diff --git a/.planning/WINDOWS.md b/.planning/WINDOWS.md index 132ccb9d..4ec34e04 100644 --- a/.planning/WINDOWS.md +++ b/.planning/WINDOWS.md @@ -2,9 +2,9 @@ schema_version: 1 open_count: 12 waived_count: 0 -fixed_count: 2 -total_count: 14 -last_updated: 2026-08-02T23:00:30.894Z +fixed_count: 3 +total_count: 15 +last_updated: 2026-08-02T23:16:04.510Z --- # Broken Windows Ledger @@ -28,7 +28,8 @@ last_updated: 2026-08-02T23:00:30.894Z | 11 | 10 | unrun-verify | docs/security/KEY-02-FLEET-ROTATION.md | | C-3 FAILED: archipelago-1, archy-x250-beta and archipelago share all three SSH host keys; the first two also share their TLS private key. Not rotated — needs an operator-driven --apply --yes per node. | open | | 2026-08-02T19:07:39.861Z | | | 12 | 10 | unrun-verify | scripts/security/host-secrets-audit.sh | | Rotation never exercised on real hardware: that 'systemctl reload ssh' keeps the operator's own forked session alive is proven only by design, not by observation. Needs --apply --yes on one disposable node from a session the operator is willing to lose. | open | | 2026-08-02T19:07:40.217Z | | | 13 | 10 | unrun-verify | core/archipelago/src/api/rpc/system/handlers.rs | | system.stats host_secrets never observed on a real node — proven against the file contract in unit tests only. Needs a build carrying 10-04 deployed to the dev pair, then a system.stats call. | fixed | | 2026-08-02T19:07:40.522Z | 2026-08-02T23:00:30.894Z | -| 14 | 10 | unrun-verify | core/archipelago/src/container/prod_orchestrator.rs | | LIVE EXPOSURE on archi-dev-box: archy-bitcoin-ui (systemd/Quadlet-owned, user-uninstalled marker set) still serves unauthenticated POST /bitcoin-rpc/ on 0.0.0.0:8334 with Access-Control-Allow-Origin *, reaching Bitcoin Core RPC through a credential-injecting proxy. Verified live 2026-08-02 (returned a real block height with no cookies). Code fix committed f6b5245b but NOT deployed: closing it needs the new binary on the node plus an archy-bitcoin-ui restart. archy-electrs-ui is in the same uninstalled-but-running state (static UI only, no credential proxy). Operator-gated; no node touched. | open | | 2026-08-02T22:44:15.215Z | | +| 14 | 10 | unrun-verify | core/archipelago/src/container/prod_orchestrator.rs | | LIVE EXPOSURE on archi-dev-box: archy-bitcoin-ui (systemd/Quadlet-owned, user-uninstalled marker set) still serves unauthenticated POST /bitcoin-rpc/ on 0.0.0.0:8334 with Access-Control-Allow-Origin *, reaching Bitcoin Core RPC through a credential-injecting proxy. Verified live 2026-08-02 (returned a real block height with no cookies). Code fix committed f6b5245b but NOT deployed: closing it needs the new binary on the node plus an archy-bitcoin-ui restart. archy-electrs-ui is in the same uninstalled-but-running state (static UI only, no credential proxy). Operator-gated; no node touched. | fixed | | 2026-08-02T22:44:15.215Z | 2026-08-02T23:16:04.071Z | +| 15 | 10 | unrun-verify | core/archipelago/src/container/prod_orchestrator.rs | | The f6b5245b reconcile fix is DEPLOYED on archi-dev-box (binary installed 19:06, running) but NEVER EXERCISED on hardware: the state it repairs (uninstall marker + Quadlet-running + stale config) stopped existing here at 18:36, when a separate rebuild of bitcoin-ui rendered the fixed conf and restarted the container. So :8334 returning 401 proves a05956c4's template, NOT the reconcile path that is supposed to deliver it. archy-electrs-ui still carries the marker+running shape and could exercise it, but has no rendered config to rewrite. Needs a node that still has a stale bitcoin-ui conf, or a deliberately re-staled one. | open | | 2026-08-02T23:16:04.510Z | | ````json [ @@ -195,9 +196,21 @@ last_updated: 