root/Jyotisha
2
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

docs(ops): record staging host key rotation guard

Browse Source
This commit is contained in:
Jesse
2026-08-06 14:24:20 +08:00
parent e018dc90a7
commit eb4ebf7c73
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/research/pre_work_error_ledger.md
+6
View File
@@ -127,6 +127,12 @@ Four migration pairs reused the same timestamp prefix, while Supabase records th
Prevention: `tests/test_supabase_migration_versions.py` requires every migration prefix to be unique. Preserve already-recorded versions, move skipped SQL into later uniquely numbered repair migrations, run `supabase db push --linked --dry-run`, and verify the remote migration ledger plus live schema before deploying dependent application code.
## ERR-092 | Staging SSH host key changed before release inspection | mitigated 2026-08-06
A direct strict SSH inspection of `118.26.111.127` stopped with `REMOTE HOST IDENTIFICATION HAS CHANGED`: the local file still contained an older ED25519/RSA/ECDSA set, while the server presented a new ED25519 fingerprint. The release was paused; strict host checking was never disabled. The current ED25519 key was accepted only after its complete key material and fingerprint matched the repository Actions variable `STAGING_KNOWN_HOSTS` exactly. The local `known_hosts` file was backed up, records for only this IP were removed, and only the trusted ED25519 record was installed. The staging deployment tree is root-owned and the SSH user cannot `cd` into it directly; inspections must use the existing constrained `sudo -n` workflow boundary rather than changing directory ownership or permissions.
Prevention: on any staging host-key warning, stop before SSH/deploy; compare the observed key against an independently administered trusted source such as `STAGING_KNOWN_HOSTS`, and require exact key-material equality. Never trust `ssh-keyscan` alone, never use `StrictHostKeyChecking=no`, and never overwrite unrelated known-host entries. Preserve a local backup and record the trusted fingerprint. Do not `chmod` or `chown` `/opt/jyotisha-staging` to make ad-hoc inspection easier.
## Fragment Sweep Command Set
## ERR-086 | Steve Jobs jyotishganit artifacts used non-San-Francisco coordinates | mitigated 2026-07-21