From 5a21b58f6950fa3a6bf6e84ee22896593a831f93 Mon Sep 17 00:00:00 2001 From: archipelago Date: Sun, 2 Aug 2026 19:19:29 -0400 Subject: [PATCH] docs(security): record what actually closed :8334, and what it does not prove MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The node is closed and verified 401 with origin-scoped CORS. But an unrelated bitcoin-ui rebuild at 18:36 cleared the stale conf before the reconcile fix was deployed at 19:06, so the 401 proves a05956c4's template and NOT the delivery path f6b5245b adds. Window 14 closed (exposure gone, verified). Window 15 opened for the delivery path, which is deployed but never exercised — bitcoin-ui is still in the uninstall marker, so this node depends on that untested path the next time its config has to change. Co-Authored-By: Claude Opus 5 (1M context) --- .planning/WINDOWS.md | 23 +++++++++++++++----- docs/security/BITCOIN-RPC-PROXY-EXPOSURE.md | 24 +++++++++++++++++++++ 2 files changed, 42 insertions(+), 5 deletions(-) diff --git a/.planning/WINDOWS.md b/.planning/WINDOWS.md index 132ccb9d..4ec34e04 100644 --- a/.planning/WINDOWS.md +++ b/.planning/WINDOWS.md @@ -2,9 +2,9 @@ schema_version: 1 open_count: 12 waived_count: 0 -fixed_count: 2 -total_count: 14 -last_updated: 2026-08-02T23:00:30.894Z +fixed_count: 3 +total_count: 15 +last_updated: 2026-08-02T23:16:04.510Z --- # Broken Windows Ledger @@ -28,7 +28,8 @@ last_updated: 2026-08-02T23:00:30.894Z | 11 | 10 | unrun-verify | docs/security/KEY-02-FLEET-ROTATION.md | | C-3 FAILED: archipelago-1, archy-x250-beta and archipelago share all three SSH host keys; the first two also share their TLS private key. Not rotated — needs an operator-driven --apply --yes per node. | open | | 2026-08-02T19:07:39.861Z | | | 12 | 10 | unrun-verify | scripts/security/host-secrets-audit.sh | | Rotation never exercised on real hardware: that 'systemctl reload ssh' keeps the operator's own forked session alive is proven only by design, not by observation. Needs --apply --yes on one disposable node from a session the operator is willing to lose. | open | | 2026-08-02T19:07:40.217Z | | | 13 | 10 | unrun-verify | core/archipelago/src/api/rpc/system/handlers.rs | | system.stats host_secrets never observed on a real node — proven against the file contract in unit tests only. Needs a build carrying 10-04 deployed to the dev pair, then a system.stats call. | fixed | | 2026-08-02T19:07:40.522Z | 2026-08-02T23:00:30.894Z | -| 14 | 10 | unrun-verify | core/archipelago/src/container/prod_orchestrator.rs | | LIVE EXPOSURE on archi-dev-box: archy-bitcoin-ui (systemd/Quadlet-owned, user-uninstalled marker set) still serves unauthenticated POST /bitcoin-rpc/ on 0.0.0.0:8334 with Access-Control-Allow-Origin *, reaching Bitcoin Core RPC through a credential-injecting proxy. Verified live 2026-08-02 (returned a real block height with no cookies). Code fix committed f6b5245b but NOT deployed: closing it needs the new binary on the node plus an archy-bitcoin-ui restart. archy-electrs-ui is in the same uninstalled-but-running state (static UI only, no credential proxy). Operator-gated; no node touched. | open | | 2026-08-02T22:44:15.215Z | | +| 14 | 10 | unrun-verify | core/archipelago/src/container/prod_orchestrator.rs | | LIVE EXPOSURE on archi-dev-box: archy-bitcoin-ui (systemd/Quadlet-owned, user-uninstalled marker set) still serves unauthenticated POST /bitcoin-rpc/ on 0.0.0.0:8334 with Access-Control-Allow-Origin *, reaching Bitcoin Core RPC through a credential-injecting proxy. Verified live 2026-08-02 (returned a real block height with no cookies). Code fix committed f6b5245b but NOT deployed: closing it needs the new binary on the node plus an archy-bitcoin-ui restart. archy-electrs-ui is in the same uninstalled-but-running state (static UI only, no credential proxy). Operator-gated; no node touched. | fixed | | 2026-08-02T22:44:15.215Z | 2026-08-02T23:16:04.071Z | +| 15 | 10 | unrun-verify | core/archipelago/src/container/prod_orchestrator.rs | | The f6b5245b reconcile fix is DEPLOYED on archi-dev-box (binary installed 19:06, running) but NEVER EXERCISED on hardware: the state it repairs (uninstall marker + Quadlet-running + stale config) stopped existing here