2026-08-02T23:00:30.894Z "file": "core/archipelago/src/container/prod_orchestrator.rs", "line": null, "description": "LIVE EXPOSURE on archi-dev-box: archy-bitcoin-ui (systemd/Quadlet-owned, user-uninstalled marker set) still serves unauthenticated POST /bitcoin-rpc/ on 0.0.0.0:8334 with Access-Control-Allow-Origin *, reaching Bitcoin Core RPC through a credential-injecting proxy. Verified live 2026-08-02 (returned a real block height with no cookies). Code fix committed f6b5245b but NOT deployed: closing it needs the new binary on the node plus an archy-bitcoin-ui restart. archy-electrs-ui is in the same uninstalled-but-running state (static UI only, no credential proxy). Operator-gated; no node touched.", - "status": "open", + "status": "fixed", "reason": "", "recorded_at": "2026-08-02T22:44:15.215Z", + "resolved_at": "2026-08-02T23:16:04.071Z" + }, + { + "id": 15, + "kind": "unrun-verify", + "phase": "10", + "file": "core/archipelago/src/container/prod_orchestrator.rs", + "line": null, + "description": "The f6b5245b reconcile fix is DEPLOYED on archi-dev-box (binary installed 19:06, running) but NEVER EXERCISED on hardware: the state it repairs (uninstall marker + Quadlet-running + stale config) stopped existing here at 18:36, when a separate rebuild of bitcoin-ui rendered the fixed conf and restarted the container. So :8334 returning 401 proves a05956c4's template, NOT the reconcile path that is supposed to deliver it. archy-electrs-ui still carries the marker+running shape and could exercise it, but has no rendered config to rewrite. Needs a node that still has a stale bitcoin-ui conf, or a deliberately re-staled one.", + "status": "open", + "reason": "", + "recorded_at": "2026-08-02T23:16:04.510Z", "resolved_at": null } ] diff --git a/docs/security/BITCOIN-RPC-PROXY-EXPOSURE.md b/docs/security/BITCOIN-RPC-PROXY-EXPOSURE.md index b605b528..3bb071cd 100644 --- a/docs/security/BITCOIN-RPC-PROXY-EXPOSURE.md +++ b/docs/security/BITCOIN-RPC-PROXY-EXPOSURE.md @@ -79,6 +79,30 @@ Deliberately narrow: survived. A new regression test pins the whole chain: stale conf in, gate present out, container restarted, nothing created. +## What actually closed it on archi-dev-box — and what that does NOT prove + +Sequence, from file mtimes, container start times and the daemon journal: + +| Time (EDT) | Event | +|---|---| +| 18:33 | Probe: `POST /bitcoin-rpc/` → `200` with a real block height. Exposure confirmed live. | +| 18:36 | A **separate rebuild of bitcoin-ui**, done outside this work, rendered the fixed conf and recreated `archy-bitcoin-ui`. `:8334` closes here. | +| 19:06 | The binary carrying `f6b5245b` is installed and the daemon restarted. | +| 19:12 | Probe: `POST /bitcoin-rpc/` → `401`. `OPTIONS` now returns `Access-Control-Allow-Origin: http://192.168.63.240:8334`, not `*`. | + +So the node is closed, and the fixed template is proven to work end to end on real +hardware — but **the reconcile fix itself was never exercised.** By the time it was +deployed, the state it repairs had already been cleared by the unrelated rebuild. The +`401` proves `a05956c4`'s template; it does not prove the delivery path `f6b5245b` adds. + +That distinction is the whole point of this document, so it is recorded rather than +rounded off: `bitcoin-ui` is *still* in the node's `user-uninstalled` marker, meaning the +next time its config needs to change, this node depends on `f6b5245b` — untested — or on +someone happening to rebuild the app again. + +Tracked as broken window 15. Closing it needs a node whose `bitcoin-ui` conf is still +stale, or a deliberately re-staled one. + ## Operator note Deploying the fix rewrites the config and restarts `archy-bitcoin-ui` (a brief Bitcoin UI