WIP: Windows existing-agent credential transition and trust-reset recovery #5

2026-10-14T10:54:44-05:00

lussierj commented

2026-10-14 10:54:44 -05:00

Source: codex/review-05-credential-recovery
Target: codex/review-04-management-packaging

Summary

This PR adds durable existing-agent credential transitions and the Windows recovery workflow needed to migrate existing MinerOps Agents safely from legacy shared-secret authentication.

It also fixes a trust-reset recovery defect where the optional per-user MinerOpsAgentTray task could block SYSTEM/QGA recovery when the tray task was missing.

Dependencies

Depends on PRs 1–4. Its target supplies the existing migration chain, authentication/enrollment services, Agent registry and UI, Windows runtime/installer, and package-delivery infrastructure.

This comparison contains exactly the three validated commits below. Earlier prerequisite commits are reviewed in their own PRs.

Commits

`3cfb0d1` — feat(agent): add durable existing-agent credential transitions

Adds the backend and migration foundation for:

durable existing-agent routing
permanent retirement from legacy shared-secret authentication
one-time credential transition authorization and redemption
transition-aware agent authentication and routing
supporting PostgreSQL and production-shape tests

`97a0139` — feat(windows): add recoverable existing-agent credential upgrade

Adds the Windows-side upgrade and recovery workflow:

Upgrade-MinerOpsAgentCredential.ps1
protected recovery state
filesystem trust blocker protocol
reboot-gated trust reset
runtime publication verification
credential convergence and cleanup
package delivery and operator UI support
extensive PowerShell, native-harness, boot-event, and package tests

`2d89e80` — fix(windows): defer missing tray task during trust reset

Fixes SYSTEM/QGA trust-reset recovery when MinerOpsAgentTray is absent.

During trust reset:

MinerOpsAgent remains mandatory and strictly verified
missing MinerOpsAgentTray creation is deferred
existing tray definitions are preserved
SYSTEM-owned auxiliary tasks can still be created
no interactive username is inferred or invented
no credential or filesystem trust checks are weakened

Validation

Local

Previously passed during validation of the exact commit boundaries:

git diff --check
PowerShell parsing
Python compilation
shell parser checks
backend transition tests
PostgreSQL migration and transition tests
Windows package tests
28 boot-event parser tests
96 credential-transition behavioral tests
34 native-harness regression tests
enrollment and installer safety tests

These results cover the validated credential-transition series. They do not establish that every earlier feature suite passes at final HEAD.

Disposable VM 251

The supplied operator validation record reports testing entirely through QGA/SYSTEM with Ethernet disconnected.

Passed:

clean untrusted-directory containment
genuine Windows reboot gate
trust-reset-authorized
trust-reset-runtime-published
before-trust-blocker-removal
final convergence
post-success safe rerun

Additional security validation passed:

malicious recovery quarantine
malicious pending quarantine
ACL-repair laundering resistance
external filesystem trust blocker persistence
same-boot trust-reset rejection
post-reboot quarantine of pre-existing untrusted artifacts
standard-user read denial of quarantine evidence

Final successful recovery completed without:

manually creating MinerOpsAgentTray
creating the tray as SYSTEM
inventing an interactive username
weakening trust blockers
weakening credential authority checks

Blocker status

BLOCKER #2: PASS

The previously blocking SYSTEM/QGA tray-registration defect is resolved. This result applies to that recovery defect and does not constitute production approval for the full stack.

Outstanding testing and security concerns

Run the broader committed backend integration suites at final HEAD.
Resolve the stale system-health migration expectation.
Review remaining legacy control producers, scheduler behavior, permissions, and discovery isolation.
Validate the complete 0014 → 0020 migration sequence against a sanitized production-shaped database, including ambiguous routing, occupied zones, historical credentials, and live queues.
Migration 0018 refuses automatic downgrade; 0019 and 0020 restrict downgrade after durable history exists. Establish a verified backup/restore plan and take queue producers offline for migration.
Per-Agent credential issuance permanently retires shared-secret authentication for that identity. Interrupted local convergence must use protected recovery rather than restoring legacy configuration.
Verify production package delivery and coordinate schema, backend, and Agent rollout.
Retain native Windows transcripts tied to the tested source/package identity. Repeat affected cases if relevant runtime, installer, packaging, or authentication changes.
Uncommitted schema-guard, Docker-context, discovery-isolation, and legacy-control work is excluded from this PR stack.

Notes

VM 250 was not modified.
VM 251 remained isolated throughout the supplied validation.
The development working tree contains unrelated unstaged/untracked work that is not part of these review branches.
Existing commits and their content are preserved.

Deployment status

This PR is not approved for production deployment. No PR in this stack authorizes merging, deployment, or physical miner-control execution.