at 18:36, when a separate rebuild of bitcoin-ui rendered the fixed conf and restarted the container. So :8334 returning 401 proves a05956c4's template, NOT the reconcile path that is supposed to deliver it. archy-electrs-ui still carries the marker+running shape and could exercise it, but has no rendered config to rewrite. Needs a node that still has a stale bitcoin-ui conf, or a deliberately re-staled one. | open | | 2026-08-02T23:16:04.510Z | | ````json [ @@ -195,9 +196,21 @@ last_updated: 2026-08-02T23:00:30.894Z "file": "core/archipelago/src/container/prod_orchestrator.rs", "line": null, "description": "LIVE EXPOSURE on archi-dev-box: archy-bitcoin-ui (systemd/Quadlet-owned, user-uninstalled marker set) still serves unauthenticated POST /bitcoin-rpc/ on 0.0.0.0:8334 with Access-Control-Allow-Origin *, reaching Bitcoin Core RPC through a credential-injecting proxy. Verified live 2026-08-02 (returned a real block height with no cookies). Code fix committed f6b5245b but NOT deployed: closing it needs the new binary on the node plus an archy-bitcoin-ui restart. archy-electrs-ui is in the same uninstalled-but-running state (static UI only, no credential proxy). Operator-gated; no node touched.", - "status": "open", + "status": "fixed", "reason": "", "recorded_at": "2026-08-02T22:44:15.215Z", + "resolved_at": "2026-08-02T23:16:04.071Z" + }, + { + "id": 15, + "kind": "unrun-verify", + "phase": "10", + "file": "core/archipelago/src/container/prod_orchestrator.rs", + "line": null, + "description": "The f6b5245b reconcile fix is DEPLOYED on archi-dev-box (binary installed 19:06, running) but NEVER EXERCISED on hardware: the state it repairs (uninstall marker + Quadlet-running + stale config) stopped existing here at 18:36, when a separate rebuild of bitcoin-ui rendered the fixed conf and restarted the container. So :8334 returning 401 proves a05956c4's template, NOT the reconcile path that is supposed to deliver it. archy-electrs-ui still carries the marker+running shape and could exercise it, but has no rendered config to rewrite. Needs a node that still has a stale bitcoin-ui conf, or a deliberately re-staled one.", + "status": "open", + "reason": "", + "recorded_at": "2026-08-02T23:16:04.510Z", "resolved_at": null } ] diff --git a/docs/security/BITCOIN-RPC-PROXY-EXPOSURE.md b/docs/security/BITCOIN-RPC-PROXY-EXPOSURE.md index b605b528..3bb071cd 100644 --- a/docs/security/BITCOIN-RPC-PROXY-EXPOSURE.md +++ b/docs/security/BITCOIN-RPC-PROXY-EXPOSURE.md @@ -79,6 +79,30 @@ Deliberately narrow: survived. A new regression test pins the whole chain: stale conf in, gate present out, container restarted, nothing created. +## What actually closed it on archi-dev-box — and what that does NOT prove + +Sequence, from file mtimes, container start times and the daemon journal: + +| Time (EDT) | Event | +|---|---| +| 18:33 | Probe: `POST /bitcoin-rpc/` → `200` with a real block height. Exposure confirmed live. | +| 18:36 | A **separate rebuild of bitcoin-ui**, done outside this work, rendered the fixed conf and recreated `archy-bitcoin-ui`. `:8334` closes here. | +| 19:06 | The binary carrying `f6b5245b` is installed and the daemon restarted. | +| 19:12 | Probe: `POST /bitcoin-rpc/` → `401`. `OPTIONS` now returns `Access-Control-Allow-Origin: http://192.168.63.240:8334`, not `*`. | + +So the node is closed, and the fixed template is proven to work end to end on real +hardware — but **the reconcile fix itself was never exercised.** By the time it was +deployed, the state it repairs had already been cleared by the unrelated rebuild. The +`401` proves `a05956c4`'s template; it does not prove the delivery path `f6b5245b` adds. + +That distinction is the whole point of this document, so it is recorded rather than +rounded off: `bitcoin-ui` is *still* in the node's `user-uninstalled` marker, meaning the +next time its config needs to change, this node depends on `f6b5245b` — untested — or on +someone happening to rebuild the app again. + +Tracked as broken window 15. Closing it needs a node whose `bitcoin-ui` conf is still +stale, or a deliberately re-staled one. + ## Operator note Deploying the fix rewrites the config and restarts `archy-bitcoin-ui` (a brief Bitcoin UI