Merge autonomous session 2 decision log

DECISIONS-LOG.md

@@ -275,6 +275,40 @@ wildcard `*.home.keithjackson.dev` cert Issued (LE-staging per ADR-0006); Gatewa
    next step (dev cert is LE-STAGING = non-self-signed but not browser-trusted — expected in dev).
 3. **cilium-operator gateway restart** (Fix 6) — verify on next rebuild / codify if it recurs.
 
+## Autonomous session 2 — Phase-2 verification + hardening (2026-08-17)
+
+Operator away again, same SOP. All safe, no spec changes.
+
+- **R-NET conformance GREEN against the DEPLOYED platform:** ran `conformance/run.sh --layer l2
+  --requirements R-NET-01,R-NET-02` → **default-deny (R-NET-01) + deny-undeclared (R-NET-02) both PASS**
+  (2/2). Confirms the live platform enforces the network isolation baseline, not just the K2 fixtures.
+- **TLS path functionally VERIFIED (not the formal test):** `openssl s_client` to the gateway VIP
+  10.73.0.240 with SNI returns `CN=*.home.keithjackson.dev`, SAN {*.home, home}.keithjackson.dev,
+  issuer **Let's Encrypt (STAGING)**, 90-day validity. The full DNS-01 → issuance → gateway-termination
+  path works. (Dev cert is LE-STAGING per ADR-0006 = non-self-signed but NOT system-trusted.)
+- **Fix: single default StorageClass** (commit ~7a45eb1) — added `local-storage` to the k3s
+  `--disable` list so `longhorn` is the sole default. Idempotent install task → effective on rebuild,
+  no disruption to the running cluster (which harmlessly keeps both defaults; all platform PVCs pin
+  longhorn). ASSUMPTION: disabling k3s local-path entirely is fine (Longhorn is the storage).
+- **Fix: conformance run.sh CWD-robustness** (commit ~ee5ad90) — chainsaw's config `report.path` is
+  relative, so run.sh exited non-zero (breaking the L2 gate) when invoked from repo root. Pass absolute
+  `--report-path ${ARTIFACTS}` + mkdir. Verified exit 0 + report written from repo root.
+
+### REMAINING for Phase-2 EXIT (needs an operator call — did NOT do autonomously)
+The roadmap Phase-2 exit is conformance-green for R-TLS + R-DNS too, but those tests are Phase-0
+**scaffolds** (TODO placeholders) — they must be AUTHORED against the live platform. Two reasons I
+deferred rather than best-effort them:
+1. **R-TLS trusted-cert (trusted-tls test) — DECISION NEEDED:** the test checks the SYSTEM trust store
+   (no -k), but dev serves an LE-**staging** cert (not system-trusted). How should dev verify "trusted"?
+   (a) verify the cert chains to the real LE **staging** root (embed the staging root in the probe) —
+   most faithful; (b) verify LE-issued + valid + SAN + non-self-signed only in dev, full system-trust
+   in prod; (c) use LE-prod for a designated test host. **Recommend (a) or (b).** Side-effect-free to
+   implement once decided.
+2. **R-DNS auto-record (dns-exposure test) — EXTERNAL SIDE-EFFECT:** verifying R-DNS-02 means letting
+   ExternalDNS create/delete a real record in the **live keithjackson.dev Cloudflare zone**. Deferred
+   to run with the operator present (or confirm it's fine to exercise autonomously with guaranteed
+   cleanup).
+
 ## KNOWN ISSUES to fix before Phase-2 un-suspend (logged, not yet fixed)
 | # | Issue | Impact | Fix |
 |---|---|---|---|