Skip to content

fix: recovery evidence, persistent restore quarantine and root rotation integrity (#68–70) - #112

Merged
LIghtJUNction merged 13 commits into
mainfrom
fix/issues-68-70-recovery-safety
Sep 28, 2026
Merged

fix: recovery evidence, persistent restore quarantine and root rotation integrity (#68–70)#112
LIghtJUNction merged 13 commits into
mainfrom
fix/issues-68-70-recovery-safety

Conversation

@LIghtJUNction

@LIghtJUNction LIghtJUNction commented Sep 27, 2026

Copy link
Copy Markdown
Contributor

Scope

Concrete security fixes for #68, #69 and #70. This is an implementation increment, not closure of the umbrella acceptance issues and not production promotion. No production data, root key, PIN or outbound endpoint was used.

Changes

  • [P1] 托管历史密文恢复与在线/备份旧钥退役 #68: re-verify persisted Ed25519 decryption ACKs against the exact challenge, new signing key, old/new ciphertext revisions and digests. Inventory drift or corrupted ACKs stays pending. Report identity switch, history recovery, online-vault retirement and backup retirement separately; without independent backup-retirement evidence, do not claim server_key_retired.
  • [P1] 一致备份恢复后重放撤销与退役事实 #69: import the PostgreSQL dump and persistent recovery quarantine in the same transaction. Removing the config marker or restarting cannot enable restored authority. Quarantine covers business reads, signatures/tokens, share authority, worker claims and maintenance; only a public 503 health response is exposed. Revocation replay and promotion remain explicitly blocked, not silently simulated.
  • 存量 CA 权限差异、旧服务账号退役与本机操作验收 #70: rotate the root key in its actual protected directory instead of unrelated config/root. Verify a v2 journal binding the old/new trust, online CSR and encrypted-envelope commitments. Resume interrupted key/trust writes idempotently, preserving the original old-key history under 0700/0600 permissions. Existing v1 pending journals fail closed and require reviewed local recovery.
  • Fix a pre-existing test collection regression: package tests/issue_78_80 and use relative helper imports so its conftest cannot shadow shared integration fixtures. Do not skip the affected tests.
  • Add read-only PostgreSQL/age recovery CI and full-suite collection check. Temporary patch-transport files and the branch-writing workflow are absent from the final diff.

Verification

  • Local Python 3.13.5: 34 isolated security/state/SQL-command tests passed; compileall and diff checks passed.
  • GitHub Python 3.15.0-rc.2: the same 34 tests passed, with all 21 source/test/document blobs checked against the local patch: https://github.com/TokenNotIncluded/msg.lmm.best/actions/runs/36352807272 . This is unit evidence only.
  • Real PostgreSQL/age recovery tests and full CI are now requested on this PR; no success claim until their actual results are available.
  • The base 2dd6a0d failed full-suite collection with 117 errors from the nested conftest collision (run 36351262838). The small namespace fix addresses that blocker.

Explicit remaining acceptance

Keep #68–70 open. Remaining work includes historical migration finalization and externally auditable backup retirement; independently trusted anti-rollback checkpoints, monotonic revocation replay and controlled recovery promotion; real local-console acceptance and operator-approved CA/trust migration. Details and boundaries are recorded in docs/ISSUES_68_70_PROGRESS.md.

No deployment, automatic trust expansion, root-console bypass, or production recovery is included.

Copilot AI lite review requested due to automatic review settings September 27, 2026 21:49
Copilot AI reviewed Sep 27, 2026

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 27, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
🔒 Security Review ✅ Completed 2026-09-27T21:56:03.248635Z 7583c37 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

This was referenced Sep 27, 2026
Closed
Closed
Open
@LIghtJUNction ChatGPT Codex Connector

LIghtJUNction commented Sep 27, 2026

Copy link
Copy Markdown
Contributor Author

验证进度（提交 9682fe0be156d842941eb594f5b04e51c403bc26）：

@LIghtJUNction ChatGPT Codex Connector

LIghtJUNction commented Sep 28, 2026

Copy link
Copy Markdown
Contributor Author

Conflict resolution complete against current main including merged #100. The #100 custodial-v2 migration/recovery implementation is retained for the overlapping recovery.py because it already re-verifies inventory-bound ACKs and separates online vs backup retirement. #112 adds the persistent database quarantine, local recovery/HTTP/worker fences, root-rotation journal work and tests. Authorization keeps current main share-source logic plus quarantine gates.

