feat(v1.100 Amendment 2): code-A — G1/AuthorityNFTBan split + §54 evidence predicate by itcmsgr · Pull Request #519 · itcmsgr/nftban

itcmsgr · 2026-04-28T19:22:28Z

Summary

Decision-layer implementation of Amendment 2 (internal/installer/restore/contract.md §§52–61, merged in #518).

Splits the existing G1/AuthorityNFTBan row into two evaluated-within-Group-1 sub-rules. The split is ENTIRELY within Group 1; no later group ever defeats a Group 1 outcome and §5 precedence is preserved.

Sub-rule	Condition	Output
`G1/AuthorityNFTBan/default`	candidate triple absent	REFUSE
`G1/AuthorityNFTBan/orphan-intent-candidate` → `OrphanProceed`	`AuthorityNFTBan + NoRecord + DirectAdmin + --panel-auto-takeover + --accept-orphan-nftban + ALL §54.1 evidence rows true`	PROCEED PanelNative/csf
`G1/EvidenceMismatch`	candidate triple present + any §54.1 row false	REFUSE

What this changes

Decision layer only. Zero mutation surfaces added.

New CLI flag --accept-orphan-nftban (flags.go). Restore-mode only. CLI argv only — no env-var fallback per §55. Help text contains zero "force"/"override" tokens.
Extended restore.Flags + restore.DecisionInput with AcceptOrphanNFTBan, Panel detect.PanelType, OrphanEvidence *OrphanEvidence.
New OrphanEvidence struct (13 boolean rows + AllTrue() + FailedRowID()).
New decideAuthorityNFTBan in restore/engine.go: candidate-triple gate → §54 evidence predicate → PROCEED or REFUSE.
New cmd/nftban-installer/restore_decide_evidence.go (read-only §54 reader). Uses existing typed surfaces (FileExists, ServiceActive, NftTableExists). E.6 csf.service state uses raw Run("systemctl","status"|"is-enabled","csf.service") per §43.3 (read-only probes authorized). No mutating systemctl verbs.
Dispatcher gathers evidence ONLY when candidate triple is otherwise present, avoiding unnecessary live reads on every restore-mode invocation.

Tests

engine_amendment2_test.go — §56.1 unit fixtures (rows 01–20 + 7d fallback variant), §56.2 regression (R1–R6), §56.4 mutation-surface AST scan, FailedRowID per-row coverage.
restore_decide_evidence_test.go — gatherOrphanEvidence per-row coverage (15 cases including E.6 sub-variants: active forbidden, not-found forbidden, enabled forbidden, static forbidden, disabled-acceptable). NFTBAN_ACCEPT_ORPHAN env-var-fallback source-scan invariant.
engine_test.go — existing G1/AuthorityNFTBan fixture re-pinned to G1/AuthorityNFTBan/default; declaredRules updated; two new allFixtures entries pin OrphanProceed and EvidenceMismatch.

CI gates (§56.3) implemented as in-process Go tests, NOT as GitHub Actions edits — per operator direction.

Test results (lab4 build host)

go test ./internal/installer/restore/... → PASS
go test ./cmd/nftban-installer/... → PASS
go test ./... → 64 packages PASS, 0 FAIL

§56.3 grep gates (scoped to Amendment 2 changed files)

iptables-(save|restore|nft) → 0 hits → PASS
build[ -]set[ ]+csf → 0 hits → PASS
WriteFileAtomic.*update-history|openat.*O_WRONLY.*update-history|WriteUpdateHistory → 0 hits → PASS
force|override in --accept-orphan-nftban CLI text → 0 hits → PASS

Invariants preserved

§5 precedence: split entirely within Group 1.
INV-PR25-AUTHORITY-IMMUTABILITY: §54 read once at decision time.
§19.2 layer 4 / main.go:132 history gate: untouched.
§20.1 panel mapping: PROCEED resolves PanelNative/csf via existing static map.
§22 / §19.4 terminals + exit codes: unchanged (zero new).
§32 11-step ordering: unchanged.
§43.3 read-only Run policy: E.6 uses status/is-enabled only.
§51.3 Option B: zero iptables introspection.
INV-PR26-NEW-MUTATION-SURFACES-BOUNDED: zero new surfaces.
INV-AMD2-EXPLICIT-INTENT-IS-NARROW: §53.4 13 REFUSE rows test-pinned.

Out of scope

§59 Q3/Q4 — typed read-only ServiceListed/ServiceEnabled/NftListTables deferred; raw Run for E.6 + existing NftTableExists used instead.
amendment-2-code-E real-host srv3 destructive evidence — separate PR after this merges.

Locked rules respected

No srv3 action.
No nftban-installer invocation on srv3.
No manual host mutation.
No §32 mutation-path change.
No new state terminals.
No new exit codes.
No update-history writes.
No iptables introspection.
No DirectAdmin custombuild rewrite.
No cPanel/Plesk/standalone expansion.
No env/config fallback for --accept-orphan-nftban.
No CI workflow edit.

