17485cac

feat(server): a host that cannot certify a guest is not a place to put one

a73x 2026-08-09 15:50

Commit message

feat(server): a host that cannot certify a guest is not a place to put one

A guest's SSH host key is generated by the host that runs it and certified by
the control plane. An agent from before v0.0.4 never reports one, so a VM it
creates carries no certificate, can never be issued one, and is unreachable
through the gate for the rest of its life — a dead end whose only remedy is to
delete the VM and make it again.

So the create refuses — when the host itself has said so. Only a host that is
connected and reporting is judged: the registry is in-memory, filled by each
agent's Hello, so a host with no entry has not spoken to this server process —
after a restart, that is every host in the fleet for a moment — and its
absence proves nothing about its age. An absent or quiet host takes the create
the way it takes any other it cannot serve this second: the row is desired
state, and the agent that eventually materializes it may be newer than
whatever was last heard. A connected host below the floor answers 409 with the
host's name, its version, and the endpoint that upgrades its agent — the same
conflict it returns for a host not accepting VMs, because it is the same kind
of answer: the request is fine, the host cannot serve it. A connected host
that names no version is an agent too old to name itself, and a version that
cannot be parsed reads the same way — exactly how the upgrade path already
treats an unstamped build. The floor is one exported predicate over the same
ordering the fleet picks upgrades with, so there is one place that knows which
release began signing guest host keys.

Placement chosen for you follows the same rule. A pre-CSR host is no more a
candidate than one that is down, and when every online host is ruled out that
way the refusal says so — "no online hosts" would send a caller looking for
hardware that is up and one upgrade away from usable. The whole story reaches
an MCP caller intact, since the client carries the control plane's own words
out with the status.

The refusal at connect time stays where it is — for the VMs that predate
this, and for the guest a never-judged host brings up uncertified. It is why
nothing is lost by waiting for facts.

docs/assumptions.md

Old		New
@@ -407,6 +407,22 @@ than booting a guest clients would refuse.
407	connection, and both the snapshot and the report are marshalled and searched for	407	connection, and both the snapshot and the report are marshalled and searched for
408	private-key bytes.	408	private-key bytes.
409		409
		410	### A host that cannot certify a guest is not a place to put one
		411
		412	An agent from before v0.0.4 never reports a guest host key, so a VM it creates
		413	can never be verified and is unreachable through the gate for the rest of its
		414	life. The control plane reads the version the host reported and refuses the
		415	create outright — and reads a version it cannot parse, or none at all, as too
		416	old, because neither proves otherwise. Underpins refusing early: at create the
		417	operator can still upgrade the agent, while at connect the only remedy left is
		418	to recreate the VM. Only a connected host is judged, because only a connected
		419	host has said anything: what a registry holds in memory about an offline one is
		420	not evidence about the agent that will run the VM.
		421	Proven in code: the create path refuses each shape of unprovable version
		422	and names the upgrade endpoint, lets a host it has not heard from take the
		423	create, and placement chosen by eitri skips such hosts and says why when that
		424	leaves none.
		425
410	### What eitri signs with is encrypted where it rests	426	### What eitri signs with is encrypted where it rests
411		427
412	Every piece of key material the server holds—the fleet's own host CA and gate	428	Every piece of key material the server holds—the fleet's own host CA and gate

docs/shape.html

Old		New
@@ -349,7 +349,8 @@
349	"imports": [	349	"imports": [
350	"internal/gateclient",	350	"internal/gateclient",
351	"internal/random",	351	"internal/random",
352	"internal/server/api/client"	352	"internal/server/api/client",
		353	"internal/server/release"
353	]	354	]
354	},	355	},
355	{	356	{

docs/shape.json

Old		New
@@ -298,7 +298,8 @@
298	"imports": [	298	"imports": [
299	"internal/gateclient",	299	"internal/gateclient",
300	"internal/random",	300	"internal/random",
301	"internal/server/api/client"	301	"internal/server/api/client",
		302	"internal/server/release"
302	]	303	]
303	},	304	},
304	{	305	{

