admin
d1a3cd0625
doc 03: slice 8B implemented — §8 controller-driven quiesce, §9 table, changelog (2026-06-10)
...
§8: controller-driven quiesce (stop stacks -> POST /backup -> restart) implemented
(controller v0.36.0 internal/quiesce + agent v0.11.0 cadence/phases); crash-safety
centerpiece + 8B.2 snapshot-mode fast-follow documented. Validated live: quiesced
postgres restore clean vs crash-consistent WAL recovery. §9 table: 8B implemented.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-10 11:04:36 +02:00
admin
e436b61368
doc 03: slice 8A implemented — §6a local-API impl, §9 back-half row, §13 (2026-06-10)
...
§6a (new): the local-API implementation — stable leaf-SHA-256 pin, token->guest
self-scoping (cross-guest 403), bootstrap.json contract + controller ingestion
(c), baked-controller deploy (no registry cred in guest), firewall narrowing.
§9 slice table: back-half = slice 8A implemented (8B quiesce / 8C de-priv split
out); build-golden.sh bakes the controller. §13 + doc changelog.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-10 10:02:11 +02:00
admin
7eb3772000
hub: opaque PBS recovery-code escrow storage (v0.8.0) + doc 03 §8a posture model
...
Slice-7 close-out (hub half). PUT /api/v1/hosts/{host_id}/escrow (per-host key)
stores the agent's OPAQUE R-wrapped blob verbatim against the host; the hub never
decrypts it (no recovery code, no decrypt path). host_escrow table + Save/GetHostEscrow.
Tests: verbatim store, rotation last-write-wins, 401/403/400 auth+body, wire contract.
doc 03 §8a rewritten into the key-custody posture model: separation principle,
topology matrix, default + anti-lockout ladder, SSH-vs-key, breach/legal, integrity
caveat. Corrected: hub opaque storage is slice 7 (this task); serving is slice 10.
Slice table + §13 updated.
No secrets committed (R/K never appear; spike findings + docs use placeholders).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-06-10 07:46:33 +02:00
admin
15c4728e2c
doc(03-host-agent): slice-7 bring-up front half + golden host-key unit implemented
...
§9: the provision front half, guest-loss DR front half, and golden recipe are now
implemented (agent v0.8.0, internal/reconcile/bringup.go; configs/build-golden.sh).
Identity reset settled + implemented: provision resets MAC (unconditional, F1) +
hostname host-side; machine-id + SSH host keys regenerate guest-side (systemd + the
baked first-boot felhom-regen-hostkeys unit, F3) — agent stays host-side-only. Slice
mapping table statuses updated.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-06-09 21:37:54 +02:00
admin
e7ed8a8483
doc(03-host-agent): slice-7 scope, scenario-specific identity-reset, PBS escrow (§8a)
...
- §9 rewritten: bring-up is a shared FRONT HALF only; identity-reset policy is
scenario-specific (provision = fresh everything; guest-loss DR = preserve
restic/tunnel/hub continuity, reset only collision-prone host-local identity).
Added the slice 7/8/10 mapping table.
- NEW §8a: PBS recovery-code escrow (zero-knowledge) — live key on box; agent-generated
recovery code R; PBS-native passphrase-wrap of K under R escrowed to hub; consumption
slice 10; irreducible-residual + rotation != key-rotation stated.
- §13 updated (resolved: provision/DR slice boundary + escrow design; open: identity-reset
set, hub-side escrow storage + restore-mode serving).
Doc-only; no version bump.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-06-09 20:25:11 +02:00
admin
715f644bf0
moved documentation to felhom.eu
2026-06-08 13:50:14 +02:00
admin