Remaining blockers before amendment-2-code-E

Auditor on-PR review of this code-A.
This PR merged to main.
Fresh Tier 1 binary built (the prior a3e283ed… binary is superseded).
Fresh srv3/operator-signoff.txt recorded (operator-side, not assistant).
Fresh srv3/pre/ snapshot captured.
Fresh auditor CONDITIONAL PRE-EXECUTION GO FOR AMENDMENT-2-CODE-E issued.

Test plan

CI passes
Auditor review
Verify zero mutation-surface additions in this diff
Verify §53.4 explicit-REFUSE row coverage in §56.1 test fixtures

🤖 Generated with Claude Code

…dence predicate + --accept-orphan-nftban Decision-layer implementation of Amendment 2 (contract.md §§52–61). Splits the existing G1/AuthorityNFTBan row into two evaluated-within- Group-1 sub-rules: - G1/AuthorityNFTBan/default — REFUSE, unchanged behavior for all flag patterns outside the candidate triple. - G1/AuthorityNFTBan/orphan-intent-candidate — delegates to the §54 evidence predicate; G1/AuthorityNFTBan/OrphanProceed on all-true, G1/EvidenceMismatch on any-false. Split is ENTIRELY within Group 1; no later group ever defeats a Group 1 outcome and §5 precedence is preserved. Implementation surface ====================== - Add CLI flag --accept-orphan-nftban (cmd/nftban-installer/flags.go). Restore-mode only. CLI argv only — no env-var fallback per §55. Help text contains zero "force"/"override" tokens. - Extend restore.Flags + restore.DecisionInput with: - AcceptOrphanNFTBan bool - Panel detect.PanelType - OrphanEvidence *OrphanEvidence - New OrphanEvidence struct with 13 boolean rows + AllTrue() + FailedRowID(). - New decideAuthorityNFTBan in restore/engine.go: candidate-triple gate → §54 evidence predicate → PROCEED PanelNative/csf or REFUSE. - New cmd/nftban-installer/restore_decide_evidence.go: read-only §54 reader. Uses existing typed surfaces (FileExists, ServiceActive, NftTableExists). E.6 csf.service state uses raw Run("systemctl", "status"|"is-enabled","csf.service") per §43.3 (read-only probes authorized). NO mutating systemctl verbs. Zero new typed mutation surfaces. - Dispatcher (restore_decide.go) gathers evidence ONLY when candidate triple is otherwise present, avoiding unnecessary live reads on every restore-mode invocation. Tests ===== - engine_amendment2_test.go: §56.1 unit fixtures (rows 01–20 + 7d acceptable-fallback variant), §56.2 regression (R1–R6), §56.4 mutation-surface AST scan, FailedRowID per-row coverage. - restore_decide_evidence_test.go: gatherOrphanEvidence per-row coverage (15 cases including E.6 sub-variants: active forbidden, not-found forbidden, enabled forbidden, static forbidden, disabled-acceptable). NFTBAN_ACCEPT_ORPHAN env-var-fallback source-scan invariant. - engine_test.go: existing G1/AuthorityNFTBan fixture re-pinned to G1/AuthorityNFTBan/default; declaredRules now lists three sub-rule consts; two new allFixtures entries pin OrphanProceed and EvidenceMismatch. CI gates (§56.3) implemented as in-process tests, NOT as GitHub Actions edits — per operator direction. Source-scan tests in engine_amendment2_test.go (force/override scan) and restore_decide_evidence_test.go (env-var fallback scan). Invariants preserved ==================== - §5 precedence: split is entirely within Group 1. - INV-PR25-AUTHORITY-IMMUTABILITY: §54 evidence read once at decision time, never re-read. - §19.2 layer 4 / main.go:132 history gate: untouched. - §20.1 panel mapping: PROCEED resolves PanelNative/csf via the existing static map. - §22 four terminals + §19.4 exit codes: unchanged. - §32 11-step ordering: unchanged. - §43.3 read-only Run policy: §54 E.6 uses status/is-enabled only. - §51.3 Option B: zero iptables introspection added. - INV-PR26-NEW-MUTATION-SURFACES-BOUNDED: zero new mutation surfaces. - INV-AMD2-EXPLICIT-INTENT-IS-NARROW: §53.4 13 explicit-REFUSE rows test-pinned in §56.1. Test results ============ - go test ./internal/installer/restore/... PASS - go test ./cmd/nftban-installer/... PASS - go test ./... 64 packages PASS, 0 FAIL Grep gates (scoped to Amendment 2 changed files) ================================================ - iptables-(save|restore|nft) 0 hits → PASS - build[ -]set[ ]+csf 0 hits → PASS - WriteFileAtomic.*update-history|... 0 hits → PASS - force|override in --accept-orphan-nftban 0 hits → PASS Out of scope (deferred) ======================= - §59 Q3/Q4 — typed read-only ServiceListed/ServiceEnabled/NftListTables not added; raw Run for E.6 + existing NftTableExists used instead. - §59 Q5 — final --help text wording locked here; further refinement optional. - amendment-2-code-E real-host srv3 destructive evidence — separate PR. No srv3 action. No CI workflow edit. No §32 mutation path change. No new state terminals. No new exit codes. No update-history writes. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

github-actions · 2026-04-28T19:22:40Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

