docs(security): smaug's missing logs are a decision, and now they are written down (#255)

[Gerrrt]

ADR-0016 reversed the monitoring direction for CasaBonita and said in advance what
it costs: "The NAS gets metrics and no logs ... the one host in the estate whose
compromise is invisible." The host landed on 2026-09-16, so the trigger on #255
has fired.

Every other accepted residual of this class has a row in SECURITY.md's Known
exposure table. This one had none — it was written down in ADR-0016, carried
forward by ADR-0040, and mentioned in one clause of a roadmap entry about a
different issue. Closing that asymmetry is the whole change. The gap is not
closed and is not meant to be.

The three boxes

• A row in SECURITY.md's Known exposure table, in the
  "Accepted residual, not a fix in progress." form of the ingest-port and
  BMC rows. It goes to the bottom of the residual block rather than the top
  of the table — b7f6e62 set that convention when it appended the BMC row,
  and 531b105 set the opposite one for a closed finding.
• A line in docs/security.md, beside the tripwire paragraph. It is two
  paragraphs rather than a line, because the second one is box 3.
• The alert decision, below.

TerminalSegmentReachedInternalNetwork is sufficient. No new alert.

security.rules.yaml:314-337 matches {app="filterlog", action="pass"} against
,10\.0\.(10|20|40)\.[0-9]+,(10\.0\.(30|50|99)|10\.7\.7)\.[0-9]+,. One event: a
terminal segment passed toward the lab, trusted, management or switch LAN.

Line that up against what a compromise of smaug looks like — indexer exploited,
segment enumerated, pool read, exfiltration over 443, persistence. Every branch
except the upward pivot is invisible, not merely unalerted, because the host
emits no log lines and Suricata does not watch igc0.40 either (ids.rules.yaml
declares igc0.20 and igc0.10). The rule covers the only branch that leaves a
record. A second rule cannot widen that: the limit is the absence of evidence.

• An absence rule — rejected, and it cannot be written.
  absent_over_time({host="smaug"}[Nh]) would fire immediately and permanently,
  and be correct to. SuricataLogsStopped became writable only once somebody
  measured what a normal silence looks like — 22 days of stream, a worst gap of
  75 minutes, nine hours chosen as seven times it. The general pattern is
  homelab_suricata_expected_interface: a declared expectation to measure the
  silence against. Here the expectation is zero and always was, so the firing
  condition is the design working.
• A up == 0 liveness rule on the scrape target — a real gap, deliberately not
  pre-empted. It belongs to Add the scrape path for a host that pushes nothing #256, which has not chosen between node_exporter
  on 9100 and TrueNAS's own endpoint; that fork changes the job name, the
  labels and possibly a fifth firewall rule.
• Documentation only — accepted. The failure being defended against is
  somebody rediscovering this in two years and treating it as an oversight.

The sharpest version, and it is newly true. scripts/check_loki_coverage.py
takes its denominator from the hosts Loki has already heard from — deliberately,
because a hand-maintained table of which rule should see which host drifts. So it
reports full coverage while blind to smaug, and is right to. JournalSourceStopped
and LogEntriesDropped are both keyed on an agent publishing metrics. Nothing
automated in the estate would notice this gap. The documents are the control.

Two corrections to the issue text

1. The issue quotes the ingest-port row as ending "and never an untrusted
   segment". That wording was replaced on 2026-09-04 by 6ce11ed; the current
   row says "…and no untrusted segment reaches it at all." The argument is
   unaffected — only the sentence it points at moved.
2. The SuricataStopped reasoning is no longer at security.rules.yaml:241-250.
   It is at loki/rules/security.rules.yaml:596-617 and
   prometheus/rules/ids.rules.yaml:30-36.

A stale paragraph, found because the new one had to sit beside it

docs/security.md's Segmentation section still said ADR-0016's CasaBonita passes
were uncreated, and that there were three. Four exist and have since
2026-09-16 — c938c37 corrected the threat-model row and left this one behind.
It now splits the two ADRs by stage (CasaBonita's exist, Skids' does not) and says
outright that half of what it claimed stopped being true, which is this file's
habit rather than a quiet overwrite. docs/network.md carried the same error in
one bullet while the next bullet said four.

Deliberately out of scope

• The scrape path — Add the scrape path for a host that pushes nothing #256, whose worktree is held by another session. Nothing
  under stacks/ is touched.
• SMART and patch state — smaug has no SMART and no patch state, and the mechanism every other host uses is a push it cannot make #483. The commit and the docs say the blind spot is
  wider than the logs and point there.
• docs/runbooks/build-the-nas.md §8 still lists smaug has no logs, and that is a decision — record it as a residual #255 under What this leaves
  open, and docs/architecture.md's "Two collection paths" sentence is now a
  three-path estate. Both are flagged, not fixed — the second is Add the scrape path for a host that pushes nothing #256's, since
  Add the scrape path for a host that pushes nothing #256 creates the target file that makes it checkably false.

Verification

python3 scripts/check_docs.py and ./scripts/lint.sh both pass. These are the
only checks that read SECURITY.md and docs/security.md; check_firewall_posture
is the load-bearing one, because it anchors on the literal "Default deny holds for"
/ "It does not hold for" sentences and their bold runs, which the edits leave
untouched.

./scripts/validate.sh also passes — all checks passed (3 skipped), the three
being the systemd-unit checks that only run in the deployment checkout. It took
about 35 minutes rather than the usual few, because promtool test rules queued
behind a dozen concurrent containers from peer sessions on this shared docker
daemon; that is contention, not a failure.

Closes #255
Refs #483 #256 #413

🤖 Generated with Claude Code