cryptolabs-proxy 1.3.1__tar.gz → 1.4.0__tar.gz

{cryptolabs_proxy-1.3.1/src/cryptolabs_proxy.egg-info → cryptolabs_proxy-1.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cryptolabs-proxy
-Version: 1.3.1
+Version: 1.4.0
 Summary: Unified reverse proxy and fleet management landing page for CryptoLabs products
 Author-email: CryptoLabs <support@cryptolabs.co.za>
 License: MIT
@@ -190,6 +190,10 @@ always-running internal VPM session and reauthentication endpoints cannot fall
 through a preserved public <code>/auth/</code> route. Rollback restores the
 original stored baseline exactly.
 
+Supported DC monitoring adoption uses the private durable
+[controller adoption guard](docs/controller-adoption-guard.md), including normal
+updater and proxy-adoption exclusion during crash recovery.
+
 ### Vast Price Manager Fleet sign-in
 
 ### Vast Price Manager prerequisite

{cryptolabs_proxy-1.3.1 → cryptolabs_proxy-1.4.0}/README.md

@@ -162,6 +162,10 @@ always-running internal VPM session and reauthentication endpoints cannot fall
 through a preserved public <code>/auth/</code> route. Rollback restores the
 original stored baseline exactly.
 
+Supported DC monitoring adoption uses the private durable
+[controller adoption guard](docs/controller-adoption-guard.md), including normal
+updater and proxy-adoption exclusion during crash recovery.
+
 ### Vast Price Manager Fleet sign-in
 
 ### Vast Price Manager prerequisite

{cryptolabs_proxy-1.3.1 → cryptolabs_proxy-1.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cryptolabs-proxy"
-version = "1.3.1"
+version = "1.4.0"
 description = "Unified reverse proxy and fleet management landing page for CryptoLabs products"
 readme = "README.md"
 license = {text = "MIT"}

{cryptolabs_proxy-1.3.1 → cryptolabs_proxy-1.4.0}/src/cryptolabs_proxy/__init__.py

@@ -1,6 +1,6 @@
 """CryptoLabs Proxy - Unified reverse proxy for CryptoLabs products."""
 
-__version__ = "1.3.1"
+__version__ = "1.4.0"
 
