From 646af887d1f5e28e74cd9ca5aee488a22f035ba1 Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Mon, 28 Sep 2026 09:25:12 -0400 Subject: [PATCH] docs: winrm re-enabled for deployment activities only (2026-09-28) Replaces the 2026-09-11 remote-exec hold: WinRM exec is allowed only for the on-box steps of a user-requested deploy; ad-hoc diagnostics/version checks use SMB, HTTP or SQL. SMB file copies and direct SQL logins remain always allowed. Scope rules live in the winrm skill's Scope section. --- CLAUDE.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index 945d9ea..701e84f 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -190,11 +190,12 @@ publish; registry `BaseUrl` host rule) and the QA topology note: [`ZB.MOM.WW.Ove > is orthogonal to the deployment tier. No production box has been identified. Full host/port > inventory for both tiers: [`deployment.md`](deployment.md) §2.1 + §7.1. > -> ⛔ **Remote command execution on the wonder boxes is DISABLED (2026-09-11).** The `winrm` skill -> (WinRM exec/ps, service control) set off the security software and has been moved to -> `~/.claude/skills-disabled/winrm`; do not use it or stand up a replacement channel until the user -> clears one. **Still allowed:** UNC/SMB file copies to the boxes and logging directly into the SQL -> Servers. Any deploy step that needs a command run on a box is blocked until a new channel is found. +> ⛔ **Remote command execution on the wonder boxes: DEPLOYMENT ACTIVITIES ONLY (2026-09-28).** The +> `winrm` skill was disabled 2026-09-11 (WinRM exec/ps set off the security software) and re-enabled +> 2026-09-28 scoped to deploys: remote exec only for the on-box steps of a deploy the user asked for +> (preflight, backup, stop/swap/start, migration, post-deploy verify, rollback). No ad-hoc diagnostics, +> log grepping or version checks over WinRM — use SMB, HTTP or SQL. **Always allowed:** UNC/SMB file +> copies and logging directly into the SQL Servers. Scope rules live in the skill's *Scope* section. > > **Deployed state (2026-09-10):** DEV and both QA nodes run every repo tip — ScadaBridge `2b9a7c3c`, > OtOpcUa `b8b4c18f`, mxaccessgw `4f931e4` (Server + x86 Worker), HistorianGateway `d8d890c`, Overview