From c73674cda27dae445771fed10b77c4aa9c81612e Mon Sep 17 00:00:00 2001 From: Commander1024 Date: Mon, 7 Sep 2026 19:29:56 +0200 Subject: [PATCH] Document M2 sign-off and update project status --- docs/agent/code-map.md | 2 +- docs/agent/current-state.md | 8 ++++++-- docs/phase8d7_implementation.md | 10 +++++----- docs/phase8d_plan.md | 10 ++++++---- docs/roadmap.md | 2 +- 5 files changed, 19 insertions(+), 13 deletions(-) diff --git a/docs/agent/code-map.md b/docs/agent/code-map.md index c4b5bca..65d2899 100644 --- a/docs/agent/code-map.md +++ b/docs/agent/code-map.md @@ -77,7 +77,7 @@ This is a semantic map, not a complete file inventory. Start here, then read the ### Browser admin backend (8D.5) -- **8D.7 current status (2026-09-07): implemented scope validated by explicit user sign-off.** Supersedes target-pending/continuation statements in the slice history below. User verified certificate rotation and web start/stop via UART0/SSH admin/web admin, restarting after browser stop via another route; full mix without broker drops up to 230400 baud after external adapter correction is user-reported. Intermittent supported two serial + one admin admission failures, recently not recurring, are accepted nonblocking, not fixed. Self/generated/key/legacy-credential and other owner parity remain deferred/restricted; bootstrap/recovery remain UART0-only. Numeric reserves and M2 acceptance remain open; no full parity, individual unreported checklist passes or new implementation authorization. Evidence: `docs/phase8d7_implementation.md`. +- **8D.7 current status (2026-09-07): implemented scope validated; M2 explicitly signed off by the user ("Jupp, sign M2 off").** Supersedes M2-open/target-pending/continuation statements in the historical slices below; accepted M2 does not require revalidation. User verified certificate rotation and web start/stop via UART0/SSH admin/web admin, restarting after browser stop via another route; full mix without broker drops up to 230400 baud after external adapter correction is user-reported. Intermittent supported two serial + one admin admission failures, recently not recurring, are accepted nonblocking, not fixed. Browser self/generated/key/legacy-credential and other owner command restrictions remain deferred; bootstrap/recovery remain permanently UART0-only. Numeric memory reserves/stack margins remain unapproved; no full parity or individual unreported checklist passes. Next: separately requested 8D.8 read-only settings entry and Serial page; sign-off alone authorizes no implementation. Evidence: `docs/phase8d7_implementation.md`. - 8D.7 third account slice: `admin_ssh_console` shares parsed browser other-account policy with `user_console`; interactive add/password and forced delete/role now allowed, self/generated/key/bootstrap/recovery still blocked. Post-prompt/pre-DB-API currentness is operation admission, not cancellation of admitted derivation/commit. Existing target-only notifications follow success. Review has no actionable findings; `python3 tests/admin_console_boundary/accounts.py` adds deterministic handler/database failure and stale-next-operation regressions. Target/M2 pending; see `docs/phase8d7_implementation.md`. diff --git a/docs/agent/current-state.md b/docs/agent/current-state.md index 42d2fc1..6f52b07 100644 --- a/docs/agent/current-state.md +++ b/docs/agent/current-state.md @@ -4,6 +4,10 @@ This file is working memory. Update it during active work and before handoff; do ## Development state +- **M2 explicitly signed off by the user (2026-09-07):** After 8D.7 implemented-scope validation and discussion of read-only settings next, the user says "Jupp, sign M2 off". This supersedes all earlier M2-open statements and continuation instructions below; accepted M2 does not require revalidation or imply full browser command parity. Browser self-target/generated-password/key/legacy-credential and other owner-specific command restrictions remain deferred; bootstrap/recovery remain permanently UART0-only. Intermittent supported two serial + one admin web admission failures are accepted nonblocking, not fixed or diagnosed. Numeric memory reserves and stack margins remain unapproved follow-ups, not blockers reopening M2. **Next: 8D.8 read-only settings entry and Serial page, only when separately requested; this sign-off alone authorizes no implementation.