burn-down night: hub v0.138.0 source (R-879 seal + roll-back, R-136, R-283, R-349/R-276 hub halves), gates R-315/R-422 closed, R-325/R-426 partial, decisions 132-133, 05 §16 (195 -> 193)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-10-05 21:48:25 +02:00
parent 0a460bcdea
commit 8925dcc633
6 changed files with 90 additions and 16 deletions
@@ -913,6 +913,19 @@ its length, and both fixes cost something the household would notice — operato
     (a 75 GiB drill box) and changes a behaviour operators rely on, with no measured floor behind 120. **Chosen (a)**;
     reversible by renaming back. Whether a REAL floor exists is unmeasured. Installer 1.32.0 (`installer-v1.32.0`, not cut).

+132. **A hub with no sealing key, asked to write a NEW box secret (R-879).** Options: (a) refuse — enrolment, customer
+     creation, passphrase regeneration and a PBS mint fail until the key is back, existing boxes unaffected; (b) write it
+     in plaintext — silently re-creates the readable secret the row removes. **Chosen (a)**: `05` §16.2 already says
+     „no key → a save is refused" for every sealed column, and the production hub runs with the key. The box lookup is
+     an UNKEYED hash so that authentication never depends on the key. Hub v0.138.0.
+133. **What removing a household's own off-site target does to its repository password (R-729, R-545).** Options: (a)
+     shred it always — a hub-held package then hits the R-241 mint refusal, and history on the NAS loses its on-box key;
+     (b) refuse the whole press while the hub holds a package — refused on practically every box, R-729 unsolved; (c)
+     clear the target, SSH key and known-host line always; keep the password whenever anything could depend on it (a
+     hub package, escrowed, a successful run, snapshots), delete it otherwise. **Chosen (c)**: R-241's rule (never drop
+     a key a package protects) and „never the repository"; keeping a key is reversible, deleting it is not. Cost: on
+     most boxes the 0600 password file stays with no target. `07`. Controller (next release).
+
 ### 2026-10-05 (~21:00) — three rulings, the reviewer's picks given to the operator (recorded before the work; the burn-down night)

 128. **R-126 — a `.fab` export onto a network drive.** **Refuse an export WITHOUT a password to any network drive; with