thanhnvandClaude Opus 4.8
82011a0c67
Two comprehensive CI fixes:
1. Adversarial harness flake (PASS=42 FAIL=2, state-dependent):
governance-check.sh re-exported audit-public.pem only when GENERATING a
new signing key. On a CI runner where the off-repo private key PERSISTS
across runs, the checked-out (Vault-signed) audit-public.pem drifted out
of sync with the local re-signing key, so verify-audit-chain.sh rejected a
genuine head ("H5/H2 verifies the genuine signed chain"). Now always
re-export the public key matching the signing key — mirrors the same fix
already applied to tool-audit-lib.sh (c31987c). Reproduced the exact
FAIL=2 locally with a drifted persisted key; now deterministically 44/44.
2. Deploy docker.sock permission denied:
Added a self-healing preflight to deploy-okr that ensures the deploy user
is in the docker group on the web VPS (idempotent, passwordless sudo) and
proves a fresh SSH session can reach the daemon before streaming images.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>