56 lines
3.5 KiB
Markdown
56 lines
3.5 KiB
Markdown
# REPORT — 2026-10-27 evening: the clean-up window button (R-1299) and `sec rm`
|
||
|
||
## Plain words first
|
||
|
||
1. **The button is live** on the hub: customer page → **Backup & DR** tab → „Off-site clean-up window". You granted a
|
||
window on Tester 1 and cancelled it again; nothing was removed.
|
||
2. **`sec rm NAME` works** (cc-secrets 0.3.0): one name per call, saved in git, undo by `git revert`.
|
||
3. **46 store entries removed** on your yes (names in `documentation/audits/r1299-window-button-2026-10-27/sec-rm.txt`):
|
||
the two D55 token copies, 20 of the 10-20 rehearsal box, 14 of the night/fixes test boxes, 3 of the rig and the
|
||
release BYO box, 5 of the 10-24 sweep box, `R_C11_REWALK`, `R_PART4`. The store went from 92 to 46.
|
||
4. **You still do:** nothing from this run. (Today's three do-items are done: agent 0.167.0 vouched, the D55 token
|
||
revoked, `Tester4-b5dbbd` deleted.)
|
||
|
||
**A defect of my own, found by your click and fixed:** hub 0.174.0 logged each grant but stored NO event row (my code
|
||
called only the dispatcher, which writes no row, and my test checked the call, not the row). Hub 0.174.1 stores the row;
|
||
the test now reads the stored rows and fails on 0.174.0's shape. 0.174.1 also moved the card to Backup & DR, where you
|
||
looked for it first.
|
||
|
||
## Versions, digests, CI
|
||
|
||
| | Version | Digest | From | CI |
|
||
|---|---|---|---|---|
|
||
| hub | 0.174.0 | `sha256:4f9ee04a9ff7c108a37a411be3c3de521b6acccb431c9e550c3567f7211e2e94` | `d85198b8` | 2433 ✓ |
|
||
| hub | 0.174.1 | `sha256:bb43f88acd59b8b20914381932eb2d9f779d44c190c34d3349eed91d37ce71fb` | `de57c090` (manifest `714ee236`) | 2437 ✓ |
|
||
| cc-secrets | 0.3.0 | — | `dc82cf9` | no CI in that repo; local suite 72 OK, red-proofs 28/28 |
|
||
| agent pin | day0_agent 0.167.0 | — | `3055bc5` | (end-of-run check) |
|
||
|
||
Live: 0.174.0 at 19:25 CET, 0.174.1 at 20:26 CET; both Synced/Healthy, 0 restarts, hub-only ArgoCD sync, built from a
|
||
clean clone (the shared clone held another session's uncommitted installer edit). 30-minute watch after 0.174.1
|
||
(to 21:13 CET): 0 warning-or-worse events, 0 WARN/ERROR lines, 10 box reports in the last 20 minutes, 0 restarts, no
|
||
new alarm mail.
|
||
|
||
## Tests
|
||
|
||
Hub `TestR1299_*` (five): the page per branch (and in the Backup & DR tab), a grant through the form stores one grant with
|
||
its limit and one stored row, refusals store nothing (above the count, not a number, no confirm, no CSRF), the ceiling
|
||
when no count is known (260 passes, 501 refused), cancel. Red-proofs: seven mutations, all caught
|
||
(`redproof-0174.0.txt`, `redproof-0174.1.txt`). **The tests were written after the code in Part 1** — so each was then
|
||
seen failing by a mutation; Part 2's `sec rm` tests were written first and seen failing before the code existed.
|
||
|
||
## Rows
|
||
|
||
Before 224 open → after 224. Closed: R-1299. Opened: R-1326 (the hub's start-up, 31–36 s, eats half its liveness margin
|
||
of ~65 s). Updated: R-1237 (its dead names are gone from the store; the sweep no longer watches those values; the
|
||
transcripts are unchanged).
|
||
|
||
## Observations
|
||
|
||
- FILED R-1326 — hub start-up vs the liveness probe.
|
||
- FIXED in-session — the window event wrote no row (0.174.0 → 0.174.1).
|
||
- FIXED in-session — the card's place (Backup & DR).
|
||
- NOT-A-FINDING: CC cannot press the button — its token has no `offsite:write` and CC holds no hub password, by design
|
||
(`09` §3 decision 251); the live click was the operator's.
|
||
- NOT-A-FINDING: the `sec doctor` sweep line still lists the removed names — it reports the LAST night's sweep (03:40 UTC),
|
||
before the removal.
|