R-924: live run + restore test evidence; STATUS and report

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-10-09 15:02:37 +02:00
parent 96f68f1b44
commit a05345eeb6
3 changed files with 22 additions and 3 deletions
@@ -52,7 +52,13 @@ no Felhom recovery step needs DooPlex; without it, S1, S6 and S8 block.
 Machine: bench 9401 — 0 containers, 0 volumes, image removed, stopped as it was. Host: DooPlex scratch dirs shredded.
 Hub: provisioned nothing. Vaultwarden: its one test backup file removed by name.

-## Decisions for the operator
+## Done after the report: R-924 option A (operator, 2026-10-09)
+
+The three signing key files and their public halves ride the nightly copy (felhom.eu `96f68f1b`, CI 1614 success). Live
+run 12:57Z: `signing: 3 key(s) with their public halves`, pushed in 22 s; restore test: `3 signing key(s) match`
+(`audits/dooplex-survival-2026-10-09/signing/`). 4 new tests, 3 red-proofs. R-924 narrowed: left is printing them.
+
+## Decisions for the operator (as asked; 1 is answered — A)

 1. **R-924 — the signing keys.** (A) Print both on the sheet AND add them to the nightly encrypted copy (CC changes the
   DooPlex job with your yes). (B) Print only the recovery key and keep it away from home. **Pick A.** **If you do
@@ -11,8 +11,8 @@
  back on a throwaway machine: it starts, with your 1 account and 797 items. Nobody opened the items.
 - **The circle is broken only when you print the sheet.** The copy on ep0 opens with one key, and that key was only
  in the password manager on DooPlex. The sheet lists the keys to print, with the commands. It holds no value itself.
- **New finding: the signing keys live only on DooPlex**, with no password and in no backup. If DooPlex is lost, no
-  box can take a signed update again without a visit. Your decision (see the report).
+- **The signing keys now go off-site too** (your answer A). They were only on DooPlex, in no backup. The Sunday test
+  proves each key still matches. Print them as well (lines S6a/S6b on the sheet).
 - **Built, not released:** a household that clears its mail address gets it deleted on the hub (your answer A); a
  restored hub sends no mail until you release it; the backup no longer stops the apps when another backup is still
  running. Found and fixed on the way: one box's key could change another household's mail settings.
@@ -0,0 +1,13 @@
+## 2026-10-09T12:57:57Z install from felhom.eu 96f68f1b
+push_rc=0
+2026-10-09T14:57:58+02:00 dooplex felhom-dooplex-offsite[1789200]: felhom-dooplex-offsite: database: 20261009-100001, 6294981 bytes, 177 min old
+2026-10-09T14:59:30+02:00 dooplex felhom-dooplex-offsite[1789200]: felhom-dooplex-offsite: files: 10 repositories, 621 MB
+2026-10-09T14:59:30+02:00 dooplex felhom-dooplex-offsite[1789200]: felhom-dooplex-offsite: secrets: 3 file(s) of 20261009_031011
+2026-10-09T14:59:31+02:00 dooplex felhom-dooplex-offsite[1789200]: felhom-dooplex-offsite: vaultwarden: integrity ok, 1 user(s), files: db.sqlite3 rsa_key.pem
+2026-10-09T14:59:31+02:00 dooplex felhom-dooplex-offsite[1789200]: felhom-dooplex-offsite: signing: 3 key(s) with their public halves
+2026-10-09T14:59:56+02:00 dooplex felhom-dooplex-offsite[1789200]: felhom-dooplex-offsite: pushed to ep0 (ns operator, host/dooplex-gitea) in 22 s
+2026-10-09T14:59:56+02:00 dooplex felhom-dooplex-offsite[1789200]: felhom-dooplex-offsite: success signal written
+restore_rc=0
+2026-10-09T14:59:58+02:00 dooplex felhom-dooplex-offsite-restore-test[1810561]: felhom-dooplex-offsite-restore-test: restoring host/dooplex-gitea/2026-10-09T12:59:34Z
+2026-10-09T15:00:40+02:00 dooplex felhom-dooplex-offsite-restore-test[1810561]: felhom-dooplex-offsite-restore-test: checked: 28244 files match the manifest, 10 repositories pass git fsck, gitea.dump readable, 3 secrets file(s), Vaultwarden 1 user(s) / 797 item(s), 3 signing key(s) match
+2026-10-09T15:00:40+02:00 dooplex felhom-dooplex-offsite-restore-test[1810561]: felhom-dooplex-offsite-restore-test: success signal written