hub v0.115.0: host_* mails skip the quiet hour (ruling 2, R-529); ruling 1 recorded (CC may sign agent_update until the first paying customer)

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-09-16 10:53:22 +02:00
parent 351296114c
commit 926723749d
6 changed files with 60 additions and 6 deletions
@@ -101,6 +101,18 @@ instructions.
 just set sizing + a threshold policy**, addable later without a redesign (Phase 4 §8). Out of scope
 now.

+### 3.1 Where the keys live, and who may sign, TODAY [operator ruling 1, 2026-09-16]
+
+The two-key model above is unchanged. What the ruling settles is custody and reach **for this phase
+only**: both keys sit on DooPlex at `/mnt/5_hdd/felhom.eu/felhom-op-operational` and
+`felhom-rec-recovery` (plus `felhom_op_ed25519`), **0600, owner `kisfenyo`** — they arrived 0664 on
+2026-09-15 and were tightened the same day (R-533). **CC may sign `agent_update` ops with the
+operational key until the first PAYING customer exists; testers do not count.** Every signature is
+per box (the blob binds `host_id`), so one box moves at a time and a fenced box cannot be swept along.
+Proven twice: `demo-hp-bb76ea` 2026-09-15, `demo-felhom-8363b5` 2026-09-16. **Revisit on the first
+sale** — at that point the key belongs behind the operator (or a hardware key, §7), and a fleet
+rollout step still has to be designed (R-530).
+
 ## 4. Rotation & compromise recovery

 The agents pin the operator public keys. The danger: rotation must **not** flow as plain hub config,
@@ -192,7 +192,11 @@ v0.114.0, pinned by `TestOperatorCooldown_NodeLivenessBypassesQuietHour`). **Thi
 above for those three types only**, and it is a ruling, not a defect fix. The reason is BIGNIGHT F9
 (2026-09-14): the controller was dead for 33 minutes; its `node_stale` mail was suppressed because F8's
 `node_stale` had used the hour 39 minutes earlier, and the later `node_recovered` mail was suppressed
-the same way. The `host_*` agent-plane siblings are **not** in the ruling and keep the hour.
+the same way. **EXTENDED by operator ruling 2, 2026-09-16 (hub v0.115.0, R-529): `host_stale`, `host_down` and
+`host_recovered` join the bypass**, with the same 5-minute dedupe. They are the same sentence about the
+same box — the agent's dead-man's-switch rather than the controller's — and leaving them on the hour
+would have kept exactly the F9 silence on the host plane. Everything else keeps the hour (pinned by
+`TestOperatorCooldown_NodeLivenessBypassesQuietHour`, which also asserts an unrelated type still waits).

 | Family | Grain | Key carries | Why |
 |---|---|---|---|