50 lines
3.2 KiB
Markdown
50 lines
3.2 KiB
Markdown
# REPORT — slice 8C Phase A (agent half): disk endpoints + data-bearing classifier gate (v0.12.0) (2026-06-10)
|
|
|
|
> Overwrite-latest report. Cumulative history: [CHANGELOG.md](CHANGELOG.md). Implements the
|
|
> host-agent half of `TASK — Slice 8C`. The controller de-privileging + disk-subsystem retirement is
|
|
> the `felhom-controller` half (v0.37.0). No hub change.
|
|
|
|
## Outcome
|
|
|
|
The agent now owns disk execution. It serves the §6 disk-management endpoints the controller's UI
|
|
drives, with the **8C security invariant**: the agent decides data-bearing-ness by **inspecting the
|
|
actual device** (agent-internal evidence), NEVER from the caller's claim. A compromised controller
|
|
asserting "this drive is blank" cannot wipe a data-bearing drive — **proven live** (a data-bearing
|
|
device → refused `pending_signature`, `mkfs` never called, the device untouched).
|
|
|
|
## What landed
|
|
|
|
- **`internal/storage`** — `SudoHostOps.Format(device, fstype)` (device-pinned `mkfs.ext4 -F` /
|
|
`mkfs.xfs -f`, `ValidateBlockDevice`+`ValidateFSType`, narrow `FELHOM_FORMAT` sudoers).
|
|
`SudoHostOps.InspectDevice(device)` → `DeviceProbe` (`blkid -p` signatures + `lsblk -J`
|
|
partitions/mount). **`DeviceProbe.DataBearing()` is conservative**: any filesystem / partition
|
|
table / partition / mount — OR a probe that did not read cleanly — is data-bearing (fail-safe).
|
|
- **`internal/localapi` — the §6 disk endpoints**, self-scoped (token→guest; cross-guest 403):
|
|
`GET /disks` (drives + data-bearing flag), `POST /disks/assign` (benign `EnsureMount`),
|
|
`POST /disks/eject` (benign `Unmount` + dependent guests), `POST /disks/format`.
|
|
**`/disks/format` is the centerpiece**: the agent inspects the device; blank → benign → `mkfs`;
|
|
**data-bearing → `ClassStorageWipe` → the slice-4 gate → `pending_signature` (refused)**. The
|
|
signed completion is slice 10. `storageGateAdapter` bridges to the gate (no new gate/crypto).
|
|
|
|
## Tests
|
|
|
|
`go test ./...` green; `-race` green (build server). localapi security matrix: blank → mkfs called,
|
|
gate not consulted; **data-bearing → 403, mkfs NEVER called**, gate consulted; ambiguous/unprobed →
|
|
fail-safe destructive; gate-allows still refuses in 8C; assign/eject; cross-guest 403; bad
|
|
device/fstype 400; unconfigured 503. storage: validators (whitelist + injection rejection),
|
|
`InspectDevice` (blank/fs/parttable/mounted/failed-probe-fail-safe), `Format` invokes the right mkfs.
|
|
|
|
## Live validation (demo-felhom)
|
|
|
|
A provisioned de-privileged controller (v0.37.0) drove the agent: `GET /disks` flagged the mounted
|
|
`felhom-usb` (`/dev/sdb1`) **`data_bearing: true`** and the LVM/PBS/dir storages false. `POST
|
|
/disks/format` on the mounted-vfat `/dev/sda2` → **403** `"device is data-bearing — format requires
|
|
operator authorization (pending_signature)"`; agent log `refusing format of a data-bearing device …
|
|
gate=pending_signature`; **`/dev/sda2` untouched**. Deployed to the standing demo service as v0.12.0.
|
|
|
|
## Deferred (stated, not built)
|
|
|
|
The operator-**signed completion** of a data-bearing wipe/format → **slice 10**. No spare blank
|
|
`/dev/sd*` on the demo to live-exercise an actual `mkfs` (won't format real disks — covered by unit
|
|
tests). No secrets committed.
|