fix(fixtures): wait for client sudo policy before simulations - #107

…b02b5cb

The review of 2f62058 found that main had moved (#89, #101, #107) and
changed files on this PR's tested path, so 287cf79's evidence did not
cover the merged tree, and that the diagnose runbook still cited #91's
46fbc58 run for cases the merged code handles.

New record 2026-10-15-b02b5cb.md repeats every check of the three
287cf79 records on b02b5cb (main merged + the left-out paths fix), with
the 44e2d20 and main f9fb701 controls, plus #91's diagnose cases (tier
refuses the client, trailing-dot FQDN, K/M and k principals, stub and
FreeIPA BIND first hops), on new six- and four-VM topologies, with the
metadata captured during the run. Results match; the control for the
port form on 44e2d20 is added. Local checks from the same clean
checkout: go test -race 57 ok, golangci-lint 0, playbook-lint, spec
lint.

The 287cf79 records are marked superseded; the dns and diagnose
runbooks' §0.5 point at the new record.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…ter edits and candidates

known-gotchas called `sss_cache -E && systemctl restart sssd` the only fix
for a denied first sudo; AGENTS.md §5.9 point 5 makes that a bug symptom.
The entry now records the observed facts (rounds 13/23/31, #95/PR #107,
#114, c45ed55), says the root cause is unknown, and tells the agent to
capture facts, check issues, file or report, and not count the run as
passing evidence. filing-policy and a new rules-table row 31 match it;
the services= note now reflects the per-OS-family setting (dfb58a5).

pilot-edit-wizard told agents to hand-edit the roster. It now lists the
roster editor's screens from current source and allows hand edits only
for what no screen covers, each with its code evidence; the stale
ssh_keys hand-edit and schema_version 1 claims are gone.

SKILL.md gains §0a: formal runs start from a frozen candidate in a clean
isolated checkout (AGENTS.md §1.5, docs/actual-run-evidence.md), and §6
no longer appends verification output to the runbook.

Co-Authored-By: Claude Opus 5.5 <[email protected]>