feat: add protected enrollment storage development #64

Merged

ams-tech merged 1 commit from codex/protected-enrollment-state into codex/device-enrollment-client

2026-09-22 20:57:12 -04:00

ams-tech commented

2026-09-22 19:31:48 -04:00

(Migrated from github.com)

This PR is stacked on #63 (codex/device-enrollment-client); review and merge that client PR first.

Add a static kaiba-enrollment-storage bundle using the existing firmware-HMAC derivation, runtime binding, memory protections and one-use storage journal. Its supported development lifecycle is create → close → restart → reopen → close on a separately prepared 65 MiB partition.
Give enrollment storage its own derivation purpose. The client generates its independent operational key inside ext4/LUKS2; absent, substituted, mismatched or swap-enabled storage is rejected. Busy or uncertain cleanup retains its incomplete journal for review.
Pin filesystem tools in the bundle and add native ARM CI export so it can be tested on the existing inspection image without another image-signing cycle. No hardware execution is included.

Validation: repository fast checks, focused Go race tests, static Go contracts, static bundle checks, a disposable LUKS/ext4 VM with client key/certificate continuity across reboot and failure cases, and all 20 real-service fleet rehearsal scenarios against this client. The VM uses synthetic firmware and real encrypted storage. Required CI runs after publication.

This implements a two-boot development experiment. Normal volume reopening/recovery, isolated real-device development eligibility, authenticated station orchestration and physical execution remain follow-up work. Hardware qualification and production enrollment remain false; no admission rule changes or private device evidence are included.

The inspection system keeps writable state in RAM, so a device enrollment key and staged certificate would disappear on reboot. Add a bounded encrypted credential filesystem and require boot-based enrollment clients to verify the actual protected mount before creating or opening their state. This PR is stacked on #63 (`codex/device-enrollment-client`); review and merge that client PR first. - Add a static `kaiba-enrollment-storage` bundle using the existing firmware-HMAC derivation, runtime binding, memory protections and one-use storage journal. Its supported development lifecycle is create → close → restart → reopen → close on a separately prepared 65 MiB partition. - Give enrollment storage its own derivation purpose. The client generates its independent operational key inside ext4/LUKS2; absent, substituted, mismatched or swap-enabled storage is rejected. Busy or uncertain cleanup retains its incomplete journal for review. - Pin filesystem tools in the bundle and add native ARM CI export so it can be tested on the existing inspection image without another image-signing cycle. No hardware execution is included. Validation: repository fast checks, focused Go race tests, static Go contracts, static bundle checks, a disposable LUKS/ext4 VM with client key/certificate continuity across reboot and failure cases, and all 20 real-service fleet rehearsal scenarios against this client. The VM uses synthetic firmware and real encrypted storage. Required CI runs after publication. This implements a two-boot development experiment. Normal volume reopening/recovery, isolated real-device development eligibility, authenticated station orchestration and physical execution remain follow-up work. Hardware qualification and production enrollment remain false; no admission rule changes or private device evidence are included.