 # Export programmatic setup API
 from .setup import (

cryptolabs_proxy-1.4.0/src/cryptolabs_proxy/controller_recovery.py

@@ -0,0 +1,284 @@
+"""Private controller exclusion on the updater's existing auth mount.
+
+This module uses only stdlib so its fixed helper can run without auth startup,
+network access, the Docker socket, or the source container's environment.
+"""
+import fcntl
+import json
+import os
+from pathlib import Path
+import re
+import socket
+import stat
+import sys
+import time
+import uuid
+from contextlib import contextmanager
+
+MARKER = 'controller-adoption.json'
+MAX_MARKER = 4096
+GUARD_IDLE_SECONDS = 300
+CAPABILITY = {'schema_version': 1, 'api': 'AdoptionEngine.controller_guard',
+              'durable_updater_exclusion': True}
+FIELDS = {'schema_version', 'kind', 'operation_id', 'source_id', 'source_image',
+          'auth_mount_sha256', 'owner'}
+
+
+class RecoveryError(RuntimeError):
+    """Fixed public failure, without private filesystem or Engine details."""
+
+
+def _hold():
+    raise RecoveryError('controller_recovery_required')
+
+
+def validate_record(value):
+    if not isinstance(value, dict) or set(value) != FIELDS:
+        _hold()
+    if type(value['schema_version']) is not int or value['schema_version'] != 1 or value['kind'] != 'dc-controller-adoption':
+        _hold()
+    patterns = {'operation_id': r'[A-Za-z0-9][A-Za-z0-9_.-]{0,95}',
+                'source_id': r'[0-9a-f]{64}',
+                'source_image': r'sha256:[0-9a-f]{64}',
+                'auth_mount_sha256': r'[0-9a-f]{64}', 'owner': r'[0-9a-f]{64}'}
+    for key, pattern in patterns.items():
+        if not isinstance(value[key], str) or not re.fullmatch(pattern, value[key]):
+            _hold()
+    return value
+
+
+def _private(info, *, directory=False):
+    return ((stat.S_ISDIR(info.st_mode) if directory else stat.S_ISREG(info.st_mode))
+            and info.st_uid == os.geteuid()
+            and stat.S_IMODE(info.st_mode) == (0o700 if directory else 0o600)
+            and (directory or info.st_nlink == 1))
+
+
+@contextmanager
+def open_directory(directory):
+    """Traverse each parent without following links; create only missing dirs."""
+    path = Path(directory)
+    if not path.is_absolute() or '..' in path.parts:
+        _hold()
+    descriptor = os.open('/', os.O_RDONLY | os.O_DIRECTORY)
+    try:
+        for index, part in enumerate(path.parts[1:]):
+            try:
+                child = os.open(part, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW, dir_fd=descriptor)
+            except FileNotFoundError:
+                os.mkdir(part, 0o700, dir_fd=descriptor)
+                os.fsync(descriptor)
+                child = os.open(part, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW, dir_fd=descriptor)
+            os.close(descriptor)
+            descriptor = child
+        if not _private(os.fstat(descriptor), directory=True):
+            _hold()
+        yield descriptor
+    except (OSError, ValueError):
+        _hold()
+    finally:
+        os.close(descriptor)
+
+
+def _unique_object(pairs):
+    result = {}
+    for key, value in pairs:
+        if key in result:
+            raise ValueError('duplicate field')
+        result[key] = value
+    return result
+
+
+def read_marker(directory_fd):
+    try:
+        descriptor = os.open(MARKER, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK, dir_fd=directory_fd)
+    except FileNotFoundError:
+        return None
+    except OSError:
+        _hold()
+    try:
+        info = os.fstat(descriptor)
+        if not _private(info) or info.st_size > MAX_MARKER:
+            _hold()
+        data = os.read(descriptor, MAX_MARKER + 1)
+        if len(data) > MAX_MARKER:
+            _hold()
+        try:
+            value = json.loads(data, object_pairs_hook=_unique_object)
+        except (ValueError, UnicodeError, RecursionError):
+            _hold()
+        return validate_record(value)
+    finally:
+        os.close(descriptor)
+
+
+def require_clear(directory):
+    with open_directory(directory) as descriptor:
+        if read_marker(descriptor) is not None:
+            _hold()
+
+
+def _write_marker(directory_fd, value):
+    validate_record(value)
+    temporary = '.' + MARKER + '-' + uuid.uuid4().hex
+    descriptor = os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW,
+                         0o600, dir_fd=directory_fd)
+    try:
+        with os.fdopen(descriptor, 'wb') as stream:
+            stream.write(json.dumps(value, sort_keys=True, separators=(',', ':')).encode())
+            stream.flush()
+            os.fsync(stream.fileno())
+        os.rename(temporary, MARKER, src_dir_fd=directory_fd, dst_dir_fd=directory_fd)
+        os.fsync(directory_fd)
+    finally:
+        try: os.unlink(temporary, dir_fd=directory_fd)
+        except FileNotFoundError: pass
+
+
+def open_lock(directory_fd, name):
+    descriptor = os.open(name, os.O_RDWR | os.O_CREAT | os.O_NOFOLLOW | os.O_NONBLOCK,
+                         0o600, dir_fd=directory_fd)
+    if not _private(os.fstat(descriptor)):
+        os.close(descriptor)
+        _hold()
+    return descriptor
+
+
+@contextmanager
+def updater_lock(directory, name):
+    with open_directory(directory) as directory_fd:
+        descriptor = None
+        try:
+            descriptor = open_lock(directory_fd, name)
+            fcntl.flock(descriptor, fcntl.LOCK_EX)
+            yield
+        except OSError:
+            _hold()
+        finally:
+            if descriptor is not None:
+                os.close(descriptor)
+
+
+def request(path, owner, action, timeout):
+    with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as client:
+        client.settimeout(timeout)
+        client.connect(path)
+        client.sendall(json.dumps({'owner': owner, 'action': action}).encode() + b'\n')
+        response = b''
+        while not response.endswith(b'\n'):
