6 Commits

Include renames

Author	SHA1	Message	Date
adminandClaude Opus 5.5	fdd87178d2	R-861 review fixes: the signed update hands the A/B wrapper a root-owned copy of the hashed bytes; mount units accept no Wants/Requires/Before and no continuation lines; the escrow read walks the path without following any symlink ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-05 12:13:42 +02:00
adminandClaude Opus 5.5	6ab1e7c56c	R-861: narrow the agent's root grants — exact sudo patterns, felhom-priv-apply content checker, fixed hook/parent files in the bundle, signed self-update verified as root, escrow root reads pinned ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-05 12:00:43 +02:00
adminandClaude Opus 4.8	301c84d9b5	v0.79.0: escrow upload carries restic_pw_sha256 (SLICE 3 auto-confirm, agent third) ... HashResticPassword = sha256 hex over the trimmed password (pinned cross-repo vector). escrowUploadRequest gains restic_pw_sha256,omitempty — set only when a staged password was sealed into the blob. Contract test updated; hub mirrors next. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6	2026-07-09 23:05:30 +02:00
adminandClaude Opus 4.8	0c22b9bbf3	v0.77.0: fork-4 — escrow the offsite restic repo password under R ... IdentityBundle gains ResticRepoPassword (rides existing age-under-R WrapIdentityBundle; custody spike febdc56 proved a recovered value opens the real repo). POST /escrow/stage-secret (withGuest, scopedFromBody) transiently stages the controller-pushed password (0600, atomic, NEVER logged), which the escrow-create ceremony auto-injects then wipes. Adds AttachResticPassword + StagedResticPasswordPath + WipeStagedResticPassword; EscrowStagePath injectable for tests. Tests: bundle carries pw byte-exact + not-in-blob + wrong-R fails closed; stage 0600 + non-secret ack + cross-guest 403 + value-not-in-log. Additive; PBS-K escrow untouched. NOT yet live-validated (supervised ceremony). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6	2026-07-09 14:56:09 +02:00
adminandClaude Fable 5	e2b6c63ea2	wgtunnel: S3 Part 3 — FELHOM_WG sudoers + capabilities + config (DEFAULT OFF) + main wiring + escrow join ... Sudoers: fixed-path conf install, enable/restart/disable, latest-handshakes-only wg read (dump FORBIDDEN — the S1 incident). 6 capability-manifest entries (Critical=false until S4 makes the tunnel load-bearing). WGTunnelConfig with enabled=false DEFAULT (the safety gate: a v0.64.0 rollout without explicit config is a no-op). Daemon wiring mirrors lanresolver + AddConsumer + SetWireguardReporter; --selftest=wgtunnel single-shot. IdentityBundle +wg_private_key (omitempty; pre-S3 blobs cannot be retrofitted — documented) with escrow-create auto-inject (field name only in logs). Red-proof (e) run. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6	2026-07-04 07:14:33 +02:00
adminandClaude Opus 4.8	e4dfe5ccc7	slice 10D (agent): DR capstone — identity escrow + restore-mode consumption (v0.18.0) ... Identity escrow wraps {tunnel_token,pbs_token} under the SAME R via age (scrypt+ChaCha20-Poly1305), reusing the K-escrow pty; wrong R fails closed. escrow.Create optionally emits the identity blob; escrow-create uploads it + the non-secret directive; identity-consume recovers it (R by hand, never logged). K-escrow + 10C Consume untouched. Closes slice 10 with hub v0.11.0; operator-side rotation model (hub holds no Cloudflare write-power). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-11 09:48:36 +02:00