4 Commits

Include renames

Author	SHA1	Message	Date
admin	bdf25f019c	Host power-off: a guest started after acceptance cancels it; escrow reply data race fixed ... Security review of c6d9435: the other-guests check ran only at acceptance. waitJobsClear now looks again before each step and CANCELS at once when another guest or VM runs (gate released). Red-proofed. Also: go test -race found a data race in the escrow ceremony start reply (reads job.Phase while the job goroutine writes it) — the reply fields are copied before the goroutine starts; -race was red before, green 3/3 after.	2026-10-13 19:38:23 +02:00
admin	c6d9435316	Host power-off: re-check jobs before each step; cancel if one is still running (R-998) ... Security review of f38b03c: a controller update, drive/NAS job, escrow ceremony or Proxmox vzdump could start between acceptance and the power-off (the heavy gate does not cover them). runHostPowerOff now asks jobBlocker again before the guest shutdown and before the host power-off, waits up to 15 min, and CANCELS (gate released, box stays on) if still busy. Red-proofed: no wait, and a gate kept after a cancel, each convicted.	2026-10-13 19:36:01 +02:00
admin	f38b03cdb8	Host power-off: refuse while another guest or VM runs; hold the heavy gate; fail closed (R-998) ... Security review of 3403c87: (1) any guest's controller could switch off a shared host — demo-hp runs a scratch guest and the Tester 1 VM. Now refused (other_guests_running) when /proc shows any other lxc-start -n N or kvm -id N; an unreadable /proc refuses. (2) the checks ran once, so a backup could start before the power-off: the heavy-operation gate is now taken on acceptance and kept (released only if the power-off command fails). (3) an unwired gate or task reader refused nothing; now refuses. Each red-proofed.	2026-10-13 19:33:09 +02:00
admin	3403c87c80	Host power-off for the household (R-998): POST /host/poweroff ... The guest's controller asks; the agent refuses in the first 10 min after boot, a second time in one boot (persisted, keyed by /proc/stat btime), and while a backup, restore test, OS step, controller update, drive format, NAS verify, escrow ceremony or vzdump runs (each a named 409 reason). On acceptance: the record first, a host report carrying deliberate_off accepted by the hub (bounded 60 s), then pct shutdown --timeout 120, then systemctl poweroff. Sudoers: two exact vectors (pct ^shutdown N --timeout N$, systemctl poweroff) in FELHOM_POWEROFF; nine injection cases. New TestEveryAliasIsGranted: a defined alias missing from the grant line passed the coverage check before. Every new test red-proofed.	2026-10-13 19:29:52 +02:00