pdurlej/platform

Fork 0

docs(vault): record destructive cleanup evidence #627

Merged

pdurlej merged 1 commit from codex/m04-vault-destructive-cleanup-evidence into main

2026-05-30 08:39:36 +02:00

codex commented

2026-05-30 08:37:04 +02:00

Collaborator

Summary

Records the completed M04-E Vault destructive cleanup evidence after the approved runtime cleanup.

What changed

Adds state/reports/m04-vault-destructive-cleanup-2026-05-30.md.
Records the sanitized pre-cleanup gates, exact approved deletion scope, SSH CA trust change, and post-cleanup smoke.
Notes historical broad-grep Vault references that were intentionally left for low-priority M10 host cleanup.

Runtime result

Vault container removed.
Vault data/log volumes removed.
Vault images removed.
Approved legacy Vault env/config/script paths removed.
Old Vault SSH CA removed from trusted user CA file.
Local safe-session CA retained.
safe-session API/web and Uptime Kuma remained healthy.
Post-cleanup API signing and SSH cert login worked.
Secret-like log matches: 0.
Vault reconnect-like log matches: 0.

Validation

PYTHONPATH=control-plane uv run --project control-plane python -m platformctl.cli validate all --json passed.
Forgejo issue #64 was updated with sanitized evidence: #64 (comment)

Non-goals

No new runtime change in this PR.
No issue/comment writer.
No dependency writer.
No auto-merge implementation.
No deletion beyond the already-executed operator-approved M04-E runtime scope.

## Summary Records the completed M04-E Vault destructive cleanup evidence after the approved runtime cleanup. ## What changed - Adds `state/reports/m04-vault-destructive-cleanup-2026-05-30.md`. - Records the sanitized pre-cleanup gates, exact approved deletion scope, SSH CA trust change, and post-cleanup smoke. - Notes historical broad-grep Vault references that were intentionally left for low-priority M10 host cleanup. ## Runtime result - Vault container removed. - Vault data/log volumes removed. - Vault images removed. - Approved legacy Vault env/config/script paths removed. - Old Vault SSH CA removed from trusted user CA file. - Local safe-session CA retained. - safe-session API/web and Uptime Kuma remained healthy. - Post-cleanup API signing and SSH cert login worked. - Secret-like log matches: 0. - Vault reconnect-like log matches: 0. ## Validation - `PYTHONPATH=control-plane uv run --project control-plane python -m platformctl.cli validate all --json` passed. - Forgejo issue #64 was updated with sanitized evidence: https://git.pdurlej.com/pdurlej/platform/issues/64#issuecomment-13165 ## Non-goals - No new runtime change in this PR. - No issue/comment writer. - No dependency writer. - No auto-merge implementation. - No deletion beyond the already-executed operator-approved M04-E runtime scope.

codex added 1 commit

2026-05-30 08:37:04 +02:00

docs(vault): record destructive cleanup evidence

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / collect-diff (pull_request) Successful in 4s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 6s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 5s

Details

canary-required / canary (pull_request) Has been skipped

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 1m10s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 1m12s

Details

0ba6553de3

pdurlej merged commit 38ac05abca into main

2026-05-30 08:39:36 +02:00

pdurlej deleted branch codex/m04-vault-destructive-cleanup-evidence

2026-05-30 08:39:36 +02:00

pdurlej referenced this pull request from a commit

2026-05-30 08:39:36 +02:00

Merge pull request 'docs(vault): record destructive cleanup evidence' (#627) from codex/m04-vault-destructive-cleanup-evidence into main

codex commented

2026-05-30 08:39:44 +02:00

Author

Collaborator

Patchwarden PR sanity

Status: eligible_sanity_clean
PR: 627
Commit: 0ba6553de3332800f716cfb5e8a7ca91abddca8b
Security-sensitive label: missing
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

No deterministic findings.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: OK
Findings: none

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
Findings: none

`redteam` / `kimi-k2.6:cloud`

Status: ok
Verdict: OK
Findings: none

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `eligible_sanity_clean` - PR: `627` - Commit: `0ba6553de3332800f716cfb5e8a7ca91abddca8b` - Security-sensitive label: `missing` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings No deterministic findings. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `redteam` / `kimi-k2.6:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.

codex referenced this pull request

2026-05-30 08:43:01 +02:00

docs(migrations): vault-to-infisical Phase 1-5 execution #64