Hermes
d8c9d79855
Gate record now carries both gate-time HEADs (1747c23 r3 / 0e58ca9 r4),
the r3 remediation commit 9d5d640, the r4 grade + its three resolved
blockers, the 'ALL dig versions' phrasing narrowed to the documented
contract + BIND 9.18.50 live verification only, and the timezone note
for the 10-29/10-30 date split.
76 lines
4.5 KiB
Markdown
76 lines
4.5 KiB
Markdown
# Internal release evidence (NOT customer-facing)
|
||
|
||
Judge grades and ledger URNs per change. Kept out of CHANGELOG.md
|
||
(DC-170 docs batch r3: the distributable changelog must stay clean).
|
||
|
||
Judging per-change is recorded in commit messages and the internal ledger. Grade lines consolidated here:
|
||
|
||
- **DC-168 judge: grade B (round 16)** urn:ump:ejzlob2bde6m6ivxfpgidmwu5a62pvl4wddm4iav7mwfuyfogirq
|
||
- **DC-167 judge: grade B (round 11)** urn:ump:kfn7m6vzd4ias2u5ghg62hvoug3j2y2gmturnytdz4g4od35hx4a
|
||
- **DC-165 judge: grade B (round 5)** urn:ump:oqgczb6zv5bemekbxko7gi5rvfle6yoshwgfwsx4mbbj4xmg6paq
|
||
- **DC-164 judge: grade B (round 6)** urn:ump:5vuahbn4znf7hrrshjvu2pcbqln5m6qcrpkkn3mx6y2rvvmdtqoa
|
||
- **DC-163 judge: grade B (round 2)** urn:ump:l2tg66wmchkmd6fde4k3ojwc56zpxqh657spe37bu6dpvduswalq
|
||
- **DC-162 judge: grade B (round 3)** urn:ump:or2qqhcytp6lfzlyi7xru7hdqy3uar2hbjllsrrbxrbray3c5kpa
|
||
|
||
## DC-171 phase 1 — BIND 9 live AXFR verification (2026-10-30)
|
||
|
||
Deploy judge r1 (dc-prod-deploy-dc171, grade D urn:ump:iesjvepuqb5poim7wu22ff4jtd5vhpw2lotfhogljemsw2h4y6vq)
|
||
blocked the cutover on dig argv order (AXFR/zone swapped vs the documented
|
||
`dig [name] [type]` contract) and demanded verification against an actual
|
||
BIND 9 endpoint. Resolution (fix commit acd0352):
|
||
|
||
1. ARGV FIXED to `@server -p port <zone> AXFR +options` (documented order).
|
||
2. LIVE BIND 9 ENDPOINT: a real BIND 9.18.50 (Extended Support Version —
|
||
the line Ubuntu 22.04/24.04 ship) was stood up in Docker
|
||
(internetsystemsconsortium/bind9:9.18) on this host with zone
|
||
`dc171test.internal` (master, allow-transfer any; SOA/NS/3xA/TXT/CNAME
|
||
records). The ADAPTER'S OWN CODE PATH (real execFile dig, real parser,
|
||
zero mocks) ran listRecords({zone:'dc171test.internal'}):
|
||
|
||
BIND 9 LIVE AXFR VIA ADAPTER — SUCCESS
|
||
zone: dc171test.internal | count: 7
|
||
dc171test.internal. 300 SOA ns1.dc171test.internal. admin.dc171test.internal. 2026102901 3600 900 604800 300
|
||
dc171test.internal. 300 NS ns1.dc171test.internal.
|
||
app.dc171test.internal. 300 A 192.0.2.10
|
||
db.dc171test.internal. 300 A 192.0.2.20
|
||
ns1.dc171test.internal. 300 A 192.0.2.53
|
||
txt.dc171test.internal. 300 TXT "dc171 live verification"
|
||
www.dc171test.internal. 300 CNAME app.dc171test.internal.
|
||
types: SOA,NS,A,TXT,CNAME
|
||
|
||
named.log: `zone dc171test.internal/IN: loaded serial 2026102901`.
|
||
The same check against the production Technitium server (100.121.150.22,
|
||
zone `sami`) returned 48 records (SOA/A/NS, real fleet names) — the
|
||
AXFR path works across both server implementations; BIND is the
|
||
judge-required one and is satisfied above. Older-dig (9.11–9.16)
|
||
leniency could not be reproduced in-container (bullseye security
|
||
mirrors currently 404); the shipped argv follows dig's documented
|
||
`[name] [type]` positional contract (man dig) and was live-verified
|
||
against BIND 9.18.50; no portability claim is made for other dig
|
||
versions beyond the documented contract itself.
|
||
3. Suites at acd0352: DNS parity 23/23; full backend 174/3754; frontend 68/68.
|
||
|
||
### Production gate record (this deploy)
|
||
- Deploy tree HEAD at gate time: 1747c23 for r3, then 0e58ca9 for r4
|
||
(dc167-deploy2 = 9f5e97c + the DC-171 batch); production rollback
|
||
target: 9f5e97c (current prod HEAD).
|
||
- r3 remediation commit: 9d5d640 (qualifies the dig version comment;
|
||
adds this gate record).
|
||
- Rollback = TWO operations: `cd /opt/dashcaddy && git reset --hard 9f5e97c`
|
||
AND `systemctl restart dashcaddy-api`.
|
||
- Bundles at gate time: SW cache `dashcaddy-shell-b87d8c8095`, CSP hash
|
||
`sha256-LqwtGSCiBtjq9Bnb5wA3kQFrFRgZWtDWcswiK656gEk=` (unchanged).
|
||
- Test log paths: full backend suite run in /root/dashcaddy/dashcaddy-api
|
||
(174 suites / 3754 tests at acd0352); frontend runner `npm test` in
|
||
/root/dashcaddy/status (68/68); deploy-tree DNS parity 23/23
|
||
(jest __tests__/dns in /opt/dashcaddy/dashcaddy-api).
|
||
- Judge grades for this deploy: r1 D (urn:ump:iesjvepuqb5poim7wu22ff4jtd5vhpw2lotfhogljemsw2h4y6vq),
|
||
r2 C (urn:ump:2d5onfwgvcigrutqjhoege3ao6mtdxup57accoaumyaqsu7jniqq),
|
||
r3 C (urn:ump:bayk3f2ibc3nffwv7wiprdts2xegcp2pac525zwabp7dst37ecbq —
|
||
blocker: unqualified 9.11-9.16 comment in rfc2136.js, fixed by 9d5d640),
|
||
r4 C (urn:ump:iysmn53oxuhn57y5v6emmztvbissz275wl3wbp2pa2w5ou77mvua —
|
||
blockers: stale gate record naming 1747c23, the 'ALL dig versions'
|
||
phrasing, and no r4 entry; all three addressed in this update).
|
||
- Timestamp note: dates in this file are host-local (UTC+8); the judge
|
||
sandbox observed 2026-10-29 — same moment, different timezone.
|