From 09569a08e6461bad8da617906b7698a2aa9bcdb8 Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Mon, 24 Aug 2026 13:13:45 -0500 Subject: [PATCH] docs: kill-switch robustness fix done+validated; conformance tests partial (rate-limited) Co-Authored-By: Claude Opus 4.8 --- DECISIONS-LOG.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/DECISIONS-LOG.md b/DECISIONS-LOG.md index 4f75cfc..c53c147 100644 --- a/DECISIONS-LOG.md +++ b/DECISIONS-LOG.md @@ -688,3 +688,16 @@ Operator provisioned the host vault; PM drove the deployment + validation on `k3 `nft flush set` line from `vpn-egress-down.sh.j2`. Gate passes without it, but this is defense-in-depth. - **Cross-agent lesson reinforced:** parallel agents must use `isolation: worktree` (an earlier non-isolated pair caused the dropped-file break above). + +### Kill-switch robustness fix DONE + validated; conformance tests PARTIAL (2026-08-24) +Dispatched two worktree-isolated, code-only agents (WS-NET fix, WS-TEST conformance). Both hit the shared +**session rate limit (resets 12:20pm CT)** and died mid-work; salvaged their uncommitted worktree changes: +- **WS-NET (DONE):** `vpn-egress-down.sh.j2` no longer flushes the nft src set on tunnel-down (retains it so + the `oifname != tun0 drop` rule stays armed = explicit, edge-independent fail-closed); README documents it. + Reviewed, `ansible-lint` clean (production profile), merged to main (`b0ff689`), redeployed to k3s-dev-3, + and **validated live**: tunnel-down → nft set RETAINS `{ 10.72.193.53 }`, drop rule armed; clean recovery. +- **WS-TEST (PARTIAL):** egress-class chainsaw test rewritten for ADR-0015 assertions — preserved as WIP on + branch `feature/conformance-egress-killswitch-adr0015` (`e7a567d`, NOT merged, unreviewed). STILL TODO: the + `vpn-killswitch` L3 test + its host fault-injection fixture (privileged node-pinned pod running + `nsenter -t 1 … systemctl stop/start vpn-egress-tunnel`, self-healing `finally`). Re-dispatch after the + rate-limit resets, or finish by hand; then run the suite live and gate gluetun retirement on it.