115 lines
2.8 KiB
Markdown
115 lines
2.8 KiB
Markdown
# Owner-approved GPT HTTPS edge activation and rollback
|
|
|
|
## Scope
|
|
|
|
This controller is the final host-side control mechanism before the disabled-by-default GPT HTTPS
|
|
edge may bind publicly.
|
|
|
|
Repository implementation and public activation remain separate states:
|
|
|
|
```text
|
|
IMPLEMENTED
|
|
≠
|
|
OWNER_APPROVED
|
|
≠
|
|
ACTIVATED
|
|
≠
|
|
RUNTIME_VERIFIED
|
|
```
|
|
|
|
The controller never creates owner approval, TLS assets, DNS, firewall rules or ingress bearer
|
|
credentials.
|
|
|
|
## Approval binding
|
|
|
|
The owner approval file is root-owned mode `0600` and has schema:
|
|
|
|
```json
|
|
{
|
|
"schema": "aios.gpt-https-edge.public-approval.v1",
|
|
"approval_id": "owner-public-edge-...",
|
|
"candidate_oid": "<exact governed edge candidate>",
|
|
"domain": "tasks.example.com",
|
|
"public_bind": true,
|
|
"bind_host": "0.0.0.0",
|
|
"port": 18443,
|
|
"tls_cert_sha256": "<exact certificate sha256>",
|
|
"issued_at": "2026-08-19T00:00:00Z",
|
|
"not_before": "2026-08-19T00:00:00Z",
|
|
"expires_at": "2026-08-20T00:00:00Z",
|
|
"owner": "<owner identity>"
|
|
}
|
|
```
|
|
|
|
Approval lifetime is at most seven days. Candidate/domain/bind/port/certificate are immutable within
|
|
one approval.
|
|
|
|
Changing any of those requires a new owner approval.
|
|
|
|
## Check
|
|
|
|
```text
|
|
aios_gpt_https_edge_activation.py check --candidate <GE>
|
|
```
|
|
|
|
Checks:
|
|
|
|
- approval ownership/mode/schema/time window;
|
|
- exact candidate binding;
|
|
- exact certificate hash;
|
|
- certificate/private-key pair;
|
|
- certificate hostname;
|
|
- certificate remaining lifetime;
|
|
- loopback GPT ingress service health.
|
|
|
|
It performs no public network mutation.
|
|
|
|
## Activate
|
|
|
|
`activate` additionally:
|
|
|
|
- writes one exact systemd public-bind drop-in atomically;
|
|
- enables/restarts only the HTTPS edge unit;
|
|
- verifies effective ExecStart points at the immutable candidate release;
|
|
- verifies effective public-bind/domain environment;
|
|
- performs a TLS handshake to `127.0.0.1:18443` using the approved public hostname;
|
|
- writes a durable activation receipt.
|
|
|
|
Any failure after drop-in mutation automatically invokes rollback.
|
|
|
|
Exact replay of an already-active matching approval returns the durable receipt without restarting
|
|
or creating duplicate state.
|
|
|
|
## Rollback
|
|
|
|
`rollback`:
|
|
|
|
- stops and disables only the HTTPS edge;
|
|
- removes only the controller-owned public-bind drop-in;
|
|
- daemon-reloads systemd;
|
|
- verifies edge inactive;
|
|
- writes a durable rollback receipt.
|
|
|
|
It does not delete:
|
|
|
|
- owner approval;
|
|
- TLS certificate/private key;
|
|
- ingress bearer token;
|
|
- internal loopback ingress;
|
|
- Task/Job state;
|
|
- Git branches.
|
|
|
|
Rollback is therefore replay-safe and does not require reconstructing secrets.
|
|
|
|
## Not covered
|
|
|
|
This controller intentionally does not own:
|
|
|
|
- DNS records;
|
|
- host firewall/NAT/security-group changes;
|
|
- certificate issuance/renewal;
|
|
- OpenAI Custom GPT domain verification;
|
|
- public Internet acceptance from outside the host.
|
|
|
|
Those remain separate owner/environment gates.
|