docs/upgrade.md

Old		New
@@ -94,10 +94,17 @@ ignored by agents that predate them.
94		94
95	One exception, from v0.0.4 on. A guest's SSH host key is generated by the	95	One exception, from v0.0.4 on. A guest's SSH host key is generated by the
96	host that runs it, and an agent from before v0.0.4 does not know how to do	96	host that runs it, and an agent from before v0.0.4 does not know how to do
97	that. A VM created on such a host boots with a host key nothing has certified,	97	that. The server will not place a VM on such a host: the create is refused with
98	and `eitri ssh` refuses it at host verification with a clear error. Existing	98	the host's name, the version it reports, and the endpoint that upgrades it —
99	VMs are unaffected — they keep the host key and certificate they were built	99	nothing could verify a guest created there. A connected host that has reported
100	with. Upgrade the host's agent, then re-create any VM created in the meantime.	100	no version at all is read the same way, since nothing says otherwise. Only a
		101	host that is connected is judged: one that is offline has told this server
		102	nothing about the agent that will eventually run the VM, so the create is
		103	accepted as desired state and the guest is verified — or refused — when it
		104	boots. Placement chosen for you skips those hosts entirely. Existing VMs are unaffected — they
		105	keep the host key and certificate they were built with; one created against an
		106	older release with an uncertified key is refused by `eitri ssh` at host
		107	verification, and re-creating it after the upgrade is the fix.
101		108
102	## cloud-hypervisor	109	## cloud-hypervisor
103		110

internal/mcpserver/api_test.go

@@ @@ -66,18 +66,85 @@ func TestDeleteVM(t *testing.T) { @@
+	require.NoError(t, c.DeleteVM(t.Context(), "abc"))
+func TestFirstEligibleHost(t *testing.T) {
+	c := fakeAPI(t, func(w http.ResponseWriter, r *http.Request) {
+		json.NewEncoder(w).Encode([]map[string]any{
+			{"id": "h0", "name": "down", "online": false, "agent_version": "v0.0.5"},
+			{"id": "h1", "name": "mewtwo", "online": true, "agent_version": "v0.0.5"},
+		})
+	})
+	h, err := c.FirstEligibleHost(t.Context())
+	require.NoError(t, err)
+	assert.Equal(t, "h1", h.ID)
+// A host whose agent predates certified host keys is not a placement candidate:
+// the control plane would refuse the create, so picking it only moves the
+// failure later. The next host that can certify takes the VM instead.
+func TestFirstEligibleHostSkipsPreCSRAgents(t *testing.T) {
+	c := fakeAPI(t, func(w http.ResponseWriter, r *http.Request) {
+		json.NewEncoder(w).Encode([]map[string]any{
+			{"id": "h0", "name": "old", "online": true, "agent_version": "v0.0.3"},
+			{"id": "h1", "name": "unstamped", "online": true, "agent_version": "dev"},
+			{"id": "h2", "name": "quiet", "online": true},
+			{"id": "h3", "name": "mewtwo", "online": true, "agent_version": "v0.0.4"},
+		})
+	})
+	h, err := c.FirstEligibleHost(t.Context())
+	require.NoError(t, err)
+	assert.Equal(t, "h3", h.ID)
+}
+// With every online host ruled out, the refusal names the reason and the fix —
+// "no online hosts" would send the caller looking for hardware that is up.
+func TestFirstEligibleHostReportsWhyNoneAreEligible(t *testing.T) {
+	c := fakeAPI(t, func(w http.ResponseWriter, r *http.Request) {
+		json.NewEncoder(w).Encode([]map[string]any{
+			{"id": "h0", "name": "old", "online": true, "agent_version": "v0.0.3"},
+			{"id": "h1", "name": "older", "online": true, "agent_version": "v0.0.1"},
+		})
+	})
+	_, err := c.FirstEligibleHost(t.Context())
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "2 online host(s)")
+	assert.Contains(t, err.Error(), "predate certified host keys (v0.0.4)")
+	assert.Contains(t, err.Error(), "upgrade-agent")
+	assert.NotContains(t, err.Error(), "no online hosts")
+}
+// A fleet with nothing up still says exactly that.
+func TestFirstEligibleHostWithNothingOnline(t *testing.T) {
+	c := fakeAPI(t, func(w http.ResponseWriter, r *http.Request) {
+		json.NewEncoder(w).Encode([]map[string]any{
+			{"id": "h0", "name": "down", "online": false, "agent_version": "v0.0.5"},
+		})
+	})
+	_, err := c.FirstEligibleHost(t.Context())
+	require.ErrorContains(t, err, "no online hosts")
+}
+// The control plane's create refusal is the whole story the model needs, so it
+// must survive the trip through the client and out of vm_create — a bare "409"
+// would leave it with nothing to act on.
+func TestVMCreateSurfacesThePreCSRRefusal(t *testing.T) {
+	const refusal = "host mewtwo (h1) runs agent v0.0.3, which predates certified host keys (v0.0.4): " +
+		"a guest created there gets no certified host key. Upgrade that host's agent"
+	c := fakeAPI(t, func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/api/v1/hosts" {
+			json.NewEncoder(w).Encode([]map[string]any{
+				{"id": "h1", "name": "mewtwo", "online": true, "agent_version": "v0.0.5"},
+			})
+			return
+		}
+		http.Error(w, refusal, http.StatusConflict)
+	})
+	tools := &Tools{API: c}
+	_, err := tools.VMCreate(t.Context(), VMCreateIn{Host: "mewtwo"})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "predates certified host keys")
+	assert.Contains(t, err.Error(), "Upgrade that host's agent")
+}
+func TestAPIErrorSurfacesBodyNotToken(t *testing.T) {
+	c := fakeAPI(t, func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "invalid name", http.StatusBadRequest)