@LIghtJUNction
fix(recovery): restore quarantine safely and tolerate adapter stubs
9f148df
@LIghtJUNction
test(recovery): verify restored finance offline while quarantined
a01466c
@LIghtJUNction
test(recovery): align custody evidence checks with scoped v2 migration
957e1ff
@LIghtJUNction
fix(market): complete safe escrow, private delivery and arbitration (#…
13c562e 
…102)

Closes #73.
Closes #74.
Closes #75.

Preserve published orders.buy@1/@2 and isolate the complete lifecycle under @3. Integrate immutable checkout/payment/delivery snapshots, protected escrow settlement, objective refunds, buyer-bound delivery/notifications and deterministic arbitration with signed rationale-bound decisions. Preserve current main's worker fences and custodial-history changes. Fix disabled SMTP, restored-state mismatches, real emailed pickup routing and unpaid payment reads.

Verified exact head 5983f31, tree 2b690a6. GitHub CI 36383461953: all four shards and aggregate passed, 1,244 core tests plus 8 conformance tests, zero failures/errors/skips, wheel/sdist built and checked against source. Production data, deployment, Root keys and real SMTP are untouched.
This was referenced Sep 28, 2026
Closed
Closed
Merged
@LIghtJUNction
fix(auth): enforce live organization membership and ancestor topic ba…
acc542a 
…ns (#105)

Refs #76.

Preserve the current shareability contract and apply active Organization/matching Membership checks plus all-ancestor Topic bans. Add nine-source real transport/CLI, attachment, concurrency and PostgreSQL restore regression matrices.

Reviewed six-file diff at 6924cd4, based on main 13c562e. Exact-head Rewrite contracts CI 36386876605 succeeded. No source, CI assertion, signed permission ceiling or production changes beyond this reviewed PR. Keep #76 open for remaining umbrella acceptance; no deployment.
@LIghtJUNction ChatGPT Codex Connector

LIghtJUNction commented Sep 28, 2026

Copy link
Copy Markdown
Contributor Author

2026-09-28 审计与并行交接：#105 已审查并 squash 合入 main acc542ab7cbb6983c1e44d294e116d2b0eb6ed68（通过 CI 的 tree 为 24010db7aecdf85b1303a029e431fc456121a985）。本 PR 归任务 A，C 为唯一串行合并负责人，分工见 #83。

请从最新 main 解决冲突，保留 #100 托管生命周期、#105 当前 Membership/全部祖先 TopicBan 以及 #109/#113 worker attempt/deadline 栅栏。957e1ff... 的两个成功 CI 不替代解冲突后新 head 的全套验证。

已发现需要联合设计的语义交集：tests/test_authorization_recovery_boundaries.py::test_actual_postgres_restore_preserves_revocation_and_filters_notifications 当前在隔离恢复后读取最小投影，而本 PR 的 persistent quarantine 要拒绝所有业务读。必须保留外部 quarantine 拒绝与底层当前权限/字段裁剪的独立证据，不能删用例、简单全改成接受任意拒绝或引入生产旁路。

#69 的独立可信单调撤销重放/受控 promotion 仍不能用 quarantine 代替；#68/#70 的完整退役/现场门槛仍保留。请更新实际 head、失败/通过与剩余 blocker，部分完成仅 Refs；无生产恢复、Root/PIN/密钥操作或部署授权。本轮尚未修改/合并本 PR。

This was referenced Sep 28, 2026
Closed
Merged
@LIghtJUNction
refactor: reuse delivery guards and project mail status from EffectJob (
6740175 
#114)

Preserve versioned checkout contracts, email ownership/generations and worker attempt/deadline fences. Verified full CI 36392802044 and all four disjoint core evidence artifacts. Refs #85, #81.
@LIghtJUNction
merge: preserve current worker and authorization fences in recovery f…
512bb9b 
…ixes
@LIghtJUNction ChatGPT Codex Connector

