From a5e21de6171831474779063996faddb88a60ddd9 Mon Sep 17 00:00:00 2001
From: znerol2 <6800371+znerol2@users.noreply.github.com>
Date: Tue, 27 Oct 2026 16:10:01 +0100
Subject: [PATCH 1/4] feat: gate configure on setup receipt

Signed-off-by: znerol2 <6800371+znerol2@users.noreply.github.com>
---
 frontend/src/App.tsx                | 14 +++++--
 frontend/src/create/ConnectStep.tsx | 46 ++++++++++++++++++--
 frontend/src/hooks/useCreateFlow.ts | 10 +++--
 src/dmf_init/bootstrap_steps.py     | 49 ++++++++++++++++++----
 src/dmf_init/main.py                | 32 ++++++++++++++
 src/dmf_init/orchestrate.py         | 32 +++++++++++++-
 tests/test_bootstrap_steps.py       | 45 ++++++++++++++++++--
 tests/test_orchestrate.py           | 65 +++++++++++++++++++++++++++++
 tests/test_retry.py                 | 50 +++++++++++++++++++---
 9 files changed, 315 insertions(+), 28 deletions(-)

diff --git a/frontend/src/App.tsx b/frontend/src/App.tsx
index 9baff67..f778c5e 100644
--- a/frontend/src/App.tsx
+++ b/frontend/src/App.tsx
@@ -207,13 +207,20 @@ export default function App() {
 
   const handleResumePause = useCallback(async () => {
     if (!activePause || !createState.runId) return
+    if (activePause.pause_id === 'setup-request') return
     await resumePause(createState.runId, activePause.pause_id)
   }, [activePause, createState.runId, resumePause])
 
+  const handleSetupRequestResume = useCallback(async (requestId: string) => {
+    if (!createState.runId) return
+    await resumePause(createState.runId, 'setup-request', { request_id: requestId })
+  }, [createState.runId, resumePause])
+
   const handleVerifyPasskey = useCallback(async () => {
     if (!createState.runId) return
-    await verifyPasskey(createState.runId)
-  }, [createState.runId, verifyPasskey])
+    if (activePause?.pause_id !== 'passkey' && activePause?.pause_id !== 'initial-passkey') return
+    await verifyPasskey(createState.runId, activePause.pause_id)
+  }, [activePause, createState.runId, verifyPasskey])
 
   // Auto-start bootstrap exactly ONCE per deploy. The ref latch is essential:
   // guarding on !runId alone re-fired the effect after every reducer reset and
@@ -313,6 +320,7 @@ export default function App() {
             passkeyChecking={createFlow.passkeyChecking}
             passkeyStatus={createFlow.passkeyStatus}
             onResume={handleResumePause}
+            onSetupRequestResume={handleSetupRequestResume}
             onVerifyPasskey={handleVerifyPasskey}
             envId={renderedEnvId ?? ''}
             runId={createState.runId ?? ''}
@@ -343,7 +351,7 @@ export default function App() {
   }
 
   // Sidebar sub-items for the active rail phase.
-  const PAUSE_IDS = ['workstation', 'passkey']
+  const PAUSE_IDS = ['workstation', 'passkey', 'initial-passkey', 'setup-request']
   const wizardPages = ['Identity', 'Target node', 'Security', 'Review & Deploy']
   const subItems: Record<string, RailSubItem[]> = {
     configure: wizardPages.map((label, i) => ({
diff --git a/frontend/src/create/ConnectStep.tsx b/frontend/src/create/ConnectStep.tsx
index 98ef67a..dc925e0 100644
--- a/frontend/src/create/ConnectStep.tsx
+++ b/frontend/src/create/ConnectStep.tsx
@@ -35,6 +35,7 @@ type ConnectStepProps = {
   passkeyChecking: boolean
   passkeyStatus: string | null
   onResume: () => void
+  onSetupRequestResume: (requestId: string) => void
   onVerifyPasskey: () => void
   envId: string
   runId: string
@@ -49,12 +50,14 @@ export function ConnectStep({
   passkeyChecking,
   passkeyStatus,
   onResume,
+  onSetupRequestResume,
   onVerifyPasskey,
   runId,
   pollPasskey,
   bundleSafe,
 }: ConnectStepProps) {
   const [passkeyCount, setPasskeyCount] = useState<{ confirmed: number; required: number } | null>(null)
+  const [setupRequestId, setSetupRequestId] = useState('')
   const stationRef = useRef<HTMLDivElement>(null)
 
