admin
994e15896f
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
41 lines
2.9 KiB
Markdown
41 lines
2.9 KiB
Markdown
# REPORT — controller v0.108.0: SLICE 3 hub-verified escrow auto-confirm — DEPLOYED
|
|
|
|
**Date:** 2026-07-09 · **Class:** implementation. Baseline v0.107.0 → **v0.108.0** (live on 9201,
|
|
`Up (healthy)`). The chain pairs: **agent v0.79.0** (ceremony uploads `restic_pw_sha256`) + **hub v0.40.0**
|
|
(stores it; report ACK serves `escrow:{identity_blob_present, restic_pw_sha256, created_at}`) — both live.
|
|
|
|
## What shipped (controller)
|
|
`report.EscrowAutoConfirmer` — runs on every report ACK; flips offbox `EscrowState` pending→escrowed ONLY
|
|
when `sha256(local repo_password) == restic_pw_sha256` from the ACK. Verifies the RIGHT fact: not "a blob
|
|
exists" but "the blob covers the CURRENT key" (a stale blob — re-provision, inject, drive history — must
|
|
never truthfully-claim; that would re-open the exact un-recoverable-ciphertext gap fork-4 closed).
|
|
- Match → flip + wipe the agent-staged secret (the v0.107.0 DELETE path; best-effort, loud on failure).
|
|
- Mismatch → stays pending + LOUD warn naming the fix ("run the escrow ceremony"), deduped per distinct
|
|
hash (not per 15-min cycle).
|
|
- No row / NULL hash / hash-without-identity-blob / no local password file → silently pending (fail-closed).
|
|
- Non-pending → total no-op — **auto-UN-confirm does not exist**.
|
|
- `backup.HashResticPassword` (canonical: sha256 hex of the TRIMMED string) + `Manager.OffboxRepoPasswordHash`;
|
|
**pinned cross-repo test vector** (same in felhom-agent) so the two hashers can never drift silently.
|
|
- Manual `POST /backup/offbox/confirm-escrow` → documented **deprecated fallback** (legacy hash-less blobs).
|
|
|
|
## Tests + companion red-proof (ALL-GREEN, red-proof fired)
|
|
Scenarios: A match→flip+wipe (+repeat ACK no-op); B stale-blob stays pending + warn-once-per-hash (+new
|
|
hash warns again); C all silent-pending cases; E never acts outside pending (even a mismatch on an escrowed
|
|
target is silent); wipe-failure keeps the confirm. **Red-proof:** modeled the blob-present-only check → the
|
|
stale-blob AND hash-less scenarios flipped when they must not → both tests FAILED. Reverted.
|
|
Pinned vector + trim convention asserted in `internal/backup` (mirrors the agent's).
|
|
|
|
## Live state check (deployed, no operator action)
|
|
Hub 0.40.0 Synced/Healthy; migration applied (`host_escrow.restic_pw_sha256` present; all 3 legacy rows
|
|
NULL — demo included). Controller 0.108.0 healthy; the startup report went through the new hub and the
|
|
demo's `escrowed` state produced **zero `escrow-confirm` log lines** — Scenario E proven live for free.
|
|
Agent 0.79.0 on felhom-pve (56/56 capabilities).
|
|
|
|
## NOT yet live-exercised
|
|
The full auto-confirm chain (fresh enable → ceremony records the hash → ACK → auto-flip) — first real
|
|
offsite enable proves it (Peti onboarding runbook). Unit red-proofs carry the logic per the task.
|
|
|
|
## NEXT
|
|
SLICE 4 (soft-quota on `quota_gb`), Peti onboarding runbook (will live-exercise auto-confirm + F4),
|
|
NEW-box restore round-trip → retire the old-box archive.
|