From 50a7ffacd2a305a8e61c2fd6bcb65e998dec23c9 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Tue, 21 Jul 2026 10:53:15 +0200 Subject: [PATCH] =?UTF-8?q?docs(report):=20STOP-2=20DONE=20+=20PROVEN=20?= =?UTF-8?q?=E2=80=94=20the=20R-39=20chain=20closed=20in=2013=20seconds?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- REPORT.md | 42 +++++++++++++++++++++++++++++------------- 1 file changed, 29 insertions(+), 13 deletions(-) diff --git a/REPORT.md b/REPORT.md index 0a49bcf..939c9af 100644 --- a/REPORT.md +++ b/REPORT.md @@ -17,24 +17,40 @@ STOP-1 evidence and the four red-proofs). | Hub v0.68.1 | **SHIPPED + DEPLOYED** — fixes the Configuration layout the v0.68.0 field broke | | STOP-1 | done + verified | | **STOP-3 — manifest save** | **DONE by the operator 2026-07-21 08:31:12Z.** All six fields persisted, including `artifact_wrapper_sha256 = 104db0a4…` (matches the agent's reported hash → drift gauge reads **ok**) and `artifact_min_agent = 0.91.2`. | -| **STOP-2 — live re-issue** | **NOT DONE — the wrong Re-issue was pressed.** The hub recorded `offsite_reissued` (the restic/Hetzner offsite credential), not the PBS-DR one. Evidence: `host_pbs_secrets` is untouched (created + consumed 2026-07-18, `generation = 0`) and the `pbs_dr` descriptor still carries **no** `secret_generation` key. See §STOP-2 below. | +| **STOP-2 — live re-issue** | **DONE + PROVEN 2026-07-21.** Chain closed in **13 seconds**; see below. | -## STOP-2 — what actually happened, and the side effect +## STOP-2 — the proof (the whole task's reason to exist) -The button pressed was the **offsite** re-issue, not **PBS DR**. Hub events at 08:29:29Z: -`offsite_reissued` followed immediately by `escrow_stale` -("A helyreállítási kulcs-letét elavult az offsite jelszó cseréje miatt"). +The operator pressed **Re-issue PBS credentials**. The identical click on 2026-07-18 did nothing. -**Consequence that needs an action:** rotating the offsite restic password makes the escrow blob seal -a password that no longer opens the repo, so the hub correctly stops advertising "ceremony done" -(the designed v0.57.0 `stale_at` behaviour — not a bug, but a real follow-up). **The recovery-code -ceremony has to be re-run** before the offsite leg is trustworthy again. +``` +hub 08:39:31Z fresh mint, generation 0 -> 1 + descriptor gains "secret_generation": 1 + (token_id + fingerprint BYTE-IDENTICAL — the re-key shape that was invisible) +agent 10:39:34 felhom-pbs-apply read felhom-pbs <- leg (b): the read that was impossible +agent 10:39:38 ERROR "REJECTED ... applied and DEAD" previous_state=applied + <- leg (c): the R-39 state, loud at last +hub 08:39:45Z consumed_at stamped +agent 10:39:45 "one-time token secret consumed" secret_len=36 + <- leg (a): NO short-circuit +agent 10:39:45 felhom-pbs-apply reconcile (set-only, no --server) +agent 10:39:47 "pbsdr: converged" state=applied +``` -**PBS-DR is untouched and healthy** — a live probe with the stored credential still returns 200 and -the secret file's mtime is unchanged (2026-07-18 20:28:52), which is exactly consistent with "no PBS -re-key happened". +(host CEST = UTC+2; hub timestamps UTC.) -The R-39 proof therefore still needs the **PBS DR** re-issue specifically. +**Corroboration:** the agent marker hash moved to `afbb3b41…` — in the failure it was *byte-identical* +to the pre-reissue marker, which was the single-line proof of the defect. `consumed_at` stamped. The +on-disk secret's mtime moved `2026-07-18 20:28:52` → `2026-07-21 10:39:45`. A live probe with the NEW +credential returns **200**. Three consecutive hub reports trace the entire state machine +`applied → auth_failed → applied`. **Zero** `pbsdr_selfheal` escalations fired, with exactly ONE mint, +ONE consume and no `consumed-failed.json` — the box healed through the descriptor path before the +damper was ever needed. + +**First attempt, worth recording:** the operator initially pressed the **offsite** re-issue — there are +two distinct Re-issue actions and my instruction said only "press Re-issue". Harmless to PBS-DR, but it +rotated the restic password and correctly marked the escrow **stale**, so the recovery-code ceremony +had to be re-run (done). Name the surface explicitly in future runbook steps. ## What shipped hub-side