6 Commits

Include renames

Author	SHA1	Message	Date
admin	45458196d1	Two texts made true after 0.160.0: the ceremony log line names the confirm order; the R-973 comments name whole_guest_backup_refused (no behaviour change)	2026-10-19 05:25:58 +02:00
admin	c11e3e2a87	The new escrow package reaches the hub only after the household typed two words of the code back: POST /escrow/ceremony/confirm; an old controller keeps the claim order (R-1151, unreleased)	2026-10-19 03:03:37 +02:00
admin	8561dc8a5c	The new escrow package reaches the hub only when its code is claimed (R-978, unreleased) ... The root ceremony uploaded the new package before the new code was claimed, and the hub overwrites the current package when the sealed secrets are unchanged: a customer who started the ceremony again and walked away kept a written-down code that opened nothing. Json mode (the FELHOM_ESCROW argv, unchanged) now returns the package (CeremonyOutput v2, PendingUpload); the daemon uploads it at POST /escrow/ceremony/claim before handing out the code. A failed upload is a 502 with the code still claimable; TTL and a new start wait for an in-flight claim upload; no uploader is a 503. Text mode still uploads at once. No sudoers change. Tests TestEscrowCeremony_R978_* (localapi) and the cmd-side defer/delivery/wiring tests, red-proved.	2026-10-18 19:42:02 +02:00
admin	bdf25f019c	Host power-off: a guest started after acceptance cancels it; escrow reply data race fixed ... Security review of c6d9435: the other-guests check ran only at acceptance. waitJobsClear now looks again before each step and CANCELS at once when another guest or VM runs (gate released). Red-proofed. Also: go test -race found a data race in the escrow ceremony start reply (reads job.Phase while the job goroutine writes it) — the reply fields are copied before the goroutine starts; -race was red before, green 3/3 after.	2026-10-13 19:38:23 +02:00
admin	a659e5dc09	v0.89.0: pbsdr self-grant (R-22) + escrow config live-reload + agent-plane poke listener (Direction-2a) ... - pbsdr: on a 403 pre-check (non-default storage id, no ACL yet) self-grant via the root wrapper then re-read, instead of aborting before the grant — closes F4/R-22. Red-proof TestSelfGrant_PreCheck403DoesNotAbortBeforeGrant. - escrow preflight: late-bound CurrentPBSStorageID re-reads agent.json so a pbsdr-seeded pbs_storage_id flips the row green in-process (no restart). Red-proof TestEscrowPreflight_PBSStorageIDLiveReload. - internal/poke: contentless UDP poke listener bound exclusively to the box WG /32 (port 51822), leading-edge debounced, fires the hub-loop out-of-band trigger for an immediate desired-state cycle. First slice of R-13. Red-proofs TestBindConfinement + TestDebounceCoalescesBurst.	2026-07-16 22:47:22 +02:00
admin	1c3a3ef9ad	v0.88.0: controller-driven escrow ceremony — --output=json machine mode (escrowCeremony extraction, text mode byte-identical), the ONE fixed argv (escrow.CeremonyArgs, shared by exec+manifest+FELHOM_ESCROW sudoers, pin-tested), localapi ceremony job (single-flight, 60s) + one-shot in-memory R claim (10min TTL, unclaimed_void) + preflight; escrow-ceremony capability (Critical, pbs_dr-gated)	2026-07-13 19:01:11 +02:00