+            chunk = client.recv(1024)
+            if not chunk: _hold()
+            response += chunk
+            if len(response) > MAX_MARKER: _hold()
+    value = json.loads(response)
+    if value != {'owner': owner, 'state': 'completed' if action == 'complete' else 'held'}:
+        _hold()
+    return value
+
+
+# This fixed client is executed inside the exact guard helper, never the proxy.
+CLIENT_COMMAND = """import json,socket,sys
+with socket.socket(socket.AF_UNIX,socket.SOCK_STREAM) as c:
+ c.settimeout(2); c.connect('/tmp/controller-guard.sock')
+ c.sendall(json.dumps({'owner':sys.argv[1],'action':sys.argv[2]}).encode()+b'\\n')
+ data=b''
+ while not data.endswith(b'\\n'):
+  part=c.recv(1024)
+  if not part: raise RuntimeError('guard_unavailable')
+  data+=part
+  if len(data)>4096: raise RuntimeError('guard_unavailable')
+ sys.stdout.buffer.write(data)
+"""
+
+
+def helper_main(directory, socket_path, expected, recover, timeout):
+    """Hold real locks until removal; durable marker outlives this process."""
+    validate_record(expected)
+    with open_directory(directory) as directory_fd:
+        descriptors = []
+        try:
+            deadline = time.monotonic() + timeout
+            for name in ('dispatch.lock', 'operation.lock'):
+                descriptor = open_lock(directory_fd, name)
+                descriptors.append((name, descriptor, os.fstat(descriptor)))
+                while True:
+                    try:
+                        fcntl.flock(descriptor, fcntl.LOCK_EX | fcntl.LOCK_NB)
+                        break
+                    except BlockingIOError:
+                        if time.monotonic() >= deadline: _hold()
+                        time.sleep(.02)
+            previous = read_marker(directory_fd)
+            if previous is not None:
+                if not recover or {k: v for k, v in previous.items() if k != 'owner'} != {k: v for k, v in expected.items() if k != 'owner'}:
+                    _hold()
+            _write_marker(directory_fd, expected)
+            completed = False
+
+            def prove():
+                # Reopen by no-follow traversal to detect replaced parent/lock
+                # inodes. Fixed helper never unlocks its live descriptors.
+                with open_directory(directory) as current_fd:
+                    if (os.fstat(current_fd).st_dev, os.fstat(current_fd).st_ino) != (os.fstat(directory_fd).st_dev, os.fstat(directory_fd).st_ino):
+                        _hold()
+                    for name, descriptor, original in descriptors:
+                        current = os.stat(name, dir_fd=current_fd, follow_symlinks=False)
+                        if not _private(current) or (current.st_dev, current.st_ino) != (original.st_dev, original.st_ino):
+                            _hold()
+                        if (os.fstat(descriptor).st_dev, os.fstat(descriptor).st_ino) != (original.st_dev, original.st_ino):
+                            _hold()
+                    actual = read_marker(current_fd)
+                    if actual != (None if completed else expected): _hold()
+
+            with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as server:
+                server.bind(socket_path)
+                os.chmod(socket_path, 0o600)
+                server.listen(1)
+                verified_at = time.monotonic()
+                while True:
+                    remaining = GUARD_IDLE_SECONDS - (time.monotonic() - verified_at)
+                    if remaining <= 0:
+                        return  # Release locks; persisted marker stays in place.
+                    server.settimeout(min(remaining, .25))
+                    try:
+                        connection, _ = server.accept()
+                    except socket.timeout:
+                        continue
+                    with connection:
+                        connection.settimeout(min(2, remaining))
+                        try:
+                            data = b''
+                            while not data.endswith(b'\n'):
+                                part = connection.recv(1024)
+                                if not part: _hold()
+                                data += part
+                                if len(data) > MAX_MARKER: _hold()
+                            command = json.loads(data)
+                            if command not in ({'owner': expected['owner'], 'action': 'check'},
+                                               {'owner': expected['owner'], 'action': 'complete'}): _hold()
+                            prove()
+                            if time.monotonic() - verified_at >= GUARD_IDLE_SECONDS:
+                                _hold()
+                            verified_at = time.monotonic()
+                            if command['action'] == 'complete':
+                                if not completed:
+                                    os.unlink(MARKER, dir_fd=directory_fd)
+                                    os.fsync(directory_fd)
+                                    completed = True
+                                state = 'completed'
+                            else:
+                                if completed: _hold()
+                                state = 'held'
+                            response = {'owner': expected['owner'], 'state': state}
+                        except (OSError, ValueError, RecoveryError):
+                            response = {'state': 'unavailable'}
+                        try: connection.sendall(json.dumps(response).encode() + b'\n')
+                        except OSError: pass
+        finally:
+            for _, descriptor, _ in descriptors: os.close(descriptor)
+            try: os.unlink(socket_path)
+            except FileNotFoundError: pass
+
+
+if __name__ == '__main__':
+    helper_main(sys.argv[1], sys.argv[2], json.loads(sys.argv[3]), sys.argv[4] == 'recover', float(sys.argv[5]))

