admin
7747a16ff1
F2 claim re-issue on clean-slate re-enroll (ReissueForReenroll, host-enroll mint path, single-bump, reset code; hub never stores the password so fork B). F3 offsite re-issue on re-enroll (ReissueOffsiteForCustomer, same machinery as the manual button). 2.3 escrow honesty (red-proofed): re-issuing offsite marks the escrow stale (MarkEscrowStale), withholds the mismatched restic hash from auto-confirm, DR checklist shows stale not done. Events: claim_reissued_reenroll / offsite_reissued / escrow_stale. Controller + scripts unchanged (source contradicted both premises): the controller reads escrow prereqs live from the agent; the installer can't know the descriptor-provisioned storage id. F4 root fix is agent-side -> ROADMAP R-22; demo unblocked live (Part 0 ACL grant). VALIDATION doc F2 erratum + F3/F4 dispositions. Green gate + Scenario-C red-proof pass.
56 lines
3.9 KiB
Markdown
56 lines
3.9 KiB
Markdown
# felhom.eu — task reports
|
|
|
|
> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).
|
|
|
|
## Reinstall-of-existing-customer arc — F2/F3/F4/2.3 (hub v0.57.0) — 2026-07-16
|
|
|
|
Closes the N100 physical-run findings (`documentation/tests/VALIDATION-n100-baremetal-2026-07-16.md`).
|
|
**Only the hub shipped** — controller + scripts unchanged (both spec premises contradicted by source,
|
|
below). Baseline: felhom.eu @ `dd961a6`, hub v0.56.0 → **v0.57.0**.
|
|
|
|
### Fork verdicts (source-verified)
|
|
- **2.1 = FORK B.** `hub/internal/claim/engine.go` + `handler.go:413-429` (`MarkClaimed`, set-only): the
|
|
hub stores the claim code + a **claimed boolean**, never the password hash (controller-owned by the
|
|
arc's design). Fork A (hub delivers the hash) would violate the design → **B** (bump generation + email).
|
|
- **3.1 = no controller change (spec premise contradicted).** `controller/internal/agentapi/escrow.go`
|
|
`EscrowPreflight` fetches the prereq checklist **live from the agent** (`GET /escrow/preflight`); it
|
|
never sources `pbs_storage_id` from hub config. The agent seeds it on PBS-DR convergence. The fresh
|
|
box "lacked" it only because F4's 403 blocked convergence — Part 0 + the demo grant restore it. **No
|
|
controller v0.138.0.**
|
|
|
|
### Part 0 — live unblock (done, reversible)
|
|
Granted `FelhomAgentStore` on `/storage/felhom-offsite` (user + token) on felhom-pve. The agent's next
|
|
tick converged: created the storage, ran `felhom-pbs-apply grant`, **seeded `escrow.pbs_storage_id`**,
|
|
`pbsdr: converged state=applied`; `pvesm` shows **felhom-offsite pbs active**. The 403s stopped.
|
|
|
|
### Part 2 — hub v0.57.0 (shipped)
|
|
- **F2 claim continuity** — `claim.ReissueForReenroll` (claimed → bump generation once + reset email;
|
|
no-op unclaimed), hooked at the host-enroll **mint path** (single-bump-per-re-enroll). Event
|
|
`claim_reissued_reenroll`.
|
|
- **F3 offsite continuity** — the re-enroll path calls `web.ReissueOffsiteForCustomer` (same machinery
|
|
as the manual button; wired via `SetOffsiteReissuer`). Event `offsite_reissued`.
|
|
- **2.3 escrow honesty** — `offsite.ReissueCredentials` marks the escrow stale (`store.MarkEscrowStale`;
|
|
cleared by the next ceremony); the ACK **withholds** the mismatched `restic_pw_sha256`; the DR
|
|
checklist shows **stale** not "done." Event `escrow_stale`.
|
|
|
|
### Scenarios / red-proofs
|
|
- **A (claim)**: `TestReissueForReenroll` — claimed rotates + reset email; unclaimed no-op. PASS.
|
|
- **C (escrow, red-proof)**: `TestReissue_InvalidatesEscrow` — after a re-issue the escrow is STALE and
|
|
the hash is withheld. **Red-proof run-fail-revert:** with `MarkEscrowStale` gutted → FAIL ("escrow
|
|
must be STALE… advertising ceremony-done against a key the repo no longer accepts"); restored → PASS.
|
|
- Green gate: `go build ./... && go vet ./... && go test ./...` all clean.
|
|
- Deployed versions + Scenario E (escrow prereqs green on the live demo): see the deploy section / the
|
|
task's verification.
|
|
|
|
### F4 — NOT an installer fix (reported)
|
|
The DR storage id lives in the agent-domain **pbs_dr descriptor** (`web/pbsdr.go`), provisioned post-WG
|
|
— not in the installer-fetched config — so `step_agent_config()` can't derive it. The block is a
|
|
bootstrap circularity: the agent's token-auth pre-check `GET /storage/<id>` 403s and aborts before its
|
|
own root-run `felhom-pbs-apply grant`. **Root fix is agent-side → ROADMAP R-22 (agent train)**; the demo
|
|
was unblocked live (Part 0). Default-storage-id customers (all new/Peti installs) already work — F4 only
|
|
bites non-default ids. Per Viktor: do NOT flip the demo's descriptor id.
|
|
|
|
### NOT done
|
|
The escrow **ceremony itself** — Viktor's S10 step (CC's boundary is prereqs-green; CC never runs the
|
|
ceremony, touches R, or mints a recovery code).
|