internal/mcpserver/tools.go

Old		New
@@ -13,6 +13,7 @@ import (
13	"github.com/a73x/eitri/internal/gateclient"	13	"github.com/a73x/eitri/internal/gateclient"
14	"github.com/a73x/eitri/internal/random"	14	"github.com/a73x/eitri/internal/random"
15	"github.com/a73x/eitri/internal/server/api/client"	15	"github.com/a73x/eitri/internal/server/api/client"
		16	"github.com/a73x/eitri/internal/server/release"
16	"golang.org/x/crypto/ssh"	17	"golang.org/x/crypto/ssh"
17	)	18	)
18		19
@@ -23,7 +24,7 @@ type api interface {
23	CreateVM(ctx context.Context, req client.CreateVMRequest) (client.CreateVMResponse, error)	24	CreateVM(ctx context.Context, req client.CreateVMRequest) (client.CreateVMResponse, error)
24	DeleteVM(ctx context.Context, id string) error	25	DeleteVM(ctx context.Context, id string) error
25	ListHosts(ctx context.Context) ([]client.Host, error)	26	ListHosts(ctx context.Context) ([]client.Host, error)
26	FirstOnlineHost(ctx context.Context) (client.Host, error)	27	FirstEligibleHost(ctx context.Context) (client.Host, error)
27	CreateExposure(ctx context.Context, vmID string, guestPort, hostPort int64) (client.Exposure, error)	28	CreateExposure(ctx context.Context, vmID string, guestPort, hostPort int64) (client.Exposure, error)
28	ListExposures(ctx context.Context, vmID string) ([]client.Exposure, error)	29	ListExposures(ctx context.Context, vmID string) ([]client.Exposure, error)
29	DeleteExposure(ctx context.Context, id string) error	30	DeleteExposure(ctx context.Context, id string) error
@@ -46,7 +47,7 @@ type Exec interface {
46	}	47	}
47		48
48	// API is the shared eitri API client plus the one piece of MCP placement	49	// API is the shared eitri API client plus the one piece of MCP placement
49	// policy the raw client doesn't carry: FirstOnlineHost.	50	// policy the raw client doesn't carry: FirstEligibleHost.
50	type API struct {	51	type API struct {
51	*client.Client	52	*client.Client
52	}	53	}
@@ -64,18 +65,36 @@ func (a API) RegisterUserCA(ctx context.Context, caLine, label string) error {
64	return c.UploadUserCA(ctx, "", caLine)	65	return c.UploadUserCA(ctx, "", caLine)
65	}	66	}
66		67
67	// FirstOnlineHost returns the first online host — the default placement	68	// FirstEligibleHost returns the first host a VM can be placed on — the default
68	// target when the caller doesn't name one. Ordering is server-defined;	69	// target when the caller doesn't name one. Eligible means online AND running an
69	// callers must not assume stability across calls.	70	// agent that certifies its guests' host keys: a VM created anywhere else is
70	func (a API) FirstOnlineHost(ctx context.Context) (client.Host, error) {	71	// unreachable through the gate, and the control plane refuses the create, so
		72	// such a host is no more a candidate than one that is down. Ordering is
		73	// server-defined; callers must not assume stability across calls.
		74	//
		75	// When every online host is ruled out that way, the refusal says so — "no
		76	// online hosts" would send the caller looking for hardware that is in fact up
		77	// and one upgrade away from usable.
		78	func (a API) FirstEligibleHost(ctx context.Context) (client.Host, error) {
71	hosts, err := a.ListHosts(ctx)	79	hosts, err := a.ListHosts(ctx)
72	if err != nil {	80	if err != nil {
73	return client.Host{}, err	81	return client.Host{}, err
74	}	82	}
		83	precsr := 0
75	for _, h := range hosts {	84	for _, h := range hosts {
76	if h.Online {	85	if !h.Online {
77	return h, nil	86	continue
78	}	87	}
		88	if !release.CertifiesGuestHostKeys(h.AgentVersion) {
		89	precsr++
		90	continue
		91	}
		92	return h, nil
		93	}
		94	if precsr > 0 {
		95	return client.Host{}, fmt.Errorf("no eligible hosts: %d online host(s) run agents that predate certified host keys (%s), "+
		96	"so a VM created on them could not be verified; upgrade an agent (the console's upgrade button, or "+
		97	"POST /api/v1/hosts/{id}/upgrade-agent) and try again", precsr, release.FirstCertifiedHostKeys)
79	}	98	}
80	return client.Host{}, errors.New("no online hosts")	99	return client.Host{}, errors.New("no online hosts")
81	}	100	}
@@ -117,7 +136,7 @@ func (t *Tools) waitTimeout() time.Duration {
117		136
118	type VMCreateIn struct {	137	type VMCreateIn struct {
119	Name string `json:"name,omitempty" jsonschema:"VM name (RFC-1123 label); default claude-<hex>"`	138	Name string `json:"name,omitempty" jsonschema:"VM name (RFC-1123 label); default claude-<hex>"`
120	Host string `json:"host,omitempty" jsonschema:"host name to place on; default first online host"`	139	Host string `json:"host,omitempty" jsonschema:"host name to place on; default first eligible host"`
121	VCPUs int64 `json:"vcpus,omitempty" jsonschema:"default 2"`	140	VCPUs int64 `json:"vcpus,omitempty" jsonschema:"default 2"`
122	MemMB int64 `json:"mem_mb,omitempty" jsonschema:"default 2048"`	141	MemMB int64 `json:"mem_mb,omitempty" jsonschema:"default 2048"`
123	DiskGB int64 `json:"disk_gb,omitempty" jsonschema:"default 20"`	142	DiskGB int64 `json:"disk_gb,omitempty" jsonschema:"default 20"`
@@ -164,7 +183,7 @@ func (t *Tools) VMCreate(ctx context.Context, in VMCreateIn) (VMCreateOut, error
164	}	183	}
165	req.HostID = hostID	184	req.HostID = hostID
166	} else {	185	} else {
167	h, err := t.API.FirstOnlineHost(ctx)	186	h, err := t.API.FirstEligibleHost(ctx)
168	if err != nil {	187	if err != nil {
169	return VMCreateOut{}, err	188	return VMCreateOut{}, err
170	}	189	}

