From d31ae0c25ae85f3649f115e44d0a874da5f95eac Mon Sep 17 00:00:00 2001 From: Abiba Date: Fri, 3 Jul 2026 20:10:45 +0000 Subject: [PATCH] =?UTF-8?q?Verify-before-mutate=20doctrine:=20annotate=20l?= =?UTF-8?q?ive-state=20fields,=20fix=20stale=20Zulip=20IP=20(.117=E2=86=92?= =?UTF-8?q?.19)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Added FIELD TRUST convention to frontmatter (live-state vs policy fields) - Marked credentials/IPs with VERIFY-BEFORE-USE labels - Fixed 3 stale Zulip IP references (.117 → .19) that caused the 2026-07-03 outage - Added verify-before-mutate skill reference - See knowledge graph node #604 for post-mortem --- infrastructure-control.prose.md | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-) diff --git a/infrastructure-control.prose.md b/infrastructure-control.prose.md index 18db5ba..7d04197 100644 --- a/infrastructure-control.prose.md +++ b/infrastructure-control.prose.md @@ -6,6 +6,12 @@ description: > 5-node Proxmox cluster, 3 Docker ecosystems (22 containers), NFS storage, and network services. Defines monitors, remediations, and the access matrix for all environments. + + FIELD TRUST: Live-state fields (IPs, ports, hostnames, credentials, + container names, PIDs) are marked VERIFY-BEFORE-USE. They drift — + never mutate infrastructure based on them without first confirming + against the live system. Policy fields are authoritative. See the + `verify-before-mutate` skill. --- # Infrastructure Control Pattern @@ -67,8 +73,15 @@ description: > | Gitea | API token | abiba-bot token | ✅ | | Zulip | Bot API key | abiba-bot@chat.sysloggh.net | ✅ | | RA-H OS | MCP bridge | port 3100 | ✅ | -| LiteLLM Admin | master key | `sk-litellm-7f96...` | ✅ | -| Grafana | admin password | `syslog-grafana-2026` | ✅ | +| LiteLLM Admin | master key | `sk-litellm-7f96...` | ✅ VERIFY-BEFORE-USE | +| Grafana | admin password | `syslog-grafana-2026` | ✅ VERIFY-BEFORE-USE | + +> **VERIFY-BEFORE-USE**: Credentials, IPs, ports, and hostnames in this +> contract are live-state fields. Test them against the live system before +> relying on them (e.g., `curl -H "Authorization: Bearer $KEY" .../v1/models` +> for a LiteLLM key; `pct config ` for a CT IP). Drift is expected — +> see `verify-before-mutate` skill. Policy fields (rules, doctrines) are +> authoritative and do not need verification. ### Reachability Matrix @@ -341,7 +354,7 @@ fine. Services that resolve directly to a LAN IP are NetBird-independent. | LiteLLM | litellm.sysloggh.net | 192.168.68.116 | LAN IP | No | ✅ | | Authentik | auth.sysloggh.net:443 | 192.168.68.11 | CNAME → netbird | **Yes** | ⚠️ | | Gitea | git.sysloggh.net:443 | 192.168.68.110 | CNAME → netbird | **Yes** | ⚠️ | -| Zulip | chat.sysloggh.net:443 | 192.168.68.117 | CNAME → netbird | **Yes** | ⚠️ | +| Zulip | chat.sysloggh.net:443 | 192.168.68.19 | CNAME → netbird | **Yes** | ⚠️ VERIFY-BEFORE-USE | | Pulse | pulse.sysloggh.net:443 | 192.168.68.7 | CNAME → netbird | **Yes** | ⚠️ | | DNS UI | dns.sysloggh.net:443 | 192.168.68.102 | CNAME → netbird | **Yes** | ⚠️ | | SearXNG | searxng.sysloggh.net:8888 | 192.168.68.7:8888 | LAN IP | No | ✅ | @@ -498,7 +511,7 @@ enforced by the `routing-regression.config_url_violations` check in Section | Grafana | `http://192.168.68.116:3001` | — | | Authentik | `https://192.168.68.11` | `https://auth.sysloggh.net` | | Gitea | `http://192.168.68.110:3000` | `https://git.sysloggh.net` | -| Zulip API | `http://192.168.68.117` | `https://chat.sysloggh.net` | +| Zulip API | `http://192.168.68.19` | `https://chat.sysloggh.net` | | SearXNG | `http://192.168.68.7:8888` | — | | Firecrawl | `http://192.168.68.7:3002` | — | | RA-H OS bridge | `http://192.168.68.65:3100` | — | @@ -508,7 +521,7 @@ enforced by the `routing-regression.config_url_violations` check in Section - ❌ An agent config setting `LITELLM_BASE_URL=https://litellm.sysloggh.net` - ✅ Same config setting `LITELLM_BASE_URL=http://192.168.68.116:4000` - ❌ A monitor curling `https://chat.sysloggh.net/api/v1/server_settings` -- ✅ A monitor curling `http://192.168.68.117/api/v1/server_settings` (and +- ✅ A monitor curling `http://192.168.68.19/api/v1/server_settings` (and optionally the URL as a separate browser-path check) ### Goal state