docs: tighten deployment runbooks

docs/dogfood-checklist.md

@@ -6,6 +6,34 @@ on two real machines before the first broader deployment. Do not mark the Phase
 10 roadmap item complete until every checkbox here has a date, platform, geth
 version or commit, and evidence note.
 
+Create one evidence directory per run and keep raw JSON, command transcripts,
+and relevant redacted logs there. Do not store bearer tokens, private keys, or
+unencrypted backup contents in the evidence directory. A run is reviewable only
+when its evidence can be tied to the matrix and sign-off records below.
+
+## Evidence Log
+
+Copy this table for each attempt. Use ISO 8601 timestamps and paths or issue
+links that another reviewer can open.
+
+| Field | Machine A | Machine B |
+| --- | --- | --- |
+| Run ID | `<YYYYMMDD-sequence>` | `<same run ID>` |
+| Started at | `<timestamp>` | `<timestamp>` |
+| Platform/architecture | `<value>` | `<value>` |
+| geth version/commit | `<value>` | `<value>` |
+| Install method/artifact checksum | `<value>` | `<value>` |
+| Fresh `GETH_HOME` | `<path or identifier>` | `<path or identifier>` |
+| Command transcript | `<path or link>` | `<path or link>` |
+| JSON and log evidence | `<path or link>` | `<path or link>` |
+| Result | `pass` / `fail` / `incomplete` | `pass` / `fail` / `incomplete` |
+
+Record each failed or skipped step separately:
+
+| Timestamp | Machine | Step | Result | Evidence | Follow-up |
+| --- | --- | --- | --- | --- | --- |
+| `<timestamp>` | `A` / `B` | `<section and command>` | `<result>` | `<path or link>` | `<issue or action>` |
+
 ## Test Matrix
 
 - `[ ]` Machine A platform, architecture, geth version/commit, and install
@@ -80,7 +108,9 @@ On Machine A:
 
 ```sh
 geth kv create prefs
+geth kv set prefs theme dark
 geth document create notes
+geth document set notes '{"purpose":"dogfood"}'
 geth cas add README.md
 geth pipe listen ops
 geth auth grant <worker-node-id> resource:kv:prefs kv.read --signing-key ~/.ssh/id_ed25519 --grant-id dogfood-kv-read
@@ -95,22 +125,45 @@ On Machine B:
 ```sh
 geth auth sync owner
 geth kv sync owner prefs
+geth kv get prefs theme
 geth document sync owner notes
+geth document get notes
 geth cas fetch owner <hash>
 geth pipe send ops "dogfood" --node owner
-geth ssh proxy owner
 geth sync now owner
 geth sync status --json
 ```
 
+Back on Machine A, verify the pipe payload:
+
+```sh
+geth pipe recv ops
+```
+
+Verify the SSH proxy with a bounded OpenSSH probe from Machine B. Replace
+`<ssh-user>` with an account accepted by Machine A's local SSH service:
+
+```sh
+ssh -o BatchMode=yes -o ConnectTimeout=10 \
+  -o 'ProxyCommand=geth ssh proxy owner' \
+  <ssh-user>@owner true
+```
+
+An authentication failure after the SSH handshake is sufficient to prove byte
+transport when Machine A intentionally has no matching SSH credential; record
+the verbose `ssh -v` transcript. A timeout or geth authorization error is not a
+successful proxy check.
+
 Acceptance:
 
 - `[ ]` Auth sync imports the expected grants.
-- `[ ]` KV sync imports `prefs`.
-- `[ ]` Document sync imports `notes`.
+- `[ ]` KV sync imports `prefs` and Machine B reads `theme=dark`.
+- `[ ]` Document sync imports the `{"purpose":"dogfood"}` state.
 - `[ ]` CAS fetch retrieves the expected blob.
-- `[ ]` Pipe send reaches the Machine A daemon-lifetime listener.
-- `[ ]` SSH proxy opens only after `ssh_proxy.connect` is granted.
+- `[ ]` Pipe send reaches the Machine A listener and `pipe recv` returns the
+  exact payload.
+- `[ ]` The bounded SSH probe reaches Machine A's SSH handshake only after
+  `ssh_proxy.connect` is granted.
 - `[ ]` `geth sync status --json` reports healthy or intentionally skipped
   streams with actionable `next_action` values.
 
@@ -186,3 +239,9 @@ Acceptance:
 - `[ ]` Evidence is attached for Machine B.
 - `[ ]` Phase 10 in `docs/production-readiness-roadmap.md` is marked complete
   only after the real-machine evidence is reviewed.
+
+| Role | Name | Timestamp | Run ID | Result |
+| --- | --- | --- | --- | --- |
+| Operator A | `<name>` | `<timestamp>` | `<run ID>` | `<result>` |
+| Operator B | `<name>` | `<timestamp>` | `<run ID>` | `<result>` |
+| Reviewer | `<name>` | `<timestamp>` | `<run ID>` | `approved` / `rejected` |