v0.289.0: off-site key cannot delete — append-only rclone transport, box sends only its public key (hub registrar), retention only inside a hub window behind the fake-snapshot guard (decisions 68-69, R-820, R-822)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-10-03 17:01:36 +02:00
parent 09453325d1
commit 55bb6c3d32
15 changed files with 1039 additions and 386 deletions
@@ -68,18 +68,18 @@ func (c *fakeClock) sleep(_ context.Context, d time.Duration) {

 // settleBridge builds a bridge wired for a FULL Reconcile (so a released gate consumes exactly once)
 // plus the injectable settle-gate. Prober is nil → the fresh consume+install path runs on release.
-func settleBridge(t *testing.T, s *fakeSettle, clk *fakeClock) (*Bridge, *fakeConsumer, *bytes.Buffer) {
+func settleBridge(t *testing.T, s *fakeSettle, clk *fakeClock) (*Bridge, *fakeRegistrar, *bytes.Buffer) {
 	t.Helper()
 	cfg := &config.Config{}
 	cfg.Offsite = goodOffsite()
-	cons := &fakeConsumer{pw: "the-transient-pw"}
+	cons := &fakeRegistrar{}
 	var logbuf bytes.Buffer
 	b := &Bridge{
 		Cfg:        cfg,
-		Consumer:   cons,
+		Registrar:  cons,
 		Scanner:    &fakeScanner{fp: "SHA256:goodfp", line: "[h]:23 ssh-ed25519 AAAAKEY"},
-		KeyGen:     &fakeKeyGen{priv: "PRIVPEM", pub: "ssh-ed25519 AAAAPUB felhom"},
-		Installer:  &fakeInstaller{},
+		KeyGen:     &realKeyGen{priv: testPriv, pub: testPub},
+		Prober:     &fakeProber{reg: cons, pinnedAfterRegister: true},
 		Enabler:    &fakeEnabler{},
 		MarkerPath: filepath.Join(t.TempDir(), "offbox", "applied_marker"),
 		Logger:     log.New(&logbuf, "", 0),