internal/mcpserver/tools_test.go

Old		New
@@ -84,7 +84,7 @@ func (f *fakeToolsAPI) DeleteVM(ctx context.Context, id string) error {
84	func (f *fakeToolsAPI) ListHosts(ctx context.Context) ([]client.Host, error) {	84	func (f *fakeToolsAPI) ListHosts(ctx context.Context) ([]client.Host, error) {
85	return f.fleet(), nil	85	return f.fleet(), nil
86	}	86	}
87	func (f *fakeToolsAPI) FirstOnlineHost(ctx context.Context) (client.Host, error) {	87	func (f *fakeToolsAPI) FirstEligibleHost(ctx context.Context) (client.Host, error) {
88	for _, h := range f.fleet() {	88	for _, h := range f.fleet() {
89	if h.Online {	89	if h.Online {
90	return h, nil	90	return h, nil

internal/server/api/api.go

+		return
+	// Certified-host-key precondition, the other half of the same story: a guest
+	// whose host key nothing signed is unreachable through the gate, and the
+	// signing depends on the agent that will run it. Refuse here, where the
+	// operator can still upgrade the host, rather than at connect time — by then
+	// the only remedy is to recreate the VM (see vmssh, which refuses the dial).
+	//
+	// Only a host that is connected and reporting has told this server what it
+	// runs. The registry is in-memory and filled by the agent's Hello, so every
+	// host in the fleet is briefly absent from it after a server restart, and a
+	// host that has gone quiet holds whatever it last said; neither is evidence
+	// about the agent that will pick this VM up. Judging them would answer a
+	// roll with "upgrade this host" about a host that is perfectly current — a
+	// wrong diagnosis at the one moment operators are watching. So an offline
+	// host takes the create exactly as it does for any other reason it cannot
+	// serve one right now: the row is desired state, the agent that materializes
+	// it may well be a newer one, and vmssh still refuses the dial if the guest
+	// it eventually boots has no certificate.
+	if st, ok := a.reg.Get(req.HostID); ok && st.Online && !release.CertifiesGuestHostKeys(st.AgentVersion) {
+		http.Error(w, precsrRefusal(host.Name, req.HostID, st.AgentVersion, a.URL(upgradeAgentPath(req.HostID))), http.StatusConflict)
+		return
+	}
+	// Install the SSH key into user-supplied cloud-init. When only one of the
+	// two is set the seed builder handles it (verbatim user-data, or the
+	// generated default template); it's the BOTH case that used to silently

