Add-host: Start fresh refuses (71) once the leftover agent wrote infraternal-login-locks/ (#305, #347) #390

New issue

Open

opened 2026-11-06 11:09:27 +00:00 by kayg · 0 comments

kayg commented

2026-11-06 11:09:27 +00:00

Owner

Found by J294 while running the #305 rootless end-to-end check on addhost-drop-stale-j241b @ 09fdbd8b4, merged with origin/dev 914b0da06, on compute01. This happens on dev too: validate_upgrade_sessions is the same there.

What happens: this shape is common. Setup is interrupted during activation, then the server restarts. The old infraternal agent is still running, so it reconnects and handles its login cleanup (#347). While doing that, it creates $base/sessions/infraternal-login-locks/, which holds <person>.person.lock and <person>.revoked, both empty 0600 files. After that, every Start fresh is refused with exit 71: "Host provisioning cannot safely remove these leftovers because their ownership is not proven." validate_upgrade_sessions (previous_attempt.sh) only accepts .lifetime-lock, plugins.sock, sessions, *.stop and proxy-secrets. It treats everything else as a socket, so a directory there exits 71.

Evidence (compute01:~claude/j294/logs/):

repro-71-base-listing.txt / repro-71-base.tgz: the leftover base at the moment of refusal (bin/live excluded)
server-phase1.log 10:32:50Z: exit_status=71
Moving only sessions/infraternal-login-locks aside made the next Start fresh complete (10:34:52Z outcome="completed"). Then terminal → echo ok worked (e2e-terminal10-echo.png).

Safety: it fails closed. Nothing is removed. The owner's code re-add is not affected, because the machine is already clean and takes D355's absence path.

Suggested fix (needs its own security review): add a strict case to validate_upgrade_sessions for infraternal-login-locks. It should accept a 0700 directory owned by the account, holding only regular, non-link, empty 0600 files named <32 hex>.person.lock, <32 hex>.revoked or host.revoked, and nothing else. Also add an oracle test for the reconnect-then-Start-fresh order.

Found by J294 while running the #305 rootless end-to-end check on `addhost-drop-stale-j241b` @ `09fdbd8b4`, merged with origin/dev `914b0da06`, on compute01. This happens on dev too: `validate_upgrade_sessions` is the same there. **What happens:** this shape is common. Setup is interrupted during activation, then the server restarts. The old infraternal agent is still running, so it reconnects and handles its login cleanup (#347). While doing that, it creates `$base/sessions/infraternal-login-locks/`, which holds `<person>.person.lock` and `<person>.revoked`, both empty 0600 files. After that, every Start fresh is refused with exit 71: "Host provisioning cannot safely remove these leftovers because their ownership is not proven." `validate_upgrade_sessions` (`previous_attempt.sh`) only accepts `.lifetime-lock`, `plugins.sock`, `sessions`, `*.stop` and `proxy-secrets`. It treats everything else as a socket, so a directory there exits 71. **Evidence** (`compute01:~claude/j294/logs/`): - `repro-71-base-listing.txt` / `repro-71-base.tgz`: the leftover base at the moment of refusal (bin/live excluded) - `server-phase1.log` 10:32:50Z: `exit_status=71` - Moving only `sessions/infraternal-login-locks` aside made the next Start fresh complete (10:34:52Z `outcome="completed"`). Then terminal → `echo ok` worked (`e2e-terminal10-echo.png`). **Safety:** it fails closed. Nothing is removed. The owner's `code` re-add is not affected, because the machine is already clean and takes D355's absence path. **Suggested fix (needs its own security review):** add a strict case to `validate_upgrade_sessions` for `infraternal-login-locks`. It should accept a 0700 directory owned by the account, holding only regular, non-link, empty 0600 files named `<32 hex>.person.lock`, `<32 hex>.revoked` or `host.revoked`, and nothing else. Also add an oracle test for the reconnect-then-Start-fresh order.

kayg referenced this issue

2026-11-06 11:09:59 +00:00

Add-host: a failed install leaves a bootstrap lock that blocks every re-add forever #305

kayg referenced this issue

2026-11-06 12:22:15 +00:00

Add host (root): upload fails with exit 71 and every retry repeats it; message tells the owner to inspect folders (J303) #394

kayg referenced this issue

2026-11-06 12:43:34 +00:00

Add host (root): upload fails with exit 71 and every retry repeats it; message tells the owner to inspect folders (J303) #394

kayg referenced this issue

2026-11-06 17:16:57 +00:00

Add host (root): upload fails with exit 71 and every retry repeats it; message tells the owner to inspect folders (J303) #394