Files

T

admin 7747a16ff1 feat(hub): v0.57.0 reinstall-of-existing-customer arc — claim/offsite/escrow continuity

F2 claim re-issue on clean-slate re-enroll (ReissueForReenroll, host-enroll mint path,
single-bump, reset code; hub never stores the password so fork B). F3 offsite re-issue on
re-enroll (ReissueOffsiteForCustomer, same machinery as the manual button). 2.3 escrow honesty
(red-proofed): re-issuing offsite marks the escrow stale (MarkEscrowStale), withholds the
mismatched restic hash from auto-confirm, DR checklist shows stale not done. Events:
claim_reissued_reenroll / offsite_reissued / escrow_stale.

Controller + scripts unchanged (source contradicted both premises): the controller reads escrow
prereqs live from the agent; the installer can't know the descriptor-provisioned storage id. F4
root fix is agent-side -> ROADMAP R-22; demo unblocked live (Part 0 ACL grant). VALIDATION doc
F2 erratum + F3/F4 dispositions. Green gate + Scenario-C red-proof pass.

2026-07-16 18:00:13 +02:00

3.9 KiB

Raw Blame History

felhom.eu — task reports

Overwrite this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in hub/CHANGELOG.md; the scripts history lives in scripts/CHANGELOG.md.

Reinstall-of-existing-customer arc — F2/F3/F4/2.3 (hub v0.57.0) — 2026-07-16

Closes the N100 physical-run findings (documentation/tests/VALIDATION-n100-baremetal-2026-07-16.md). Only the hub shipped — controller + scripts unchanged (both spec premises contradicted by source, below). Baseline: felhom.eu @ dd961a6, hub v0.56.0 → v0.57.0.

Fork verdicts (source-verified)

2.1 = FORK B. hub/internal/claim/engine.go + handler.go:413-429 (MarkClaimed, set-only): the hub stores the claim code + a claimed boolean, never the password hash (controller-owned by the arc's design). Fork A (hub delivers the hash) would violate the design → B (bump generation + email).
3.1 = no controller change (spec premise contradicted). controller/internal/agentapi/escrow.go EscrowPreflight fetches the prereq checklist live from the agent (GET /escrow/preflight); it never sources pbs_storage_id from hub config. The agent seeds it on PBS-DR convergence. The fresh box "lacked" it only because F4's 403 blocked convergence — Part 0 + the demo grant restore it. No controller v0.138.0.

Part 0 — live unblock (done, reversible)

Granted FelhomAgentStore on /storage/felhom-offsite (user + token) on felhom-pve. The agent's next tick converged: created the storage, ran felhom-pbs-apply grant, seeded escrow.pbs_storage_id, pbsdr: converged state=applied; pvesm shows felhom-offsite pbs active. The 403s stopped.

Part 2 — hub v0.57.0 (shipped)

F2 claim continuity — claim.ReissueForReenroll (claimed → bump generation once + reset email; no-op unclaimed), hooked at the host-enroll mint path (single-bump-per-re-enroll). Event claim_reissued_reenroll.
F3 offsite continuity — the re-enroll path calls web.ReissueOffsiteForCustomer (same machinery as the manual button; wired via SetOffsiteReissuer). Event offsite_reissued.
2.3 escrow honesty — offsite.ReissueCredentials marks the escrow stale (store.MarkEscrowStale; cleared by the next ceremony); the ACK withholds the mismatched restic_pw_sha256; the DR checklist shows stale not "done." Event escrow_stale.

Scenarios / red-proofs

A (claim): TestReissueForReenroll — claimed rotates + reset email; unclaimed no-op. PASS.
C (escrow, red-proof): TestReissue_InvalidatesEscrow — after a re-issue the escrow is STALE and the hash is withheld. Red-proof run-fail-revert: with MarkEscrowStale gutted → FAIL ("escrow must be STALE… advertising ceremony-done against a key the repo no longer accepts"); restored → PASS.
Green gate: go build ./... && go vet ./... && go test ./... all clean.
Deployed versions + Scenario E (escrow prereqs green on the live demo): see the deploy section / the task's verification.

F4 — NOT an installer fix (reported)

The DR storage id lives in the agent-domain pbs_dr descriptor (web/pbsdr.go), provisioned post-WG — not in the installer-fetched config — so step_agent_config() can't derive it. The block is a bootstrap circularity: the agent's token-auth pre-check GET /storage/<id> 403s and aborts before its own root-run felhom-pbs-apply grant. Root fix is agent-side → ROADMAP R-22 (agent train); the demo was unblocked live (Part 0). Default-storage-id customers (all new/Peti installs) already work — F4 only bites non-default ids. Per Viktor: do NOT flip the demo's descriptor id.

NOT done

The escrow ceremony itself — Viktor's S10 step (CC's boundary is prereqs-green; CC never runs the ceremony, touches R, or mints a recovery code).

3.9 KiB Raw Blame History