   useEffect(() => {
@@ -64,7 +67,8 @@ export function ConnectStep({
   }, [activePause?.pause_id])
 
   useEffect(() => {
-    if (activePause?.pause_id !== 'passkey' || !runId) return
+    if (activePause?.pause_id !== 'passkey' && activePause?.pause_id !== 'initial-passkey') return
+    if (!runId) return
     let cancelled = false
     const interval = setInterval(async () => {
       const result = await pollPasskey(runId)
@@ -76,6 +80,10 @@ export function ConnectStep({
     return () => { cancelled = true; clearInterval(interval) }
   }, [activePause?.pause_id, runId, pollPasskey])
 
+  useEffect(() => {
+    setSetupRequestId('')
+  }, [activePause?.pause_id])
+
   function downloadCaCertificate(payload: CaCertPayload) {
     const blob = new Blob([payload.pem], { type: 'application/x-pem-file' })
     const objectUrl = URL.createObjectURL(blob)
@@ -165,7 +173,7 @@ export function ConnectStep({
           )}
 
           {/* Passkey station */}
-          {activePause.pause_id === 'passkey' && (
+          {(activePause.pause_id === 'passkey' || activePause.pause_id === 'initial-passkey') && (
             <PasskeyStation
               payload={activePause.payload as PasskeyPayload}
               passkeyCount={passkeyCount}
@@ -175,6 +183,27 @@ export function ConnectStep({
             />
           )}
 
+          {activePause.pause_id === 'setup-request' && (
+            <div className="grid gap-3">
+              <p className="text-sm leading-6 text-muted">
+                {(activePause.payload.message as string) ??
+                  'Create the fixed born-inventory setup request in the DMF Console, then paste its request id here.'}
+              </p>
+              <label className="grid gap-1 text-sm">
+                <span>Setup request id</span>
+                <input
+                  autoComplete="off"
+                  spellCheck={false}
+                  maxLength={32}
+                  value={setupRequestId}
+                  onChange={(event) => setSetupRequestId(event.target.value.trim())}
+                  placeholder="32 lowercase hexadecimal characters"
+                  className="rounded-md border border-border bg-bg px-3 py-2 font-mono text-sm"
+                />
+              </label>
+            </div>
+          )}
+
           {/* Export-gate station: block resume until recovery bundle is saved */}
           {activePause.pause_id === 'checkpoint-2-export-gate' && (
             <div className="grid gap-3">
@@ -200,7 +229,7 @@ export function ConnectStep({
 
         {/* Continue button */}
         <div className="mt-4 flex flex-wrap items-center gap-3 border-t border-border pt-3">
-          {activePause.pause_id === 'passkey' ? (
+          {activePause.pause_id === 'passkey' || activePause.pause_id === 'initial-passkey' ? (
             <button
               type="button"
               onClick={onVerifyPasskey}
@@ -209,6 +238,15 @@ export function ConnectStep({
             >
               {passkeyChecking ? 'Checking…' : resumeBusy ? 'Continuing…' : 'Verify & Continue'}
             </button>
+          ) : activePause.pause_id === 'setup-request' ? (
+            <button
+              type="button"
+              onClick={() => onSetupRequestResume(setupRequestId)}
+              disabled={resumeBusy || !/^[0-9a-f]{32}$/.test(setupRequestId)}
+              className="rounded-lg border border-accent/30 bg-accent px-4 py-2 text-sm font-semibold text-bg transition hover:bg-accent/90 disabled:cursor-not-allowed disabled:opacity-60"
+            >
+              {resumeBusy ? 'Validating request…' : 'Continue to configure'}
+            </button>
           ) : (
             <button
               type="button"
@@ -220,7 +258,7 @@ export function ConnectStep({
             </button>
           )}
           <span className="text-xs text-muted">
-            {activePause.pause_id === 'passkey'
+            {activePause.pause_id === 'passkey' || activePause.pause_id === 'initial-passkey'
               ? 'The station stays active until the passkey check confirms the required count.'
               : 'The bootstrap will continue once resumed.'}
           </span>
diff --git a/frontend/src/hooks/useCreateFlow.ts b/frontend/src/hooks/useCreateFlow.ts
index bb06d35..29b0d22 100644
--- a/frontend/src/hooks/useCreateFlow.ts
+++ b/frontend/src/hooks/useCreateFlow.ts
@@ -22,6 +22,8 @@ type BootstrapCheckpoint = {
 export type ActivePause =
   | { pause_id: 'workstation'; title: string; payload: Record<string, unknown> }
   | { pause_id: 'passkey'; title: string; payload: Record<string, unknown> }
+  | { pause_id: 'initial-passkey'; title: string; payload: Record<string, unknown> }
+  | { pause_id: 'setup-request'; title: string; payload: Record<string, unknown> }
   | { pause_id: 'checkpoint-2-export-gate'; title: string; payload: Record<string, unknown> }
 
