admin
fec2e8fd84
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
44 lines
3.2 KiB
Markdown
44 lines
3.2 KiB
Markdown
# REPORT — controller v0.107.0: offsite hardening (key-auth-first + staged-secret wipe) — DEPLOYED
|
|
|
|
**Date:** 2026-07-09 · **Class:** implementation. Baseline v0.106.1 → **v0.107.0** (live on guest 9201,
|
|
`Up (healthy)`, clean logs). Part of the offsite hardening bundle: pairs with **hub v0.39.0** (F4 re-issue +
|
|
F2 scan retry + F5 save UX) and **agent v0.78.0** (`DELETE /escrow/stage-secret`) — both also deployed live.
|
|
|
|
## What shipped (controller)
|
|
- **Key-auth-first bridge** (`internal/offsiteapply`): new `KeyAuthProber` seam + `SFTPKeyAuthProber` (probes
|
|
the already-installed key against the descriptor target, pinned to the freshly-scanned known_hosts,
|
|
BatchMode + 20s budget). On a descriptor change where the key still authenticates: re-pin + reconfigure
|
|
+ marker — **no consume, no install**. Kills the stale-descriptor consume-404 loop (seen twice in the live
|
|
e2e) and shrinks the F4 blast radius to genuinely-fresh guests. The probe NEVER weakens identity: scan +
|
|
fingerprint verify still precede it, and a mismatch refuses before any probe (test-asserted with a
|
|
panicking prober). Fresh guests fall through to the unchanged full path.
|
|
- **Staged-secret wipe:** `agentapi.WipeStagedEscrowSecret` (DELETE, agent ≥ v0.78.0); the confirm-escrow
|
|
handler wipes the agent-staged repo password on every flip to `escrowed` — best-effort (failure logs a
|
|
loud "NOT wiped" ERROR, never fails the confirm; re-confirm retries). Seam-injectable (`wipeStagedEscrowFn`).
|
|
|
|
## Tests + companion red-proofs (ALL-GREEN, both red-proofs fired)
|
|
- `TestBridge_KeyAuthFirstSkipsConsume` — probe-success: consumer PANICS if called; enabler gets the
|
|
EXISTING key + fresh pin; marker updated. **Red-proof:** deleted the key-auth-first block → the panicking
|
|
consumer fired → FAIL. Reverted.
|
|
- `TestBridge_FreshGuestFallsThroughToFullPath` — probe-fail: consume+install exactly once with the
|
|
GENERATED key. **Red-proof:** made probe-fail return early → `cons=0 inst=0` → FAIL. Reverted.
|
|
- `TestBridge_HostKeyMismatchRefuses` — now also proves the probe never runs on a failed identity check.
|
|
- `TestOffboxWeb_ConfirmWipesStagedSecret` — confirm wipes exactly once; a failing wipe still confirms +
|
|
logs "NOT wiped".
|
|
|
|
## Live validation (this deploy)
|
|
- v0.107.0 on 9201 healthy; the bridge no-ops on the unchanged descriptor (marker match — no probe needed).
|
|
- **One-off cleanup executed via the NEW endpoint:** the staged file left behind by the e2e's Option-A
|
|
confirm (`/var/lib/felhom-agent/escrow-stage/restic_repo_password`) was wiped through the controller
|
|
container → agent `DELETE /escrow/stage-secret` → `{"removed":true}`; the file is GONE on felhom-pve, and
|
|
an idempotent re-wipe returned `{"removed":false}`. Token handled in a shell var only.
|
|
|
|
## NOT exercised live
|
|
Hub F4 re-issue (would reset a real credential — the demo's working offsite must not be touched; a live
|
|
exercise needs a throwaway customer under supervision). Unit-tested with the exactly-1-scope red-proof.
|
|
F5 (submit-disable JS) ships in the hub template — visible on the next operator save.
|
|
|
|
## NEXT
|
|
SLICE 3 (escrow auto-confirm — inherits the wipe-on-escrowed), SLICE 4 (soft-quota), NEW-box restore
|
|
round-trip → retire the old-box archive, Peti onboarding runbook.
|