Alan-Jowett / sonde / 26537192756

81%

push

github

feat(gateway): implement rotation execution engine (GW-2006, GW-2007, GW-2013) (#1060)

* feat(gateway): implement rotation execution engine (GW-2006, GW-2007, GW-2013)

Implement the master key rotation execution engine -- the critical-path
component that makes SubmitRotation gRPC and DESIRED_STATE rotation
operational.

New module: rotation_engine.rs
- RotationEngine struct receiving rotation payloads from both gRPC
  (rotation_tx channel) and DESIRED_STATE (gateway_desired_state_tx)
- 8-step rotation pipeline: decrypt, verify code, verify epoch,
  prepare, migrate PSKs, rewrap identity, commit, emit
- Crash recovery via resume_pending_rotation() at startup
- AtomicBool flag for concurrent rotation rejection
- ACTUAL_STATE re-emission via existing ConnectorEventHub API

Storage changes: sqlite_storage.rs
- pending_rotation table migration -- previously deferred, now created
  in open() with crash-safe schema
- Dual-key PSK decryption -- rotation_key_state field enables frame
  processing during migration (mixed master_key_epoch values)
- master_key swap support -- changed to RwLock<Arc<Zeroizing<...>>>
  for in-memory key swap after rotation commit
- Pending-rotation-aware startup -- validate_master_key tries both
  old and new keys when an interrupted rotation is detected
- New methods: write_pending_rotation, read_pending_rotation,
  update_rotation_phase, migrate_node_psk, migrate_phone_psk,
  rewrap_identity_seed, commit_rotation, swap_master_key,
  list_node_escrow_state, is_rotation_in_progress

Integration tests: tests/rotation.rs
- T-2003: Rotation code authentication
- T-2004: Happy path (3 nodes + 1 phone PSK, full rotation cycle)
- T-2004a: Validation failures (wrong epoch, wrong code, corrupted, replay)
- T-2004b: Concurrent rotation discard
- T-2005: Crash-safe rotation (partial migration, resume on restart)
- T-2008: gRPC rotation path via spawned engine task
- T-2009: Crash recovery -- all three phases
- T-2010: Pending recovery purge... (continued)

749 of 946 new or added lines in 2 files covered. (79.18%)

38681 of 46882 relevant lines covered (82.51%)

242.82 hits per line