internal/server/api/api_test.go

@@ @@ -14,6 +14,7 @@ import ( @@
+	"github.com/a73x/eitri/internal/joinblob"
+	"github.com/a73x/eitri/internal/server/hub"
+	"github.com/a73x/eitri/internal/server/registry"
+	"github.com/a73x/eitri/internal/server/release"
+	"github.com/a73x/eitri/internal/server/store"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	require.Equal(t, 201, resp.StatusCode)
+	var out map[string]string
+	json.NewDecoder(resp.Body).Decode(&out)
+	agentJoins(out["host_id"])
+	return out
@@ @@ -271,6 +273,29 @@ func mintTestPAT(t *testing.T, st *store.Store) { @@
+	testPAT = secret
+// testAgentVersion is what the enrol helpers report on a joining host's behalf:
+// a release that certifies guest host keys, so a host these tests enrol is
+// never one an operator would be told to upgrade.
+const testAgentVersion = release.FirstCertifiedHostKeys
+// testReg is the registry newServer built. Like testPAT it is package-level
+// because the enrol helpers take only the server, and what an agent said about
+// itself lives in the registry, not the store.
+var testReg *registry.Registry
+// agentJoins records the Hello a real agent sends the moment after it enrols:
+// a host is in the fleet precisely because its agent connected and named its
+// version. It stops there, at connected-but-not-yet-reporting, because several
+// tests need an enrolled host whose agent is offline (the abandoned-tombstone
+// sweep, for one). Tests that exercise the certified-host-key precondition
+// bring their host online themselves with agentReports.
+func agentJoins(hostID string) { testReg.SetAgentVersion(hostID, testAgentVersion) }
+// agentReports is the first report that follows the Hello: it sets LastSeen, so
+// registry.Get reads the host as online and the create path will judge what its
+// agent said about itself.
+func agentReports(hostID string) { testReg.UpdateReport(hostID, registry.Report{}) }
+// newServer is the shared builder. It also returns the *API itself for tests
+// that need post-construction wiring (SetConsoleDialer, SetCertMinter).
+func newServer(t *testing.T) (*httptest.Server, *store.Store, *hub.Hub, *registry.Registry, *API) {
+	seedTestTenant(t, st)
+	h := hub.New()
+	reg := registry.New(time.Now)
+	testReg = reg
+	a := New(Config{
+		HostSecret: []byte("hostsecret"),
+		DefaultImages: map[string]DefaultImage{
+func enroll(t *testing.T, ts *httptest.Server) map[string]string {
+	t.Helper()
+	out := enrollSilent(t, ts)
+	agentJoins(out["host_id"])
+	return out // host_id, credential, bridge_cidr
+}
+// enrollSilent enrols a host whose agent never connects: the row is in the
+// store and the registry has never heard of it. That is the state of every
+// host in the fleet for a moment after the server restarts.
+func enrollSilent(t *testing.T, ts *httptest.Server) map[string]string {
+	t.Helper()
+	resp := do(t, "POST", ts.URL+"/api/v1/enroll-tokens", testPAT, nil)
+	require.Equal(t, 201, resp.StatusCode)
+	var tok map[string]string
+// TestCreateVMRefusesAHostThatCannotCertifyItsGuest pins the create-time half
+// of the certified-host-key story. A guest whose host key nothing signed cannot
+// be verified and is unreachable through the gate for the rest of its life, so
+// the create is refused while an operator can still fix it by upgrading the
+// agent — the refusal names the host, what it reported, and the endpoint that
+// upgrades it. A version that cannot be read, and a connected host that has
+// named none at all, are treated the same as an old one: neither proves the
+// guest could be certified.
+func TestCreateVMRefusesAHostThatCannotCertifyItsGuest(t *testing.T) {
+	for _, tc := range []struct{ name, version, want string }{
