docs(pilot): GL-6 Phase 3 PASS — armed-key update round-trip (real op key)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
2026-07-08 15:19:36 +02:00
parent 9dfa247e04
commit 37fafd04f0
1 changed files with 36 additions and 1 deletions
@@ -225,6 +225,41 @@ via the box's broken dnsmasq (F6) was failing.)
  UNAUTHENTICATED (the known G10 exposure, now confirmed live). Geo-restriction also OFF. **Operator
  leg pending:** Viktor sets the dashboard password via the hub, then CC verifies login is enforced.

-## Gate 2 — [Viktor]: <pending — install+F4+drive-reenroll all green; password-set (operator/hub) is the last 2b leg>
+## Gate 2 — [Viktor]: **GO** — Peti's byo path live-proven end to end
+
+Green: anonymous fetch, sha-verified 0.76.0 + 0.103.0, signers ARMED from first boot, caps applied,
+no root@pam touched, controller healthy, drive re-enrolled additively with pre-drill data intact.
+F4 found + fixed (v1.11.3) + live-proven. **Deferred to GL-7 with Peti:** the dashboard password
+(operator-set via hub — G9) + geo-restriction; **G10 (open dashboard until the operator sets a
+password) is now a GL-7 onboarding prerequisite.** Findings F1/F2/F3/F6 → post-drill installer pile.
+
+## Phase 3 — armed key end-to-end (the only leg that needed real keys)
+
+**PASS — the armed-key chain proven both directions with the REAL operational key.**
+
+- 3a: drill agent **0.76.1** published (sha `ff18972f…aed16c`), version-only bump, throwaway.
+- **Delivery mechanism (deviation from the [CC] tag, recorded):** the hub pod is a minimal image
+  (no sqlite3/python — only the felhom-hub binary) and the admin-enqueue API is GLOBAL-key gated, so
+  CC cannot inject the signed job. `felhom-opsign` has a built-in `-upload`+`-hub-key`, so the sign +
+  enqueue is ONE operator command (Viktor's secrets stay in it). The `-hub-key` is the hub's
+  **`report_api_key`** (live ConfigMap == committed `manifests/hub.yaml:77`; the operator/global key,
+  NOT the web-UI login) — a point of confusion worth a GL-7 note.
+- 3b/3c FORWARD (0.76.0→0.76.1): `felhom-opsign -op agent_update -host demo-felhom-01 -key-id
+  felhom-op-1 -agent-version 0.76.1 -sha256 ff18972f… -key <op-priv> -upload https://hub.felhom.eu
+  -hub-key <report_api_key>`. Agent (restart-forced poll) → audit `gate decision class=agent_update
+  disposition=destructive allowed=true reason=signed key_id=felhom-op-1 nonce=4176e8e0…` → download
+  (anon Gitea) → sha re-verify → `felhom-selfupdate-guarded apply` A/B flip → `new version running
+  0.76.1 prev=0.76.0 dwell=1m0s` → `update committed version=0.76.1`. `.prev`=0.76.0 retained;
+  crash-guard silent.
+- RETURN (0.76.1→0.76.0): same with the 0.76.0 published sha `9828c5f7…` + a FRESH nonce → committed
+  back to **0.76.0** (the manifest-vouched version; sha confirmed). Double round-trip = sign→verify→
+  nonce→swap proven twice with the real key.
+- 3d: 0.76.1 package DELETED (HTTP 204 → 404 anon). Box ends at 0.76.0, daemon active.
+
+**Key validation leg 4 (the whole point of GL-1's key-pin): the pinned operational key actually
+authorizes a real signed op end-to-end.** Combined with legs 1–3 (box==repo==manager fingerprints,
+armed-from-first-boot), the operator-signed self-update path is fully live-validated.
+
+## Gate 3 — [Viktor]: <pending>

 *(Phases 3–6 appended as they run.)*