 type TerminalState =
@@ -300,7 +302,7 @@ export function useCreateFlow() {
 
   // resumePause
   const resumePause = useCallback(
-    async (runId: string, pauseId: string) => {
+    async (runId: string, pauseId: string, pausePayload?: Record<string, unknown>) => {
       setResumeBusy(true)
       setResumeError(null)
       try {
@@ -308,7 +310,7 @@ export function useCreateFlow() {
           method: 'POST',
           credentials: 'same-origin',
           headers: { 'content-type': 'application/json' },
-          body: JSON.stringify({ run_id: runId, pause_id: pauseId, payload: null }),
+          body: JSON.stringify({ run_id: runId, pause_id: pauseId, payload: pausePayload ?? null }),
         })
         if (flagIfUnauthorized(response)) return
         // Only clear the pause locally if the server actually resumed. A 409
@@ -327,7 +329,7 @@ export function useCreateFlow() {
 
   // verifyPasskey
   const verifyPasskey = useCallback(
-    async (runId: string) => {
+    async (runId: string, pauseId: 'passkey' | 'initial-passkey' = 'passkey') => {
       setPasskeyChecking(true)
       setResumeError(null)
       try {
@@ -341,7 +343,7 @@ export function useCreateFlow() {
         const statusText = `${payload.confirmed}/${payload.required}`
         setPasskeyStatus(statusText)
         if (payload.confirmed >= payload.required) {
-          await resumePause(runId, 'passkey')
+          await resumePause(runId, pauseId)
           return
         }
         setResumeError(`Passkey enrollment is not complete yet (${statusText}).`)
diff --git a/src/dmf_init/bootstrap_steps.py b/src/dmf_init/bootstrap_steps.py
index eded3f5..e5d1e55 100644
--- a/src/dmf_init/bootstrap_steps.py
+++ b/src/dmf_init/bootstrap_steps.py
@@ -350,8 +350,20 @@ def _run_passkey_helper(ctx: BootstrapContext) -> subprocess.CompletedProcess[st
     )
 
 
-def _command_step(ctx: BootstrapContext, step_id: str, argv: list[str]) -> CommandStep:
-    return CommandStep(id=step_id, argv=argv, cwd=ctx.repos_root / "dmf-env", env=ctx.command_env())
+def _command_step(
+    ctx: BootstrapContext,
+    step_id: str,
+    argv: list[str],
+    *,
+    setup_request_pause_id: str | None = None,
+) -> CommandStep:
+    return CommandStep(
+        id=step_id,
+        argv=argv,
+        cwd=ctx.repos_root / "dmf-env",
+        env=ctx.command_env(),
+        setup_request_pause_id=setup_request_pause_id,
+    )
 
 
 # Only this profile is auto-unsealable: it uses a 1-of-1 Shamir key held in the
@@ -671,16 +683,27 @@ def build_bootstrap_steps(ctx: BootstrapContext) -> list[Step]:
             "post-seed",
             ctx.run_playbook_argv("bootstrap-sandbox-provision-post-seed.yml"),
         ),
-        _command_step(
-            ctx,
-            "configure",
-            ctx.run_playbook_argv("bootstrap-sandbox-configure.yml"),
-        ),
         PauseStep(
             id="workstation",
             title="Prepare your workstation",
             payload_fn=lambda run, ctx=ctx: build_workstation_payload(ctx),
         ),
+        PauseStep(
+            id="initial-passkey",
+            title="Establish your first passkey",
+            payload_fn=lambda run, ctx=ctx: build_passkey_payload(ctx),
+        ),
+        PauseStep(
+            id="setup-request",
+            title="Authorize setup inventory",
+            payload_fn=lambda run, ctx=ctx: build_setup_request_payload(ctx),
+        ),
+        _command_step(
+            ctx,
+            "configure",
+            ctx.run_playbook_argv("bootstrap-sandbox-configure.yml"),
+            setup_request_pause_id="setup-request",
+        ),
         PauseStep(
             id="passkey",
             title="Complete passkey enrollment",
@@ -695,6 +718,18 @@ def build_bootstrap_steps(ctx: BootstrapContext) -> list[Step]:
     ]
 
