get_devsec_history.read: SSH no-cli (empty cli+raw vs MOPS n=1)

[AdamRickards]

WHERE (Σ pack 2026-09-24)

• method: get_devsec_history.read
• tip SHA: b3d219686dbeea457f8dfb44a707036e5f220e68 (sidecar ref: main)
• HTTP: 200; result.passed=true; protocols mops/snmp/ssh all status=ok
• bucket: no-cli

CLI

• (empty) — no SSH commands executed

mops vs ssh (redacted)

• parity_diffs: row count: mops=1 vs ssh=0 (same vs snmp)
• mops raw: one history row {cause:'', timestamp:''} keyed 1
• ssh raw: {}
• No SSH overlay attributes for history wires in wire/ssh/ (diagnostic overlays cover get_devsec / get_devsec_status senses, not history).

Scoped miss

SSH untested: empty cli + empty raw while MOPS emits a row. Prefer existing tools; no invent gold.

Proof only — no schema/wire fix in this filing.

[AdamRickards]

Decision trail (Schema clerk Rank1 — #363 get_devsec_history.read SSH)

• Tip: 30147a5717a2ca8f57754942b634860e309d00fd (main 2b29424+).
• Hole named: SSH no-cli — empty cli+raw vs MOPS n=1. History wires undeclared on SSH overlay. No invent. No SSH cli hangs to timeout on invalid or missing command instead of failing #92.
• CLI.json / archive: show security-status events exists; archive binds events via show security-status all section last (ts/cause/cause_index). Sibling get_devsec.read: SSH close-format (state/pml_disabled vs MOPS) #323/get_devsec_status.read: SSH no-cli (empty cli vs MOPS) #326 same show family.
• Rank1 tools tried:
  • Invent floors / reopen SSH cli hangs to timeout on invalid or missing command instead of failing #92 / Engine — ruled out.
  • Fanout-per-row — forbidden (get_vlans.read: SSH close-format (port membership vs MOPS) #290/fix(wire): SSH get_vlans Rank1v2 PVID membership via show vlan port (#290) #303 HARD).
  • SCHEMA MUST: defaults cause/timestamp≠ attrs history_* — rename attrs to match defaults + wire.
  • Fit: bind pk+cause+timestamp from archive section last; devsec_cause_cli on cause (type:integer invent-0 class).
• End: green (YAML). PR schema(#363): SSH get_devsec_history from security-status all #373 Related:get_devsec_history.read: SSH no-cli (empty cli+raw vs MOPS n=1) #363. validate_schemas.py --errors → 0 errors.
• Soft path: do not start get_ip_source_guard_bindings.read: SSH no-cli (empty cli; honest-empty both) #364 here. Named proof upstairs. Do not ask merge.

[AdamRickards]

WHERE — Tip Test re-inspect #363 / PR #373

Command: sidecar POST /v1/run get_devsec_history.read trace:true (named proof equivalent)
Tree/SHA: tip 30147a5 (sidecar synced op=pr #373). Tip does not contain main de0db22 yet — Schema may want rebase before merge.
Verdict: pass on scoped Rank1 intent (merge-ready soft). Prior no-cli cleared. Soft leftover — do not invent-green / not all-green for provenance.

Expect / receipt:

• cli: show security-status all ✓ (protocol present)
• fields: cause=secure-boot-disabled, timestamp match MOPS ✓
• soft leftover: row key 1 (mops/snmp) vs 0 (ssh) — parity_diffs n=4 (mops/snmp-only vs ssh-only rows)

Receipt:

• ssh status=ok
• n=1 both shapes; values match under different keys

Leftovers: key-shape 1 vs 0 — leave open; no invent-green.

No invent; #92 stays closed. Proof only.

[AdamRickards]

Architect trail: soft-merged #373 → tip bc4c4bd after Test soft prove (no-cli cleared; cause/timestamp match).

Leftover stays on this issue:

• row key mops/snmp '1' vs ssh '0' (parity_diffs n=4) — no invent key remap

No provenance until all-green. Last in pack: #364 / PR #374.