From 7f9dd2172dbd51cf3bf956967b4d3c1dde908822 Mon Sep 17 00:00:00 2001 From: archipelago Date: Mon, 3 Aug 2026 08:57:51 -0400 Subject: [PATCH] docs(state): record phase 13 context session --- .planning/STATE.md | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/.planning/STATE.md b/.planning/STATE.md index 635caf0c..13c32995 100644 --- a/.planning/STATE.md +++ b/.planning/STATE.md @@ -5,16 +5,16 @@ milestone_name: milestone current_phase: 09 current_phase_name: BotFights Platform Upgrade status: planning -stopped_at: v1.7.120-alpha STAGED — built, deployed and verified on archi-dev-box; awaiting operator go/no-go + signing (mnemonic is operator-only) -last_updated: "2026-08-02T23:20:00.000Z" -last_activity: 2026-08-02 -last_activity_desc: 01-04 shipped (lnd.getinfo identity+uris, LightningInfo mesh message, mesh.lightning-peers/send-lightning-info) — 1087 tests green; found 3 wholesale-rebuild paths that would have silently wiped MeshPeer.lightning_uri +stopped_at: Phase 13 context gathered +last_updated: "2026-08-03T12:57:51.075Z" +last_activity: 2026-07-31 +last_activity_desc: Phase 02 complete, transitioned to Phase 09 progress: - total_phases: 11 - completed_phases: 1 + total_phases: 13 + completed_phases: 2 total_plans: 45 - completed_plans: 30 - percent: 9 + completed_plans: 38 + percent: 15 --- # Project State @@ -193,22 +193,26 @@ The 5x lifecycle gate was NOT run. ## Session Continuity -Last session: 2026-08-02T23:20:00.000Z -Stopped at: Phase 10 complete; a05956c4 verified on archi-dev-box, delivery gap found + fixed + deployed -Resume file: docs/security/BITCOIN-RPC-PROXY-EXPOSURE.md +Last session: 2026-08-03T12:57:50.980Z +Stopped at: Phase 13 context gathered +Resume file: .planning/phases/13-aiui-functional-conversational-node-control-and-content-surf/13-CONTEXT.md Open on this thread (all recorded as broken windows, none blocking): + - Window 15 CLOSED 2026-08-02 20:02 — f6b5245b's reconcile path proven on archi-dev-box by a controlled test: stale conf installed + container restarted (probe 200, genuinely re-exposed), daemon started, reconcile repaired it unaided at 20:02:19 with the expected warn line, probe 401, conf byte-identical to the known-good. Both halves now proven on hardware. + - Windows 11/12: host-secret rotation on three fleet nodes sharing SSH host keys — detect-only so far; rotation is USER-GATED and deliberately not actioned. + - Credential rotation DECIDED AGAINST 2026-08-02 (operator): no LND macaroon rotation, no Bitcoin RPC password rotation — no evidence of exploitation and the vulnerability is being closed rather than lived with. rotate-lnd-macaroon.sh stays as a tool, exercised in detect mode only, never run against a node. Do not re-litigate; see docs/security/BITCOIN-RPC-PROXY-EXPOSURE.md. + - Dev-pair verification is archi-dev-box ONLY, by operator instruction 2026-08-02. Do not raise archy-x250-dev as a blocker again.