admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: SLICE 3 — hub README, REPORT, CONTEXT

Browse Source 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
This commit is contained in:
authentik Default Admin
2026-07-09 23:26:16 +02:00
parent c24d4afeee
commit cb26dc7e83
3 changed files with 43 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hub/README.md
+6 -1
View File
@@ -89,7 +89,12 @@ host-key scan retries through fresh-subaccount DNS lag (~60s ladder, F2); the sa
in-flight notice (F5); and **"Re-issue offsite credentials"** (F4, `POST /configs/{id}/offsite-reissue`) is
the explicit recovery for a consumed-password dead-end — resets ONLY the resource labelled for that customer
(refuses unless exactly 1), stores a fresh one-time secret, bumps `ConfigVersion`. Never implicit rotation.
SLICE 3 (escrow auto-confirm) and SLICE 4 (soft-quota) follow.
**SLICE 3 (v0.40.0) — hub-verified escrow auto-confirm:** the agent's ceremony upload carries
`restic_pw_sha256` (non-reversible hash of the sealed offsite repo password — safe to store/serve); the hub
stores it on `host_escrow` (NULL on legacy rows) and serves
`escrow:{identity_blob_present, restic_pw_sha256, created_at}` in the **report ACK**; the controller
auto-confirms its pending offbox escrow ONLY on a hash match with its current repo password (blob-presence
alone never confirms). SLICE 4 (soft-quota) follows.
### Infrastructure Backup — RETIRED (Phase-1, 2026-06-16, hub v0.12.0)