Claude 2cdadf017a feat(cluster): break-glass enrolment by code ...

For an LB MAIN cannot reach over SSH. `cluster:enrol-code <id>` issues a
one-time code (MAIN URL, panel key hash, 128-bit secret; 30 min). MAIN
keeps only K_req/K_res, sealed to the machine under a row MAC.

The node sends enrol_code (sid:<n>, epoch 0; MAC'd with K_req, signed by
the key it asks to enrol, body SEALed to the panel box key). Nothing is
minted until `cluster:enrol-approve <id> <SAS>`: the admin types the SAS
the node shows, which binds its keys; five wrong entries reject. The
node then collects epoch 1 via enrol_code_status (MAC'd with K_res,
panel-signed `pre`) and finishes with enrol_complete.

A wrong code MAC records nothing; other keys under a used code are a
signed ENROL_CONFLICT, the same keys again are accepted. Migration 036
keeps the request's per-epoch key until approval. Both commands are
MAIN-only (stripped from the LB archive).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DcNdxHieZuUh3EnMUKt7zf

2026-09-25 12:32:59 +00:00

..

check_procedural_use.php

fix(ci): correct check_procedural_use skip path to Infrastructure/Tmdb/lib

2026-08-07 21:03:57 +03:00

check-vendor-prod-only.sh

build: gitignore dev packages under vendor + harden the prod-only gate

2026-06-25 21:59:46 +03:00

verify-lb-archive.sh

feat(cluster): break-glass enrolment by code

2026-09-25 12:32:59 +00:00