 
+def build_setup_request_payload(ctx: BootstrapContext) -> dict[str, Any]:
+    return {
+        "action": "born-inventory-secretid-issue",
+        "message": (
+            "In the DMF Console, create a born-inventory setup request with a "
+            "non-secret reason. Paste its request id below. The request expires "
+            "after 15 minutes and is consumed once; after a failed configure or "
+            "interruption, create a fresh request."
+        ),
+    }
+
+
 class CheckpointError(RuntimeError):
     pass
 
diff --git a/src/dmf_init/main.py b/src/dmf_init/main.py
index fb51089..715d3b3 100644
--- a/src/dmf_init/main.py
+++ b/src/dmf_init/main.py
@@ -46,6 +46,8 @@
     build_ca_cert_payload,
     build_hosts_map_payload,
     build_passkey_payload,
+    build_setup_request_payload,
+    build_workstation_payload,
     ensure_runtime_repos,
     make_checkpoint_fn,
     seed_openbao_redactions,
@@ -76,6 +78,7 @@
 from .orchestrate import (
     BootstrapRun,
     CheckpointStep,
+    PauseStep,
     SubprocessExecutor,
     run_worker,
     stream_events,
@@ -916,6 +919,35 @@ def _clear_active() -> None:
                     detail=f"failed step '{failed_step_id}' not in build",
                 ) from None
             steps = all_steps[idx:]
+            # A configure retry starts after its original first-passkey and
+            # one-use receipt gates. Recreate only those gates, then rerun the
+            # failed configure command; do not replay post-seed provisioning.
+            configure_index = next(
+                (i for i, step in enumerate(steps) if getattr(step, "id", None) == "configure"),
+                None,
+            )
+            if configure_index is not None and not any(
+                isinstance(step, PauseStep)
+                and step.id == "setup-request"
+                for step in steps[:configure_index]
+            ):
+                steps[configure_index:configure_index] = [
+                    PauseStep(
+                        id="workstation",
+                        title="Prepare your workstation",
+                        payload_fn=lambda run, ctx=ctx: build_workstation_payload(ctx),
+                    ),
+                    PauseStep(
+                        id="initial-passkey",
+                        title="Establish your first passkey",
+                        payload_fn=lambda run, ctx=ctx: build_passkey_payload(ctx),
+                    ),
+                    PauseStep(
+                        id="setup-request",
+                        title="Authorize setup inventory",
+                        payload_fn=lambda run, ctx=ctx: build_setup_request_payload(ctx),
+                    ),
+                ]
 
             # ADR-0044 forced export gate also applies to retry/resume-from-cursor:
             # if we'd resume *past* the gate (the gate step isn't in this slice),
diff --git a/src/dmf_init/orchestrate.py b/src/dmf_init/orchestrate.py
index 62c4552..85a62c6 100644
--- a/src/dmf_init/orchestrate.py
+++ b/src/dmf_init/orchestrate.py
@@ -2,16 +2,20 @@
 
 import json
 import os
+import re
 import subprocess
 import threading
 import time
 from collections.abc import Callable, Iterable, Iterator
-from dataclasses import dataclass, field
+from dataclasses import dataclass, field, replace
 from pathlib import Path
 from typing import Any, Protocol
 
 from .redaction import redact_text
 
+SETUP_REQUEST_PAUSE_ID = "setup-request"
+SETUP_REQUEST_ID_RE = re.compile(r"^[0-9a-f]{32}$")
+
 
 @dataclass(frozen=True)
 class CommandStep:
@@ -19,6 +23,8 @@ class CommandStep:
     argv: list[str]
     cwd: Path | None = None
     env: dict[str, str] | None = None
+    setup_request_pause_id: str | None = None
+    setup_request_pause_id: str | None = None
 
