admin
88aecf55b6
gates / gates (push) Successful in 7m23s
Live on demo-hp (--rotate-recovery-only): vault time moved, new value 200, old 401. Harness 52/0; the R1145 cases fail against HEAD. Publishes only with the next installer tag.
2.1 KiB
2.1 KiB
Verdicts on the independent review (2026-10-18) — each checked against source by the attending session
The report: independent-review.md (this folder; written by a fresh reviewer with no context from the night; read back
here — 54 lines, 4 findings).
| # | Finding | Verdict | What was done |
|---|---|---|---|
| F1 (medium) | --rotate-recovery-only checks only an unauthenticated /healthz; a stale host key → chpasswd runs → the vault PUT 401s → root holds an unvaulted password |
REAL in the night's code (felhom-host-install.sh step 4b set the password first). |
Fixed by R-1145 (today): the vault comes FIRST, so a stale key stops at the PUT and the password is not touched. Harness R1145-e (vault 401 → no chpasswd); red-proof: it FAILS against HEAD (P5/redproof-r1145.txt). |
| F2 (low–medium) | offsite_snapshots_unexplained is explained by the box's OWN reported offsite.last_run — a box (or whoever holds its key) can report a matching run and silence the warning |
REAL, by design today (decision 68 accepts a box-trusted run time; the custody-critical offsite_snapshots_vanished is judged on the hub's own listing and window credits and is not affected — the reviewer confirms). |
Recorded in R-895's row (its design §3.1/§3.2 remainder is where an independent upload-time check belongs); not a new row. |
| F3 (low) | „anyway" stops the drive's apps before the agent is asked; a refusal leaves them stopped | REAL, already filed (R-1144). | Fixed today (controller): the agent's own disk list is asked first; a refusal after the stops starts exactly the apps that were running. TestR1144_*, red-proofed (P3/). |
| F4 (low) | step 4b passes the host api_key in curl's argv (-H "Authorization: Bearer …"), visible in ps |
REAL, pre-existing (moved verbatim). | Fixed today: the header rides a 0600 temp file written by the printf builtin (-H @file), removed after. The harness asserts the key is in no fake's argv (all R1145 cases). |
Nothing else was reported. The reviewer's „checked and found sound" list is in its report.