Ben Stull
49 lines
2.1 KiB
Markdown
49 lines
2.1 KiB
Markdown
# Session 0032.0 — Transcript
|
|
|
|
> Date: 2026-05-28
|
|
> Start: 2026-05-28T18-52 (PST implied)
|
|
> Status: **PLACEHOLDER — claimed at session start; finalized at session end.**
|
|
>
|
|
> This file reserves session ID 0032. The driver replaces this body
|
|
> with the full transcript before publishing, and renames the file to
|
|
> its final SESSION-0032.0-TRANSCRIPT-2026-05-28T18-52--<end>.md form.
|
|
|
|
---
|
|
|
|
## Launch prompt
|
|
|
|
```
|
|
OHM driver session. Two infra/cleanup threads left over from Session 0030
|
|
(which fully remediated security-audit-0026 and shipped rfc-app v0.27.0 +
|
|
flotilla PR #1 — all live on prod; see SESSION-0030.0 transcript in
|
|
ohm-session-history for context).
|
|
|
|
Task 1 — Harden OHM SSH via IAP (§19.2; closes audit-0026 L5 + retires the
|
|
L9 first-connect-TOFU residue):
|
|
- Project wiggleverse-ohm, VM ohm-rfc-app, zone us-central1-a.
|
|
- Add an IAP firewall rule (source 35.235.240.0/20 → tcp:22), grant the
|
|
operator roles/iap.tunnelResourceAccessor.
|
|
- VERIFY `gcloud compute ssh ohm-rfc-app --tunnel-through-iap` works
|
|
BEFORE removing anything.
|
|
- Only then delete the `default-allow-ssh` 0.0.0.0/0 rule, and flip the
|
|
flotilla deployment to IAP: set tunnel_through_iap=true on the
|
|
deployment record + confirm the deploy ssh path uses --tunnel-through-iap.
|
|
- Re-verify a deploy/ssh still works end-to-end after the cutover.
|
|
|
|
Task 2 — Resolve the stuck `trial-merge-v1.2.0` branch in the flotilla repo
|
|
to ship flotilla v1.2.0 (session 0028's PR):
|
|
- It conflicts with the L1 redaction change in `_PhaseRunner.run`
|
|
(deploy.py) — both edited the same block. Do a proper 3-way merge that
|
|
KEEPS BOTH: the live-redaction wrapping of phase detail AND v1.2.0's
|
|
deploy-robustness / record-maintenance verbs.
|
|
- IMPORTANT: do the merge in an ISOLATED git worktree with its own venv,
|
|
NOT the shared flotilla checkout.
|
|
- Ship as a PR (operator merges + tags), matching the repo convention.
|
|
|
|
Minor leftovers if time: audit-0026 I3 (dead text/html email branch in
|
|
email_envelope.py) and I4 (turnstile.py siteverify async) — small v0.28.0.
|
|
And VM: sudo rm orphaned /opt/ohm-rfc-app/backend/data/ohm-app.db\r* files
|
|
once confirmed orphaned.
|
|
|
|
```
|