feat(control): add background Link reconciliation #12

Merged

ochenstarik-ui merged 1 commit from hermes/task3-b2-background-reconciliation into main

2026-08-03 06:55:49 +00:00

ochenstarik-ui commented

2026-08-03 06:51:42 +00:00

(Migrated from github.com)

Summary

add immediate and periodic reconciliation for all effective Link policies
add generation-safe root marker handling for emergency firewall recovery
aggregate Mesh firewall unavailable state and expose a recoverable Desktop banner
fix direct Link lookup and CR/LF error compaction
extend unit, helper, Desktop, and physical acceptance harness coverage

Security and correctness

preserves sorted endpoint node locks -> per-Link gate
preserves strict privileged-helper argv boundary and fail-closed nft error handling
marker is root-owned 0600, atomic, generation-aware, and retained on incomplete convergence
independent full-contract repair review: APPROVE; no BLOCKING/HIGH/MEDIUM/LOW findings

Verification

Control Release: 76/76 PASS
Desktop Security Release: 12/12 PASS
Desktop Release x64: 0 warnings, 0 errors
bootstrap/helper contracts: PASS
Windows Desktop contracts: PASS
shell syntax and git diff check: PASS
fresh ad-hoc verification: PASS

Scope

M2, M4, and M5 are explicitly deferred to a separate B-3 PR. Block C is not included.

Acceptance

Physical three-server acceptance was not run because SSH/topology inputs are unavailable. CI and contract tests do not substitute for it. Final status after merge must remain verified and merged, physical acceptance pending until this succeeds:

SMM_ACCEPT_RESTORE=1 SMM_ACCEPT_REBOOT=1 tests/acceptance/three-server-mesh.sh

## Summary - add immediate and periodic reconciliation for all effective Link policies - add generation-safe root marker handling for emergency firewall recovery - aggregate Mesh firewall unavailable state and expose a recoverable Desktop banner - fix direct Link lookup and CR/LF error compaction - extend unit, helper, Desktop, and physical acceptance harness coverage ## Security and correctness - preserves sorted endpoint node locks -> per-Link gate - preserves strict privileged-helper argv boundary and fail-closed nft error handling - marker is root-owned 0600, atomic, generation-aware, and retained on incomplete convergence - independent full-contract repair review: APPROVE; no BLOCKING/HIGH/MEDIUM/LOW findings ## Verification - Control Release: 76/76 PASS - Desktop Security Release: 12/12 PASS - Desktop Release x64: 0 warnings, 0 errors - bootstrap/helper contracts: PASS - Windows Desktop contracts: PASS - shell syntax and git diff check: PASS - fresh ad-hoc verification: PASS ## Scope M2, M4, and M5 are explicitly deferred to a separate B-3 PR. Block C is not included. ## Acceptance Physical three-server acceptance was not run because SSH/topology inputs are unavailable. CI and contract tests do not substitute for it. Final status after merge must remain **verified and merged, physical acceptance pending** until this succeeds: `SMM_ACCEPT_RESTORE=1 SMM_ACCEPT_REBOOT=1 tests/acceptance/three-server-mesh.sh`