burndown 2: controller 0.322.0 released; R-1033, R-970, R-1103 closed; R-972 narrowed; R-1104, R-1105 filed

2026-10-16 19:10:08 +02:00
parent 9d6f3b4637
commit 7e1c6df3a0
32 changed files with 554 additions and 7 deletions
@@ -102,6 +102,11 @@ credentials.
 - The agent and the controller **poll** the hub; the hub never initiates inbound.
 - Operator actions are delivered as **signed jobs**: the agent verifies an operator signature
  before executing, so a compromised hub database alone cannot forge commands.
+- **[FACT, 2026-10-16, R-970]** The last contradiction is gone: until controller v0.322.0 the box's own hub API key,
+  sent as a Bearer token, opened `/api/config/` (read `controller.yaml` with every secret in it, and REPLACE it,
+  unsigned) and the self-update and geo routes. Nothing called them (the hub never connects to a box). The config
+  routes are removed and no route accepts the hub key; every `/api/` route needs a dashboard session (pinned by
+  `TestR970_HubKeyOpensNoDoor` on the real route table). The box exposes no control endpoint, as stated above.
 - All operator-initiated actions are recorded in a **customer-visible audit log**.

 ---