 
 @dataclass(frozen=True)
@@ -44,6 +50,9 @@ def run(self, step: CommandStep) -> Iterator[tuple[str, int | None]]: ...
 class SubprocessExecutor:
     def run(self, step: CommandStep) -> Iterator[tuple[str, int | None]]:
         env = os.environ.copy()
+        # Never inherit a caller-supplied receipt id. Only the in-memory
+        # pause payload may add this value to the gated configure step.
+        env.pop("DMF_SETUP_REQUEST_ID", None)
         if step.env:
             env.update(step.env)
         proc = subprocess.Popen(
@@ -147,6 +156,14 @@ def resume(self, pause_id: str, payload: dict[str, Any] | None = None) -> None:
             pause_event = self.pauses[pause_id]
             if pause_event.is_set():
                 raise ValueError(f"pause already resumed: {pause_id}")
+            if pause_id == SETUP_REQUEST_PAUSE_ID:
+                if (
+                    not isinstance(payload, dict)
+                    or set(payload) != {"request_id"}
+                    or not isinstance(payload.get("request_id"), str)
+                    or not SETUP_REQUEST_ID_RE.fullmatch(payload["request_id"])
+                ):
+                    raise ValueError("a valid setup request id is required")
             self.pause_payloads[pause_id] = payload or {}
             pause_event.set()
             self.cond.notify_all()
@@ -177,8 +194,19 @@ def run_worker(run: BootstrapRun) -> None:
                 }
             )
             if isinstance(step, CommandStep):
+                command_step = step
+                if step.setup_request_pause_id:
+                    payload = run.pause_payloads.pop(step.setup_request_pause_id, None)
+                    request_id = payload.get("request_id") if payload else None
+                    if not isinstance(request_id, str) or not SETUP_REQUEST_ID_RE.fullmatch(
+                        request_id
+                    ):
+                        raise ValueError("a fresh setup request id is required before configure")
+                    command_env = dict(step.env or {})
+                    command_env["DMF_SETUP_REQUEST_ID"] = request_id
+                    command_step = replace(step, env=command_env)
                 log_tail: list[str] = []
-                for line, code in run.executor.run(step):
+                for line, code in run.executor.run(command_step):
                     if code is None:
                         if line:
                             run.emit({"event": "log", "step": step.id, "line": line})
diff --git a/tests/test_bootstrap_steps.py b/tests/test_bootstrap_steps.py
index cbf6760..fc9d41d 100644
--- a/tests/test_bootstrap_steps.py
+++ b/tests/test_bootstrap_steps.py
@@ -38,8 +38,10 @@
 class FakeExecutor:
     scripts: dict[str, tuple[list[str], int]]
     gates: dict[str, threading.Event] = field(default_factory=dict)
+    seen_steps: list[CommandStep] = field(default_factory=list)
 
     def run(self, step: CommandStep):
+        self.seen_steps.append(step)
         lines, exit_code = self.scripts[step.id]
         for line in lines:
             yield line, None
@@ -362,8 +364,10 @@ def fake_run_passkey_helper(_ctx: BootstrapContext) -> subprocess.CompletedProce
         "unseal",
         "seed-bao",
         "post-seed",
-        "configure",
         "workstation",
+        "initial-passkey",
+        "setup-request",
+        "configure",
         "passkey",
         "verify",
         "checkpoint-3",
@@ -465,7 +469,10 @@ def checkpoint_fn(run: BootstrapRun, n: int) -> dict[str, Any]:
     _wait_for(
         lambda: any(ev["event"] == "pause" and ev["pause_id"] == "workstation" for ev in run.events)
     )
-    assert not any(ev["event"] == "pause" and ev["pause_id"] == "passkey" for ev in run.events)
+    assert not any(
+        ev["event"] == "pause" and ev["pause_id"] == "initial-passkey"
+        for ev in run.events
+    )
     log_lines = [event["line"] for event in run.events if event["event"] == "log"]
     assert log_lines
     assert all("UNSEAL-SENTINEL" not in line for line in log_lines)
@@ -473,6 +480,32 @@ def checkpoint_fn(run: BootstrapRun, n: int) -> dict[str, Any]:
     assert any("[REDACTED]" in line for line in log_lines)
 
