Krzysztof kuhy Rudnicki 0cea82cab5 feat: the nftables drift check now runs itself at boot ... `verify` gated on the two invariants whose breach cut every bridged container off the internet on 2026-08-29 and again after the 2026-08-30 reboot -- but nothing invoked it, so it reported drift only when a human thought to ask, and the outage it exists for is exactly the one nobody thinks to ask about. nftables-drift.service now runs it after nftables.service, docker.service and network-online.target at every boot, plus a daily Persistent timer. A breach is a failed unit in `systemctl --failed`, not a log line: a self-check that detects a failure has to gate, not warn. Proven in ~/utils/vmbox across two real reboots -- drifted /etc leaves the unit failed with the diff and the missing docker0 accept in its journal, matching /etc leaves it active with no false positive -- then installed and run green on the host. Not yet observed across a host reboot. Also bumps the gatelock pin to v0.7.3, which is what turned main's dependency-freshness job red; CI_GREEN_SKIP is set because this commit is that fix. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015d48t4qsQLBJnDwDeo2Nom		2026-08-30 15:49:12 +02:00
..
android-ui-hint-labels-2026-08-27.json	Find Material text fields by their hint label	2026-08-27 20:39:46 +02:00
app-icons-bowl-star-2026-08-29.json	app_icons: add the bowl-star glyph for restaurant-rater	2026-08-29 17:18:16 +02:00
artifact-prune-mode-2026-08-23.json	Give the artifact cap a --prune escape hatch	2026-08-23 19:41:11 +02:00
cap-artifact-growth-2026-08-23.json	Cap artifact growth instead of recommending a future prune	2026-08-23 19:33:53 +02:00
ci-green-hint-push-2026-08-29.json	Tell the fix-forward path that it needs the flag twice	2026-08-29 12:09:02 +02:00
ci-mirror-serialise-under-pressure-2026-08-23.json	Serialise the heavy ci-mirror gates when memory is tight	2026-08-23 20:02:59 +02:00
delete-hippo-2026-08-23.json	Delete the dead .hippo memory store	2026-08-23 20:42:03 +02:00
dependency-freshness-gate-2026-08-28.json	Latest stable dependencies, gatelock v0.7.2, and the gate	2026-08-28 17:38:25 +02:00
drop-alarm-leg-morning-routine-2026-08-30.json	Drop the alarm leg from the morning routine	2026-08-30 15:26:04 +02:00
extract-digital-wellbeing-2026-08-23.json	Record the vendor-closure and broad-scan findings in the evidence	2026-08-23 21:10:14 +02:00
extract-hosts-blocker-2026-08-23.json	Extract the hosts blocker into its own repo	2026-08-23 20:30:18 +02:00
fix-bats-diag-path-2026-08-23.json	Point the diagnostics bats suite at the flattened path	2026-08-23 20:08:40 +02:00
fix-music-parallelism-drift-guard-2026-08-23.json	Derive the lib prefix in the music_parallelism drift guard	2026-08-23 19:53:17 +02:00
fix-precommit-utils-checkout-2026-08-25.json	ci: check out shared gates in pre-commit; add punchme icon	2026-08-25 21:31:32 +02:00
flatten-linux-configuration-2026-08-23.json	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
focus-owner-icon-registration-2026-08-24.json	Add focus_owner and a padlock-closed glyph to the icon family	2026-08-24 23:23:28 +02:00
hosts-guard-rollback-fresh-install-2026-08-24.json	Let --rollback work on a freshly installed machine	2026-08-24 12:57:24 +02:00
hosts-guard-tests-2026-08-23.json	Clear both hosts-guard libs; teach the instrument done <redirect> (88 -> 86)	2026-08-23 11:50:13 +02:00
i3blocks-screen-locker-2026-08-29.json	Put the screen-locker status back on the i3 bar	2026-08-29 22:55:24 +02:00
installer-cross-repo-fix-2026-08-24.json	Make install_core_system.sh work on a fresh machine	2026-08-24 12:45:21 +02:00
live-state-installed-scripts-2026-08-23.json	report_live_state: also scan installed scripts under /usr/local	2026-08-23 17:44:10 +02:00
md-naming-namespaces-2026-08-24.json	Adopt the four markdown namespaces and gate them	2026-08-24 15:55:46 +02:00
