docs: escrow-wizard felhom.eu leg REPORT + CONTEXT (ruling F1 recorded; operator follow-ups: supervised wizard pass drill+demo, agent 0.88.0 publish/vouch)
This commit is contained in:
+12
@@ -3,6 +3,18 @@
|
||||
> Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub),
|
||||
> `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`.
|
||||
|
||||
- **2026-07-13 eve — ESCROW CEREMONY WIZARD SHIPPED (agent v0.88.0 + controller v0.127.0; this
|
||||
repo: host-install v1.16.0 + RUNBOOK rewrite).** The recovery-code ceremony is now
|
||||
customer-driveable from the controller (`/backup/escrow`): one-shot R reveal, re-stage-first,
|
||||
Scenario-F stale-blob re-check (fired LIVE on both boxes' hash-less blobs at first ACK; drill's
|
||||
repaired via a real ceremony — hub hash now covers). **Ruling F1 (2026-07-13), settled:** *R
|
||||
transiting the Cloudflare tunnel once at reveal is an accepted risk — same trust class as the
|
||||
claim code/login password; LAN-direct delivery is PARKED.* (threat model:
|
||||
runbooks/RUNBOOK-escrow-ceremony.md). host-install v1.16.0 = FELHOM_ESCROW rides the canonical
|
||||
sudoers fetch; hub `hostInstallVersion` synced (gate green), **hub NOT redeployed** (const rides
|
||||
the next train). OPEN: supervised full-browser wizard pass (Viktor's drill login; also demo, to
|
||||
clear its legacy stale warning); agent 0.88.0 publish + Day-0 vouch at the next train.
|
||||
|
||||
- **2026-07-13 — CLOSING BUNDLE SHIPPED: hub v0.53.0** — the last engineering items on the
|
||||
pre-tester board: F-14 gated auto-Reissue (deletion provenance `host_deletions` in-tx +
|
||||
`token_exists` gate → the EXISTING Reissue op + `pbsdr_auto_reissue` audit event; no record /
|
||||
|
||||
@@ -2,32 +2,26 @@
|
||||
|
||||
> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).
|
||||
|
||||
## SPIKE — controller-driven escrow ceremony (daemon-context invocation mechanics) — 2026-07-13
|
||||
## Controller-driven escrow ceremony — felhom.eu leg (installer + docs) — 2026-07-13
|
||||
|
||||
Docs-only commit; findings at `documentation/audits/SPIKE-controller-escrow-2026-07-13.md`.
|
||||
No production code written; agent/controller repos untouched. **All five mechanisms under test: GO**
|
||||
— the production spec (local-API ceremony endpoint + `--output=json` + job/one-shot-R-claim) can be
|
||||
written on observed behavior.
|
||||
Companion commits to felhom-agent **v0.88.0** (`1c3a3ef`) + felhom-controller **v0.127.0**
|
||||
(`08a966b`) — the customer-facing recovery-code wizard. felhom.eu commit `375cb08`.
|
||||
|
||||
- **Target:** the drill VM (qm 300, `192.168.0.152`, take-two end state, agent **0.87.0**); full
|
||||
probe plan P0–P8 ran, nothing skipped; demo host + live demo escrow untouched (hub row verified).
|
||||
- **SQ1 (load-bearing): the PTY-driven PBS re-key works with NO controlling terminal** — 3/3
|
||||
ceremonies exit 0 under `systemd-run --uid=felhom-agent` + `sudo -n` (the daemon shape), ~2.3 s
|
||||
each, self-verify included.
|
||||
- **Refusal matrix 5/5:** the fixed-argv sudoers line refused every altered argv (value change,
|
||||
extra flag, reorder, `--config` omitted, alternate config path) — direct self-invocation is
|
||||
sound; no guarded wrapper needed. Caller must pin argv order + `--` spelling byte-exact.
|
||||
- **R pipe-capture round-trip PROVEN:** R parsed from the captured stdout opened the blob via
|
||||
`escrow-consume` (fingerprint-gated, recovered key = live key size). Banner parsing is brittle →
|
||||
`--output=json` is mandatory for production.
|
||||
- **env_reset clean** (pinned `--config`; WG key auto-captured; hub upload authenticated);
|
||||
**`--upload` hub-verified** (`host_escrow` row timestamped to the second, 383 B blob, empty
|
||||
`restic_pw_sha256` — no staged secret existed, as gated in P0).
|
||||
- **Timings:** 2.28–2.37 s incl. upload → job pattern with 2 s poll / 60 s timeout recommended;
|
||||
ceremony process peaks ~264 MiB.
|
||||
- **Correction to the task premise:** capability probes are LIST-mode (`sudo -n -l`), never
|
||||
executing (manifest.go, verified live) — the escrow grant can get a normal probe entry.
|
||||
- **Hygiene:** zero R fragments in journal/auth logs/state dir; all probe artifacts removed
|
||||
(sudoers drop-in gone + post-removal refusal re-proven; scratch shredded; VM left running).
|
||||
- **Recorded side effect (deliberate, drill scratch):** the drill box's take-two escrow blob is
|
||||
superseded by a hash-less one; the take-two paper R no longer opens the CURRENT blob.
|
||||
- **host-install v1.16.0:** the `FELHOM_ESCROW` sudoers alias ships via the EXISTING canonical
|
||||
sudoers fetch (no new step; header documents it). Hub `hostInstallVersion` synced to 1.16.0 in
|
||||
the same commit (`hostinstall_gates.py` green; hub green gate run; **no hub deploy** — the
|
||||
const rides the next hub train, display-only lag).
|
||||
- **RUNBOOK-escrow-ceremony.md rewritten:** the controller wizard is the PRIMARY path; the CLI is
|
||||
the operator fallback (text mode unchanged); **F1 threat-model paragraph** (R transits the CF
|
||||
tunnel once at reveal — accepted 2026-07-13, same trust class as claim code/login password;
|
||||
agent→controller leg never leaves the box; LAN-direct delivery PARKED); stale-blob warning +
|
||||
supersede/void semantics documented; CLI staged-secret rule spelled out (a CLI run without the
|
||||
staged secret mints a hash-less blob → the new Scenario-F warning).
|
||||
- Deploy + live validation evidence: felhom-agent/REPORT.md + felhom-controller/REPORT.md
|
||||
(agents 0.88.0 on demo host + drill VM, 63/63 capabilities; controllers 0.127.0 on both guests;
|
||||
Scenario F fired live on BOTH boxes' hash-less blobs; the drill blob repaired —
|
||||
`restic_pw_sha256` now covers the local password; one-shot claim + 410 proven endpoint-exact).
|
||||
- **Operator follow-ups:** (1) one supervised wizard pass with Viktor's drill login (the full
|
||||
browser leg incl. re-auth + reveal — CC cannot type the customer-owned password), ideally also
|
||||
on the demo box to clear ITS legacy stale warning; (2) publish agent 0.88.0 + vouch in the
|
||||
Day-0 manifest at the next publish train (deployed hosts got direct deploys).
|
||||
|
||||
Reference in New Issue
Block a user