3 Commits

Author	SHA1	Message	Date
admin	d3c50b50f6	hub v0.128.0: set-aside deletion through the hub after a 7-day wait (decision 74, R-823), key-file clean-up route (R-826), read-only key check (R-827), window cap = half ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-04 07:05:21 +02:00
admin	f417cdede1	hub v0.127.0: off-site key registrar (box never gets the storage password), password sealed at rest, daily key check, clean-up window (shipped off) — decisions 68-69, R-820/R-821/R-822 ... Part A evidence (migration spike, sftp-written repo through the pinned rclone key) and the hub red-proofs under documentation/audits/offsite-lock-build-2026-10-03/. Manifest bump follows after the image is built and Secret/offsite-secret-key exists. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-03 16:57:04 +02:00
admin	44ec06b50f	hub v0.37.0: offsite provisioning SLICE 1 — Cloud-API client + provisioning core ... Hetzner storage-box provisioning against api.hetzner.com/v1 (NOT .cloud). internal/hetznerapi (typed client + CloudAPI interface + Fake + WaitAction); internal/offsite (Provisioner.ProvisionOffsite — idempotent by label, shared sub-account/dedicated box, transient password, non-secret Descriptor, fail-closed); one_time_secrets store (single-use Save/Consume); POST /offsite/consume-password/{id} (customer-key auth, once); config-form Offsite section → applyOffsite (502+no-save on error) → descriptor in ConfigJSON → version bump. Token/passwords never logged/committed/in ConfigJSON. Tested vs a faked Cloud API + fail-closed red-proof. NOT yet live-provisioned (needs the dedicated-project scoped token; current token can delete ep0). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6	2026-07-09 18:38:24 +02:00