get_devsec_status.read: SSH no-cli (empty cli vs MOPS)

[AdamRickards]

SSH remainder (Σ Execute 2026-09-23)

Method: get_devsec_status · main 2c65702.

Receipt: ssh ok n=3; cli=[].

Bucket: no-cli. No invent. No #92.

[AdamRickards]

Architect trail (2026-09-23)

• Hole: Schema / SSH — no-cli (empty or protocol-absent). Rank1 = find declared show(s) / Media CLI that populate cli without inventing values.
• Order: CLI.json + sibling overlays → Schema PR → Test re-inspect. Fanout lessons from get_vlans.read: SSH close-format (port membership vs MOPS) #290/fix(wire): SSH get_vlans Rank1v2 PVID membership via show vlan port (#290) #303 apply (timeout = HARD stop that path).
• Named proof: python3 tests/release_matrix.py --inspect --method <this> --protocol ssh --trace on tip 6a9ac64+.
• Provenance: cell stays untested until green. No invent; SSH cli hangs to timeout on invalid or missing command instead of failing #92 closed.
• Owner: Schema clerk. NO_HOLE → Architect parks Engine (do not widget-wait).

[AdamRickards]

Decision trail (Schema clerk Rank1 — #326 get_devsec_status.read SSH)

• Tip: cd1e3cb (main pulled; ~cd1e3cb+).
• Hole named: SSH no-cli — empty cli vs MOPS. Receipt on older tip: ssh ok n=3; cli=[]. No invent. No SSH cli hangs to timeout on invalid or missing command instead of failing #92.
• 1.17 / ask inventory: oper_state → hm2devsecoperstate (already SSH from get_devsec.read: SSH close-format (state/pml_disabled vs MOPS) #323: show security-status all / OperState); trap_cause → hm2devsectrapcause (diagnostic INTEGER); status_index → hm2devsecstatusindex (status-table walk). Archive: Trap Cause on show security-status all. CLI.json: same show (+ state/trap/events siblings).
• Rank1 tools tried:
  • Invent floors / reopen SSH cli hangs to timeout on invalid or missing command instead of failing #92 / Engine — ruled out.
  • VLAN-scale fanout / per-row shows — forbidden (get_vlans.read: SSH close-format (port membership vs MOPS) #290/fix(wire): SSH get_vlans Rank1v2 PVID membership via show vlan port (#290) #303 HARD).
  • oper_state: already declared on tip via get_devsec.read: SSH close-format (state/pml_disabled vs MOPS) #323 shared wire — cli non-empty once that show runs; not re-touched.
  • trap_cause: missing SSH source — fit: bind show security-status all field Trap Cause (archive). Same show as oper_state → fanout stays 1 (dedup). CLI strings match schema enums (parity); no invent map.
  • status_index: no simple declared scalar CLI field (events table ≠ scalar index) — leave undeclared (no invent parser).
• End: green (YAML). PR fix(wire): SSH get_devsec_status trap_cause no-cli (#326) #350 Related:get_devsec_status.read: SSH no-cli (empty cli vs MOPS) #326. validate_schemas.py --errors → 0 errors.
• Soft path: do not start get_gmrp.read: SSH no-cli (protocol absent vs MOPS) #327 here. Named proof upstairs (Test re-inspect vs MOPS floor).

[AdamRickards]

WHERE — Tip Test re-inspect #326 / PR #350

Command: sidecar POST /v1/run get_devsec_status.read trace:true (named proof equivalent)
Tree/SHA: tip 4c74d59 (sidecar synced op=pr #350)
Verdict: fail on scoped expect — not merge-ready. trap_cause still invent-wrong.

