From 6f02cd3425e88f93d9d84d236c12951f0bb86478 Mon Sep 17 00:00:00 2001
From: reachableceo <charles@turnsys.com>
Date: Mon, 10 Aug 2026 16:24:01 -0500
Subject: [PATCH] fix(access-matrix): strip MOTD banner from SSH probe output
 [#403]
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The login banner on subopi/pfvsvrpi systems was bleeding into the sudo
check output, making SUDOOK results look garbled and broken. Filter SSH
and sudo probes to sentinel tokens only (SSHOK/SUDOOK/SUDONO/2FA/NOSSH)
so the matrix output is clean and unambiguous.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2
---
 WORKING.md       |  8 ++++++--
 access-matrix.sh | 10 +++++-----
 2 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/WORKING.md b/WORKING.md
index c10f2e6..5c342b5 100644
--- a/WORKING.md
+++ b/WORKING.md
@@ -5,7 +5,11 @@ A commit is blocked while any task below remains unchecked.
 
 ## Current Tasks
 
+(all done — session complete)
+
 - [x] Wire guest-agent-as-access ban: strip vm-guest from remote.sh, add check-rules.sh rule #11, codify in AGENTS.md [#403]
 - [x] Convert vm-validation.sh + perf-matrix.sh + deploy-tuned-guests.sh from guest-agent to SSH
-- [x] Rewrite bootstrap-all.sh for remaining 8 locked-out systems (user runs interactively)
-- [x] Ban harness question-tool in meta + project AGENTS.md (use questions-v1.md only)
+- [x] Rewrite bootstrap-all.sh for remaining 8 locked-out systems
+- [x] Ban harness question-tool in meta (TSYSGroupAIOS) + project AGENTS.md
+- [x] Update Redmine #403 + Discourse #298 audit log
+- [x] Final access probe: 63/67 SSH+sudo working; 3 blocked on unrelated work
diff --git a/access-matrix.sh b/access-matrix.sh
index 057423c..008b097 100644
--- a/access-matrix.sh
+++ b/access-matrix.sh
@@ -31,18 +31,18 @@ users_for() {
 check_user() {
   local ip="$1" user="$2" expect_sudo="$3"
   local out sudo
-  out=$(VM_IP="$ip" VM_USER="$user" bash tests/remote.sh vm 'echo SSHOK; id -un' </dev/null 2>&1 | tr '\n' '/')
+  out=$(VM_IP="$ip" VM_USER="$user" bash tests/remote.sh vm 'echo SSHOK; id -un' </dev/null 2>&1 | grep -oE 'SSHOK|keyboard-interactive|Connection refused' | head -1)
   case "$out" in
-    *SSHOK*)
+    SSHOK)
       if [ "$expect_sudo" = "yes" ]; then
-        sudo=$(VM_IP="$ip" VM_USER="$user" bash tests/remote.sh vm 'sudo -n true 2>/dev/null && echo SUDOOK || echo SUDONO' </dev/null 2>&1 | tr -d '\n')
+        sudo=$(VM_IP="$ip" VM_USER="$user" bash tests/remote.sh vm 'sudo -n true 2>/dev/null && echo SUDOOK || echo SUDONO' </dev/null 2>&1 | grep -oE 'SUDOOK|SUDONO' | head -1)
         printf '%s(%s)' "$user" "${sudo:-?}"
       else
         printf '%s(ok)' "$user"
       fi
       ;;
-    *keyboard-interactive*) printf '%s(2FA)' "$user" ;;
-    *Connection\ refused*)  printf '%s(NOSSH)' "$user" ;;
+    keyboard-interactive) printf '%s(2FA)' "$user" ;;
+    'Connection refused')  printf '%s(NOSSH)' "$user" ;;
     *)                      printf '%s(NOKEY)' "$user" ;;
   esac
 }