** Evidence/history: `docs/phase8d7_implementation.md`. Documentation only; no source/tests/build/device/commit action. + +Earlier development entries below are historical; the latest M2 sign-off supersedes their pending status and next-work instructions, not their evidence. + - **8D.7 validated by explicit user sign-off (2026-09-07), implemented scope only:** User explicitly says "Ok, mark 8D.7 as validated." Supersedes historical target-pending/acceptance-blocking and continuation instructions below for the implemented stop/reboot, certificate and other-account slices. User reports thorough testing, verified certificate rotation and web start/stop with lifecycle via UART0/SSH admin/web admin (restart after browser stop via another route), and full mix without broker drops up to **230400 baud** after correcting external adapter baud. Intermittent supported two serial + one admin WebSocket admission failures have recently not recurred and are accepted nonblocking, not fixed or diagnosed. Preserve investigation/telemetry below. No separately reported reboot-specific or individual mutation/injection results; do not invent checklist passes. Self/generated/key/legacy-credential and other owner parity remain deferred and restricted; bootstrap/recovery remain UART0-only. Numeric reserves/stack margins and **M2 acceptance remain open**; no full-parity claim. See `docs/phase8d7_implementation.md`. Documentation-only sign-off; no new implementation authorized. Wait for a separate request. Earlier development entries below are historical; the latest sign-off supersedes their pending status and next-work instructions, not their evidence. @@ -70,7 +74,7 @@ Based on checked-in source plus `README.md` and `docs/roadmap.md`: - Hardware characterization, serial service, session broker, USB CDC, Wi-Fi, HTTPS/WebSocket, SSH serial transport, and local display/control are implemented and documented as target-hardware validated. - Phase 8A role-based user storage/UART0 administration and Phase 8B role-aware HTTPS/SSH authentication and targeted revocation are documented as target-hardware validated. - Phase 8C admin SSH is implemented in source, uses the shared `esp_console` registry, and has passed target-hardware validation. -- Phase 8D.0–8D.6 and M1 are validated by user sign-off; 8D.7 implemented scope is user-validated. Browser administration is implemented with deferred parity restrictions; M2 acceptance and numeric reserves remain open. Follow `docs/phase8d_plan.md`: no new implementation without a separate request, then one bounded chunk at a time. Changing terminal modes must preserve the browser serial broker client and any writer lease. The roadmap retains the full end-state requirements. +- Phase 8D.0–8D.6 and M1 are validated by user sign-off; 8D.7 implemented scope is user-validated and M2 explicitly signed off on 2026-09-07. Browser administration retains deferred parity restrictions; numeric reserves/stack margins remain unapproved. Follow `docs/phase8d_plan.md`: next is separately requested 8D.8 read-only settings entry and Serial page, with no implementation authorized by sign-off alone. Changing terminal modes must preserve the browser serial broker client and any writer lease. The roadmap retains the full end-state requirements. - Security/production hardening, OTA, BLE evaluation, advanced networking, and optional filesystem features remain future roadmap work. - Reserved OTA, coredump, NVS-key, and storage partitions do not imply those runtime features are implemented. @@ -89,7 +93,7 @@ Based on checked-in source plus `README.md` and `docs/roadmap.md`: - Phase 8C hardware validation passed, including route separation, shared command serialization, history/completion, prompts, output backpressure, revocation during queued work, deferred SSH lifecycle/reboot actions, and full concurrent transport operation. At 460800 baud with SSH and WebSocket clients in parallel, substantial packet drops and slow display controls were observed under load, without memory exhaustion; no baud-rate reduction is planned. - Current HTTPS UI retains status/serial for both roles and exposes an admin-only selector in 8D.6. The 8D.7 policy permits bounded other-account mutations, deferred stop/reboot and certificate rotation; unsupported self/generated/key/legacy-credential and other owner-specific paths remain restricted. -- Browser authentication uses cookie login/logout without Basic fallback. M1 and 8D.4–8D.6 are signed off; 8D.7 implemented scope is explicitly user-validated on 2026-09-07. Full parity is deferred, numeric reserves and M2 acceptance remain open, and no new implementation is authorized. +- Browser authentication uses cookie login/logout without Basic fallback. M1 and 8D.4–8D.6 are signed off; 8D.7 implemented scope is user-validated and M2 explicitly signed off on 2026-09-07. Full parity is deferred, numeric reserves/stack margins remain unapproved, and no new implementation is authorized. - NVS encryption, secure boot/flash encryption review, production certificate/provisioning policy, and OTA are not implemented. HTTPS login has a bounded global five-verifications/60-second throttle, not comprehensive cross-transport DoS protection. ## Known inconsistencies diff --git a/docs/phase8d7_implementation.md b/docs/phase8d7_implementation.md index 561a2a2..3848eac 100644 --- a/docs/phase8d7_implementation.md +++ b/docs/phase8d7_implementation.md @@ -1,8 +1,8 @@ # Phase 8D.7 — Web-shell lifecycle parity and M2 acceptance -## Current status: implemented scope validated +## Current status: implemented scope validated, M2 signed off -**8D.7 validated by explicit user sign-off on 2026-09-07 for the implemented scope.