Memory"** though it indexes all four + repos. Left for the R-230(a) ruling. +5. **`register_state` is a reusable register parser now.** Anything else needing "is R-nnn open" + should call it — its two parsing traps are not obvious and were both found the hard way. diff --git a/STATUS.md b/STATUS.md index c015837..bc0b426 100644 --- a/STATUS.md +++ b/STATUS.md @@ -76,6 +76,15 @@ failed until someone walks it end to end with no help from us. ## What shipped recently +- **2026-08-06 (later)** — **The page that says which machine may be wrecked had one wrong sentence, + and it has been checked against the machine rather than corrected from memory.** It claimed the + spare HP box keeps no off-site copy, and used that as the reason to aim risky backup tests at the + other one. The HP box **does** keep an off-site copy — two of them, the newest from 4 August, in + its own space on the off-site server. The sentence was true when it was written and went out of + date on 23 July. It matters because a belief that a machine holds nothing is how a destructive test + lands on one that does. Also today: the notes the assistant keeps had three statements that were + simply untrue (including that the demo boxes were still away) — those three are fixed, the rest are + now flagged automatically rather than rewritten by hand. *(R-229, R-230)* - **2026-08-06** — **The assistant's own working notes were on one machine with no copy anywhere.** Everything the assistant has learned about this system over months — where things live, which traps cost us an incident — sat in a folder on the build machine that no backup touched and no repository