{cryptolabs_proxy-1.3.1 → cryptolabs_proxy-1.4.0}/src/cryptolabs_proxy/standard_adoption.py

@@ -228,6 +228,8 @@ try:
   fcntl.flock(stream,fcntl.LOCK_EX|fcntl.LOCK_NB)
 except BlockingIOError:
  sys.exit(73)
+# Presence is sufficient: malformed/unknown/link markers also require recovery.
+if os.path.lexists(directory/'controller-adoption.json'): sys.exit(74)
 pathlib.Path(sys.argv[2]).write_text('held')
 while True: time.sleep(60)
 """
@@ -254,6 +256,151 @@ while True: time.sleep(60)
         finally:
             self.remove(name,ignore_missing=True)
 
+    @contextmanager
+    def controller_guard(self, source_proxy, image_id, operation_id, *, recover=False):
+        """Exclude durable updates until verified controller completion.
+
+        Context exit always removes the helper but retains its marker. Recovery
+        reclaims the same source/mount/operation only under both real locks.
+        """
+        from . import controller_recovery as recovery
+        from .migration import _mount_request
+        import uuid
+        if type(recover) is not bool:
+            raise AdoptionError('controller_guard_identity_invalid')
+        owner = uuid.uuid4().hex + uuid.uuid4().hex
+        mounts = source_proxy.get('Mounts', [])
+        auth = [m for m in mounts if m.get('Destination') == '/data/auth']
+        if len(auth) != 1 or not auth[0].get('RW', True) or any(
+                m.get('Destination', '').startswith('/data/auth/') for m in mounts):
+            raise AdoptionError('controller_guard_auth_mount_unsupported')
+        if auth[0].get('Type') not in ('bind', 'volume') or image_id != source_proxy.get('Image'):
+            raise AdoptionError('controller_guard_source_unsupported')
+        try:
+            mount = _mount_request(auth[0])
+            record = recovery.validate_record({'schema_version': 1, 'kind': 'dc-controller-adoption',
+                'operation_id': operation_id, 'source_id': source_proxy['Id'], 'source_image': image_id,
+                'auth_mount_sha256': sha256(_canonical(mount)), 'owner': owner})
+        except (KeyError, TypeError, ValueError, MigrationError, recovery.RecoveryError):
+            raise AdoptionError('controller_guard_identity_invalid') from None
+        name = 'cryptolabs-controller-lock-' + owner[:24]
+        command = Path(recovery.__file__).read_text()
+        self.create(name, {'Config': {'Image': image_id, 'Entrypoint': ['python3'],
+            'Cmd': ['-c', command, '/data/auth/update-jobs', '/tmp/controller-guard.sock',
+                    json.dumps(record, sort_keys=True, separators=(',', ':')),
+                    'recover' if recover else 'new', str(min(self.timeout, 15))],
+            'Healthcheck': {'Test': ['NONE']}, 'Labels': {'io.cryptolabs.controller.guard': owner,
+                'com.centurylinklabs.watchtower.enable': 'false'}},
+            'HostConfig': {'NetworkMode': 'none', 'RestartPolicy': {'Name': 'no'},
+                'Mounts': [mount], 'LogConfig': {'Type': 'json-file', 'Config': {'max-size': '1m', 'max-file': '1'}}},
+            'NetworkingConfig': {'EndpointsConfig': {}}})
+        helper_id = None
+        completed = False
+
+        def invoke(action):
+            try:
+                helper = self.inspect(helper_id or name)
+                if (not helper.get('State', {}).get('Running') or helper.get('Image') != image_id
+                        or helper.get('Config', {}).get('Labels', {}).get('io.cryptolabs.controller.guard') != owner
+                        or helper_id and helper.get('Id') != helper_id):
+                    raise ValueError()
+                response = self._controller_guard_rpc(helper['Id'], owner, action)
+                if response != {'owner': owner, 'state': 'completed' if action == 'complete' else 'held'}:
+                    raise ValueError()
+                return helper['Id']
+            except Exception:
+                raise AdoptionError('controller_guard_unavailable; controller recovery required') from None
+
+        def check():
+            if completed:
+                raise AdoptionError('controller_guard_completed')
+            invoke('check')
+
+        def complete():
+            nonlocal completed
+            invoke('complete')
+            completed = True
+
+        check.complete = complete
+        try:
+            self.start(name)
+            deadline = time.monotonic() + min(self.timeout, 15) + 1
+            while True:
+                try:
+                    helper_id = invoke('check')