…abled for restore-to-CSF (#520) Surfaced by Amendment-2-code-E srv3 destructive run (2026-04-28T21:06:03Z): the dispatcher reached G1/AuthorityNFTBan/OrphanProceed PROCEED but RESTORE_FAILED_EXECUTION at preflight stage with exit=8 because the existing PR-25 §23.1 preflight required the canonical csf binary to be present in PATH. The Amendment-2 orphan-restore scenario specifically has /usr/sbin/csf ABSENT and /usr/sbin/csf.disabled PRESENT (the install-time-disabled state from switchop.DisableConflicts step 4), which the dispatcher then restores via §32 A.3 rename. This is a contract gap in PR-25 preflight, NOT in Amendment 2's decision layer. Code-A (#519) and Amendment 2 §53 + §54 work as designed. Surgical patch ============== In productionPreflightDep.PreflightTarget: - For firewallType=="csf": if no canonical csf binary in PATH, accept /usr/sbin/csf.disabled as a restorable candidate. - For non-CSF firewalls (ufw / firewalld / iptables): existing strict in-PATH check unchanged. No .disabled relaxation. Per Amendment 1 §30.2 (CSF-only inverse-of-install scope). - Existing unit-file presence check unchanged. - Preflight remains read-only — uses existing exec.FileExists. A.3 (Amendment 1 §31) remains the authoritative rename and detects the ambiguous-both-present state for refusal at §32 step 1. Tests added (9 cases per operator scope) ======================================== 1. AMD2-1: csf in PATH, .disabled absent, unit present → PASS 2. AMD2-2: csf absent, .disabled present, unit present → PASS (§54 case) 3. AMD2-3: csf absent, .disabled absent, unit present → REFUSE ErrPreflightBinaryMissing 4. AMD2-4: csf in PATH AND .disabled present, unit present → PASS at preflight; ambiguity is A.3's responsibility 5. AMD2-5: csf in PATH, unit absent → REFUSE ErrPreflightUnitMissing 6. AMD2-6: ufw absent + ufw.disabled present → REFUSE (no relaxation) 7. AMD2-7: firewalld absent + firewall-cmd.disabled present → REFUSE 8. AMD2-8: iptables absent + iptables.disabled present → REFUSE 9. AMD2-9: unknown firewallType → REFUSE ErrPreflightUnknownFirewall 10. AMD2-10: §54 branch records ZERO mutation commands (read-only contract preserved) Test results (lab4 build host) ============================== - go test ./cmd/nftban-installer/... -run 'Preflight|RestoreDeps' → PASS - go test ./cmd/nftban-installer/... → PASS - go test ./internal/installer/restore/... → PASS - go test ./... → 64 pkgs PASS, 0 FAIL Files changed ============= cmd/nftban-installer/restore_deps.go | +24 / -4 (28 lines) cmd/nftban-installer/restore_deps_test.go | +163 (10 new tests) No files outside the operator-allowed two. Invariants preserved ==================== - §23.1 preflight read-only: unchanged. New branch uses FileExists only. - INV-PR26-NEW-MUTATION-SURFACES-BOUNDED: zero new surfaces. - §32 ordering: unchanged. A.3 still authoritative rename. - §22 / §19.4 terminals + exit codes: unchanged. - Amendment 1 §30.2 CSF-only scope: preserved (non-CSF .disabled files explicitly refuse — tests AMD2-6/7/8 pin this). - §19.2 layer 4 / main.go:132 history gate: untouched. - Existing 4B-1 fixture matrix: unchanged behavior, all pass. No CI workflow edit. No state machine change. No flag change. No contract change. No execute.go change. No engine.go change. No main.go change. No srv3 action. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

itcmsgr merged commit 433f53c into main Apr 28, 2026
63 checks passed

itcmsgr deleted the amendment-2-code-A-decision-layer branch April 28, 2026 20:59

itcmsgr mentioned this pull request Apr 28, 2026

fix(v1.100 Amendment 2): code-B — preflight accepts /usr/sbin/csf.disabled for restore-to-CSF #520

Merged

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(v1.100 Amendment 2): code-A — G1/AuthorityNFTBan split + §54 evidence predicate#519

feat(v1.100 Amendment 2): code-A — G1/AuthorityNFTBan split + §54 evidence predicate#519
itcmsgr merged 1 commit intomainfrom
amendment-2-code-A-decision-layer

itcmsgr commented Apr 28, 2026

Uh oh!

github-actions Bot commented Apr 28, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

itcmsgr commented Apr 28, 2026

Summary

What this changes

Tests

Test results (lab4 build host)

§56.3 grep gates (scoped to Amendment 2 changed files)

Invariants preserved

Out of scope

Locked rules respected

Remaining blockers before amendment-2-code-E

Test plan

Uh oh!

github-actions Bot commented Apr 28, 2026

Dependency Review

Scanned Files

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant