HardwareControlFabric skill has unusable default certificate paths on the /code host.

Reported (UTC): 2026-07-13 22:21

What was being attempted: confirm frozen buildtest event streams on production host 198.199.106.165 through the preferred HardwareControlFabric channel before force-failing two wedged CI runs.

What went wrong: the skill's documented base command failed before connecting with exact error 'Error: Certificate file not found: /home/helena/.config/hardware-control-fabric/fabric-client-cert.pem' and 'java.lang.IllegalArgumentException: Certificate file not found: /home/helena/.config/hardware-control-fabric/fabric-client-cert.pem'. A filesystem search found no fabric certificates under ~/.config or the alternate client_cert.pem/fabric_key.pkcs8/server_cert.pem names later in the same skill.

Impact: the mandated preferred production-management path was unusable, blocking host-side CI forensics and forcing the server-management hierarchy's last-resort raw SSH path.

Workaround used: verify certificate absence locally, then use ssh -p 23 root@198.199.106.165 only for the required buildtest run-file inspection and deletion.

Suggested durable fix: provision the mTLS client certificate/key/CA bundle on the /code execution image and update hardware-fabric-processes/SKILL.md to one canonical set of paths, with a preflight command that reports how to provision missing credentials.

Production verification — 2026-07-17

Status: STILL EXISTS. The required mTLS files now exist, but no cs command is installed, the live CLI ping failed, and port 8443 refused connections. Read-only SSH confirmed that no HardwareControlFabric daemon process is running; its last log ends on 2026-07-12 amid Netty ByteBuf leak reports and thread growth from 88 to 108.

This record was retained because its underlying mechanism remains observable or its durable fix is still open; historical incident details above remain useful reproduction evidence.