hub v0.167.0 source (not built, not deployed): D31 — the F-14 PBS auto re-issue reads the newest deletion of a host that held a key, a keyless install between no longer blocks it (R-1205); D30 — the new key's handshake clears wg_tunnel_stale (pinned), wording; wire gate entry; Part 1 stray-copy 9202 evidence

2026-10-22 21:04:42 +02:00
parent 96ac07e168
commit 84751cb0ce
18 changed files with 517 additions and 13 deletions
@@ -259,9 +259,7 @@ ALLOWLIST = {
        "does not bite here. **Delete with its siblings.**"),


-    (_AH, "wireguard.last_handshake_age_s"): (
-        "redundant: hub-side wgsync reconciles peers from its own state, and the OOB path's own "
-        "wg_handshake_age_s IS now decoded (into HostOOBRow, for the alert text)."),
+    # wireguard.last_handshake_age_s left this list 2026-10-22 night: the hub reads it (api/host_tunnel.go, R-1204).

    # ---- R-319: guest_net AND ALL SEVEN CHILDREN ARE GONE FROM THIS LIST ----
    # They are no longer allowlisted because they are no longer unconsumed: the hub models the R-54