fix(v1.100 Amendment 2): code-B — preflight accepts /usr/sbin/csf.disabled for restore-to-CSF

[itcmsgr]

Summary

Fixes the preflight contract bug surfaced by the Amendment-2-code-E srv3 destructive run (2026-04-28T21:06:03Z).

The dispatcher reached G1/AuthorityNFTBan/OrphanProceed PROCEED correctly, but failed at RESTORE_FAILED_EXECUTION (stage=preflight, exit=8) because the existing PR-25 §23.1 preflight requires the canonical csf binary in PATH. The Amendment-2 orphan-restore scenario specifically has /usr/sbin/csf ABSENT and /usr/sbin/csf.disabled PRESENT (the install-time-disabled state from switchop.DisableConflicts step 4), which the dispatcher restores via §32 A.3 rename later.

This is a contract gap in PR-25 preflight, not in Amendment 2's decision layer. Code-A (#519) and Amendment 2 §53 + §54 work as designed.

Surgical patch

In productionPreflightDep.PreflightTarget:

• For firewallType == "csf": if no canonical csf binary in PATH, accept /usr/sbin/csf.disabled as a restorable candidate.
• For non-CSF firewalls (ufw / firewalld / iptables): existing strict in-PATH check unchanged. No .disabled relaxation. Per Amendment 1 §30.2 (CSF-only inverse-of-install scope).
• Existing unit-file presence check unchanged.
• Preflight remains read-only — uses existing exec.FileExists.

A.3 (Amendment 1 §31) remains the authoritative rename and detects the ambiguous-both-present state for refusal at §32 step 1.

Tests added (10 new test functions)

Test	Scenario	Expected
AMD2_CSF_InPath_DisabledAbsent_Pass	csf in PATH, .disabled absent	PASS
AMD2_CSF_Absent_DisabledPresent_Pass	csf absent, .disabled present	PASS (§54 case)
AMD2_CSF_BothAbsent_Refuse	both absent	REFUSE ErrPreflightBinaryMissing
AMD2_CSF_BothPresent_Pass_AmbiguityIsA3	both present	PASS (ambiguity is A.3's job)
AMD2_CSF_InPath_UnitAbsent_Refuse	csf in PATH, unit absent	REFUSE ErrPreflightUnitMissing
AMD2_NonCSF_NoDisabledRelaxation	ufw/firewalld/iptables .disabled present	REFUSE (CSF-only scope)
AMD2_UnknownFirewall_StillRefuse	unknown firewallType	REFUSE ErrPreflightUnknownFirewall
AMD2_CSF_DisabledBranch_NoMutationCalls	§54 branch	zero mutation commands

Test results (lab4 build host)

• go test ./cmd/nftban-installer/... -run 'Preflight|RestoreDeps' → PASS
• go test ./cmd/nftban-installer/... → PASS
• go test ./internal/installer/restore/... → PASS
• go test ./... → 64 packages PASS, 0 FAIL

Files changed

File	Change
cmd/nftban-installer/restore_deps.go	+24 / -4 (CSF-only .disabled branch in PreflightTarget)
cmd/nftban-installer/restore_deps_test.go	+163 (10 new test functions)

Files NOT touched

• internal/installer/restore/contract.md ✅
• internal/installer/restore/engine.go ✅
• internal/installer/restore/execute.go ✅
• internal/installer/state/machine.go ✅
• cmd/nftban-installer/flags.go ✅
• cmd/nftban-installer/main.go ✅
• .github/workflows/* ✅
• All other files ✅

Invariants preserved

• §23.1 preflight read-only: unchanged.
• INV-PR26-NEW-MUTATION-SURFACES-BOUNDED: zero new surfaces.
• §32 ordering: unchanged. A.3 still authoritative rename.
• §22 / §19.4 terminals + exit codes: unchanged.
• Amendment 1 §30.2 CSF-only scope: preserved (non-CSF .disabled files explicitly refuse — pinned in tests).
• §19.2 layer 4 / main.go:132 history gate: untouched.
• Existing 4B-1 fixture matrix: unchanged behavior, all pass.

Out of scope

• No new lattice rule.
• No new state terminal.
• No new exit code.
• No new mutation surface.
• No CI workflow edit.
• No host action.

Test plan

• CI passes
• Auditor verifies CSF-only scope (non-CSF .disabled paths still REFUSE)
• Auditor verifies preflight remains read-only (zero Run/Service*/Nft* calls in changed branch)
• Auditor verifies A.3 ambiguity-detection at §32 step 1 unchanged

After merge

Fresh Tier 1 binary build → fresh srv3 H2/H3 attestation → fresh auditor CONDITIONAL PRE-EXECUTION GO → one new srv3 destructive attempt.

🤖 Generated with Claude Code

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None