     run.resume("workstation")
+    _wait_for(
+        lambda: any(
+            ev["event"] == "pause" and ev["pause_id"] == "initial-passkey"
+            for ev in run.events
+        )
+    )
+    run.resume("initial-passkey")
+    _wait_for(
+        lambda: any(
+            ev["event"] == "pause" and ev["pause_id"] == "setup-request"
+            for ev in run.events
+        )
+    )
+    run.resume("setup-request", {"request_id": "c" * 32})
+    _wait_for(
+        lambda: any(
+            ev["event"] == "step_complete"
+            and ev["step"] == "configure"
+            and ev["status"] == "ok"
+            for ev in run.events
+        )
+    )
+    configure = next(step for step in executor.seen_steps if step.id == "configure")
+    assert configure.env is not None
+    assert configure.env["DMF_SETUP_REQUEST_ID"] == "c" * 32
+    assert all("c" * 32 not in json.dumps(event) for event in run.events)
     _wait_for(
         lambda: any(ev["event"] == "pause" and ev["pause_id"] == "passkey" for ev in run.events)
     )
@@ -482,7 +515,13 @@ def checkpoint_fn(run: BootstrapRun, n: int) -> dict[str, Any]:
     assert not worker.is_alive()
     assert checkpoint_calls == [2, 3]
     pause_ids = [event["pause_id"] for event in run.events if event["event"] == "pause"]
-    assert pause_ids == ["checkpoint-2-export-gate", "workstation", "passkey"]
+    assert pause_ids == [
+        "checkpoint-2-export-gate",
+        "workstation",
+        "initial-passkey",
+        "setup-request",
+        "passkey",
+    ]
     assert run.events[-1]["event"] == "complete"
     assert run.events[-1]["checkpoints"] == [2, 3]
 
diff --git a/tests/test_orchestrate.py b/tests/test_orchestrate.py
index df6a69f..0482a56 100644
--- a/tests/test_orchestrate.py
+++ b/tests/test_orchestrate.py
@@ -6,12 +6,15 @@
 from dataclasses import dataclass, field
 from typing import Any
 
+import pytest
+
 from dmf_init.orchestrate import (
     BootstrapRun,
     CheckpointStep,
     CommandStep,
     PauseStep,
     Step,
+    SubprocessExecutor,
     run_worker,
     stream_events,
 )
@@ -213,6 +216,68 @@ def test_resume_before_pause_still_completes() -> None:
     assert events[-1]["event"] == "complete"
 
 
+def test_setup_request_is_ephemeral_and_only_added_to_configure_environment() -> None:
+    class CapturingExecutor:
+        def __init__(self):
+            self.steps = []
+
+        def run(self, step):
+            self.steps.append(step)
+            yield "configured", None
+            yield "", 0
+
+    executor = CapturingExecutor()
+    steps: list[Step] = [
+        PauseStep(id="setup-request", title="Authorize setup inventory"),
+        CommandStep(
+            id="configure",
+            argv=["run-playbook.sh", "configure"],
+            env={"KEEP": "value"},
+            setup_request_pause_id="setup-request",
+        ),
+        CommandStep(id="verify", argv=["run-playbook.sh", "verify"]),
+    ]
+    run = BootstrapRun(run_id="run-c5", steps=steps, executor=executor)
+    worker = threading.Thread(target=run_worker, args=(run,))
+    worker.start()
+    _wait_for(lambda: any(event.get("pause_id") == "setup-request" for event in run.events))
+    run.resume("setup-request", {"request_id": "a" * 32})
+    worker.join(timeout=2)
+    assert not worker.is_alive()
+    assert executor.steps[0].id == "configure"
+    assert executor.steps[0].env == {"KEEP": "value", "DMF_SETUP_REQUEST_ID": "a" * 32}
+    assert executor.steps[1].env is None
+    assert run.pause_payloads == {}
+    assert all("a" * 32 not in json.dumps(event) for event in run.events)
+
+
+def test_setup_request_rejects_wrong_payload_shape_without_exposing_value() -> None:
+    run = BootstrapRun(
+        run_id="run-c5-invalid",
+        steps=[PauseStep(id="setup-request", title="Authorize setup inventory")],
+    )
+    with pytest.raises(ValueError):
+        run.resume("setup-request", {"request_id": "a" * 32, "reason": "forged"})
+
+
+def test_subprocess_executor_strips_untrusted_inherited_setup_request(monkeypatch) -> None:
+    captured = {}
+
+    class FakeProcess:
+        stdout = iter(["ready\n"])
+
+        def __init__(self, _argv, **kwargs):
+            captured.update(kwargs)
+
+        def wait(self):
+            return 0
+
+    monkeypatch.setenv("DMF_SETUP_REQUEST_ID", "b" * 32)
+    monkeypatch.setattr("dmf_init.orchestrate.subprocess.Popen", FakeProcess)
+    list(SubprocessExecutor().run(CommandStep(id="ordinary", argv=["true"])))
+    assert "DMF_SETUP_REQUEST_ID" not in captured["env"]
+
+
 def test_command_failure_sets_failed_step_id_and_hint() -> None:
     steps: list[Step] = [
         CommandStep(id="pre-seed", argv=["ignored"]),
diff --git a/tests/test_retry.py b/tests/test_retry.py
index e0297b0..1166419 100644
--- a/tests/test_retry.py
+++ b/tests/test_retry.py
@@ -23,8 +23,8 @@ def _real_build_steps() -> list[Step]:
     """Subset of build_bootstrap_steps matching the real graph order.
 