+		{"an older release", "v0.0.3", "runs agent v0.0.3, which predates certified host keys (v0.0.4)"},
+		{"an unstamped build", "dev", "runs agent dev, which predates certified host keys (v0.0.4)"},
+		{"nothing reported", "", "has reported no agent version"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			ts, st, _ := testServer(t)
+			out := enroll(t, ts)
+			testReg.SetAgentVersion(out["host_id"], tc.version)
+			agentReports(out["host_id"])
+			resp := do(t, "POST", ts.URL+"/api/v1/vms", testPAT,
+				map[string]any{"host_id": out["host_id"], "name": "doomed"})
+			require.Equal(t, 409, resp.StatusCode)
+			body, _ := io.ReadAll(resp.Body)
+			msg := string(body)
+			assert.Contains(t, msg, tc.want)
+			assert.Contains(t, msg, "host host-a ("+out["host_id"]+")", "the refusal must name the host to act on")
+			assert.Contains(t, msg, "/api/v1/hosts/"+out["host_id"]+"/upgrade-agent", "the refusal must name the fix")
+			vms, err := st.ListVMs()
+			require.NoError(t, err)
+			assert.Empty(t, vms, "a refused create must leave no row behind")
+		})
+	}
+}
+// TestCreateVMOnACertifyingAgentIsUntouched is the other side of the same
+// guard: every version at or past the floor — including a build described past
+// it — places a VM exactly as before.
+func TestCreateVMOnACertifyingAgentIsUntouched(t *testing.T) {
+	for _, version := range []string{"v0.0.4", "v0.0.5", "v0.0.5-2-gabc1234"} {
+		t.Run(version, func(t *testing.T) {
+			ts, _, _ := testServer(t)
+			out := enroll(t, ts)
+			testReg.SetAgentVersion(out["host_id"], version)
+			agentReports(out["host_id"])
+			resp := do(t, "POST", ts.URL+"/api/v1/vms", testPAT,
+				map[string]any{"host_id": out["host_id"], "name": "fine"})
+			assert.Equal(t, 201, resp.StatusCode)
+		})
+	}
+}
+// TestCreateVMJudgesOnlyAConnectedHostsAgent pins who the certified-host-key
+// refusal is allowed to accuse. The registry is in-memory and filled by the
+// agent's Hello, so a host that is not connected right now has told this server
+// process nothing: after a restart that is the whole fleet, and the empty
+// version an absent entry carries must never be read as "too old" and answered
+// with "upgrade this host" — the wrong diagnosis, delivered during a roll, about
+// a host running the newest agent there is. A host that has gone quiet is the
+// same: what it last said is not what the agent that eventually picks this VM up
+// will be. Both take the create like any host that cannot serve one this second,
+// and the connect-time refusal remains the backstop.
+func TestCreateVMJudgesOnlyAConnectedHostsAgent(t *testing.T) {
+	t.Run("absent from the registry", func(t *testing.T) {
+		ts, st, _ := testServer(t)
+		out := enrollSilent(t, ts)
+		resp := do(t, "POST", ts.URL+"/api/v1/vms", testPAT,
+			map[string]any{"host_id": out["host_id"], "name": "pending"})
+		body, _ := io.ReadAll(resp.Body)
+		require.Equal(t, 201, resp.StatusCode, "body: %s", body)
+		assert.NotContains(t, string(body), "upgrade-agent")
+		vms, err := st.ListVMs()
+		require.NoError(t, err)
+		assert.Len(t, vms, 1, "the create must land as desired state")
+	})
+	t.Run("connected once, now quiet", func(t *testing.T) {
+		ts, st, _ := testServer(t)
+		out := enroll(t, ts)
+		// The last thing this host said was pre-CSR, and it has not reported
+		// since — stale memory, not a diagnosis.
+		testReg.SetAgentVersion(out["host_id"], "v0.0.3")
+		resp := do(t, "POST", ts.URL+"/api/v1/vms", testPAT,
+			map[string]any{"host_id": out["host_id"], "name": "pending"})
+		body, _ := io.ReadAll(resp.Body)
+		require.Equal(t, 201, resp.StatusCode, "body: %s", body)
+		vms, err := st.ListVMs()
+		require.NoError(t, err)
+		assert.Len(t, vms, 1)
+	})
+}
+func TestDeleteTombstones(t *testing.T) {
+	ts, st, _ := testServer(t)
+	out := enroll(t, ts)