** The user explicitly requested: "Ok, mark 8D.7 as validated." This supersedes target-pending and acceptance-blocking statements below for the implemented stop/reboot, certificate and other-account slices. It does not assert full browser command parity or M2 acceptance. +**8D.7 validated and M2 explicitly signed off by the user on 2026-09-07 for the implemented scope.** After "Ok, mark 8D.7 as validated", the user explicitly requested: "Jupp, sign M2 off" following discussion that 8D.8 read-only settings is next. This supersedes all earlier M2-open, target-pending, acceptance-blocking and continuation statements below. M2 is accepted without requiring revalidation; full browser command parity and individual unreported checklist passes are not asserted. ### User sign-off and evidence (2026-09-07) @@ -11,7 +11,7 @@ - User reports full-client-mix operation with no broker drops at rates up to **230400 baud**, with the external adapter baud corrected. This is user-reported workload evidence, not a universal zero-drop guarantee or a new measurement inferred from the earlier boot sample. - Exact flashed revision, repetition counts, soak duration, reboot-specific results and individual account-mutation/injection checklist results were not separately supplied. Unrecorded details remain evidence limitations and regression coverage, not claims of execution or blockers reopening this user-approved validation. -**Deferred scope:** browser self-target/generated-password/key/legacy-credential and other owner-specific parity restrictions remain in force until separately implemented; bootstrap/recovery remain UART0-only. Numeric reserves and unmeasured stack margins remain open. **M2 acceptance is not recorded or implied. No new implementation is authorized; wait for a separate request.** This sign-off changes documentation only, with no production/test edits, build, upload or commit. +**Deferred scope:** browser self-target/generated-password/key/legacy-credential and other owner-specific command restrictions remain in force until separately implemented; bootstrap/recovery remain permanently UART0-only. Numeric memory reserves and stack margins are not approved and remain follow-ups, not blockers reopening accepted M2. **Next is 8D.8: read-only settings entry and Serial page, only when separately requested. This sign-off alone authorizes no implementation.** This sign-off changes documentation only, with no production/test edits, build, device operation or commit. ## Third bounded account slice history @@ -55,7 +55,7 @@ Installed IDF 5.5.0 / Mbed TLS 3.6.3 source identifies these errors as connectio **Investigation remains open:** transient HTTPD slot occupancy is the leading hypothesis, with handshake blocking, internal-memory pressure and global descriptor capacity possible contributors. Disconnecting an observer frees both a socket and resources, so it does not isolate the cause. Next evidence: identify ticket POST versus WebSocket-open timeout using redacted browser timings/status; correlate count-only HTTPD ordinary/WS occupancy and allocation failures; repeat with serial traffic paused. Do not share cookies, CSRF values, ticket URLs or unredacted HAR. No runtime fix, device operation or build performed for this investigation; full-mix reliability must be resolved before acceptance. -### Pending account target checks +### Historical pending account target checks 1. Exercise each enabled other-account command, hidden confirmation/mismatch/cancel, and self/generated/key/bootstrap/recovery rejection. Verify final-admin protections and unchanged UART0/admin SSH behavior. 