From 8e6a9dad222a5b8659d87321aa9f8872c6d7cfbe Mon Sep 17 00:00:00 2001 From: Ben Stull Date: Thu, 28 May 2026 19:43:10 -0700 Subject: [PATCH] update 0032/SESSION-0032.0-TRANSCRIPT-2026-05-28T18-52--2026-05-28T19-13.md --- ...RIPT-2026-05-28T18-52--2026-05-28T19-13.md | 21 ++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/0032/SESSION-0032.0-TRANSCRIPT-2026-05-28T18-52--2026-05-28T19-13.md b/0032/SESSION-0032.0-TRANSCRIPT-2026-05-28T18-52--2026-05-28T19-13.md index 9461a8b..cdf0d52 100644 --- a/0032/SESSION-0032.0-TRANSCRIPT-2026-05-28T18-52--2026-05-28T19-13.md +++ b/0032/SESSION-0032.0-TRANSCRIPT-2026-05-28T18-52--2026-05-28T19-13.md @@ -6,6 +6,12 @@ > (audit-0026 L5/L9) and ship flotilla v1.2.0 — plus the minor leftovers > (audit I3/I4 as rfc-app v0.28.0, and the orphaned VM db files). > +> Post-publish addendum: the operator merged **PR #2** (rfc-app v0.28.0) +> immediately after this transcript first published — merge commit +> `019c8a9` on `main`. It is **not yet tagged or deployed**; OHM still runs +> v0.27.0 until the operator tags `v0.28.0`, deploys, and bumps the pin. +> The cut-state, ledger, and operator-plate below are updated to match. +> > Outcome: **All four tasks landed. OHM SSH is now IAP-only (L5 closed, > L9 residue retired); the VM was re-verified healthy end-to-end through > flotilla's own SSH path. flotilla v1.2.0 was found already merged + @@ -169,7 +175,7 @@ git credential (never printed). Removed the worktree. | | | | --- | --- | | flotilla | `main`/`origin/main` = `ef34ffe`, tag `v1.2.0` (merged+tagged by session 0031; re-verified here, 184 tests). No change this session. | -| rfc-app | `main` = `fe044ed` (v0.27.0). Branch `feature/v0.28.0-email-turnstile-async` = `79a447c` pushed; **PR #2 open** (awaiting operator merge+tag+deploy). | +| rfc-app | **PR #2 merged** by the operator post-publish → `main` = `019c8a9` (v0.28.0 code, VERSION=0.28.0). **Not yet tagged/deployed** — `v0.28.0` tag + `flotilla deploy` + pin bump remain operator gestures. | | OHM live | `deploys` unchanged, **HTTP 200 v0.27.0 status=ok** before and after all infra changes. | | ohm-rfc pin | `0.27.0` (unchanged; bumps to 0.28.0 only after the operator deploys PR #2). | | GCP firewall | `default-allow-ssh` **deleted**; `allow-iap-ssh` (35.235.240.0/20→tcp:22) added. SSH is IAP-only. | @@ -181,7 +187,7 @@ git credential (never printed). Removed the worktree. | --- | --- | | Task 1 — IAP SSH hardening (L5 + L9) | ✅ shipped + re-verified | | Task 2 — flotilla v1.2.0 | ✅ (shipped by 0031; independently re-verified) | -| Task 3 — rfc-app v0.28.0 (I3 + I4) | 🟡 PR #2 open — operator merges + tags + deploys | +| Task 3 — rfc-app v0.28.0 (I3 + I4) | ✅ PR #2 **merged** (019c8a9) post-publish; 🟡 tag + deploy + pin bump remain operator gestures | | Task 4 — orphaned VM db files | ✅ deleted | --- @@ -205,8 +211,8 @@ git credential (never printed). Removed the worktree. ## What lands on the operator's plate -1. **Merge + tag + deploy rfc-app v0.28.0** — review PR #2 - (`ben.stull/rfc-app/pulls/2`), merge, `git tag v0.28.0`, then +1. **Tag + deploy rfc-app v0.28.0** — PR #2 is already **merged** to + `main` (`019c8a9`). Remaining: `git tag v0.28.0`, then `flotilla deploy ohm-rfc-app` (now over IAP) and bump `ohm-rfc/.rfc-app-version` to `0.28.0`. No migration/secret/overlay change; plain code deploy. @@ -237,9 +243,10 @@ State as of session 0032 (2026-05-28): Open item: - rfc-app v0.28.0 (audit-0026 I3 dead-HTML-email guard + I4 async Turnstile - siteverify) is PR #2 (ben.stull/rfc-app/pulls/2), backend suite 365 green, - no-op upgrade. If not yet merged: review + merge + `git tag v0.28.0` + - `flotilla deploy ohm-rfc-app` + bump ohm-rfc/.rfc-app-version to 0.28.0. + siteverify) — PR #2 is MERGED to main (019c8a9), backend suite 365 green, + no-op upgrade, but NOT yet tagged/deployed. Remaining: `git tag v0.28.0` + + `flotilla deploy ohm-rfc-app` + bump ohm-rfc/.rfc-app-version to 0.28.0. + (Skip if the operator already did this between sessions — check the pin.) Then pick up the ROADMAP (~/git/ohm-rfc/ROADMAP.md) — the audit-0026 Critical/High/Medium remediations already shipped in v0.27.0; remaining