internal/server/api/decommission_api_test.go

Old		New
@@ -24,13 +24,15 @@ func apiServer(t testing.T) (httptest.Server, API, store.Store) {
24	require.NoError(t, err)	24	require.NoError(t, err)
25	t.Cleanup(func() { st.Close() })	25	t.Cleanup(func() { st.Close() })
26	seedTestTenant(t, st)	26	seedTestTenant(t, st)
		27	reg := registry.New(time.Now)
		28	testReg = reg
27	a := New(Config{	29	a := New(Config{
28	HostSecret: []byte("hostsecret"),	30	HostSecret: []byte("hostsecret"),
29	DefaultImages: map[string]DefaultImage{"amd64": {URL: "http://img", SHA256: strings.Repeat("a", 64)}},	31	DefaultImages: map[string]DefaultImage{"amd64": {URL: "http://img", SHA256: strings.Repeat("a", 64)}},
30	AdvertiseHTTP: "http://127.0.0.1:8080",	32	AdvertiseHTTP: "http://127.0.0.1:8080",
31	AdvertiseQUIC: "127.0.0.1:8443",	33	AdvertiseQUIC: "127.0.0.1:8443",
32	ServerCertSHA256: strings.Repeat("c", 64),	34	ServerCertSHA256: strings.Repeat("c", 64),
33	}, st, registry.New(time.Now), hub.New())	35	}, st, reg, hub.New())
34	// BYO-CA precondition: VM create requires the tenant to have ≥1 registered	36	// BYO-CA precondition: VM create requires the tenant to have ≥1 registered
35	// SSH user CA. Seed the default tenant so VM-create tests reach the create	37	// SSH user CA. Seed the default tenant so VM-create tests reach the create
36	// path rather than the precondition (mirrors newServer in api_test.go).	38	// path rather than the precondition (mirrors newServer in api_test.go).

internal/server/api/isolation_test.go

Old		New
@@ -47,6 +47,7 @@ func enrollWith(t testing.T, ts httptest.Server, pat, name string) string {
47	require.Equal(t, 201, resp.StatusCode)	47	require.Equal(t, 201, resp.StatusCode)
48	var out map[string]string	48	var out map[string]string
49	require.NoError(t, json.NewDecoder(resp.Body).Decode(&out))	49	require.NoError(t, json.NewDecoder(resp.Body).Decode(&out))
		50	agentJoins(out["host_id"])
50	return out["host_id"]	51	return out["host_id"]
51	}	52	}
52		53

internal/server/api/upgrade.go

Old		New
@@ -3,11 +3,35 @@ package api
3	import (	3	import (
4	"database/sql"	4	"database/sql"
5	"errors"	5	"errors"
		6	"fmt"
6	"net/http"	7	"net/http"
7		8
8	"github.com/a73x/eitri/internal/server/release"	9	"github.com/a73x/eitri/internal/server/release"
9	)	10	)
10		11
		12	// upgradeAgentPath is the endpoint that offers one host's agent an upgrade —
		13	// the route the console's upgrade button calls, and the fix every "this agent
		14	// is too old" refusal names.
		15	func upgradeAgentPath(hostID string) string { return "/api/v1/hosts/" + hostID + "/upgrade-agent" }
		16
		17	// precsrRefusal explains why a host cannot be given a VM: its agent predates
		18	// certified guest host keys. The two readings — a version below the floor, and
		19	// no reported version at all, which proves nothing either way — differ only in
		20	// what is known, so they share the consequence and the fix. Both describe a
		21	// host that is connected and reporting: silence from one that is up is an agent
		22	// too old to name itself, which is why it reads the same as an old version.
		23	func precsrRefusal(hostName, hostID, agentVersion, upgradeURL string) string {
		24	known := fmt.Sprintf("host %s (%s) runs agent %s, which predates certified host keys (%s)",
		25	hostName, hostID, agentVersion, release.FirstCertifiedHostKeys)
		26	if agentVersion == "" {
		27	known = fmt.Sprintf("host %s (%s) has reported no agent version, so nothing says it is new enough for certified host keys (%s)",
		28	hostName, hostID, release.FirstCertifiedHostKeys)
		29	}
		30	return known + ": a guest created there gets no certified host key, so nothing could verify it and it would be " +
		31	"unreachable through the gate. Upgrade that host's agent — the console's upgrade button, or POST " +
		32	upgradeURL + " — then create the VM."
		33	}
		34
11	// handleUpgradeAgent records a pending self-upgrade offer for one host's agent	35	// handleUpgradeAgent records a pending self-upgrade offer for one host's agent
12	// and pokes its snapshot stream. The human is the rollout controller: nothing	36	// and pokes its snapshot stream. The human is the rollout controller: nothing
13	// upgrades without this per-host click, so a bad release stops at one host.	37	// upgrades without this per-host click, so a bad release stops at one host.