+                    break
+                except AdoptionError:
+                    if time.monotonic() >= deadline or not self.inspect(name).get('State', {}).get('Running'):
+                        raise AdoptionError('controller_guard_unavailable; controller recovery required') from None
+                    time.sleep(.02)
+            yield check
+        finally:
+            self.remove(helper_id or name, ignore_missing=True)
+
+    def _controller_guard_rpc(self, helper_id, owner, action):
+        """Execute the fixed client on this Engine, with bounded framed output."""
+        from .controller_recovery import CLIENT_COMMAND
+        from .migration import _UnixHTTPConnection
+        try:
+            command = ['python3', '-c', CLIENT_COMMAND, owner, action]
+            if action not in ('check', 'complete'):
+                raise ValueError()
+            created = self._request('POST', '/containers/' + quote(helper_id, safe='') + '/exec',
+                {'AttachStdin': False, 'AttachStdout': True, 'AttachStderr': True,
+                 'Tty': False, 'Cmd': command})
+            if len(created) > 4096:
+                raise ValueError()
+            exec_id = json.loads(created)['Id']
+            if not isinstance(exec_id, str) or not re.fullmatch('[0-9a-f]{64}', exec_id):
+                raise ValueError()
+            # Generic Engine requests read the complete response. Bound this
+            # attached exec stream before allocation on the very same socket.
+            connection = _UnixHTTPConnection(self.socket_path, min(self.timeout, 5))
+            try:
+                connection.request('POST', '/exec/' + exec_id + '/start',
+                    body=json.dumps({'Detach': False, 'Tty': False}).encode(),
+                    headers={'Content-Type': 'application/json'})
+                response = connection.getresponse()
+                if response.status != 200:
+                    raise ValueError()
+                output = response.read(16385)
+            finally:
+                connection.close()
+            if len(output) > 16384:
+                raise ValueError()
+            stdout = bytearray()
+            offset = 0
+            while offset < len(output):
+                header = output[offset:offset + 8]
+                if len(header) != 8 or header[0] not in (1, 2) or header[1:4] != b'\0\0\0':
+                    raise ValueError()
+                length = int.from_bytes(header[4:8], 'big')
+                offset += 8
+                if length > len(output) - offset or header[0] == 2 and length:
+                    raise ValueError()
+                if header[0] == 1:
+                    if len(stdout) + length > 4096:
+                        raise ValueError()
+                    stdout.extend(output[offset:offset + length])
+                offset += length
+            inspected = self._request('GET', '/exec/' + exec_id + '/json')
+            if len(inspected) > 4096:
+                raise ValueError()
+            execution = json.loads(inspected)
+            process = execution.get('ProcessConfig', {})
+            if (execution.get('ID') != exec_id or execution.get('ContainerID') != helper_id
+                    or execution.get('Running') is not False
+                    or type(execution.get('ExitCode')) is not int or execution['ExitCode'] != 0
+                    or process.get('entrypoint') != command[0] or process.get('arguments') != command[1:]
+                    or process.get('tty') is not False):
+                raise ValueError()
+            value = json.loads(stdout)
+            if value != {'owner': owner, 'state': 'completed' if action == 'complete' else 'held'}:
+                raise ValueError()
+            return value
+        except Exception:
+            raise AdoptionError('controller_guard_unavailable') from None
+
     def read_config(self,name):
         return CustomConfigMigrator(Path('/etc/cryptolabs-proxy'),Path('/etc/cryptolabs-proxy/migrations'),engine=self)._read_active_config(name)
     def image(self,reference): return json.loads(self._request('GET','/images/'+quote(reference,safe='')+'/json'))

{cryptolabs_proxy-1.3.1 → cryptolabs_proxy-1.4.0}/src/cryptolabs_proxy/updates.py

@@ -22,6 +22,7 @@ from urllib.request import urlopen
 
 from .migration import DockerEngine, MigrationError, _mount_request, endpoint_configurations
 from . import release_selection as selection
+from . import controller_recovery
 
