admin f417cdede1 hub v0.127.0: off-site key registrar (box never gets the storage password), password sealed at rest, daily key check, clean-up window (shipped off) — decisions 68-69, R-820/R-821/R-822 ...

Part A evidence (migration spike, sftp-written repo through the pinned rclone key) and the hub
red-proofs under documentation/audits/offsite-lock-build-2026-10-03/. Manifest bump follows after
the image is built and Secret/offsite-secret-key exists.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

2026-10-03 16:57:04 +02:00

..

reconciler_test.go

R-204 item 4 (hub half): the hub answers a rebuilt box's request (hub v0.96.0)

2026-08-05 10:48:18 +02:00

reconciler.go

hub v0.127.0: off-site key registrar (box never gets the storage password), password sealed at rest, daily key check, clean-up window (shipped off) — decisions 68-69, R-820/R-821/R-822

2026-10-03 16:57:04 +02:00

wiring_test.go

R-204 item 4 (hub half): the hub answers a rebuilt box's request (hub v0.96.0)

2026-08-05 10:48:18 +02:00