admin
cb26dc7e83
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
35 lines
2.6 KiB
Markdown
35 lines
2.6 KiB
Markdown
# felhom.eu — task reports
|
|
|
|
> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).
|
|
|
|
## TASK — offsite SLICE 3: hub-verified escrow auto-confirm — 2026-07-09 — DEPLOYED
|
|
|
|
**Shipped (felhom.eu):** hub **v0.40.0** `49d1233` + bump `c24d4af` — LIVE (Synced/Healthy). Chain pairs:
|
|
agent **v0.79.0** (felhom-pve, 56/56) + controller **v0.108.0** (9201, healthy) — all live. Operator-free
|
|
task (Viktor ran nothing).
|
|
|
|
**The verification chain:** the ceremony hashes the staged repo password it seals (agent) → the hub stores
|
|
`restic_pw_sha256` alongside the escrow blob (additive migration; NULL on legacy rows) and serves
|
|
`escrow:{identity_blob_present, restic_pw_sha256, created_at}` in the **report ACK** → the controller flips
|
|
offbox `EscrowState` pending→escrowed ONLY on `sha256(local repo_password)` match. **Blob-presence alone
|
|
never confirms** — a stale blob (re-provision/inject/history) would be a false custody claim re-opening the
|
|
fork-4 gap; this is the red-proofed core (blob-present-only check → stale-blob test flips → FAIL).
|
|
Mismatch → pending + loud warn naming the ceremony (deduped per hash); never un-confirms. On flip the
|
|
agent-staged secret is wiped (v0.107.0 path). The two hashers are pinned by the SAME cross-repo test vector
|
|
(trimmed-string sha256). Manual confirm-escrow → documented deprecated fallback for legacy hash-less blobs.
|
|
|
|
**Hub specifics:** `host_escrow.restic_pw_sha256` migration; `SaveHostEscrow`/`HostEscrow`/`GetHostEscrow`
|
|
NULL-safe; `GetEscrowStatusForCustomer` (hosts⋈host_escrow, latest-updated wins); ACK object omitted when
|
|
no escrow row (fresh customers stay silently pending); `TestEscrowUploadContract` mirrors agent v0.79.0.
|
|
|
|
**Live state check (no operator action):** migration applied on the production DB — all 3 legacy rows
|
|
(demo included) read hash-NULL; the demo's `escrowed` target produced **zero** `escrow-confirm` controller
|
|
log lines after reports through the new hub (Scenario E — never-revisit — proven live for free); no hub
|
|
errors.
|
|
|
|
**NOT yet live-exercised:** the full happy chain (fresh enable → ceremony records the hash → ACK →
|
|
auto-flip) — the first real offsite enable (Peti onboarding) proves it; unit red-proofs carry the logic.
|
|
|
|
**NEXT:** SLICE 4 (soft-quota on `quota_gb`), Peti onboarding runbook (live-exercises auto-confirm + F4
|
|
re-issue), NEW-box restore round-trip → retire the old-box archive.
|