mirror of
https://github.com/Vateron-Media/XC_VM.git
synced 2026-10-31 11:03:22 +01:00
Divarion_D
98cfa54519
- NodeConfigPack is the single config_pack caller: v2 when XcvtTargets::ready(), otherwise v1 with a node.config_v1 audit warning (N); never v1 to a node pinned with v2 or to one pinned before N unless its extension is too old (ext_old). - XcvtTargets keeps the xcvt.<sid> record (panel_pk sealed to sid and install_id), ready() and ensureRoot(); every cluster root creation (install, server:xcvt-pin, Settings, cluster:init) goes through it, cluster:init --force is audit-logged. - LB install: install_id, panel_pk, ensureRoot and a licence-free v2 pin run as root before the config and the chown; readback after runStartup (status 4 on mismatch). - Backfill: pin_core returns panel_pk; new server:xcvt-pin (host-key-verified SSH, --expect-hostkey required for a first-use key) and server:xcvt-report (the N+1 gate). Both are stripped from the LB archive. - Stale-key re-probe on a failed install_config; one re-pack on RECORD:replay. Security review (security-architect): APPROVE WITH CONDITIONS, M1/M2 and L2-L6 applied.