fix(triage): state the measured kernel posture and drop the stale sec-check section #25

Merged

Philipp Baumann merged 1 commit from fm/dse-security-reports-wording-batch into main

2026-10-28 12:00:03 +00:00

Philipp Baumann commented

2026-10-28 11:56:32 +00:00

Owner

Summary

The captain's wording pass batches three defects into one change: the fan-out section heading, and the el9 (P15) and Alma 10 (P4) kernel prose still describing a measurement gap that the 27.10.2026 evidence round closed, recommending work that is already done. The kernel prose now states the measured posture (running kernel measured and trivy-fixed on all eight Linux units, only the non-running retained kernels vulnerable) and moves the recommendation to pruning. Per a second captain instruction, the «Sicherheits-Update-Check je Einheit» section is deleted, with every cross-reference removed or repointed.

Provenance: the replacement kernel prose is firstmate's draft, built from the verified 27.10 evidence caches — these are proposed replacements, not the captain's own sentences. The reviewer is reading suggested wording and can edit it at review time. Where the drafts disagreed with the caches (evidence-2026-10-27/, .local/derived/, .local/scans/), the caches won; each deviation is listed below.

What changed

reports/defender-triage.typ
- Heading = Empfehlung Fan-out für die Folgeagenten becomes = Empfehlung; the table header Auftrag an das Folge-Agents becomes Auftrag; the one in-text cross-reference (siehe Empfehlung Fan-out) is repointed to (siehe Empfehlung).
- P15 (el9) rewritten: Trivy finds 16 kernel CVEs (the old "30+" matches nothing in the current caches; measured union across the four el9 units is 16 unique CVEs, 243 findings); all four units run 5.14.0-687.60.1.el9_8, the newest installed and trivy-fixed kernel; 687.58.1 and 687.59.1 remain installed as non-running stock, of which only 687.58.1 is trivy-vulnerable — the draft's "687.58.1 und 687.59.1 remain the only vulnerable presence" lumped them, but the derivation (vulnerableInstalled/fixedVersions) and the kernel-posture table's «davon verwundbar» column carry 687.58.1 only, 687.59.1 is the fixed floor; 687.57.1 is gone everywhere. Vorschlag becomes pruning the retained old kernels (installonly_limit).
- P4 (Alma 10) rewritten: all four machines run 6.12.0-211.68.1.el10_2, a measured and trivy-fixed kernel, no reboot pending; the retained 211.66.1 and 211.67.1 are the only vulnerable presence (matches the derivation exactly); Vorschlag becomes pruning.
- The two kernel rows of the Empfehlung table (rows 4 and 6) carried the same finished uname -r/reboot asks and now recommend pruning; row 6's label "3 Workbenches" becomes "4 el9-Einheiten" to match P15 and the ranking row.
- The section «Sicherheits-Update-Check je Einheit» is deleted (57 lines: intro prose, the generated table, the post-table prose).
AGENTS.md — the triage-report section list no longer names the deleted section.

Sweep for «Sicherheits-Update-Check» (both reports plus AGENTS.md) found exactly: the section heading itself (deleted with the section), the header-comment entry describing the section (removed), the Evidenzabdeckung header-comment mention of the per-unit check (repointed to the sensor status only), the P15 parenthetical cross-reference (removed; the rest of that sentence is kept verbatim), and the coverageGaps gap string sec-check error (Microsoft-Repo, siehe Unterabschnitt) (dangling pointer dropped, the gap note itself kept). reports/defender-findings.typ has no mention; its Update-Politik table is untouched.

Fact survival verified per unit against the derived evidence rather than assumed: the three Workbenches' clean result and the WireGuard abort (Microsoft repo, missing trusted signing key, verified 28.10) survive in the kept P15 sentence; the four Alma 10 units' abort (packages-microsoft-com-prod, "Signing key not found") existed only in the deleted section and is now summarised in one P4 sentence; the PROD-WORKBENCH 28.10 re-check (exit 100, one real open update xdg-dbus-proxy, machine reachable and patchable) is re-homed into P15. Dropped with the section and disclosed here for the reviewer: the 26.10 history ("alle acht Einheiten error"), the per-unit abort-text distinction — whose WireGuard claim ("Bad GPG signature") the evidence cache already contradicted (it reads "Signing key not found" for all five error units, including WireGuard) — and the stale 57.1-era fixed-version line naming CVE-2026-53011, which no current scan carries.

Behaviour change

Render-only: the triage PDF states the measured kernel posture instead of a closed measurement gap, no longer recommends the finished uname -r/reboot work, and carries no «Sicherheits-Update-Check je Einheit» section; both derivation lanes are untouched and stay byte-identical. Validated with just all, just repro (byte-identical PDFs for both reports), just py-crosscheck (polars matches stdlib), just test (39 passed), just lint; the real 2026-10-28 round was re-rendered and republished (previous copies moved to artifacts/superseded/, the 2026-10-26 set untouched).

