[Gerrrt]

What changed

Docs only. These now record shiva as it stands after a read-only Redfish audit on 2026-11-13 and the hand fixes that followed it the same day:

• docs/hardware.md, the Management row;
• docs/network.md, ImaginationLAN's notes;
• docs/security.md, the BMC threat row;
• SECURITY.md, the BMC residual.

The changelog carries that day's entry.

Why

The docs said the BMC's "one path out of the segment" was deleted, and that HTTPS, the remote console and SNMP were what stayed on. The re-read found more:

• a second local account with every privilege, older than the retained event log;
• the unauthenticated XML reply (/xmldata), and SSDP with Federation multicast discovery;
• a DHCP gateway, which gave the BMC the lab's internet egress;
• no NTP server, so the clock restarted at 1970 after each power removal;
• only every third failed login logged.

The 2026-09-09 settings themselves held. SSH and IPMI-over-LAN are off, SNMP is v3-only, and firmware 2.82 is still HPE's last iLO 4 release.

Fixed by hand before this publishes anything:

• The second account is deleted on the iLO.
• On the iLO, the XML reply, SSDP and Federation multicast discovery are off, SNTP is set to 10.0.30.1, and every failed login is logged.
• morpheus blocks 10.0.30.10 from anything off-segment, above Allow internet on igc0.30. Return traffic for existing connections still carries the SNMP replies.
• These rows are amended to the fixed state.

HTTP on 80 stays on and is recorded as such.

Blast radius

None from this PR: five Markdown files. The firewall rule it documents was added on morpheus by hand, and only narrows what 10.0.30.10 can reach.

• No change to network segmentation or firewall rules in this PR
• No new port published to a VLAN that could not already reach the service
• No credential added outside secrets/*.sops.yaml

Verification

• python3 scripts/check_docs.py prints docs OK. ./scripts/lint.sh passed with 14 checks skipped; CI runs the full set.

• The iLO fixes were confirmed by a second Redfish read, using GETs only:

  • AccountService/Accounts lists one account.
  • The NetworkService read shows SSDP.ProtocolEnabled: false and XMLResponseEnabled: false.
  • /xmldata?item=all without a login returns an empty <RIMP>.
  • In Managers/1, Federation MulticastDiscovery is Disabled.
  • DateTime.NTPServers is 10.0.30.1, and the iLO clock matches Saruman's.
  • AuthFailureLoggingThreshold is 1.
  • The event log records each change, including "User … deleted" and "iLO clock has been synchronized with 10.0.30.1".

• The morpheus rule is recorded on the operator's word. It was not tested from the BMC's side.

• make validate passes (lint passed locally with 14 skips; CI is the full set)

• Deployed to the lab and confirmed working (n/a: docs)

• Docs updated (docs/, service README, or docs/roadmap.md)

🤖 Generated with Claude Code