feat(windows): add recoverable existing-agent credential upgrade

scripts/test-agent-credential-transition.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "${repo_root}"
+project_name="${MINEROPS_CREDENTIAL_TRANSITION_PROJECT:-minerops-credential-transition-$$}"
+compose=(docker compose --project-name "${project_name}" --env-file .env.dev -f compose.dev.yaml)
+
+cleanup() {
+    status=$?
+    if (( status != 0 )); then
+        "${compose[@]}" logs --no-color --tail 160 postgres || true
+    fi
+    "${compose[@]}" down --volumes --remove-orphans >/dev/null 2>&1 || true
+    exit "${status}"
+}
+trap cleanup EXIT
+
+[[ -f .env.dev ]] || { echo "Missing .env.dev" >&2; exit 1; }
+for source_file in \
+    backend/tests/test_agent_credential_transition_postgres.py \
+    agents/windows/Upgrade-MinerOpsAgentCredential.ps1; do
+    permissions="$(stat -c '%a' "${source_file}")"
+    (( (10#${permissions} % 10) & 4 )) || {
+        echo "${source_file} is not readable by the non-root test container" >&2
+        exit 1
+    }
+done
+"${compose[@]}" up --detach postgres
+for attempt in $(seq 1 60); do
+    "${compose[@]}" exec -T postgres sh -ec \
+        'pg_isready -U "$POSTGRES_USER" -d "$POSTGRES_DB"' >/dev/null 2>&1 && break
+    (( attempt < 60 )) || { echo "PostgreSQL did not become ready" >&2; exit 1; }
+    sleep 1
+done
+
+"${compose[@]}" build backend
+expected_head="$("${compose[@]}" run --rm --no-deps backend alembic heads 2>/dev/null | awk 'NR == 1 { print $1 }')"
+[[ "${expected_head}" == "0020_existing_agent_transition" ]]
+
+echo "Testing the additive 0019 -> 0020 transition-binding migration..."
+"${compose[@]}" run --rm --no-deps backend alembic upgrade 0019_agent_legacy_auth_retire
+"${compose[@]}" run --rm --no-deps backend alembic upgrade head
+
+echo "Testing production-shaped transactional credential transition..."
+"${compose[@]}" run --rm --no-deps \
+    --volume "${repo_root}/backend/tests:/app/tests:ro" \
+    --env MINEROPS_CREDENTIAL_TRANSITION_DISPOSABLE=1 \
+    --env MINEROPS_AGENT_ID=plexus-windows-agent \
+    --env MINEROPS_AGENT_SHARED_SECRET=credential-transition-legacy-secret \
+    backend python -m unittest -v \
+    tests.test_agent_credential_transition_postgres
+
+echo "Testing downgrade refusal after transition history exists..."
+if output="$("${compose[@]}" run --rm --no-deps backend \
+    alembic downgrade 0019_agent_legacy_auth_retire 2>&1)"; then
+    echo "0020 downgrade unexpectedly discarded transition history" >&2
+    exit 1
+fi
+[[ "${output}" == *"existing-Agent credential transition history exists"* ]]
+
+echo "Existing-Agent credential transition checks passed."

scripts/test-windows-agent-package.sh

@@ -37,6 +37,7 @@ echo "=== VERIFY CANONICAL SOURCE IS IN IMAGE ==="
 "${compose[@]}" run --rm --no-deps \
     backend sh -ec '
         test -f /app/agents/windows/Enroll-MinerOpsAgent.ps1
+        test -f /app/agents/windows/Upgrade-MinerOpsAgentCredential.ps1
         test -f /app/agents/windows/install.ps1
         test -f /app/agents/windows/MinerOpsAgentService.ps1
         test -f /app/agents/windows/VERSION
@@ -52,7 +53,9 @@ docker run --rm \
 
         foreach ($script in @(
             "/work/Enroll-MinerOpsAgent.ps1",
-            "/work/install.ps1"
+            "/work/Upgrade-MinerOpsAgentCredential.ps1",
+            "/work/install.ps1",
+            "/work/MinerOpsAgentGUI.ps1"
         )) {
             $tokens = $null
             $errors = $null
@@ -70,6 +73,8 @@ docker run --rm \
         }
 
