fix(drill): refuse to judge #16 on a broken baseline #31

Merged

dan-claude-bot merged 1 commit from fix/drill-no-verdicts-on-broken-baseline into main

2026-07-14 00:06:02 +00:00

dan-claude-bot commented

2026-07-14 00:04:26 +00:00

(Migrated from github.com)

Run 7's box had no network before a single hardening change was applied — a clone/source IP collision had taken it down. Phase D measured anyway, and reported:

FAIL  mac+ipv4 filtering BROKE the box's networking
  → B5 L2 filtering: BREAKS the box — design veto

It does not. The box was already broken. Had I banked that, #16 would have been redesigned around a fiction — for the second time in this audit (the first was the B3 dns.mode=none "veto" I had to retract when runs 2 and 3 disagreed).

The fix

Phase D is now gated on baseline egress passing. If the box can't reach the internet before hardening, the drill says so loudly and refuses to produce verdicts:

NOTE  SKIPPING phase D — the box could not reach the internet BEFORE any hardening was applied
      a design verdict measured on a broken baseline is worthless; fix the baseline and re-run
  → B1/B3/B5: NOT MEASURED — baseline egress was already broken (see A1)

Also: the dns.mode=none rejection stops swallowing Incus's error message (2>/dev/null). The message is the finding — run 7 reported "incus rejected dns.mode=none" with no reason, and that reason is exactly what #16 needs.

RUNS.md gains trap 9: check that the thing you are measuring with still works before you trust what it tells you. Same failure as the B3 flip, different costume — and this drill has now produced two false design verdicts against #16, which is a worse failure mode than hanging.

🤖 Generated with Claude Code

Run 7's box **had no network before a single hardening change was applied** — a clone/source IP collision had taken it down. Phase D measured anyway, and reported: ``` FAIL mac+ipv4 filtering BROKE the box's networking → B5 L2 filtering: BREAKS the box — design veto ``` **It does not.** The box was already broken. Had I banked that, #16 would have been redesigned around a fiction — for the second time in this audit (the first was the B3 `dns.mode=none` "veto" I had to retract when runs 2 and 3 disagreed). ## The fix Phase D is now **gated on baseline egress passing**. If the box can't reach the internet before hardening, the drill says so loudly and refuses to produce verdicts: ``` NOTE SKIPPING phase D — the box could not reach the internet BEFORE any hardening was applied a design verdict measured on a broken baseline is worthless; fix the baseline and re-run → B1/B3/B5: NOT MEASURED — baseline egress was already broken (see A1) ``` Also: the `dns.mode=none` rejection stops swallowing Incus's error message (`2>/dev/null`). **The message is the finding** — run 7 reported "incus rejected dns.mode=none" with no reason, and that reason is exactly what #16 needs. `RUNS.md` gains **trap 9: check that the thing you are measuring *with* still works before you trust what it tells you.** Same failure as the B3 flip, different costume — and this drill has now produced two false design verdicts against #16, which is a worse failure mode than hanging. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: heavy-duty/box#31

No description provided.