#439 - #437: revoked is a watch, not a verdict — transient refusals self-heal, and the drop explains itself - Cordy/Cairn

Cordy commented

2026-09-06 02:44:11 +00:00

Owner

Closes #437.

The August incident, closed end to end:

Backend (TDD, red witnessed on the runner): a 403 revoked/unknown still drops the licence to the free tier immediately, but now starts a 14-day revoked watch — daily check-ins continue and the first 200 restores the licence with no admin action. Past the watch the instance goes quiet for good. Legacy revoked state re-enters the watch on load. The state file records a capped drop/restore transition history with reasons (refused/grace/expired) — the forensic trail the incident lacked. Status API adds inactiveReason/inactiveSince/retryUntil/licSeats. TestForbiddenRevokedStillStops asserted the incident-causing behaviour and became TestForbiddenRevokedEntersWatch.

Observability: /metrics gains cairn_license_installed / cairn_license_licensed / cairn_license_seat_cap (absent when unwired) — installed=1 with licensed=0 is the silent free-tier fallback and becomes alertable (homelab-config rule follows separately).

Frontend (per the approved license-inactive-states mockup): one state-driven dropcard on the Licence page for the three inactive states, shared calm line, Check in now action; the seat meter dims and names the suspended cap; the bell renders license-dropped/license-restored transitions (admin-only, click lands on Licensing); 20 i18n keys ×4 locales.

Docs: CHANGELOG v0.6.133; licensing-faq and ARCHITECTURE revoked wording updated to the watch semantics.

Closes #437. The August incident, closed end to end: **Backend (TDD, red witnessed on the runner):** a 403 revoked/unknown still drops the licence to the free tier immediately, but now starts a 14-day revoked watch — daily check-ins continue and the first 200 restores the licence with no admin action. Past the watch the instance goes quiet for good. Legacy revoked state re-enters the watch on load. The state file records a capped drop/restore transition history with reasons (refused/grace/expired) — the forensic trail the incident lacked. Status API adds `inactiveReason`/`inactiveSince`/`retryUntil`/`licSeats`. `TestForbiddenRevokedStillStops` asserted the incident-causing behaviour and became `TestForbiddenRevokedEntersWatch`. **Observability:** `/metrics` gains `cairn_license_installed` / `cairn_license_licensed` / `cairn_license_seat_cap` (absent when unwired) — installed=1 with licensed=0 is the silent free-tier fallback and becomes alertable (homelab-config rule follows separately). **Frontend (per the approved license-inactive-states mockup):** one state-driven dropcard on the Licence page for the three inactive states, shared calm line, Check in now action; the seat meter dims and names the suspended cap; the bell renders license-dropped/license-restored transitions (admin-only, click lands on Licensing); 20 i18n keys ×4 locales. **Docs:** CHANGELOG v0.6.133; licensing-faq and ARCHITECTURE revoked wording updated to the watch semantics.

Cordy added 12 commits

2026-09-06 02:44:12 +00:00

#437 red: a transient check-in refusal must self-heal, not revoke forever 999167346a

The 2026-08 incident: one 403 (reason "unknown", during a licence-server
redeploy) set Revoked=true, which made checkinRequiredLocked() false, so
the instance never asked again — a permanent free-tier downgrade healed
only by an admin re-pasting the key. This test witnesses the bug: after a
refused check-in, the next daily retry must still reach the server, and a
healthy 200 must restore the licence.

#437 red (phase B): transitions history + named inactive states 6c2e8279f0

Compile-red against main: Transitions, RevokedSince, InactiveReason,
RetryUntil and LicSeats do not exist yet. The licence state records its
own drop/restore history (the forensic trail the 2026-08 incident
lacked), Status names WHY an installed key is not counting, and legacy
revoked state re-enters the watch on load instead of staying silent
forever.

#437 red (phase B): licence gauges on /metrics eb45407d71

Compile-red against main: SetLicenseProvider does not exist yet. The
silent free-tier fallback of the 2026-08 incident becomes an alertable
signal: installed=1 with licensed=0 pages instead of waiting a month to
be noticed on the licence page.

#437 one-shot: backend revoked-watch build (red witnessed, then green) 902143e93f

#437 : TestForbiddenRevokedStillStops -> TestForbiddenRevokedEntersWatch d3feaa9551

The old test encoded the terminal-revoked behaviour that CAUSED the
2026-08 incident: it asserted that one 403-revoked stops check-ins
forever. Under #437 the refusal still drops the licence immediately, but
check-ins continue daily inside the 14-day revoked watch and stop only
past it - which is what the test now asserts.

#437 : revoked is a watch, not a verdict - transient refusals self-heal 7199aae419

checkinRequiredLocked keeps daily check-ins alive for revokedWatchWindow (14d) after a 403 revoked/unknown; past it the instance goes quiet for good. State gains RevokedSince plus a capped Transitions history (dropped/restored with reason) - the forensic trail the 2026-08 incident lacked - and legacy revoked state re-enters the watch on load. Status names the inactive state (inactiveReason/inactiveSince/retryUntil/licSeats). The bell derives admin-only license-dropped/license-restored items from Transitions. /metrics gains cairn_license_installed/licensed/seat_cap gauges, absent when unwired.

TDD: TestTransientRefusalSelfHeals witnessed red (server hits stayed 1); transitions_test.go and license_gauges_test.go witnessed compile-red; all green after splice.

#437 one-shot: frontend dropcard + dimmed meter + bell items + i18n ×4

fe-437.yml / #437 one-shot: frontend dropcard + dimmed meter + bell items + i18n ×4 (push) Failing after 0s

Details

fe4bca9ecc

#437 one-shot fix: i18n block built from one-line tuples (YAML indent trap) deab809ebc

#437 one-shot fix: renderLicDrop post-condition is 2 (def + call), not 3 ab9313ecb0

#437 frontend: licence dropcard, dimmed meter, bell items, i18n x4 5436bd1e99

One state-driven card on the Licence page (refused at check-in / server unreachable / expired, per the approved license-inactive-states mockup) with the shared calm line and a Check in now action; the seat meter dims and names the suspended cap; the bell renders license-dropped/license-restored transitions (admin-only, click lands on Licensing); 20 new i18n keys in all four locales.

#437 one-shot: CHANGELOG v0.6.133 + FAQ/ARCHITECTURE revoked-watch wording e411b89b72

#437 docs: CHANGELOG v0.6.133; revoked-watch wording in FAQ and ARCHITECTURE

ci / test-and-build (pull_request) Successful in 42s

Details

61b4575f84