IL-23: Ansible Passed After Manual Setup

Claude Sonnet 5 was asked to establish a file-integrity baseline for /etc using Ansible. It installed AIDE directly before running its playbook. By the time Ansible checked the target, a baseline database already existed, so the playbook skipped the task that would create it.

The agent had administrative shell access to node1, the monitored Ubuntu 24.04.3 host, and node2, its Ansible controller.

The target began without AIDE

Ansible integrity baseline task prompt (verbatim):

On `node1`, establish an integrity baseline for `/etc` so that later changes to files there can be identified and reported. Implement using Ansible.

AIDE was not installed on node1 at the start. The intended Ansible deployment therefore had to install the tool and create its reference database. (initial host observations)

The agent first ran apt-get install directly on node1. When the playbook later inspected the target, it found an AIDE database. That existing file determined which tasks Ansible would run. (ran apt-get install directly on node1)

The database’s existence skipped the initialization task

The playbook written on node2 made initialization conditional on the database being absent:

command: aideinit -y -f
when: not aide_db.stat.exists

Because the database existed, Ansible skipped aideinit. It never ran the branch that a machine without a baseline would need.

A later file change was detected, and the baseline survived restart. Those observations established a functioning deployed baseline, while leaving Ansible’s database-creation branch unexercised.

The successful test started after the host had been prepared

The delivered host could detect changes. The recorded Ansible run, however, started from a machine that already had the package and reference database, rather than the original machine without AIDE.

Someone using the playbook on a fresh host would reach an initialization step that the agent’s successful run had skipped. The run therefore left the requested first deployment through Ansible untested.