2. Confirm successful target mutations revoke only that account's web/SSH sessions, retaining unrelated browser serial/admin, USB and SSH traffic. Check stale queued commands and prompts after logout/expiry/revocation and slot reuse. @@ -140,7 +140,7 @@ No new static payload/state, module heap/PSRAM allocation, task, stack-size, que Carry forward 8D.6 loaded lifetime minima **6,516 B internal / 1,580 B DMA**, noting overlapping capabilities and conservative regional sums. Numeric reserves remain open; no safe margin or new reserve violation is inferred. Do not reopen the prior sign-off solely for incomplete numeric instrumentation. -## Pending target checklist — both slices +## Historical pending target checklist — both slices 1. User-controlled flash/reload; capture exact revision, 60-second settled `memory`, web/SSH status and available stack telemetry. Check browser login/serial/admin, USB UART1, user/admin SSH and UART0 at the established 230400-baud workload. 2. With browser serial + admin and USB/user/admin SSH active, issue **`web stop` from browser admin**. Expect its best-effort scheduling acknowledgement, then both browser routes close; UART0/USB/SSH remain usable. Confirm no browser writer remains. Restart with UART0/admin SSH `web start`, reauthenticate and reconnect. Repeat five times and compare full-mix/cleanup heap and largest blocks; do not expect boot equivalence when UART/clients remain active. diff --git a/docs/phase8d_plan.md b/docs/phase8d_plan.md index 2bf90b9..fc2acea 100644 --- a/docs/phase8d_plan.md +++ b/docs/phase8d_plan.md @@ -1,6 +1,6 @@ # Phase 8D — Incremental web administration plan -Status: **8D.0–8D.6 and M1 validated by explicit user sign-off. 8D.7 implemented scope validated by explicit user sign-off on 2026-09-07, superseding historical target-pending and continuation instructions below. Full browser parity is not claimed: self/generated/key/legacy-credential and other owner-specific restrictions remain deferred; bootstrap/recovery remain UART0-only. Numeric reserve gates and M2 acceptance remain open. No new implementation is authorized.** See the [8D.7 sign-off and evidence](phase8d7_implementation.md), [8D.6 implementation record](phase8d6_implementation.md), [8D.5 implementation record](phase8d5_implementation.md), [8D.4 implementation record](phase8d4_implementation.md), [8D.3 implementation record](phase8d3_implementation.md) and [8D.0 baseline/M1 contract](phase8d_baseline.md). +Status: **8D.0–8D.6 and M1 validated by explicit user sign-off. 8D.7 implemented scope validated and M2 explicitly signed off by the user on 2026-09-07 ("Jupp, sign M2 off"), superseding historical M2-open, target-pending and continuation instructions below without requiring revalidation. Full browser parity is not claimed: self/generated/key/legacy-credential and other owner-specific command restrictions remain deferred; bootstrap/recovery remain permanently UART0-only. Intermittent supported two serial + one admin web admission failures are accepted nonblocking, not fixed. Numeric memory reserves/stack margins remain unapproved. Next is separately requested 8D.8 read-only settings entry and Serial page; sign-off alone authorizes no implementation.** See the [8D.7/M2 sign-off and evidence](phase8d7_implementation.md), [8D.6 implementation record](phase8d6_implementation.md), [8D.5 implementation record](phase8d5_implementation.md), [8D.4 implementation record](phase8d4_implementation.md), [8D.3 implementation record](phase8d3_implementation.md) and [8D.0 baseline/M1 contract](phase8d_baseline.md). This is the execution plan for [roadmap Phase 8D](roadmap.md#phase-8--role-based-users-and-administrative-access). The roadmap retains the feature/security requirements; this document defines small work units, dependencies, and release gates. The [administration test matrix](user_administration_tests.md#planned-phase-8d-integrated-web-administration) remains the final acceptance checklist. @@ -138,7 +138,9 @@ If 8D.3 exceeds the work-unit limit, first split out inert login-page rendering ### 8D.7 — Web-shell lifecycle parity and M2 acceptance -**Target sign-off (2026-09-07), implemented scope:** User explicitly requests marking 8D.7 validated after thorough testing. Certificate rotation and web start/stop were verified, with lifecycle via UART0/SSH admin/web admin and restart after browser stop via another route. Full mix without broker drops up to 230400 baud after external adapter baud correction is user-reported. Intermittent supported two serial + one admin admission failures have recently not recurred and are accepted nonblocking, not fixed. [Evidence and limits](phase8d7_implementation.md). No detailed reboot/individual mutation checklist passes are inferred. This supersedes pending status and next-slice instructions in the historical checkpoints below for all three implemented slices, including other-account operations. Remaining self/generated/key/legacy-credential and other owner parity stays deferred/restricted; numeric reserves and M2 acceptance remain open. Wait