hub v0.135.0: CSRF on the Basic-auth path (R-135), console passwords sealed at rest (R-133), boxes left behind listed and alarmed (R-604, R-530), no-e-mail banner (R-508)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

hub/cmd/hub/main.go

@@ -201,6 +201,12 @@ func main() {
 		} else {
 			logger.Printf("[INFO] off-site secrets sealed at rest (%d legacy plaintext row(s) sealed now)", n)
 		}
+		// R-133 (v0.135.0): the break-glass console passwords use the same key and the same seal.
+		if n, serr := dataStore.SealLegacyRecoverySecrets(); serr != nil {
+			logger.Printf("[ERROR] sealing legacy console passwords failed after %d row(s): %v", n, serr)
+		} else {
+			logger.Printf("[INFO] console passwords sealed at rest (%d legacy plaintext row(s) sealed now)", n)
+		}
 	}
 	logger.Printf("[INFO] Database opened at %s", dbPath)
 
@@ -321,6 +327,7 @@ func main() {
 	webServer.SetAssetManager(assetsMgr)
 	webServer.SetClaimEngine(claimEngine)   // v0.50.0 — Setup-tab claim chip + resend button
 	webServer.SetSelfBindMailer(dispatcher) // v0.66.0 (R-27) — customer self-bind link button (sibling of claim mailer)
+	webServer.SetEventEmitter(dispatcher.ProcessEvent) // v0.135.0 (R-604) — the "floor raise skipped boxes" mail
 	// Day-0 artifact version dropdowns: let the operator pick a version and have the hub derive the
 	// sha256 from Gitea (no hand-copied checksums). Reuses the registry creds; degrades to manual text
 	// entry when they're absent.
@@ -453,6 +460,7 @@ func main() {
 		{"OS_ALARM_RING0_STALL_AFTER", &osSvc.Ring0StallAfter, 7 * 24 * time.Hour},
 		{"OS_ALARM_NOT_COVERED_AFTER", &osSvc.NotCoveredAfter, 14 * 24 * time.Hour},
 		{"OS_ALARM_BUNDLE_BEHIND_AFTER", &osSvc.BundleBehindAfter, 7 * 24 * time.Hour},
+		{"OS_ALARM_AGENT_BEHIND_AFTER", &osSvc.AgentBehindAfter, 7 * 24 * time.Hour},
 	} {
 		*a.dst = a.def
 		if v := os.Getenv(a.env); v != "" {

hub/cmd/hub/r133_wiring_test.go

@@ -0,0 +1,51 @@
+package main
+
+import (
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"testing"
+)
+
+// R-133 seam wiring: main() must CALL SealLegacyRecoverySecrets (a comment or a string does not count —
+// the AST is walked). Without the call, every console password written before v0.135.0 stays in plaintext.
+// RED-PROOF: comment the call out → this test fails.
+func TestR133_MainSealsLegacyRecoverySecrets(t *testing.T) {
+	f, err := parser.ParseFile(token.NewFileSet(), "main.go", nil, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	found := false
+	ast.Inspect(f, func(n ast.Node) bool {
+		if c, ok := n.(*ast.CallExpr); ok {
+			if sel, ok := c.Fun.(*ast.SelectorExpr); ok && sel.Sel.Name == "SealLegacyRecoverySecrets" {
+				found = true
+			}
+		}
+		return true
+	})
+	if !found {
+		t.Fatal("cmd/hub/main.go never calls SealLegacyRecoverySecrets — legacy console passwords stay in plaintext")
+	}
+}
+
+// R-604 seam wiring: main() must hand the web server the dispatcher (SetEventEmitter), or the "floor raise skipped
+// boxes" mail is logged and never sent. RED-PROOF: delete the call → this test fails.
+func TestR604_MainWiresTheWebEventEmitter(t *testing.T) {
+	f, err := parser.ParseFile(token.NewFileSet(), "main.go", nil, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	found := false
+	ast.Inspect(f, func(n ast.Node) bool {
+		if c, ok := n.(*ast.CallExpr); ok {
+			if sel, ok := c.Fun.(*ast.SelectorExpr); ok && sel.Sel.Name == "SetEventEmitter" && len(c.Args) == 1 {
+				found = true
+			}
+		}
+		return true
+	})
+	if !found {
+		t.Fatal("cmd/hub/main.go never calls webServer.SetEventEmitter — the R-604 mail is never sent")
+	}
+}