 
 SERVICES = {
@@ -55,7 +56,8 @@ PROXY_ADOPTION_MESSAGE = ('Proxy replacement requires the published host CLI: ru
 def get_capabilities():
     """Additive caller contract; proxy replacement requires host authority."""
     return {'selection_contract': selection.SELECTION_CONTRACT,
-            'proxy_replacement_policy': PROXY_REPLACEMENT_POLICY}
+            'proxy_replacement_policy': PROXY_REPLACEMENT_POLICY,
+            'controller_adoption_guard': dict(controller_recovery.CAPABILITY)}
 
 
 def _require_selected_updater(engine, source):
@@ -436,11 +438,11 @@ def job_status(job_id, *, directory=JOBS_DIR, engine=None):
 
 @contextmanager
 def _lock(directory, name):
-    Path(directory).mkdir(mode=0o700, parents=True, exist_ok=True)
-    descriptor = os.open(Path(directory) / name, os.O_RDWR | os.O_CREAT, 0o600)
-    with os.fdopen(descriptor, 'w') as stream:
-        fcntl.flock(stream, fcntl.LOCK_EX)
-        yield
+    try:
+        with controller_recovery.updater_lock(directory, name):
+            yield
+    except controller_recovery.RecoveryError:
+        raise UpdateError('controller_recovery_required') from None
 
 
 def helper_request(source, directory, job_id):
@@ -476,6 +478,10 @@ def submit_job(service, branch, action, *, directory=JOBS_DIR, engine=None,
     if snapshot and service != 'all' and (service not in targets or targets[service]['owner'] != 'proxy-updater'):
         raise UpdateError('service_not_selected')
     with _lock(directory, 'dispatch.lock'):
+        try:
+            controller_recovery.require_clear(directory)
+        except controller_recovery.RecoveryError:
+            raise UpdateError('controller_recovery_required') from None
         active = Path(directory) / 'active.json'
         if active.exists():
             previous = read_job(directory, json.loads(active.read_text())['id'])
@@ -614,6 +620,13 @@ def run_job(directory, job_id, *, engine=None):
         job = read_job(directory, job_id)
         if job.get('state') not in (None, 'queued'):
             return job  # A completed/interrupted operation is never replayed.
+        try:
+            controller_recovery.require_clear(directory)
+        except controller_recovery.RecoveryError:
+            job.update(state='blocked', success=False, reason='controller_recovery_required',
+                       finished_at=time.time(), results={})
+            write_job(directory, job)
+            return job
         job.update(state='running', results={})
         write_job(directory, job)
         if 'selection_snapshot' in job:

{cryptolabs_proxy-1.3.1 → cryptolabs_proxy-1.4.0/src/cryptolabs_proxy.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cryptolabs-proxy
-Version: 1.3.1
+Version: 1.4.0
 Summary: Unified reverse proxy and fleet management landing page for CryptoLabs products
 Author-email: CryptoLabs <support@cryptolabs.co.za>
 License: MIT
@@ -190,6 +190,10 @@ always-running internal VPM session and reauthentication endpoints cannot fall
 through a preserved public <code>/auth/</code> route. Rollback restores the
 original stored baseline exactly.
 
+Supported DC monitoring adoption uses the private durable
+[controller adoption guard](docs/controller-adoption-guard.md), including normal
+updater and proxy-adoption exclusion during crash recovery.
+
 ### Vast Price Manager Fleet sign-in
 
 ### Vast Price Manager prerequisite

{cryptolabs_proxy-1.3.1 → cryptolabs_proxy-1.4.0}/src/cryptolabs_proxy.egg-info/SOURCES.txt

@@ -5,6 +5,7 @@ src/cryptolabs_proxy/__init__.py
 src/cryptolabs_proxy/auth.py
 src/cryptolabs_proxy/cli.py
 src/cryptolabs_proxy/config.py
+src/cryptolabs_proxy/controller_recovery.py
 src/cryptolabs_proxy/custom_config.py
 src/cryptolabs_proxy/exporter_manager.py
 src/cryptolabs_proxy/identity.py
@@ -34,6 +35,8 @@ src/cryptolabs_proxy/templates/standard-service-routes.conf.j2
 src/cryptolabs_proxy/templates/vast-price-manager-auth-blocks.conf.j2
 src/cryptolabs_proxy/templates/vast-price-manager.conf.j2
 tests/test_auth.py
+tests/test_controller_guard_transport.py
+tests/test_controller_recovery_guard.py
 tests/test_edge_ownership.py
 tests/test_exporter_auth_protections.py
 tests/test_host_forwarding.py