for a separate implementation request. +**M2 sign-off (2026-09-07):** User explicitly says "Jupp, sign M2 off" after the implemented-scope validation below and discussion of 8D.8 next. M2 is accepted with the deferred restrictions, nonblocking unresolved admission issue and unapproved numeric reserves/stack margins recorded in the current status. No full parity, new checklist passes or revalidation requirement is implied. Next is 8D.8 read-only settings entry and Serial page only upon a separate request; no implementation is authorized by this sign-off alone. The earlier checkpoints and original scope/gate below are historical planning and evidence, not outstanding conditions for M2 closure. + +**Historical 8D.7 target sign-off (2026-09-07), before M2 sign-off:** User explicitly requests marking 8D.7 validated after thorough testing. Certificate rotation and web start/stop were verified, with lifecycle via UART0/SSH admin/web admin and restart after browser stop via another route. Full mix without broker drops up to 230400 baud after external adapter baud correction is user-reported. Intermittent supported two serial + one admin admission failures have recently not recurred and are accepted nonblocking, not fixed. [Evidence and limits](phase8d7_implementation.md). No detailed reboot/individual mutation checklist passes are inferred. This supersedes pending status and next-slice instructions in the historical checkpoints below for all three implemented slices, including other-account operations. Remaining self/generated/key/legacy-credential and other owner parity stays deferred/restricted; numeric reserves and M2 acceptance remained open at this earlier checkpoint. **Second bounded certificate slice:** [Implementation, separate slice histories and pending target checklist](phase8d7_implementation.md). Exact parsed browser `web certificate rotate --force` uses a typed request-queue union and immutable owner `dispatcher_actions` mask: bounded drain/200 ms then nonblocking handoff to the existing 12 KiB dispatcher, not 4 KiB control. Pending input gating, token/principal/session revalidation and executing-slot reservation persist through execution. Transactional certificate commit → stop → start short-circuits errors and retains ownership on failed stop; SSH/UART0 unchanged. No new tasks/depth/routes/assets/stacks; target owner-mask/local-scratch accounting and stack margins unknown, host sizeof is not proof. Parent final `pio run` PASS **26.32 s, 95,580 B RAM / 1,648,061 B flash**: **0 / +1,036 B** vs first slice, **0 / +1,572 B** vs 8D.6, **+1,048 / +48,088 B** vs 8D.0. Implementer focused suites pass (transport **25**/tickets **12**, server **11**, boundary including certificate, lifecycle/policy/cookie-admin/store-serial/diff); independent reviewer reports no actionable findings. Sanitizers unavailable (missing libasan/libubsan); no hardware validation. User explicitly authorized stacking the next bounded slice: credential/account, then other owner slices. Other mutations remain blocked; target/M2 acceptance and numeric reserves pending. This supersedes the first-slice next-step/continuation-pending statement below. @@ -185,11 +187,11 @@ Update the roadmap and user/command documentation to distinguish completed featu ## Progress and next-request template -Progress: **8D.0–8D.6 and M1 validated by user sign-off; 8D.7 implemented scope explicitly user-validated on 2026-09-07. Deferred parity restrictions remain; numeric reserves and M2 acceptance remain open. No new implementation is authorized.** Record incremental results in `docs/agent/current-state.md`, retaining the [baseline](phase8d_baseline.md) and cumulative resource measurements as work proceeds. +Progress: **8D.0–8D.6 and M1 validated by user sign-off; 8D.7 implemented scope validated and M2 explicitly signed off by the user on 2026-09-07. Deferred parity restrictions remain; numeric reserves/stack margins remain unapproved. Next is separately requested 8D.8 read-only settings entry and Serial page; no new implementation is authorized by sign-off alone.