fix(enrollment): repair node enrollment path #24

Merged

ochenstarik-ui merged 2 commits from hermes/node-enrollment-fix into main

2026-08-09 15:32:54 +00:00

ochenstarik-ui commented

2026-08-09 15:02:50 +00:00

(Migrated from github.com)

Summary

make published trimmed Agent configuration binding fail closed before certificate/network access
enforce strict HTTPS Control origins across Agent and bootstrap, including compressed IPv6 with embedded IPv4 and overflow-safe numeric parsing
add system bootstrap and control-device-code delivery with strict arity and protected token handling
migrate alpha.7 Control state safely with automatic post-stop recovery and migration-compatible manual rollback
preserve shared CA and isolate co-located Control/Agent role state
run the full published self-contained trimmed enrollment cycle in Linux CI

Verification

Windows locked restore/build: PASS, 0 errors
Windows Control tests: 108/108 PASS
Windows whitespace/style formatting: PASS
exact-tree Linux locked build: PASS
exact-tree Linux Control tests: 108/108 PASS
Bash syntax and bootstrap contract: PASS
Linux enrollment-token argv secrecy: PASS
self-contained single-file PublishTrimmed probes: invalid NodeId rc=2; plaintext HTTP rc=2; no pre-validation agent.pfx access
independent spec review: APPROVE
independent security/correctness review: APPROVE

Remaining external gates

privileged root/systemd enrollment, update, and rollback smoke runs in hosted CI
physical multi-server registration is intentionally post-release and requires authorized topology inputs; co-located smoke is not mesh acceptance

Security notes

no enrollment/device token is placed in argv or diagnostics
mTLS, token TTL/one-time semantics, SO_PEERCRED, sudo/helper, and role-private state boundaries are retained

## Summary - make published trimmed Agent configuration binding fail closed before certificate/network access - enforce strict HTTPS Control origins across Agent and bootstrap, including compressed IPv6 with embedded IPv4 and overflow-safe numeric parsing - add system bootstrap and `control-device-code` delivery with strict arity and protected token handling - migrate alpha.7 Control state safely with automatic post-stop recovery and migration-compatible manual rollback - preserve shared CA and isolate co-located Control/Agent role state - run the full published self-contained trimmed enrollment cycle in Linux CI ## Verification - Windows locked restore/build: PASS, 0 errors - Windows Control tests: 108/108 PASS - Windows whitespace/style formatting: PASS - exact-tree Linux locked build: PASS - exact-tree Linux Control tests: 108/108 PASS - Bash syntax and bootstrap contract: PASS - Linux enrollment-token argv secrecy: PASS - self-contained single-file PublishTrimmed probes: invalid NodeId rc=2; plaintext HTTP rc=2; no pre-validation `agent.pfx` access - independent spec review: APPROVE - independent security/correctness review: APPROVE ## Remaining external gates - privileged root/systemd enrollment, update, and rollback smoke runs in hosted CI - physical multi-server registration is intentionally post-release and requires authorized topology inputs; co-located smoke is not mesh acceptance ## Security notes - no enrollment/device token is placed in argv or diagnostics - mTLS, token TTL/one-time semantics, `SO_PEERCRED`, sudo/helper, and role-private state boundaries are retained