nftables-docker-forward-2026-08-29.json	fix: stop the wireguard firewall from silently cutting every container off	2026-08-29 18:34:25 +02:00
nftables-drift-self-check-2026-08-30.json	feat: the nftables drift check now runs itself at boot	2026-08-30 15:49:12 +02:00
nftables-drift-verify-2026-08-30.json	feat: gate on nftables drift so the docker cut-off cannot come back silently	2026-08-30 14:56:24 +02:00
nvidia-config-allowlist-2026-08-23.json	Take nvidia_config.sh off the allowlist for real (85 -> 84)	2026-08-23 14:13:24 +02:00
nvidia-config-seams-restore-2026-08-23.json	Restore nvidia_config.sh's four test seams	2026-08-23 13:33:35 +02:00
nvidia-config-tests-2026-08-23.json	Test nvidia_config.sh to 100%; the 8-lib campaign is done (85 -> 84)	2026-08-23 13:14:37 +02:00
precommit-workflow-dispatch-2026-08-23.json	Allow Pre-commit checks to be run manually	2026-08-23 16:38:15 +02:00
prettier-endurain-readme-2026-08-23.json	Apply prettier to endurain/README.md	2026-08-23 13:43:22 +02:00
prune-superpowers-artifacts-2026-08-23.json	Prune 655 superpowers evidence and contract artifacts	2026-08-23 19:28:49 +02:00
python-314-lint-target-2026-08-29.json	Grade against 3.14 too, not just run on it	2026-08-29 11:50:39 +02:00
python-tests-minimal-deps-2026-08-23.json	Install only the test deps in Python tests CI: 79 packages -> 17	2026-08-23 16:29:24 +02:00
python-tests-path-filter-symlink-2026-08-23.json	Trigger Python tests when meta/requirements.txt changes	2026-08-23 16:20:10 +02:00
quarantine-arch-sysctl-cases-2026-08-22.json	Quarantine the arch_sysctl cases: they broke bt_audio's measurement	2026-08-23 10:15:11 +02:00
register-betting-sim-icon-2026-08-28.json	Register betting_sim with the shared icon generator	2026-08-28 10:00:29 +02:00
repair-stale-live-references-2026-08-23.json	Repair live self-repair broken by the flatten and extractions	2026-08-23 20:39:59 +02:00
restructure-step0-safety-net-2026-08-23.json	Restructure step 0: live-state inventory + depth gate dry run	2026-08-23 16:59:54 +02:00
shell-coverage-bar-back-to-presence-2026-08-23.json	Drop the 100% shell coverage bar; back to a presence ratchet	2026-08-23 15:47:04 +02:00
skip-duplicated-pytest-in-precommit-ci-2026-08-23.json	Stop running the Python suite twice per push in CI	2026-08-23 16:30:27 +02:00
split-boot-repair-2026-08-23.json	Cap extensionless scripts, and split the one that was hiding	2026-08-23 19:13:40 +02:00
suite-speedup-2026-08-23.json	Take the fixes/lib suite from 110s to 37s, same 645 assertions	2026-08-23 14:00:13 +02:00
syncyomi-local-fork-build-2026-08-28.json	Run SyncYomi from the local fork build and stop clobbering the Caddy edge	2026-08-28 14:44:40 +02:00
template.json	style(prettier): apply markdown/json formatting updates	2026-05-07 22:08:00 +02:00
thorium-repairs-tests-2026-08-23.json	Test thorium_repairs.sh to 100%, lift the gate timeout (89 -> 88)	2026-08-23 11:05:56 +02:00
token-audit-batching-axis-2026-08-28.json	token_audit: measure tool-call batching per API message	2026-08-28 12:22:21 +02:00
ubuntu-perf-fixes-tests-2026-08-23.json	Test ubuntu_perf_fixes.sh to 100%, take it off the allowlist (86 -> 85)	2026-08-23 12:38:40 +02:00
website-admin-editor-unit-2026-08-29.json	Run the website's post editor as a loopback unit, no Caddy route	2026-08-29 17:50:03 +02:00
website-blog-directory-index-2026-08-29.json	Serve prerendered blog posts, not the SPA shell, from the website container	2026-08-29 16:19:28 +02:00
website-force-recreate-2026-08-29.json	Force-recreate the website container so config and dist changes apply	2026-08-29 16:35:30 +02:00
wire-shell-coverage-ratchet-2026-08-23.json	Wire the shell ratchet into pre-commit, and test the coverage tooling	2026-08-23 15:51:29 +02:00
wire-structure-gates-2026-08-23.json	Wire the depth and size gates, exempting structural depth	2026-08-23 19:26:16 +02:00