From a6e8bcb475d1b8c7fc6153298359585af6c0d180 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Thu, 9 Jul 2026 23:25:10 +0200 Subject: [PATCH] =?UTF-8?q?docs:=20v0.79.0=20REPORT=20=E2=80=94=20deployed?= =?UTF-8?q?=20felhom-pve=20(56/56)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6 --- REPORT.md | 46 +++++++++++++++++++++++----------------------- 1 file changed, 23 insertions(+), 23 deletions(-) diff --git a/REPORT.md b/REPORT.md index e6d83f5..7cb7432 100644 --- a/REPORT.md +++ b/REPORT.md @@ -1,29 +1,29 @@ -# REPORT — agent v0.78.0: DELETE /escrow/stage-secret (fork-4 hygiene) — DEPLOYED +# REPORT — agent v0.79.0: SLICE 3 escrow upload carries the sealed password's hash — DEPLOYED -**Date:** 2026-07-09 · **Class:** implementation (agent, small). **Baseline:** v0.77.0 → **v0.78.0**, live -on felhom-pve (`felhom-agent 0.78.0`, capabilities self-check **56/56, degraded=0**). Part of the offsite -hardening bundle: pairs with controller v0.107.0 (calls this on every `EscrowState` flip to `escrowed`) and -hub v0.39.0 (F4/F2/F5). +**Date:** 2026-07-09 · **Class:** implementation (agent, small). Baseline v0.78.0 → **v0.79.0**, live on +felhom-pve (`felhom-agent 0.79.0`, capabilities self-check **56/56, degraded=0**). The hub-verified escrow +auto-confirm chain, agent third — pairs with hub v0.40.0 (stores + serves) and controller v0.108.0 +(matches + auto-confirms). All three deployed live. ## What shipped -`internal/localapi`: **`DELETE /escrow/stage-secret`** (withGuest, bearer-authed) — removes the staged -offsite restic repo password (+ any stale `.tmp` partial). **Idempotent:** an absent file is a clean 200 -`{removed:false}`. Closes the fork-4 hygiene gap where a confirm WITHOUT a fresh ceremony (the password -already escrowed — the live e2e's Option-A close) left the transient 0600 staging file behind indefinitely -(only the escrow-create ceremony wiped it before). +- `internal/escrow.HashResticPassword` — the CANONICAL hasher: sha256 hex over the TRIMMED password string, + exactly the value `AttachResticPassword` seals into the identity blob. **Pinned cross-repo test vector** + (`TestHashResticPassword_PinnedVector` — the identical vector is asserted in felhom-controller's backup + package), so the two hashers can never drift silently (newline/encoding/trim). +- `cmd/felhom-agent`: the escrow-create ceremony computes the hash when a staged password is folded in and + includes it in the blob upload — `escrowUploadRequest.restic_pw_sha256,omitempty`. No staged password → + field OMITTED (hub stores NULL → the controller stays pending; correct — the blob doesn't cover the key). + The hash of a 256-bit random secret is non-reversible — safe to upload/serve; the password itself is + never logged or uploaded in the clear (it rides only inside the R-wrapped blob, as before). +- `TestEscrowUploadContract` updated in lockstep with the hub's mirror (same commit-pair) + asserts the + omitted-when-unstaged behavior. +- Ceremony flow (create / self-verify / R banner / staged-file wipe) untouched beyond the hash. -## Tests -`TestWipeStagedEscrowSecret`: stage → wipe (EFFECT: file GONE) → idempotent re-wipe (`removed:false`) → -401 unauthenticated. Full suite green (`go build && go vet && go test ./...`). - -## Live validation -The endpoint was exercised for the one-off cleanup: the lingering -`/var/lib/felhom-agent/escrow-stage/restic_repo_password` (left by the e2e) was wiped through the -controller container over the pinned local-API channel → `{"removed":true}`, file verified GONE on -felhom-pve; an immediate re-wipe returned `{"removed":false}` (idempotency proven live). No secret value -was ever printed or logged. +## NOT yet live-exercised +A real ceremony with a staged password recording the hash — happens at the next real offsite enable (Peti +onboarding). The demo's escrow row remains a legacy NULL-hash blob (covered by the deprecated manual +confirm; verified live that the controller no-ops on it). ## Deploy -Standard flow: built on 180 (`-X main.version=0.78.0`), scp'd via local → felhom-pve, `.bak-0.77.0` kept, -`install -m0755` + restart. `configs/` unchanged → no sudoers/wrapper shipping needed. NOT published to -Gitea (no Day-0 vouch change; the Day-0 manifest still vouches 0.76.0). +Standard: built on 180, `.bak-0.78.0` kept, `install -m0755` + restart. `configs/` unchanged. NOT published +to Gitea (Day-0 manifest still vouches 0.76.0).