admin 74009014aa R-366: the hub retains the escrow when the whole-guest backup key changes ...

A reinstall mints a new PBS key K while R-241 keeps the restic password, so
the supersession rule (restic sha only) overwrote the only copy of the old K
and every pre-reinstall whole-guest archive became unopenable for good. The
current row is now also retained when the key fingerprint changes (case and
space ignored; an empty fingerprint is unknown, not a change).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

2026-10-06 20:45:00 +02:00

..

testdata

hub v0.131.0: the tunnel status is true (R-841: three states, tunnel_down after two not_running reports, unknown never alarms); OS updates per layer (guest/host separate approved sets, host candidate leaves out kernel/boot/firmware, host_release in the box block), the fleet view and four hourly operator alarms (11 §8 steps 3+4); red-proofs in audits/os-host-lane-2026-10-04

2026-10-04 13:05:00 +02:00

appliance_test.go

…

appliance.go

R-879: seal box API keys, owner passphrases, controller keys and PBS-DR tokens at rest

2026-10-05 21:45:04 +02:00

artifact_test.go

…

backup_run_digest_event_test.go

…

backup_target_event_test.go

…

chaosnight_events_test.go

…

claim_ack_test.go

…

config_version_ack_test.go

…

controller_supervisor_event_test.go

…

crash_test.go

hub v0.132.0: the System page (versions + OS updates with the ring/switch/approve buttons, R-852), the Hosts Proxmox/kernel column, the operator-approved Docker engine release (2 healthy ring-0 nights), the crash-guard events (R-851); evidence audits/os-docker-crash-2026-10-04

2026-10-04 16:16:02 +02:00

crash.go

hub v0.132.0: the System page (versions + OS updates with the ring/switch/approve buttons, R-852), the Hosts Proxmox/kernel column, the operator-approved Docker engine release (2 healthy ring-0 nights), the crash-guard events (R-851); evidence audits/os-docker-crash-2026-10-04

2026-10-04 16:16:02 +02:00

desired_test.go

…

dr_test.go

…

dr.go

…

escrow_get_test.go

…

escrow_repo_key_changed_test.go

…

escrow_retained_get_test.go

…

escrow_test.go

…

event_test.go

…

floor_ack_test.go

…

handler.go

R-366: the hub retains the escrow when the whole-guest backup key changes

2026-10-06 20:45:00 +02:00

host_enroll_test.go

…

host_recovery_test.go

…

host_test.go

…

logbundle_ack_test.go

…

logtail_ack_test.go

…

mail_test.go

…

mail.go

…

managed_floor_ack_test.go

…

offsite_test.go

hub v0.129.0: operator raises ONE clean-up window's cap (R-833); restore-beside script + runbooks (R-834)

2026-10-04 08:56:56 +02:00

offsite.go

hub v0.128.0: set-aside deletion through the hub after a 7-day wait (decision 74, R-823), key-file clean-up route (R-826), read-only key check (R-827), window cap = half

2026-10-04 07:05:21 +02:00

os_updates_test.go

hub v0.131.0: the tunnel status is true (R-841: three states, tunnel_down after two not_running reports, unknown never alarms); OS updates per layer (guest/host separate approved sets, host candidate leaves out kernel/boot/firmware, host_release in the box block), the fleet view and four hourly operator alarms (11 §8 steps 3+4); red-proofs in audits/os-host-lane-2026-10-04

2026-10-04 13:05:00 +02:00

os_updates.go

hub v0.130.0: OS updates, guest fast lane — rings, per-box switch, OS releases approved from ring 0, os-report, os_update desired block

2026-10-04 10:56:39 +02:00

pbsdr_test.go

…

pbsdr.go

…

poke_seam_test.go

…

preferences_guard_test.go

…

r262_restoretest_subset_test.go

burn-down Part B: 14 small rows fixed and closed across four repos (306 -> 292); no :latest in the hub build; gate list pinned; closed-id duplicates refused; R-262 subset pinned

2026-10-05 17:10:38 +02:00

r387_severity_visibility_test.go

…

r871_catchup_event_test.go

hub v0.134.0: a down box is judged on longer missed-backup lines (R-872); household outage mail at most weekly (R-873); backup_catchup_done allowed (R-871)

2026-10-05 09:24:14 +02:00

r879_box_seal_test.go

R-879: seal box API keys, owner passphrases, controller keys and PBS-DR tokens at rest

2026-10-05 21:45:04 +02:00

recovery_unit_event_test.go

…

tunnel_test.go

hub v0.131.0: the tunnel status is true (R-841: three states, tunnel_down after two not_running reports, unknown never alarms); OS updates per layer (guest/host separate approved sets, host candidate leaves out kernel/boot/firmware, host_release in the box block), the fleet view and four hourly operator alarms (11 §8 steps 3+4); red-proofs in audits/os-host-lane-2026-10-04

2026-10-04 13:05:00 +02:00

wait_test.go

…

wait.go

…

wg_test.go

…

wg.go

…

whole_guest_event_test.go

…