$ sudo netctrl apply --node andr-koskow-003 --role core --change ANDR-CORE-2025-12-20-B
[00:43:11] Connecting to node andr-koskow-003 (role: core)
[00:43:11] Auth method : cluster-cert
[00:43:11] Quorum requirement : ENABLED
[00:43:12] Quorum status : 2/2 peers confirmed
[00:43:12] Session ID : csession-ef21a4c8
[00:43:13] Applying policy: control-plane rate-limit
max-retransmits : 3
window : 1000ms
scope : global
status : OK
[00:43:14] Applying policy: randomized backoff
base : 40ms
jitter : 120ms
exponential : yes
max : 800ms
status : OK
[00:43:15] Applying policy: session guard
idle-timeout : 4500ms
hard-timeout : 30000ms
keepalive-limit : 5
freshness-token : required
status : OK
[00:43:16] Applying policy: orchestration degradation
priority class : non-critical
rate cap : 35%
status : OK
[00:43:17] Applying security policy: GeoFence (control-plane)
allowed regions : ['ANDRO_REGION']
deny action : challenge_then_rate_limit
challenge ttl : 8s
audit on deny : enabled
status : OK
[00:43:18] Applying security policy: ASNFilter (routing)
allowed ASNs : ['AS-CLUSTER-TRUST-1','AS-CORE-TRUST-2']
default action : quarantine
quarantine timeout : 600s
snapshot on quar. : enabled
status : OK
[00:43:19] Applying security policy: ForeignControlChallenge
secondary auth : challenge-response + OTP
otp ttl : 60s
max failed : 3
escalate on excess : human-ops
status : OK
[00:43:20] Applying policy: UpstreamAlert (provider notification)
threshold events : 20
window : 300s
notify providers : enabled
include hashes : enabled
status : OK
[00:43:21] Committing changes
author : Cname Dascha
reason : geo/asn fence + foreign challenge
change-id : ANDR-CORE-2025-12-20-B
commit hash : d3f9a2b8c4e1
audit-log : written
[00:43:22] Verifying post-commit state
geo-fence stats : foreign-control-attempts=48 (5m window)
foreign challenge : issued=48, passed=9, failed=39
quarantined routes : 7 (non-whitelisted ASNs)
control retransmits: ↓ stabilizing
decision latency : improving (2.8x → 2.0x baseline)
integrity checks : clean
[00:43:23] Alerts / Escalation
human-ops alerted : yes (ticket #ANDR-SEC-789)
upstream providers : notified (upstream-peering-security)
forensic snapshot : created (hash: a1b2c3d4...)
[00:43:24] Session closed
[00:43:24] Status: SUCCESS
$ |