v0.80.0: PBS DR tier slice 2 — the apply-bridge (pbs_dr consumer, felhom-pbs-apply set-only wrapper, verify-pin-before-consume, adoption-first, loud consumed-failed, escrow seed)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

internal/pbs/probe.go

@@ -0,0 +1,47 @@
+package pbs
+
+// ProbeFingerprint (PBS DR slice 2) — the verify-pin-BEFORE-consume check: a bare TLS dial to
+// the PBS server pinned to the DESCRIPTOR's fingerprint. Success proves the box at that address
+// presents exactly the pinned cert (and is reachable over the tunnel); nothing is authenticated
+// and nothing is consumed. A mismatch or unreachability MUST abort the bridge before the
+// one-time token secret is touched (the offsite ordering law).
+
+import (
+	"context"
+	"crypto/tls"
+	"fmt"
+	"net"
+	"strings"
+	"time"
+)
+
+// ProbeFingerprint dials server (host or host:port; default port 8007) and verifies the
+// presented leaf cert against fingerprint (sha256, colon-form ok). Returns nil only when the
+// pin matches exactly.
+func ProbeFingerprint(ctx context.Context, server, fingerprint string) error {
+	tlsCfg, err := pinnedTLS(fingerprint)
+	if err != nil {
+		return err
+	}
+	addr := server
+	if !strings.Contains(addr, ":") {
+		addr = net.JoinHostPort(addr, "8007")
+	}
+	d := net.Dialer{Timeout: 15 * time.Second}
+	raw, err := d.DialContext(ctx, "tcp", addr)
+	if err != nil {
+		return fmt.Errorf("pbs: fingerprint probe dial %s: %w", addr, err)
+	}
+	defer raw.Close()
+	if dl, ok := ctx.Deadline(); ok {
+		raw.SetDeadline(dl)
+	} else {
+		raw.SetDeadline(time.Now().Add(15 * time.Second))
+	}
+	conn := tls.Client(raw, tlsCfg)
+	if err := conn.HandshakeContext(ctx); err != nil {
+		return fmt.Errorf("pbs: fingerprint probe %s: %w", addr, err)
+	}
+	conn.Close()
+	return nil
+}