From 09bd7191e04530d801203827674e4b40a4dd8949 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Fri, 10 Jul 2026 00:25:57 +0200 Subject: [PATCH] =?UTF-8?q?docs:=20SLICE=204=20=E2=80=94=20hub=20README,?= =?UTF-8?q?=20REPORT,=20CONTEXT=20(offsite=20arc=20build-complete)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6 --- CONTEXT.md | 13 +++++++++++++ REPORT.md | 53 +++++++++++++++++++++++++++------------------------ hub/README.md | 9 ++++++++- 3 files changed, 49 insertions(+), 26 deletions(-) diff --git a/CONTEXT.md b/CONTEXT.md index 04ca582..a21b65f 100644 --- a/CONTEXT.md +++ b/CONTEXT.md @@ -3,6 +3,19 @@ > Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub), > `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`. +- **2026-07-10 — SLICE 4 soft-quota + offsite health SHIPPED+LIVE (hub v0.41.0 + controller v0.109.1) — + the offsite arc is BUILD-COMPLETE.** Controller: `quota_gb` rides the descriptor into the target (hash + includes it → quota changes re-apply via key-auth-first, no consume); `repo_size_bytes` from restic + stats; pre-run gate (≥100% refuses NEW backups Hungarian-loudly, **prune still runs** — red-proofed; + restore never gated; ≥80% warns); /backups usage bar. Hub: `monitor.OffsiteChecker` (fill 90/95 of + quota + `offsite_stale` >48h for enabled+escrowed only — red-proofed; nil-safe on old reports) + + **manual-only Freeze/Unfreeze lever** (readonly on the exactly-1 labelled sub-account, SSH preserved). + **Live:** key-auth-first proven against the real box (the deploy's own re-apply); that re-apply exposed + + fixed v0.109.1 (re-apply must preserve EscrowState + runtime status — it demoted the escrowed demo); + demo repaired (manual confirm + run: escrowed, 45 MB / 50 GB, checker healthy 0 events, usage bar + renders). Freeze + 100%-refusal NOT live-exercised (STOP; red-proofs cover). NEXT: Peti onboarding + runbook, NEW-box restore round-trip → old-box retirement. + - **2026-07-09 — SLICE 3 hub-verified escrow auto-confirm SHIPPED+LIVE (hub v0.40.0 + controller v0.108.0 + agent v0.79.0).** Replaces the operator-trust confirm with a verified fact: ceremony hashes the sealed repo password (agent, `restic_pw_sha256,omitempty` on the escrow upload — contract test moved in lockstep) diff --git a/REPORT.md b/REPORT.md index 4761811..150959f 100644 --- a/REPORT.md +++ b/REPORT.md @@ -2,33 +2,36 @@ > **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md). -## TASK — offsite SLICE 3: hub-verified escrow auto-confirm — 2026-07-09 — DEPLOYED +## TASK — offsite SLICE 4: soft-quota + health monitoring + freeze lever — 2026-07-10 — DEPLOYED -**Shipped (felhom.eu):** hub **v0.40.0** `49d1233` + bump `c24d4af` — LIVE (Synced/Healthy). Chain pairs: -agent **v0.79.0** (felhom-pve, 56/56) + controller **v0.108.0** (9201, healthy) — all live. Operator-free -task (Viktor ran nothing). +**Shipped (felhom.eu):** hub **v0.41.0** `fad5573` + bump `04826c9` — LIVE (Synced/Healthy, "Offsite +checker initialized"). Pairs with controller **v0.109.1** (9201, healthy). The offsite arc's last build +item; operator-free (Viktor ran nothing). -**The verification chain:** the ceremony hashes the staged repo password it seals (agent) → the hub stores -`restic_pw_sha256` alongside the escrow blob (additive migration; NULL on legacy rows) and serves -`escrow:{identity_blob_present, restic_pw_sha256, created_at}` in the **report ACK** → the controller flips -offbox `EscrowState` pending→escrowed ONLY on `sha256(local repo_password)` match. **Blob-presence alone -never confirms** — a stale blob (re-provision/inject/history) would be a false custody claim re-opening the -fork-4 gap; this is the red-proofed core (blob-present-only check → stale-blob test flips → FAIL). -Mismatch → pending + loud warn naming the ceremony (deduped per hash); never un-confirms. On flip the -agent-staged secret is wiped (v0.107.0 path). The two hashers are pinned by the SAME cross-repo test vector -(trimmed-string sha256). Manual confirm-escrow → documented deprecated fallback for legacy hash-less blobs. +**Hub changes:** +- **`monitor.OffsiteChecker`** — sibling of StorageFillChecker over the controller report's new `offsite` + object: fill warn/crit at 90/95% of `quota_gb` (quota 0 = dedicated, silent) + `offsite_stale` (warning) + for enabled+**escrowed** targets with no run >48h/never — the silently-stuck detector (recently-FAILING + runs are `backup_failed`'s signal; pending/disabled never alert — **red-proofed**: dropping the + escrowed-only filter made the pending customer alert → FAIL). Nil-safe on pre-v0.109 reports; + same-second latest-report ties processed once per sweep. +- **Freeze lever:** `Provisioner.SetOffsiteFrozen` — flips ONLY `readonly` on the exactly-1 labelled + sub-account (SSH preserved — tested; ambiguity refuses); confirm-gated **Freeze/Unfreeze** buttons next + to Re-issue (shared only). **MANUAL only, never automatic** — freezing also blocks prune, the customer's + only way down from over-quota. -**Hub specifics:** `host_escrow.restic_pw_sha256` migration; `SaveHostEscrow`/`HostEscrow`/`GetHostEscrow` -NULL-safe; `GetEscrowStatusForCustomer` (hosts⋈host_escrow, latest-updated wins); ACK object omitted when -no escrow row (fresh customers stay silently pending); `TestEscrowUploadContract` mirrors agent v0.79.0. +**Live verification (free checks, real pipeline):** the controller deploy's re-apply exercised +**key-auth-first live** (re-pinned, zero password consumed) and surfaced a real bug — the re-apply demoted +the escrowed demo to pending + wiped runtime status → **fixed as controller v0.109.1** (re-apply preserves +custody + status; red-proofed), demo repaired (manual confirm — truthful, same escrowed password — + a +run). The next report carried the full offsite object (`escrowed`, 45 MB / 50 GB, fresh run); the +**checker held it healthy (0 offsite_* events)**; the `/backups` usage bar renders +"Tárhelykeret: 43.2 MB / 50 GB (0%)". -**Live state check (no operator action):** migration applied on the production DB — all 3 legacy rows -(demo included) read hash-NULL; the demo's `escrowed` target produced **zero** `escrow-confirm` controller -log lines after reports through the new hub (Scenario E — never-revisit — proven live for free); no hub -errors. +**NOT live-exercised (per the STOP):** the freeze (would write-lock the demo's working offsite) and the +100% refusal (demo is at 0.08%) — unit red-proofs cover both. -**NOT yet live-exercised:** the full happy chain (fresh enable → ceremony records the hash → ACK → -auto-flip) — the first real offsite enable (Peti onboarding) proves it; unit red-proofs carry the logic. - -**NEXT:** SLICE 4 (soft-quota on `quota_gb`), Peti onboarding runbook (live-exercises auto-confirm + F4 -re-issue), NEW-box restore round-trip → retire the old-box archive. +**The offsite arc is now build-complete:** provisioning (S1/S2) → hardening (F1–F5, key-auth-first, wipe) +→ auto-confirm (S3) → quota + health (S4). **NEXT:** the Peti onboarding runbook (live-exercises +auto-confirm + F4 + fresh-provision quota end-to-end), NEW-box restore round-trip → retire the old-box +archive. diff --git a/hub/README.md b/hub/README.md index 80597bd..2db6348 100644 --- a/hub/README.md +++ b/hub/README.md @@ -94,7 +94,14 @@ the explicit recovery for a consumed-password dead-end — resets ONLY the resou stores it on `host_escrow` (NULL on legacy rows) and serves `escrow:{identity_blob_present, restic_pw_sha256, created_at}` in the **report ACK**; the controller auto-confirms its pending offbox escrow ONLY on a hash match with its current repo password (blob-presence -alone never confirms). SLICE 4 (soft-quota) follows. +alone never confirms). +**SLICE 4 (v0.41.0) — offsite health monitoring + freeze lever:** `monitor.OffsiteChecker` reads the +controller report's `offsite` object — fill alerts at 90/95% of `quota_gb` (quota 0 = dedicated, silent) +and an `offsite_stale` warning when an enabled+escrowed target has no run in >48h (the silently-stuck +detector; run FAILURES are `backup_failed`'s job; pending/disabled never alert). Nil-safe on pre-v0.109 +reports. The operator **Freeze/Unfreeze offsite** buttons (shared model only, next to Re-issue) flip ONLY +`readonly` on the exactly-1 labelled sub-account — MANUAL only, never automatic (freezing also blocks +prune, the customer's only way down from over-quota). ### Infrastructure Backup — RETIRED (Phase-1, 2026-06-16, hub v0.12.0)