feat(sudo-io): stop recording bulk data (sudoers BULK_DATA !log_output fleet-wide), drop >64 MiB streams from archives, prune existing bulk recordings

services/sudo-io-archive/sudo-io-archive-host.sh

@@ -24,7 +24,7 @@ install -d -m 700 /var/log/sudo-io-archive
 case "$phase" in
 pack)
   [[ $arg =~ ^[0-9]+$ ]] || { echo "pack needs a day count"; exit 2; }
-  if [ -f /var/log/sudo-io-archive/outbox.tar.gz ]; then
+  if [ -f /var/log/sudo-io-archive/outbox.tar.gz ] && [ -f /var/log/sudo-io-archive/outbox.sha256 ] && [ -f /var/log/sudo-io-archive/count ]; then
     # a previous run packed but never committed: ship that same archive again rather than repacking
     chgrp infra-ops /var/log/sudo-io-archive /var/log/sudo-io-archive/outbox.tar.gz
     chmod 750 /var/log/sudo-io-archive
@@ -32,6 +32,9 @@ pack)
     echo "RESULT PACKED $(cut -d' ' -f1 /var/log/sudo-io-archive/outbox.sha256) $(cat /var/log/sudo-io-archive/count) reused"
     exit 0
   fi
+  # leftovers of a pack that failed its own checks (no sha/count written, so never shipped): start over
+  rm -f /var/log/sudo-io-archive/outbox.tar.gz
+  rm -f /var/log/sudo-io-archive/outbox.tar.gz.new
   touch -d "-${arg} days" /var/log/sudo-io-archive/cutoff
   : > /var/log/sudo-io-archive/list
   # session dirs are XX/YY/ZZ; include one only if nothing inside it changed after the cutoff
@@ -49,14 +52,27 @@ pack)
   fi
   # sh -c so the session dirs land BEFORE -type (plain `xargs find -type f` appends them after the predicate)
   files=$(cd /var/log/sudo-io && xargs -0 -a /var/log/sudo-io-archive/list sh -c 'find "$@" -type f' sh | wc -l)
+  # Oversize output streams are not archived (Prime 2026-10-04: "we don't need to durably back up weights and rsyncs
+  # forever"). Any stdout/stdin/tty stream over 64 MiB is DATA moving through sudo, not an audit record; the session's
+  # log, log.json and timing are still archived, and commit deletes the stream with everything else. Since the same
+  # day the infra-ops sudoers also stops recording rsync/tar/cat/dd/docker save at all, so this is the backstop.
+  (cd /var/log/sudo-io && xargs -0 -a /var/log/sudo-io-archive/list sh -c \
+    'find "$@" -type f \( -name stdout -o -name stdin -o -name ttyout -o -name ttyin -o -name stderr \) -size +64M -print0' sh) \
+    > /var/log/sudo-io-archive/oversize
+  # NUL-separated on purpose: tar's --null applies to -X as well as -T (a newline list silently excluded nothing,
+  # caught by the member-count check in the 2026-10-04 positive control)
+  oversize=$(tr -cd '\0' < /var/log/sudo-io-archive/oversize | wc -c)
   # gzip, not zstd: it is on every Debian host, and sudo already gzips the stream files inside each session
-  tar -C /var/log/sudo-io --null -T /var/log/sudo-io-archive/list -cf - | gzip -1 > /var/log/sudo-io-archive/outbox.tar.gz
-  gzip -t /var/log/sudo-io-archive/outbox.tar.gz
-  members=$(tar -tzf /var/log/sudo-io-archive/outbox.tar.gz | grep -vc '/$' || true)
-  if [ "$members" -ne "$files" ]; then
-    echo "archive holds $members files, the sessions hold $files: refusing"; exit 3
+  # -X before -T: GNU tar options are positional, and an exclude placed after the file list "has no effect"
+  tar -C /var/log/sudo-io --null -X /var/log/sudo-io-archive/oversize -T /var/log/sudo-io-archive/list -cf - \
+    | gzip -1 > /var/log/sudo-io-archive/outbox.tar.gz.new
+  gzip -t /var/log/sudo-io-archive/outbox.tar.gz.new
+  members=$(tar -tzf /var/log/sudo-io-archive/outbox.tar.gz.new | grep -vc '/$' || true)
+  if [ "$members" -ne $((files - oversize)) ]; then
+    echo "archive holds $members files, expected $files minus $oversize oversize streams: refusing"; exit 3
   fi
-  echo "$sessions $files" > /var/log/sudo-io-archive/count
+  mv /var/log/sudo-io-archive/outbox.tar.gz.new /var/log/sudo-io-archive/outbox.tar.gz
+  echo "$sessions $files $oversize" > /var/log/sudo-io-archive/count
   sha256sum /var/log/sudo-io-archive/outbox.tar.gz > /var/log/sudo-io-archive/outbox.sha256
   # the collector reads the outbox as plain infra-ops, NOT through sudo: sudo's log_output would record the whole
   # archive as a new session, and sudo >= 1.9.14 (Debian 13) truncated the piped stream at exit (2026-10-04:
@@ -64,7 +80,7 @@ pack)
   chgrp infra-ops /var/log/sudo-io-archive /var/log/sudo-io-archive/outbox.tar.gz
   chmod 750 /var/log/sudo-io-archive
   chmod 640 /var/log/sudo-io-archive/outbox.tar.gz
-  echo "RESULT PACKED $(cut -d' ' -f1 /var/log/sudo-io-archive/outbox.sha256) $sessions $files"
+  echo "RESULT PACKED $(cut -d' ' -f1 /var/log/sudo-io-archive/outbox.sha256) $sessions $files $oversize"
   ;;
 commit)
   [[ $arg =~ ^[0-9a-f]{64}$ ]] || { echo "commit needs the collector's sha256"; exit 2; }
@@ -82,6 +98,7 @@ commit)
   rm -f /var/log/sudo-io-archive/list
   rm -f /var/log/sudo-io-archive/cutoff
   rm -f /var/log/sudo-io-archive/count
+  rm -f /var/log/sudo-io-archive/oversize
   echo "RESULT COMMITTED $(du -sh /var/log/sudo-io | cut -f1) left"
   ;;
 status)