86092cf08a
Two of the Operator's five split children from the audit remediation intent were correctly sent "zurück zur Planung" by Review, both for the same root cause: the Builder cited "docs/review/reviewer- systemaudit-2026-09-01.md Finding F3/F4" as justification, but that document exists and has nothing to do with either finding -- the real source was docs/research/full-system-aufit.md (2026-09-11). Fixed directly rather than re-running Builder and risking the same fabrication again: - hosts/nix-gc.nix: nix.gc.dates is now per-host again (blunix=daily, fixing the actual disk-space incident; pinix=weekly, preserving the SD-card-wear reasoning the file's own comment already documented, which a blanket "daily" for both silently violated). - forgejo.nix: corrected the Codeberg-mirror-disable comment's citation to the real source document. Also, for the two "no_changes" children (Builder correctly declined rather than guess): - traefik/default.nix + fail2ban.nix: LLDAP's own failed-login log line carries no client IP at all (verified live), so no filter against it could ever ban anything -- added Traefik accessLog (Common Log Format, filtered to 4xx/5xx only) and a fail2ban jail matching that instead. The failregex is derived from CLF structure, not a live-captured line (accessLog was just turned on in this same change) -- flagged in-file to re-verify against a real 401 entry after deploy, before trusting it in production. - GoToSocial data removal (gotosocial-orphaned-data-cleanup) still needs a manual `rm -rf /var/lib/gotosocial` -- confirmed orphaned (no gotosocial.service unit or module on blunix, 117M, matches the audit), but deleting it is outside what this session does unprompted. agents/builder.md: added an explicit rule against citing an unverified source/finding in comments or commit messages, naming this exact incident, so the underlying behavior (not just these two symptoms) doesn't recur. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016w25covboHfcYuLXBAvX3g |
||
|---|---|---|
| .. | ||
| cal.nix | ||
| default.nix | ||
| dex.nix | ||
| forgejo.nix | ||
| prosody.nix | ||
| routes-external.nix | ||
| routes-internal.nix | ||