Source: `codex/review-05-credential-recovery` Target: `codex/review-04-management-packaging` ### Summary This PR adds durable existing-agent credential transitions and the Windows recovery workflow needed to migrate existing MinerOps Agents safely from legacy shared-secret authentication. It also fixes a trust-reset recovery defect where the optional per-user `MinerOpsAgentTray` task could block SYSTEM/QGA recovery when the tray task was missing. ### Dependencies Depends on PRs 1–4. Its target supplies the existing migration chain, authentication/enrollment services, Agent registry and UI, Windows runtime/installer, and package-delivery infrastructure. This comparison contains exactly the three validated commits below. Earlier prerequisite commits are reviewed in their own PRs. ### Commits #### `3cfb0d1` — feat(agent): add durable existing-agent credential transitions Adds the backend and migration foundation for: - durable existing-agent routing - permanent retirement from legacy shared-secret authentication - one-time credential transition authorization and redemption - transition-aware agent authentication and routing - supporting PostgreSQL and production-shape tests #### `97a0139` — feat(windows): add recoverable existing-agent credential upgrade Adds the Windows-side upgrade and recovery workflow: - `Upgrade-MinerOpsAgentCredential.ps1` - protected recovery state - filesystem trust blocker protocol - reboot-gated trust reset - runtime publication verification - credential convergence and cleanup - package delivery and operator UI support - extensive PowerShell, native-harness, boot-event, and package tests #### `2d89e80` — fix(windows): defer missing tray task during trust reset Fixes SYSTEM/QGA trust-reset recovery when `MinerOpsAgentTray` is absent. During trust reset: - `MinerOpsAgent` remains mandatory and strictly verified - missing `MinerOpsAgentTray` creation is deferred - existing tray definitions are preserved - SYSTEM-owned auxiliary tasks can still be created - no interactive username is inferred or invented - no credential or filesystem trust checks are weakened ### Validation #### Local Previously passed during validation of the exact commit boundaries: - `git diff --check` - PowerShell parsing - Python compilation - shell parser checks - backend transition tests - PostgreSQL migration and transition tests - Windows package tests - 28 boot-event parser tests - 96 credential-transition behavioral tests - 34 native-harness regression tests - enrollment and installer safety tests These results cover the validated credential-transition series. They do not establish that every earlier feature suite passes at final HEAD. #### Disposable VM 251 The supplied operator validation record reports testing entirely through QGA/SYSTEM with Ethernet disconnected. Passed: - clean untrusted-directory containment - genuine Windows reboot gate - `trust-reset-authorized` - `trust-reset-runtime-published` - `before-trust-blocker-removal` - final convergence - post-success safe rerun Additional security validation passed: - malicious recovery quarantine - malicious pending quarantine - ACL-repair laundering resistance - external filesystem trust blocker persistence - same-boot trust-reset rejection - post-reboot quarantine of pre-existing untrusted artifacts - standard-user read denial of quarantine evidence Final successful recovery completed without: - manually creating `MinerOpsAgentTray` - creating the tray as SYSTEM - inventing an interactive username - weakening trust blockers - weakening credential authority checks ### Blocker status **BLOCKER #2: PASS** The previously blocking SYSTEM/QGA tray-registration defect is resolved. This result applies to that recovery defect and does not constitute production approval for the full stack. ### Outstanding testing and security concerns - Run the broader committed backend integration suites at final HEAD. - Resolve the stale system-health migration expectation. - Review remaining legacy control producers, scheduler behavior, permissions, and discovery isolation. - Validate the complete `0014 → 0020` migration sequence against a sanitized production-shaped database, including ambiguous routing, occupied zones, historical credentials, and live queues. - Migration `0018` refuses automatic downgrade; `0019` and `0020` restrict downgrade after durable history exists. Establish a verified backup/restore plan and take queue producers offline for migration. - Per-Agent credential issuance permanently retires shared-secret authentication for that identity. Interrupted local convergence must use protected recovery rather than restoring legacy configuration. - Verify production package delivery and coordinate schema, backend, and Agent rollout. - Retain native Windows transcripts tied to the tested source/package identity. Repeat affected cases if relevant runtime, installer, packaging, or authentication changes. - Uncommitted schema-guard, Docker-context, discovery-isolation, and legacy-control work is excluded from this PR stack. ### Notes - VM 250 was not modified. - VM 251 remained isolated throughout the supplied validation. - The development working tree contains unrelated unstaged/untracked work that is not part of these review branches. - Existing commits and their content are preserved. ### Deployment status This PR is not approved for production deployment. No PR in this stack authorizes merging, deployment, or physical miner-control execution.

lussierj added 3 commits 2026-10-14 10:54:45 -05:00

feat(agent): add durable existing-agent credential transitions 3cfb0d1abe

feat(windows): add recoverable existing-agent credential upgrade 97a0139e3d

fix(windows): defer missing tray task during trust reset 2d89e80410

You are not authorized to merge this pull request.

This pull request can be merged automatically.

This pull request is marked as a work in progress.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin codex/review-05-credential-recovery:codex/review-05-credential-recovery

git checkout codex/review-05-credential-recovery

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: lussierj/minerops#5