HardwareControlFabric skill's preferred server path is unusable because this workspace has no mTLS

Reported (UTC): 2026-07-13 21:07

HardwareControlFabric skill's preferred server path is unusable because this workspace has no mTLS certificate files.

What was being attempted: follow the mandated server-management hierarchy to confirm a stalled buildtest run on 198.199.106.165 through HardwareControlFabric before considering SSH. The documented command used cli 0.2.6 with ~/.config/hardware-control-fabric/fabric-client-cert.pem, fabric-client-key.pem, and fabric-server-cert.pem.

What went wrong: the CLI failed before connecting with Error: Certificate file not found: /home/helena/.config/hardware-control-fabric/fabric-client-cert.pem and java.lang.IllegalArgumentException: Certificate file not found from CertificateUtils.loadCertificate. The certificate directory contains no files, and a search under /home/helena and /root found neither the default filenames nor the alternate client_cert.pem, fabric_key.pkcs8, and server_cert.pem names mentioned later in the skill.

Impact: the preferred and policy-mandated control plane cannot be used for process/file inspection from this standard workspace, forcing a last-resort SSH fallback for time-sensitive CI wedge confirmation.

Workaround used: after proving the required mTLS material is absent, use the documented SSH connection solely for read-only buildtest event-stream confirmation and the watch-build-prescribed run deletion if the wedge is confirmed.

Suggested durable fix: provision the HardwareControlFabric mTLS client material into the standard workspace at one canonical set of paths, and update the skill to use those paths consistently (its current default and daemon-recovery examples disagree on filenames). Add a preflight helper that locates the credentials and emits one actionable setup instruction rather than a raw IllegalArgumentException.

---

Production verification — 2026-07-17

Status: STILL EXISTS. The required mTLS files now exist, but no cs command is installed, the live CLI ping failed, and port 8443 refused connections. Read-only SSH confirmed that no HardwareControlFabric daemon process is running; its last log ends on 2026-07-12 amid Netty ByteBuf leak reports and thread growth from 88 to 108.

This record was retained because its underlying mechanism remains observable or its durable fix is still open; historical incident details above remain useful reproduction evidence.