Expect checks:

• cli includes show security-status all (fanout=1) — present ✓
• oper_state (via get_devsec.read: SSH close-format (state/pml_disabled vs MOPS) #323) — error/error match ✓
• trap_cause populated vs MOPS — FAIL: mops/snmp 'secure-boot-disabled' vs ssh 0 (int)
• status_index undeclared leftover OK — observed: mops {'1': 1} vs ssh 0

Receipt:

• ssh status=ok
• keys present: oper_state, status_index, trap_cause
• parity_diffs n=4: both status_index + both trap_cause (mops/snmp vs ssh)

Leftovers / blockers:

• blocker: trap_cause still 0 — not populated from CLI; invent-wrong vs MOPS string
• honest leftover OK: status_index shape (dict vs int) — leave open; no invent-green

No invent; #92 stays closed. Proof only. Needs Schema iterate on trap_cause bind.

[AdamRickards]

Architect — Test receipt on PR #350 tip 4c74d59

Not merge-ready. Soft Rank1v2 kicked to Schema.

• Green: cli=show security-status all; oper_state match
• Blocker: trap_cause ssh 0 invent-wrong vs mops secure-boot-disabled
• Honest: status_index dict vs int
• Next: fix Trap Cause bind/map → Test re-prove. No invent. SSH cli hangs to timeout on invalid or missing command instead of failing #92 closed.

[AdamRickards]

Decision trail (Schema clerk Rank1v2 — #326 get_devsec_status trap_cause amend PR #350)

• Tip: 4ed0a57 (PR fix(wire): SSH get_devsec_status trap_cause no-cli (#326) #350 amended; main merged in — force-push blocked by branch rules).
• Hole named: Tip Test on 4c74d59 not merge-ready. Green: cli=show security-status all; oper_state match. Blocker: trap_cause mops 'secure-boot-disabled' vs ssh 0 (invent-wrong). Honest leftover OK: status_index dict vs int 0.
• Live Trap Cause cell (receipt CLI): Trap Cause..................................secure-boot-disabled — field bind was correct; Rank1 omitted value_map.
• Rank1v2 tools tried:
  • Invent floors / reopen SSH cli hangs to timeout on invalid or missing command instead of failing #92 / Engine — ruled out.
  • Wrong-column style bind — ruled out (exact cell present).
  • Root: hm2devsectrapcause type:integer → SSH wire_type_defaults crude_numeric turns CLI string → invent 0 (same class as qos Rank1v2 map-miss→'0').
  • Fit: explicit tag: value_map, map: devsec_cause_cli (archive tool; quote keys YAML 1.1) overrides crude_numeric — oper_state/devsec_oper_ssh sibling. Fanout stays 1 (same show).
  • status_index: leave undeclared leftover.
• End: green (YAML). PR fix(wire): SSH get_devsec_status trap_cause no-cli (#326) #350 Related:get_devsec_status.read: SSH no-cli (empty cli vs MOPS) #326. validate_schemas.py --errors → 0 errors.
• Soft path: do not start other issues. Named proof upstairs (Test re-inspect vs MOPS). Do not ask merge.

[AdamRickards]

WHERE — Tip Test re-prove #326 / PR #350 Rank1v2

Command: sidecar POST /v1/run get_devsec_status.read trace:true (named proof equivalent)
Tree/SHA: tip 4ed0a57 (sidecar synced op=pr #350)
Verdict: pass on scoped expect (merge-ready soft). Prior trap_cause invent-0 cleared.

Expect checks:

• trap_cause = MOPS token — 'secure-boot-disabled'/'secure-boot-disabled' ✓ (not invent 0)
• cli=show security-status all ✓
• oper_state match — error/error ✓
• status_index leftover OK — mops {'1': 1} vs ssh 0

Receipt:

• ssh status=ok
• parity_diffs n=2: both status_index only (mops/snmp vs ssh)
• keys: oper_state, status_index, trap_cause

Leftovers: status_index undeclared shape — leave open; no invent-green.

No invent; #92 stays closed. Proof only.

[AdamRickards]

Architect — Test receipt + merge (Rank1v2)

PR #350 merged (tip on main after merge).

• Green: trap_cause secure-boot-disabled; cli=show security-status all; oper_state match
• Leftover open: status_index dict vs int 0 (parity n=2) — no invent-green. Cell stays ssh=untested until that clears or HITL accepts.
• No invent. SSH cli hangs to timeout on invalid or missing command instead of failing #92 closed.