Instructions-PR: none

## Summary The captain's wording pass batches three defects into one change: the fan-out section heading, and the el9 (P15) and Alma 10 (P4) kernel prose still describing a measurement gap that the 27.10.2026 evidence round closed, recommending work that is already done. The kernel prose now states the measured posture (running kernel measured and trivy-fixed on all eight Linux units, only the non-running retained kernels vulnerable) and moves the recommendation to pruning. Per a second captain instruction, the «Sicherheits-Update-Check je Einheit» section is deleted, with every cross-reference removed or repointed. **Provenance:** the replacement kernel prose is firstmate's draft, built from the verified 27.10 evidence caches — these are proposed replacements, not the captain's own sentences. The reviewer is reading suggested wording and can edit it at review time. Where the drafts disagreed with the caches (`evidence-2026-10-27/`, `.local/derived/`, `.local/scans/`), the caches won; each deviation is listed below. ## What changed - `reports/defender-triage.typ` - Heading `= Empfehlung Fan-out für die Folgeagenten` becomes `= Empfehlung`; the table header `Auftrag an das Folge-Agents` becomes `Auftrag`; the one in-text cross-reference `(siehe Empfehlung Fan-out)` is repointed to `(siehe Empfehlung)`. - P15 (el9) rewritten: Trivy finds 16 kernel CVEs (the old "30+" matches nothing in the current caches; measured union across the four el9 units is 16 unique CVEs, 243 findings); all four units run 5.14.0-687.60.1.el9_8, the newest installed and trivy-fixed kernel; 687.58.1 and 687.59.1 remain installed as non-running stock, of which only 687.58.1 is trivy-vulnerable — the draft's "687.58.1 und 687.59.1 remain the only vulnerable presence" lumped them, but the derivation (`vulnerableInstalled`/`fixedVersions`) and the kernel-posture table's «davon verwundbar» column carry 687.58.1 only, 687.59.1 is the fixed floor; 687.57.1 is gone everywhere. Vorschlag becomes pruning the retained old kernels (`installonly_limit`). - P4 (Alma 10) rewritten: all four machines run 6.12.0-211.68.1.el10_2, a measured and trivy-fixed kernel, no reboot pending; the retained 211.66.1 and 211.67.1 are the only vulnerable presence (matches the derivation exactly); Vorschlag becomes pruning. - The two kernel rows of the Empfehlung table (rows 4 and 6) carried the same finished `uname -r`/reboot asks and now recommend pruning; row 6's label "3 Workbenches" becomes "4 el9-Einheiten" to match P15 and the ranking row. - The section «Sicherheits-Update-Check je Einheit» is deleted (57 lines: intro prose, the generated table, the post-table prose). - `AGENTS.md` — the triage-report section list no longer names the deleted section. Sweep for «Sicherheits-Update-Check» (both reports plus `AGENTS.md`) found exactly: the section heading itself (deleted with the section), the header-comment entry describing the section (removed), the Evidenzabdeckung header-comment mention of the per-unit check (repointed to the sensor status only), the P15 parenthetical cross-reference (removed; the rest of that sentence is kept verbatim), and the `coverageGaps` gap string `sec-check error (Microsoft-Repo, siehe Unterabschnitt)` (dangling pointer dropped, the gap note itself kept). `reports/defender-findings.typ` has no mention; its Update-Politik table is untouched. Fact survival verified per unit against the derived evidence rather than assumed: the three Workbenches' clean result and the WireGuard abort (Microsoft repo, missing trusted signing key, verified 28.10) survive in the kept P15 sentence; the four Alma 10 units' abort (`packages-microsoft-com-prod`, "Signing key not found") existed only in the deleted section and is now summarised in one P4 sentence; the PROD-WORKBENCH 28.10 re-check (exit 100, one real open update xdg-dbus-proxy, machine reachable and patchable) is re-homed into P15. Dropped with the section and disclosed here for the reviewer: the 26.10 history ("alle acht Einheiten error"), the per-unit abort-text distinction — whose WireGuard claim ("Bad GPG signature") the evidence cache already contradicted (it reads "Signing key not found" for all five error units, including WireGuard) — and the stale 57.1-era fixed-version line naming CVE-2026-53011, which no current scan carries. ## Behaviour change Render-only: the triage PDF states the measured kernel posture instead of a closed measurement gap, no longer recommends the finished `uname -r`/reboot work, and carries no «Sicherheits-Update-Check je Einheit» section; both derivation lanes are untouched and stay byte-identical. Validated with `just all`, `just repro` (byte-identical PDFs for both reports), `just py-crosscheck` (polars matches stdlib), `just test` (39 passed), `just lint`; the real 2026-10-28 round was re-rendered and republished (previous copies moved to `artifacts/superseded/`, the 2026-10-26 set untouched). Instructions-PR: none

Philipp Baumann added 1 commit

2026-10-28 11:56:32 +00:00

fix(triage): state the measured kernel posture and drop the stale sec-check section 1469cddc66

- simplify the fan-out heading to «Empfehlung» and the table header to
  «Auftrag», and repoint the one in-text cross-reference
- rewrite the P15 (el9) and P4 (Alma 10) kernel prose to the measured
  27.10.2026 state: running kernel measured and trivy-fixed on all eight
  units, only the non-running retained kernels remain vulnerable
  (el9: 687.58.1; el10: 211.66.1/211.67.1), 687.57.1 gone everywhere
- move both kernel recommendations to pruning the retained old kernels
  (installonly_limit) instead of the finished uname -r/reboot work, and
  align the two kernel rows of the Empfehlung table
- delete the «Sicherheits-Update-Check je Einheit» section: the P15
  sentence keeps the three-workbench/WireGuard results, P4 gains the
  four-unit abort summary, the Evidenzabdeckung gap note drops the
  dangling pointer, and the header comment list no longer documents the
  removed section

Philipp Baumann merged commit 7893e683f7 into main

2026-10-28 12:00:03 +00:00

Philipp Baumann deleted branch fm/dse-security-reports-wording-batch

2026-10-28 12:00:04 +00:00

Philipp Baumann referenced this pull request from a commit

2026-10-28 12:00:08 +00:00

fix(triage): state the measured kernel posture and drop the stale sec-check section (#25)