From 9d225473b11d6cb76daf559fea9f48edbb5a435e Mon Sep 17 00:00:00 2001 From: archipelago Date: Tue, 4 Aug 2026 02:49:36 -0400 Subject: [PATCH] docs(1.7.121): record what shipped, both gate incidents, and the .122 queue Co-Authored-By: Claude Opus 5 (1M context) --- .planning/RELEASE-1.7.121-TASKS.md | 64 ++++++++++++++++++++++++++++++ 1 file changed, 64 insertions(+) diff --git a/.planning/RELEASE-1.7.121-TASKS.md b/.planning/RELEASE-1.7.121-TASKS.md index ed5e769d..7542bda1 100644 --- a/.planning/RELEASE-1.7.121-TASKS.md +++ b/.planning/RELEASE-1.7.121-TASKS.md @@ -443,6 +443,70 @@ below is dead on every path. Pre-existing; spotted in the v1.7.120 build warning --- +## STATUS 2026-08-04 — what shipped in 1.7.121 and what did not + +### Shipped (committed + pushed) + +| Item | Commit | Verified | +|---|---|---| +| 3. Federation trust escalation | `c0cfc72a` | 42/42 federation tests | +| 3b. Trusted requires node password | `24ce8b39` | 44/44 + 79/79 + vue-tsc | +| 4. lnd-ui OTA pin + host networking | `5088aef5` | — | +| 1b. Manifest `auth:` declarations | `0c4826f8` | 73/73, all 56 manifests parse | +| 1c. App gate (engine + audit) | `0de67ca6` | 23/23 appgate | +| Dashboard backdrop-filter seam | `63d0183d` | 3/3, **live on archi-dev-box** | +| 7. Release refuses unsigned manifest | `cc9e1958` | dry-run: signed/stripped/wrong-signer | +| Gate safety model (`Option`) | `ab2c8b6e` | 75/75 incl. LND wallet-port case | +| Companion rebuild-loop | `719446c0` | podman behaviour proven first | +| 5. Federated peers messageable | `edc9a172` | predicate pinned across device types | + +### The two gate incidents — read before touching the gate again + +Both were ONE mistake: a safety decision read an ABSENT manifest field as a +value. A node's installed manifests always lag the binary, so "absent" is the +normal state, and the daemon acted on instructions no manifest ever gave. + +1. Gating any `session` port regardless of `bind` **published Bitcoin's + loopback-only RPC 8332 on the LAN/Tailscale/IPv6** within seconds of deploy. +2. The `bind`-keyed replacement looked safe (it protected `bind: 127.0.0.1`) + but LND's gRPC 10009 / REST 18080 carry an EMPTY bind — one container + recreate from pinning them to loopback and **breaking Zeus and every remote + wallet**. + +Now structural: `auth_policy()` classifies (undeclared → reported as +unprotected, always safe), `auth_is_declared()` gates action (undeclared → +never acted on). **Silence is not consent.** + +### Proven on the node, empirically, not by reasoning + +- Gate challenge → login → proxy works end to end over LAN and Tailscale. +- **Daemon-side publish rewriting was removed.** Publishes are built in several + places (`podman_client`, `package::install`, `stacks`); patching one covered + one — the strfry recreate went through another and the pin never fired. +- **Disk manifest edits do not apply to catalog-covered apps.** Even + `bind: 127.0.0.1` written into the node's strfry manifest was overridden by + the signed catalog. The catalog re-sign is REQUIRED; there is no shortcut. +- A loopback-bound host port is **unreachable** from a pasta container, so + loopback-pinning the Wyoming ports would break Home Assistant voice. + +### Open for 1.7.122 + +1. **Catalog re-sign** — `bind: 127.0.0.1` + `auth: session` on the ~39 gated + UI ports. This is what turns the gate from auditing into enforcing. Nothing + in code can substitute for it. +2. **Release-root rotation** — branch `rotate-release-root`, key + `did:key:z6Mkfu5LT…DLWT` / `1578adcc…4418`, validated as a real curve point. + **Sign the rotation release with the OLD key**; only the release after it + uses the new one. Re-sign the catalog too. +3. **Wyoming voice ports** (10200/10300/10400) — unauthenticated, and by the + operator's policy they should not be. Correct fix is co-locating Home + Assistant with the pine services on one container network so nothing is + published; needs a node running both. +4. **Item 2** filebrowser default login. **Items 6/6b** app updates + + multiversion (`versions[]` already exists, populated for 2 of 66 apps). +5. **`cargo-test-weekly` times out** at its 1500s cap on a loaded box — raise + the cap or split the stage; it is not a code failure. + ## RESUME HERE — next session **Landed this session (both pushed):**