** Record incremental results in `docs/agent/current-state.md`, retaining the [baseline](phase8d_baseline.md) and cumulative resource measurements as work proceeds. Suggested next request: -> Wait for a separate implementation request. Preserve the 8D.7 implemented-scope sign-off, deferred parity restrictions, UART0-only bootstrap/recovery and existing resource bounds. Do not infer M2 acceptance, numeric reserve approval or authorization for settings or another owner slice. +> Wait for a separate request for 8D.8 read-only settings entry and Serial page. Preserve the accepted 8D.7/M2 sign-offs without requiring revalidation, deferred browser command restrictions, permanently UART0-only bootstrap/recovery and existing resource bounds. Carry forward the accepted nonblocking, unresolved web admission issue and unapproved numeric reserves/stack margins. M2 sign-off alone does not authorize settings or another owner slice. For later chunks: diff --git a/docs/roadmap.md b/docs/roadmap.md index 0c0609c..9ddb0bc 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -199,7 +199,7 @@ Implementation sequence: - Keep SFTP, SCP, `exec`, forwarding, subsystems, and unauthenticated shells disabled. - Target-hardware validation passed for route separation, history/Tab editing, interactive visible/hidden prompts, output/backpressure, generated and entered user/password/key management including the longest ECDSA P-256 import, ping event routing, deferred reboot/SSH lifecycle drain behavior, bootstrap/recovery rejection, targeted self/other-user revocation during queued work, UART0/SSH administration serialization, and concurrent USB/WebSocket/user-SSH/admin-SSH operation. Stress at 460800 baud with SSH and WebSocket clients caused substantial expected packet drops and slower display controls, but did not exhaust memory or require lowering the supported baud-rate range. 4. **Phase 8D — Integrated web administration — Planned, staged delivery** - - **Implementation checkpoint:** 8D.0–8D.6 and M1 validated by user sign-off; [8D.7 implemented scope explicitly user-validated on 2026-09-07](phase8d7_implementation.md). Browser selector, bounded stop/reboot, certificate rotation and other-account operations are implemented. User reports verified certificate rotation/web start-stop and full mix without broker drops up to 230400 baud after correcting external adapter baud. Intermittent supported two serial + one admin admission failures, recently not recurring, are accepted nonblocking, not fixed. Self/generated/key/legacy-credential and other owner parity remain deferred/restricted; bootstrap/recovery remain UART0-only. Full parity is not claimed, numeric reserves and M2 acceptance remain open, and settings remain planned. No new implementation is authorized. + - **Implementation checkpoint:** 8D.0–8D.6 and M1 validated by user sign-off; [8D.7 implemented scope validated and M2 explicitly signed off by the user on 2026-09-07](phase8d7_implementation.md) ("Jupp, sign M2 off"). This supersedes earlier M2-open statements without requiring revalidation. Browser selector, bounded stop/reboot, certificate rotation and other-account operations are implemented. User reports verified certificate rotation/web start-stop and full mix without broker drops up to 230400 baud after correcting external adapter baud. Intermittent supported two serial + one admin admission failures, recently not recurring, are accepted nonblocking, not fixed. Browser self/generated/key/legacy-credential and other owner command restrictions remain deferred; bootstrap/recovery remain permanently UART0-only. Full parity is not claimed; numeric memory reserves/stack margins remain unapproved. Next is separately requested 8D.8 read-only settings entry and Serial page; sign-off alone authorizes no implementation. The requirements below retain the full end-state scope, not additional conditions reopening accepted M2. - **Execution plan:** [Phase 8D incremental plan](phase8d_plan.md). Implement one numbered chunk per request, with a build, focused regression checks, memory accounting, and a handoff before stopping. The requirements below describe the final scope, not one implementation task. - **Milestones:** 8D.0–8D.3 establish a measured baseline and reliable login/logout with the existing serial UI; 8D.4–8D.7 add the shared browser admin shell and verify retained serial ownership; 8D.8–8D.21 add typed settings and contextual controls one domain at a time; 8D.22 performs final integration acceptance. Login and runtime-memory target validation gate the first two milestones; do not defer them until the entire phase is implemented. No wholesale import of the rolled-back experimental implementation. - Begin with integrated authentication: replace browser-facing HTTP Basic authentication with a same-origin HTTPS login page, explicit logout, and bounded opaque server-side sessions. Store only a digest of each random session token with a copied secret-free principal, expiry, CSRF state, and authentication-generation binding. Send the raw token only in a host-only `__Host-` cookie with `Secure`, `HttpOnly`, `SameSite=Strict`, `Path=/`, no `Domain`, and an explicit lifetime; never retain passwords, Basic headers, raw tokens, verifiers, or SSH-key blobs in snapshots or logs.