         & /work/tests/Test-MinerOpsEnrollment.ps1
+        & /work/tests/Test-MinerOpsBootEventParser.ps1
+        & /work/tests/Test-MinerOpsCredentialTransition.ps1
         & /work/tests/Test-MinerOpsInstaller.ps1
     '
 

scripts/test-windows-agent-source.sh

@@ -4,7 +4,12 @@ set -euo pipefail
 service="agents/windows/MinerOpsAgentService.ps1"
 control="agents/windows/MinerOpsControl.ps1"
 installer="agents/windows/install.ps1"
+transition="agents/windows/Upgrade-MinerOpsAgentCredential.ps1"
+gui="agents/windows/MinerOpsAgentGUI.ps1"
 rg -q 'X-MinerOps-Agent-ID' "${service}"
+rg -q 'X-MinerOps-Agent-ID' "${gui}"
+rg -Fq '$config.agent_id' "${gui}"
+rg -q 'X-MinerOps-Agent-Secret' "${gui}"
 rg -Fq '$config.agent_zone_id' "${service}"
 rg -Fq '$body["agent_zone_id"]' "${service}"
 rg -q '"agent_zone_id"' agents/windows/config.example.json
@@ -28,9 +33,39 @@ rg -q 'could not restart restored MinerOpsAgent' "${installer}"
 ! rg -q 'Register-ScheduledTask.*-Force' "${installer}"
 ! rg -q 'agent_secret|api3_password|api3_account' "${installer}"
 
+rg -q 'existing_agent_credential_transition' "${transition}"
+rg -q '/api/agent/credential-transition' "${transition}"
+rg -q 'RandomNumberGenerator' "${transition}"
+rg -q 'agent-credential-transition.recovery.json' "${transition}"
+rg -q 'minerops-credential-transition\.blocked' "${transition}"
+rg -q 'Assert-MinerOpsTrustedAncestorNamespace' "${transition}"
+rg -q 'Open-MinerOpsDirectoryLock' "${transition}"
+rg -q 'Invoke-MinerOpsRecoverableConfigInstall' "${transition}"
+rg -q 'active-moved-to-prior' "${transition}"
+rg -q 'pending-moved-to-active' "${transition}"
+! rg -q '\[IO\.File\]::Replace|Invoke-MinerOpsAtomicConfigReplace' "${transition}"
+rg -q 'minerops-filesystem-trust\.blocked-' "${installer}"
+rg -q 'ApproveFilesystemTrustResetAfterReboot' "${installer}"
+rg -q 'windows-full-boot-event-v1:' "${installer}"
+rg -q 'windows-full-boot-event-v1:' "${transition}"
+! rg -q 'LastBootUpTime' "${installer}" "${transition}" \
+    agents/windows/Enroll-MinerOpsAgent.ps1
+! rg -q 'Remove-MinerOpsInstallerTrustBlocker' "${installer}"
+! rg -q 'Remove-MinerOpsEnrollmentTrustBlocker' \
+    agents/windows/Enroll-MinerOpsAgent.ps1
+rg -q 'Remove-MinerOpsFilesystemTrustBlockerAfterConvergence' "${transition}"
+rg -q 'GetNumberOfLinks' "${installer}"
+rg -q 'Assert-MinerOpsInstallerTrustedAncestors' "${installer}"
+! rg -q 'plexus-windows-agent|Plexus Mining Site' "${transition}"
+rg -q 'Get-MinerOpsVerifiedScheduledTask' "${transition}"
+! rg -q 'Get-ScheduledTask[^[:cntrl:]]*SilentlyContinue' "${transition}"
+
 if command -v pwsh >/dev/null 2>&1; then
     pwsh -NoProfile -File agents/windows/tests/Test-MinerOpsControl.ps1
     pwsh -NoProfile -File agents/windows/tests/Test-MinerOpsInstaller.ps1
+    pwsh -NoProfile -File agents/windows/tests/Test-MinerOpsBootEventParser.ps1
+    pwsh -NoProfile -File agents/windows/tests/Test-MinerOpsCredentialTransition.ps1
+    pwsh -NoProfile -File agents/windows/tests/Test-MinerOpsNativeHarness.ps1
 else
     echo "pwsh is not installed; deterministic PowerShell harnesses retained but not executed."
 fi