admin
a6e8bcb475
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
30 lines
2.1 KiB
Markdown
30 lines
2.1 KiB
Markdown
# REPORT — agent v0.79.0: SLICE 3 escrow upload carries the sealed password's hash — DEPLOYED
|
|
|
|
**Date:** 2026-07-09 · **Class:** implementation (agent, small). Baseline v0.78.0 → **v0.79.0**, live on
|
|
felhom-pve (`felhom-agent 0.79.0`, capabilities self-check **56/56, degraded=0**). The hub-verified escrow
|
|
auto-confirm chain, agent third — pairs with hub v0.40.0 (stores + serves) and controller v0.108.0
|
|
(matches + auto-confirms). All three deployed live.
|
|
|
|
## What shipped
|
|
- `internal/escrow.HashResticPassword` — the CANONICAL hasher: sha256 hex over the TRIMMED password string,
|
|
exactly the value `AttachResticPassword` seals into the identity blob. **Pinned cross-repo test vector**
|
|
(`TestHashResticPassword_PinnedVector` — the identical vector is asserted in felhom-controller's backup
|
|
package), so the two hashers can never drift silently (newline/encoding/trim).
|
|
- `cmd/felhom-agent`: the escrow-create ceremony computes the hash when a staged password is folded in and
|
|
includes it in the blob upload — `escrowUploadRequest.restic_pw_sha256,omitempty`. No staged password →
|
|
field OMITTED (hub stores NULL → the controller stays pending; correct — the blob doesn't cover the key).
|
|
The hash of a 256-bit random secret is non-reversible — safe to upload/serve; the password itself is
|
|
never logged or uploaded in the clear (it rides only inside the R-wrapped blob, as before).
|
|
- `TestEscrowUploadContract` updated in lockstep with the hub's mirror (same commit-pair) + asserts the
|
|
omitted-when-unstaged behavior.
|
|
- Ceremony flow (create / self-verify / R banner / staged-file wipe) untouched beyond the hash.
|
|
|
|
## NOT yet live-exercised
|
|
A real ceremony with a staged password recording the hash — happens at the next real offsite enable (Peti
|
|
onboarding). The demo's escrow row remains a legacy NULL-hash blob (covered by the deprecated manual
|
|
confirm; verified live that the controller no-ops on it).
|
|
|
|
## Deploy
|
|
Standard: built on 180, `.bak-0.78.0` kept, `install -m0755` + restart. `configs/` unchanged. NOT published
|
|
to Gitea (Day-0 manifest still vouches 0.76.0).
|