diff --git a/REPORT-doorstep-1271.md b/REPORT-doorstep-1271.md index 6e708e18..a13ba6ec 100644 --- a/REPORT-doorstep-1271.md +++ b/REPORT-doorstep-1271.md @@ -82,9 +82,13 @@ Opened **R-502 … R-508** (7). Closed **R-497**. Fixed awaiting publish **R-496 ## 8. Teardown Layers 1–2 done (VMs 331/332 destroyed; ≈12.8 GiB back on `nvme-scratch`; both ISOs and `/root/doorstep` -gone; 9201/9202 untouched). Layer 3: appliance 27 discarded; host `tester-1-8603a2` delete pending its -stale window (see the follow-up commit). **Customer `tester-1` KEPT.** Left on ep0 by the DR tier: -namespace `tester-1`, token `felhom@pbs!tester-1` — retained with the customer for the operator's ruling. +gone; 9201/9202 untouched). Layer 3: appliance 27 discarded (16:20Z); host `tester-1-8603a2` stale at 16:46:43Z (a true +`host_stale` operator mail), deleted 16:46:52Z (`host deleted: tester-1-8603a2 (escrow deleted: false)`; +host page 404, gone from `/hosts`); its ep0 WireGuard peer `10.77.0.5` removed at the 16:49:13Z push +(0 left, control peer 1). **Customer `tester-1` KEPT** (page 200). **Left on ep0 by the DR tier, read-only +check 16:51Z:** namespace `tester-1` exists with **2 directories inside — backup data from the test box**, +plus token `felhom@pbs!tester-1`. Not removed: ep0 is protected, and the only product path (customer +RESET) would also remove the tunnel. Retained for the operator's ruling. The hub's event stream and three operator mails are append-only and stay. ## 9. Observations diff --git a/STATUS.md b/STATUS.md index 348c4b2b..79e90856 100644 --- a/STATUS.md +++ b/STATUS.md @@ -28,8 +28,9 @@ have public hostnames? **If you do nothing:** a volunteer on a network like ours dashboard. (2) **Put the volunteer's e-mail on their customer record.** **If you do nothing:** they get no setup code. (3) **Say yes or no to publishing installer 1.27.1** — only after (1) is sorted, by the rule you set. **If you do nothing:** the old installer stays online, with the English admin line on screen. -(4) **The test left a backup namespace for „Tester 1" on the off-site server**, created by its DR setting; -removing it would also remove the customer's tunnel. **If you do nothing:** it stays, empty. +(4) **The test left backup data for „Tester 1" on the off-site server**, written by its DR setting +from the test box (now destroyed); removing it the product's way would also remove the customer's +tunnel. **If you do nothing:** it stays and uses a little space on the off-site server. --- diff --git a/documentation/audits/DOORSTEP-walk-1270-2026-09-14.md b/documentation/audits/DOORSTEP-walk-1270-2026-09-14.md index 49f350f5..af3b609b 100644 --- a/documentation/audits/DOORSTEP-walk-1270-2026-09-14.md +++ b/documentation/audits/DOORSTEP-walk-1270-2026-09-14.md @@ -98,8 +98,8 @@ Closed with this evidence: **R-497** (hub v0.113.0 live). Fixed, awaiting publis Layers 1–2 measured in `teardown-layers-1-2.txt` (VMs 331/332 destroyed; `nvme-scratch` used 23 528 192 → 10 132 924 KiB; `local` 26 489 992 → 23 033 320 KiB; ISOs and `/root/doorstep` gone; 9201/9202 running; `local-lvm` 44.17 % unchanged). Layer 3 in `teardown-layer3-hub.txt`: appliance 27 discarded; host -`tester-1-8603a2` deleted once stale (**customer `tester-1` is KEPT** — the operator's fixture; a RESET or -DELETE would remove its tunnel and zone). **Left on ep0 by design of the DR tier, named:** namespace -`tester-1` and token `felhom@pbs!tester-1`, provisioned at enrolment; a host delete does not deprovision -tenancy — only the customer RESET does, which would also remove the tunnel. Disposition: retained with -the customer, for the operator to rule. +`tester-1-8603a2` deleted at 16:46:52Z once stale; its ep0 peer gone at the 16:49:13Z push (**customer +`tester-1` is KEPT** — the operator's fixture; a RESET or DELETE would remove its tunnel and zone). **Left on +ep0 by the DR tier, measured read-only:** namespace `tester-1` with **2 directories of backup data** and +token `felhom@pbs!tester-1`; a host delete does not deprovision tenancy — only the customer RESET does, +which would also remove the tunnel. Disposition: retained with the customer, for the operator to rule. diff --git a/documentation/audits/evidence-doorstep-walk-1270-2026-09-14/teardown-layer3-hub.txt b/documentation/audits/evidence-doorstep-walk-1270-2026-09-14/teardown-layer3-hub.txt index fc71e367..c8668da6 100644 --- a/documentation/audits/evidence-doorstep-walk-1270-2026-09-14/teardown-layer3-hub.txt +++ b/documentation/audits/evidence-doorstep-walk-1270-2026-09-14/teardown-layer3-hub.txt @@ -6,3 +6,18 @@ HTTP/1.1 303 See Other Location: /hosts?flash=appliance_discarded 332 MAC still on hosts page: 0 host tester-1-8603a2 delete-impact: {"deletable":false,"escrow_present":false,"guests":1,"log_bundles":0,"pbs_secret_present":true,"recovery_present":true,"reports":3,"status":"ok","wg_peer_bound":true} +=== host delete 2026-09-14T16:46:52Z +impact: {"deletable":true,"escrow_present":false,"guests":1,"log_bundles":0,"pbs_secret_present":true,"recovery_present":true,"reports":3,"status":"stale","wg_peer_bound":true} +ep0 peer 10.77.0.5 before: 1 +HTTP/1.1 303 See Other +Location: /hosts +host page: 404 +customer page tester-1 (must stay): 200 +tester-1 on /hosts: 0 +2026/09/14 18:46:43 [INFO] Host staleness: tester-1-8603a2 ok → stale (host_stale) +2026/09/14 18:46:44 [INFO] Operator email sent for tester-1/host_stale +2026/09/14 18:46:53 [INFO] host deleted: tester-1-8603a2 (escrow deleted: false) +=== ep0 read-only 2026-09-14T16:51:13Z +2026/09/14 18:49:13 [INFO] wgsync: pushed 4 peers to 167.233.158.164:22 +peer 10.77.0.5: 0 control 10.77.0.3: 1 +namespace dirs named tester-1: 1 snapshots inside: 2