From c758c97a1a1a3acb069201104d82a8f11e0d7b4e Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Sat, 4 Jul 2026 20:35:34 +0200 Subject: [PATCH] =?UTF-8?q?docs(offsite):=20=C2=A73.5=20=E2=80=94=20offsit?= =?UTF-8?q?e=20escrow=20CREATED=20(S4=20Part=205=20done,=20operator-presen?= =?UTF-8?q?t)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit escrow-create -storage felhom-offsite -identity-bundle -directive -upload on felhom-pve: fresh R (operator-recorded off-transcript) wraps K + WG key + offsite PBS token; uploaded to hub. Independently verified in host_escrow (demo-felhom-01: key_fingerprint=offsite b0:fe:2a…, identity blob 499B, directive present, created_at=now) with zero knowledge of R. S5 (DR consume) now UNBLOCKED. This re-run also remediated an earlier escrow whose R had leaked into an agent transcript (last-write-wins overwrote it with the clean-R blob). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6 --- .../architecture/06-offsite-connectivity.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/documentation/architecture/06-offsite-connectivity.md b/documentation/architecture/06-offsite-connectivity.md index fbda352..e192b76 100644 --- a/documentation/architecture/06-offsite-connectivity.md +++ b/documentation/architecture/06-offsite-connectivity.md @@ -141,6 +141,18 @@ code, restores the WG key, and re-establishes the tunnel; hub-side the peer entr the endpoint: the box is off the offsite network immediately, auditable, no box cooperation needed. +**Offsite escrow CREATED — S4 Part 5 DONE (2026-07-04, operator-present; runbook +`RUNBOOK-offsite-escrow-create`).** `escrow-create -storage felhom-offsite -identity-bundle +-directive -upload` on felhom-pve minted a fresh R (operator-recorded off-transcript), wrapped the +offsite client key K + the auto-injected WG private key + the offsite PBS token under it, and +uploaded the opaque blobs to the hub. Independently verified in `host_escrow` (host `demo-felhom-01`: +`key_fingerprint` = the offsite key `b0:fe:2a…`, identity blob 499 B, directive with the non-secret +DR coords, `created_at` = now) — all with **zero knowledge of R**. `tunnel_token` intentionally empty +(the Cloudflare edge lives in the guest/controller, re-provisioned separately in DR). **S5 (DR +consume) is now UNBLOCKED:** R + the hub-stored blobs reconstruct K + the WG key (+ the offsite PBS +token). Note: `host_escrow` is one slot per host (last-write-wins) — the offsite escrow is the one +that matters for real DR (D6); the dev `felhom-pbs` key still lives on the box. + **Revocation semantics, agent side (S3-final):** the agent registers ONCE (key exists + no local marker). A `wireguard` block absent from a PRESENT desired-state = revocation → the agent disables the service, KEEPS its marker, and never re-registers on its own — revoked stays