Repository navigation
fix(hosts): treat a definitive activation refusal after expiry as terminal #99
Description
After #85, connection.Run ends with owner newcode recovery when the active certificate has expired and no pending certificate exists. When a pending certificate exists and the old certificate has expired, though, a first activation that the server definitively refuses is retried forever. An expired pending certificate is also retried forever. The contract (specs/006-whr-cli/contracts/host-enrollment.md, "Renewal and crash recovery") says: "First staging/activation after old expiry fails and requires explicit owner newcode recovery."
Acceptance criteria
- A definitive activation refusal after the old certificate's expiry (server error class, not transport) ends
Runwith the recovery error and exit 66. - An expired pending certificate ends
Runthe same way. - Transient failures (transport, 5xx, timeouts) keep retrying with backoff.
- Tests cover each case;
make checkis green.
Found by the independent review of #85 on 2026-10-16. Builds on #98.
🤖 Generated with Claude Code
Activity
fix(hosts): end Run on terminal activation refusal after expiry
docs(hosts): state terminal activation outcomes in agent exit table
fix(hosts): answer transient agent faults with 503, not 400/401
fix(hosts): treat only allowlisted activation codes as final
docs(hosts): record final activation codes and the 503 rule
fix(hosts): answer an unavailable post-activation check with 503
test(hosts): prove the real server refusal is final for the agent
wstein commentedon Oct 16, 2026
Done in #114: definitive activation refusals after expiry end the agent with exit 66; transient faults return 503 and retry; 403 is reported and retried (H72:a, H73:a).