keymaker server --super-duper-self-nuker mode #2

New issue

Closed

opened 2026-04-13 20:30:31 +00:00 by ryansquared · 1 comment

ryansquared commented

2026-04-13 20:30:31 +00:00

(Migrated from codeberg.org)

Current status — 2026-09-24

Single-use generation and scheduled selfnuke are implemented; robust termination and live lifecycle acceptance remain.

The production selfnuke feature acquires the generation permit after request validation, retains it permanently and schedules a ten-second reboot. Platform now supervises the Nitro management process; Keymaker's configuration requests replacement after termination. See generation lifecycle and restart support.

Remaining:

Make reboot/termination failure fail closed rather than leaving a live process with a consumed permit.
Demonstrate actual Nitro termination, connection closure and a fresh replacement instance across success, generation error, concurrency/load and lost response. Local/mocked lifecycle tests do not establish those properties.
State the evidence boundary accurately: bundle attestation is created before shutdown; it does not independently prove subsequent memory destruction or a hard ten-second deadline.
Keep hosted access/network admission in Platform #349; automatic replacement must not enable unrestricted repeated generation. Do not automatically replay a generation POST after uncertain delivery.

Keep open for failure handling and acceptance. Existing source and the nine mocked lifecycle/four configuration tests confirm implementation progress, not complete operational assurance.

Original requirement

make a mode where we only allow generating a single bundle at once (hold the semaphore after parsing, but before generating, then reboot the instance entirely (terminating all existing connections). do not drop the semaphore lock.

## Current status — 2026-09-24 **Single-use generation and scheduled selfnuke are implemented; robust termination and live lifecycle acceptance remain.** The production `selfnuke` feature acquires the generation permit after request validation, retains it permanently and schedules a ten-second reboot. Platform now supervises the Nitro management process; Keymaker's configuration requests replacement after termination. See [generation lifecycle](https://codeberg.org/caution/locksmith/src/commit/9f702bbf465bc4968e0fa57adcbbc366a1c6977c/crates/keymaker/src/routes/generate_quorum.rs) and [restart support](https://codeberg.org/caution/platform/src/commit/1f7e2963932ac616ba6c4f0e9553112cb548ce72/docs/enclave-restarts.md). Remaining: - Make reboot/termination failure fail closed rather than leaving a live process with a consumed permit. - Demonstrate actual Nitro termination, connection closure and a fresh replacement instance across success, generation error, concurrency/load and lost response. Local/mocked lifecycle tests do not establish those properties. - State the evidence boundary accurately: bundle attestation is created before shutdown; it does not independently prove subsequent memory destruction or a hard ten-second deadline. - Keep hosted access/network admission in [Platform #349](https://codeberg.org/caution/platform/issues/349); automatic replacement must not enable unrestricted repeated generation. Do not automatically replay a generation POST after uncertain delivery. Keep open for failure handling and acceptance. Existing source and the nine mocked lifecycle/four configuration tests confirm implementation progress, not complete operational assurance. ## Original requirement make a mode where we only allow generating a single bundle at once (hold the semaphore _after parsing_, but _before generating_, then reboot the instance entirely (terminating all existing connections). do not drop the semaphore lock.