obscuremind 39f698d09e docs(lb-gate): record that xcvm-noderoot (incl. certbot) legitimately ships to serve-only LBs ...

Sourcery read 'no privileged code on an LB' as 'no code that ever runs as
root' and flagged the helper's certbot verb. The verify-lb-archive rule is
narrower — it bars MAIN-only admin/reseller/install/cluster-API code, not the
constrained edge operations an LB legitimately performs (certbot, cache/cleanup
crons). Document, at the SENSITIVE allowlist, why bin/install/xcvm-noderoot is
intentionally NOT listed: it is the serve-only root trust-boundary helper, its
archive copy (under xc_vm-writable /home/xc_vm) is never run as root, and the copy
root runs is installed to /usr/local/sbin only on a serve-only node, over SSH from
MAIN's trusted copy (provisionNodeRootHelper, gated on $rServeOnly). No behaviour
change; the gate already passes.

2026-10-27 02:26:51 +03:00

..

check_procedural_use.php

fix(ci): correct check_procedural_use skip path to Infrastructure/Tmdb/lib

2026-08-07 21:03:57 +03:00

check-core-cluster-refs.php

ci(cluster): gate the crypto vectors and Core's reach into MAIN's domain

2026-09-27 15:19:00 +00:00

check-vendor-prod-only.sh

build: gitignore dev packages under vendor + harden the prod-only gate

2026-06-25 21:59:46 +03:00

lb_settings_keys.php

fix(cluster): address the ReplicaStage and settings-miss review

2026-09-27 02:26:56 +00:00

lb-settings-keys.sh

feat(cluster): the node replica's settings section and its LB allowlist

2026-09-26 08:39:21 +00:00

verify-lb-archive.sh

docs(lb-gate): record that xcvm-noderoot (incl. certbot) legitimately ships to serve-only LBs

2026-10-27 02:26:51 +03:00