34 lines
2.6 KiB
Markdown
34 lines
2.6 KiB
Markdown
# felhom.eu — task reports
|
||
|
||
> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).
|
||
|
||
## SPIKE — controller-driven escrow ceremony (daemon-context invocation mechanics) — 2026-07-13
|
||
|
||
Docs-only commit; findings at `documentation/audits/SPIKE-controller-escrow-2026-07-13.md`.
|
||
No production code written; agent/controller repos untouched. **All five mechanisms under test: GO**
|
||
— the production spec (local-API ceremony endpoint + `--output=json` + job/one-shot-R-claim) can be
|
||
written on observed behavior.
|
||
|
||
- **Target:** the drill VM (qm 300, `192.168.0.152`, take-two end state, agent **0.87.0**); full
|
||
probe plan P0–P8 ran, nothing skipped; demo host + live demo escrow untouched (hub row verified).
|
||
- **SQ1 (load-bearing): the PTY-driven PBS re-key works with NO controlling terminal** — 3/3
|
||
ceremonies exit 0 under `systemd-run --uid=felhom-agent` + `sudo -n` (the daemon shape), ~2.3 s
|
||
each, self-verify included.
|
||
- **Refusal matrix 5/5:** the fixed-argv sudoers line refused every altered argv (value change,
|
||
extra flag, reorder, `--config` omitted, alternate config path) — direct self-invocation is
|
||
sound; no guarded wrapper needed. Caller must pin argv order + `--` spelling byte-exact.
|
||
- **R pipe-capture round-trip PROVEN:** R parsed from the captured stdout opened the blob via
|
||
`escrow-consume` (fingerprint-gated, recovered key = live key size). Banner parsing is brittle →
|
||
`--output=json` is mandatory for production.
|
||
- **env_reset clean** (pinned `--config`; WG key auto-captured; hub upload authenticated);
|
||
**`--upload` hub-verified** (`host_escrow` row timestamped to the second, 383 B blob, empty
|
||
`restic_pw_sha256` — no staged secret existed, as gated in P0).
|
||
- **Timings:** 2.28–2.37 s incl. upload → job pattern with 2 s poll / 60 s timeout recommended;
|
||
ceremony process peaks ~264 MiB.
|
||
- **Correction to the task premise:** capability probes are LIST-mode (`sudo -n -l`), never
|
||
executing (manifest.go, verified live) — the escrow grant can get a normal probe entry.
|
||
- **Hygiene:** zero R fragments in journal/auth logs/state dir; all probe artifacts removed
|
||
(sudoers drop-in gone + post-removal refusal re-proven; scratch shredded; VM left running).
|
||
- **Recorded side effect (deliberate, drill scratch):** the drill box's take-two escrow blob is
|
||
superseded by a hash-less one; the take-two paper R no longer opens the CURRENT blob.
|