Repository navigation
fix(hosts): report owner newcode recovery for an expired identity - #98
Merged
Merged
Conversation
4 tasks done
wstein
force-pushed
the
test/84-renewal-loop-tests
branch
from
October 16, 2026 10:35
07ac5c7 to
509efb3
Compare
wstein
force-pushed
the
fix/85-expired-identity-recovery
branch
from
October 16, 2026 10:35
8046dce to
0045e7c
Compare
Owner
Author
|
Review CLEAR on |
wstein
force-pushed
the
test/84-renewal-loop-tests
branch
from
October 16, 2026 10:42
509efb3 to
33804a3
Compare
wstein
force-pushed
the
fix/85-expired-identity-recovery
branch
from
October 16, 2026 10:42
0045e7c to
acfe257
Compare
Owner
Author
wstein
marked this pull request as ready for review
October 16, 2026 10:55
Owner
Author
|
Ready per owner: review CLEAR on this head; local |
wstein
force-pushed
the
test/84-renewal-loop-tests
branch
from
October 16, 2026 11:19
33804a3 to
0ce831f
Compare
wstein
marked this pull request as draft
October 16, 2026 11:20
wstein
force-pushed
the
fix/85-expired-identity-recovery
branch
from
October 16, 2026 11:20
acfe257 to
2583949
Compare
wstein
marked this pull request as ready for review
October 16, 2026 11:21
Owner
Author
wstein
force-pushed
the
test/84-renewal-loop-tests
branch
from
October 16, 2026 11:32
0ce831f to
6189c0a
Compare
wstein
force-pushed
the
fix/85-expired-identity-recovery
branch
from
October 16, 2026 11:33
2583949 to
8855da6
Compare
Owner
Author
An expired active certificate with no issued pending certificate cannot stage a replacement, so retrying every 30 s never succeeds and only hides the failure behind endless disconnected events. Run now returns ErrRecoveryRequired with all state preserved, and the agent exits 66 (unauthenticated: expired credential, ADR 0013) naming owner newcode recovery. A stored pending certificate still gets activation attempts, because activation can succeed after the old certificate expired. Refs: #85 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The blocked-read test only proved the socket closed at the deadline; a session that never reached the connected state would pass too. Assert the connected event was emitted first. Refs: #85 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The agent's exit 66 for an expired identity needs a stable, citable home so service managers do not restart into a loop. The table is the agent's own and separate from the whr table in ADR 0013, so the code comment now cites the host-enrollment contract instead. Refs: #85 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The expiry check also covers the issuer, but the fixtures only expired the leaf, so dropping the issuer check went unnoticed. Refs: #85 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
wstein
force-pushed
the
fix/85-expired-identity-recovery
branch
from
October 16, 2026 12:01
8855da6 to
ea4d5e1
Compare
Owner
Author
|
Restacked onto |
4 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements #85: an expired identity with no issued pending certificate now ends the agent with a terminal error naming owner newcode recovery, instead of retrying forever.
3556151:connection.ErrRecoveryRequiredandidentity.Expired(min of leaf and issuer). A stored pending certificate still goes through activation.workharbor-agentexits 66 with "host identity expired; owner newcode recovery required".2d520ee: the test(hosts): cover the renewal loop and the expiry watchdog #84 blocked-read test also assertsconnectedbefore the deadline.d01f627: records theworkharbor-agentexit codes inhost-enrollment.md(0 stop, 1 other failure, 66 expired identity; do not restart on 66, systemdRestartPreventExitStatus=66), per owner decision H56:a. Separate from thewhrtable in ADR 0013.8046dce: covers an expired issuer with a valid leaf.Follow-up: #99 (definitive activation refusal after expiry becomes terminal).
Review: CLEAR (Opus 5.5) on 8046dce.
make checkon this head is pending. Stacked on #93 (#84).🤖 Generated with Claude Code