Commit graph

4 commits

Author SHA1 Message Date
301c7e9006 Runbook: A3 resolved (key located+confirmed, path kept private), A4 corrected (driver = pacta_provider CLI), A3b opened (key has no second copy)
The append driver was never lost: pacta's committed provider/ CLI
(check / log-append / log-publish) produced leaves 8-11, signing heads
with the verified-dalek-serial dogfood backend (self_inclusion:
verified). Only the per-run orchestration was session work — A4 is now
rehearsal + private documentation, not reconstruction. A3: private key
located laptop-side (0600, gitignored state dir; public half
byte-matches provider.ed25519.pub); exact path deliberately excluded
from this public file. A3b: the key has NO second copy anywhere —
encrypted SD backup procedure added as a Phase-A blocker.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-12 18:46:36 +02:00
7d58fe52c7 Runbook: B4 matches the real deploy anatomy; key + infra facts sharpened
The droplet serves a DERIVED log dir rebuilt from a published/ mirror
(PersonalCloudServer DEPLOY.md § 'The LTL service') — B4 now refreshes
published/ and runs reconstruct.py instead of a bare app pull. Facts:
signing key verified NOT on the droplet (server only serves); server
deployment now version-controlled in private PersonalCloudServer@a186bac
(md5-verified == droplet).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-12 18:03:39 +02:00
0f0cb403cd Runbook A5: Forgejo mirrors are anonymously readable — no-SSH verification loop
Corrected the facts table (mirror URL scheme zkdefi.org/saymrwulf/,
nightly reconcile path + log) and replaced the server-side A5 with an
anonymous seven-repo GitHub==Forgejo head comparison.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-12 17:28:09 +02:00
fc913655ab Add ATTESTATION-RUNBOOK: the persisted, no-AI-required path to entry 13
Single authoritative ToDo between now and leaf index 12. Phase A (now):
reviewer confirmations, author statement read, operator-only key
confirmation (openssl pubkey diff against provider.ed25519.pub),
reconstruction of the never-persisted append driver (found 2026-07-12:
the leaves 8-11 driver was session work), Forgejo mirror verification.
Phase B (gated on ePrint decision + fresh explicit operator order):
clean-room button run, driver append, witness-audit, consumer
sth-refresh 12->13, publish, live checks, mirrors, SD archive. Iron
rules, failure protocol, and an Agent Appendix (key handling forbidden
to agents; the fifth gate condition cannot be satisfied from files).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-12 16:24:19 +02:00