internal/server/release/release.go

@@ @@ -138,9 +138,40 @@ func Less(a, b string) bool { @@
+	if !oka || !okb {
+		return false
+	return before(pa, pb)
+}
+// FirstCertifiedHostKeys is the release whose agent began generating each
+// guest's SSH host key and submitting the public half for the control plane to
+// sign. A VM created by anything older carries no host certificate and can
+// never be issued one — the key it would certify was never reported — so
+// nothing can verify that guest at connect time.
+const FirstCertifiedHostKeys = "v0.0.4"
+// CertifiesGuestHostKeys reports whether an agent at version v certifies the
+// host keys of the guests it creates, ordering v against
+// FirstCertifiedHostKeys by the same rule Less publishes.
+//
+// An unparsable version — "dev", a "-dirty" tree, a malformed tag — does not:
+// nothing can be proven about a version that cannot be read, and this is the
+// same conservative reading the upgrade path takes when it never offers such a
+// build an upgrade. So is the empty version a host reports before it has said
+// anything at all.
+func CertifiesGuestHostKeys(v string) bool {
+	p, ok := parse(v)
+	if !ok {
+		return false
+	}
+	// The floor is a release tag, so it parses by construction (pinned by test).
+	floor, _ := parse(FirstCertifiedHostKeys)
+	return !before(p, floor)
+}
+// before compares two ordering tuples, the one place their fields are ranked.
+func before(a, b [6]int) bool {
+	for i := range a {
+		if a[i] != b[i] {
+			return a[i] < b[i]
+	return false

internal/server/release/release_test.go

+// TestCertifiesGuestHostKeys pins the capability question the create path asks
+// of a host: does this agent generate a guest host key for the plane to sign?
+// The floor is a release, so every build of it and everything after qualifies,
+// while a pre-release of the floor does not — it is genuinely older.
+func TestCertifiesGuestHostKeys(t *testing.T) {
+	yes := []string{"v0.0.4", "v0.0.4-2-gabc1234", "v0.0.5", "v0.1.0", "v1.0.0"}
+	for _, v := range yes {
+		if !CertifiesGuestHostKeys(v) {
+			t.Errorf("CertifiesGuestHostKeys(%q) = false, want true", v)
+		}
+	}
+	no := []string{"v0.0.3", "v0.0.1", "v0.0.4-pre.9", "v0.0.3-7-gabc1234"}
+	for _, v := range no {
+		if CertifiesGuestHostKeys(v) {
+			t.Errorf("CertifiesGuestHostKeys(%q) = true, want false", v)
+		}
+	}
+}
+// TestCertifiesGuestHostKeysRefusesTheUnreadable holds the conservative line:
+// a version nothing can parse — including the empty one a host reports before
+// it has said anything — proves nothing, so it is treated as too old, exactly
+// as the upgrade path never offers such a build an upgrade.
+func TestCertifiesGuestHostKeysRefusesTheUnreadable(t *testing.T) {
+	for _, v := range []string{"", "dev", "v0.0.9-dirty", "v0.0", "latest"} {
+		if CertifiesGuestHostKeys(v) {
+			t.Errorf("CertifiesGuestHostKeys(%q) = true, want false", v)
+		}
+	}
+}
+// The floor is spelled as a version, and every refusal quotes it; a typo would
+// silently refuse (or admit) the whole fleet.
+func TestFirstCertifiedHostKeysIsAReleaseTag(t *testing.T) {
+	if _, ok := parse(FirstCertifiedHostKeys); !ok {
+		t.Fatalf("FirstCertifiedHostKeys = %q, which does not parse as a version", FirstCertifiedHostKeys)
+	}
+}
+func TestRefreshParsesManifest(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte(`{"version":"v0.0.2","artifacts":{"eitri-agent":{"linux/amd64":{"url":"https://eitri.sh/dl/v0.0.2/a.tar.gz","sha256":"ab"}}}}`))