docs: v0.86.0 copy-without-reveal + the break-glass credential leg is now proven (PVE ticket minted)

2026-07-31 09:24:24 +02:00
parent 80f473999e
commit 5825ceeabf
2 changed files with 25 additions and 1 deletions
@@ -8,6 +8,30 @@ neither half is useful alone. Live evidence:
 > deployed and validated in the same session; its durable record is `hub/CHANGELOG.md` v0.84.0 plus
 > `CONTEXT.md` ruling **S-4** and `documentation/backlog/` **R-133**.

+## 0. Follow-up shipped the same session — hub v0.86.0 (Copy without reveal)
+
+**The operator hit a real defect in the v0.84.0 Console access card and it cost a login.** Copy was
+`disabled` until a Reveal, so clicking it did **nothing, silently**; the clipboard kept its previous
+contents — **another host's console password** — which was pasted into demo-hp's PVE login. It failed
+with `password check failed for user (root)`, which reads exactly like a stale credential and sends
+you diagnosing the wrong thing.
+
+Diagnosis, read-only first: the vaulted password **matched the box's `/etc/shadow` hash**, the account
+was unlocked and non-expiring, no TFA, no `pam_faillock` — and then it **minted a real PVE ticket**
+(`POST /api2/json/access/ticket` → HTTP 200, `root@pam`, 367-char ticket). So the credential was
+always good; only the clipboard was wrong. **That also closes the leg §7 of this report listed as
+operator-only** — the capability-map row now records it.
+
+**v0.86.0** makes Copy work without revealing (the *safer* default — the secret never renders, so it
+cannot be shoulder-surfed or screenshotted) and closes three silent-failure branches in one eight-line
+function: the disabled no-op, a missing `navigator.clipboard`, and an **ignored `writeText()`
+rejection** that let the operator believe a refused write had succeeded. The success message now names
+the host, because the clipboard is fleet-wide and "copied" alone cannot say for which box.
+
+Tests 566 → 568, both pinning the regression; red-proof: re-adding `disabled` reproduces the shipped
+bug. Deployed and live-verified (`Synced/Healthy`, image `:0.86.0`, button served without `disabled`,
+retrieval URL defined exactly once, all four outcome messages present). Commits `670ec35` + `80f4739`.
+
 ## 1. Baselines

 | Repo | `main` @ start of this half | Version before → after |