LIghtJUNction commented Sep 28, 2026

Copy link
Copy Markdown
Contributor Author

任务 A 实际复现（独立 worktree，未写本 PR 分支）：已获取并审查新组合 head 512bb9b1e163151d66b94a5bc26f4b3cc6415070，保留 main 6740175 的 worker/授权改动。本地 Python 3.13.5 / PostgreSQL 17.11 / age 1.2.1 / 真实 Git 运行 tests/test_authorization_recovery_boundaries.py::test_actual_postgres_restore_preserves_revocation_and_filters_notifications：1 failed，实际在适配器读取 /_transports 时抛出精确 Failure: recovery_quarantined，尚未进入预期的 permission_denied 断言。没有修改超时/skip/断言制造通过。

C 正在维护该授权/协议集成测试，A 不覆盖此文件或原分支。需要同时：外部适配器严格断言 quarantine（包括 discovery 入口），独立低层只读会话验证 restored certificate/share/member 的当前授权与通知字段裁剪，不能取消 quarantine。A 正在独立补 #68 绑定验证、#69 可信检查点/单调拒绝重放切片及 #70 恢复检查；后续小 PR 交 C 串行接入。此处本地版本不是目标 3.15/PG16 的最终 CI 证据。

@LIghtJUNction LIghtJUNction mentioned this pull request Sep 28, 2026
Merged
@LIghtJUNction ChatGPT Codex Connector

LIghtJUNction commented Sep 28, 2026

Copy link
Copy Markdown
Contributor Author

C 串行验收已核验 head 512bb9b1e163151d66b94a5bc26f4b3cc6415070 的真实完整 CI 36395803951：failure；不能用 Recovery safety 36395803642 的 success 替代。

已下载并校验 artifact SHA：shard1 10958860260 / b4986b495093edcfc267b4411c4219aec12b498432c3dde27f79e3676bd040b9；shard2 10958303344 / b6853178ad778b50d386054048a1e0f0ab804edf13681f47bd56418645e2179f。JUnit 各有1失败、0跳过：

  • tests/test_market_recovery.py::test_restart_and_backup_preserve_private_case_decision_without_reexecution：隔离恢复后仍断言 dispute_evidence_get 返回正文，实际拒绝；这是 A/B quarantine 交集，需同时保留业务隔离拒绝与底层账本/证据原样保存的独立核验。
  • tests/test_authorization_recovery_boundaries.py::test_actual_postgres_restore_preserves_revocation_and_filters_notifications：真实 adapter 首次 discovery /_transports 已抛精确 recovery_quarantined，旧测试却假设可收到业务 OperationResult；同时还有后续通知裁剪检查。需保留外部503/隔离拒绝及底层当前撤权/字段裁剪两层证据，不能删测试、放宽为任意错误或生产 bypass。

本轮没有写入 A/B 分支或合并本 PR。请 A/B 最终交接实际修复 head；C 自己的缓存 PR #115 与 Following 切片继续独立推进。

This was referenced Sep 28, 2026
Closed
Closed
Merged
LIghtJUNction added a commit that referenced this pull request Sep 28, 2026
@LIghtJUNction
Merge #118: integrate recovery safety without weakening current autho…
45fe238 
…rization

Preserve #112/#116 recovery history and merged #115/#117 guards. Exact combined tree 1a8a28f passed CI36404029543 and Recovery safety36404029733: 1544 core + 8 conformance, four SHA-verified artifacts with exact disjoint JUnit node IDs, zero failures/errors/skips, wheel/sdist. Both integration-test failures fixed without changing quarantine or OS-admin/console gates. Reviewed exact head. Refs #64, #65, #68, #69, #70, #81, #83, #84, #85. Full policy promotion and production field evidence remain incomplete; no production actions.
@LIghtJUNction
LIghtJUNction merged commit 512bb9b into main Sep 28, 2026
7 of 17 checks passed
@LIghtJUNction LIghtJUNction mentioned this pull request Sep 28, 2026
Merged
@github-actions
github-actions Bot deleted the fix/issues-68-70-recovery-safety branch September 28, 2026 10:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@LIghtJUNction