     Real order: pre-seed, checkpoint-2, checkpoint-2-export-gate, unseal,
-    seed-bao, post-seed, configure, workstation (pause), passkey (pause),
-    verify, checkpoint-3.
+    seed-bao, post-seed, workstation, initial-passkey, setup-request,
+    configure, post-configure passkey, verify, checkpoint-3.
     """
     return [
         CommandStep(id="pre-seed", argv=["ignored"]),
@@ -33,8 +33,10 @@ def _real_build_steps() -> list[Step]:
         CommandStep(id="unseal", argv=["ignored"]),
         CommandStep(id="seed-bao", argv=["ignored"]),
         CommandStep(id="post-seed", argv=["ignored"]),
-        CommandStep(id="configure", argv=["ignored"]),
         PauseStep(id="workstation", title="Prepare your workstation"),
+        PauseStep(id="initial-passkey", title="Establish your first passkey"),
+        PauseStep(id="setup-request", title="Authorize setup inventory"),
+        CommandStep(id="configure", argv=["ignored"], setup_request_pause_id="setup-request"),
         PauseStep(id="passkey", title="Complete passkey enrollment"),
         CommandStep(id="verify", argv=["ignored"]),
         CheckpointStep(id="checkpoint-3", n=3),
@@ -228,19 +230,57 @@ def test_retry_passes_passphrase_and_slices_from_failed_step(
     assert step_ids == [
         "bao-preflight",
         "post-seed",
-        "configure",
         "workstation",
+        "initial-passkey",
+        "setup-request",
+        "configure",
         "passkey",
         "verify",
         "checkpoint-3",
     ]
     assert retry_run.env_id == env_id
     assert retry_run.passphrase == "correct horse battery staple"
-
     with app.state.bootstrap_lock:
         assert new_run_id in app.state.bootstrap_runs
 
 
+def test_configure_retry_recreates_only_trust_passkey_and_fresh_request_gates(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    data_root = tmp_path / "data"
+    env_id = "sandbox-alpha"
+    env_dir, _ = _make_env_on_disk(data_root, env_id)
+    (env_dir / "openbao-keys.json").write_text("{}", encoding="utf-8")
+
+    app = create_app(Settings(data_root=data_root, tls_enabled=False))
+    client = TestClient(app)
+    _authenticate(client, app)
+    monkeypatch.setattr("dmf_init.main.build_bootstrap_steps", lambda ctx: _real_build_steps())
+    monkeypatch.setattr("dmf_init.main.make_checkpoint_fn", lambda ctx: lambda run, n: {})
+    spawned_runs: list[BootstrapRun] = []
+    monkeypatch.setattr("dmf_init.main.run_worker", lambda run: spawned_runs.append(run))
+
+    run_id = _make_failed_run(app, env_id=env_id, failed_step_id="configure")
+    _seed_current_download(app, env_id)
+    response = client.post(
+        "/api/bootstrap/retry",
+        json={"run_id": run_id, "passphrase": "correct horse battery staple"},
+    )
+
+    assert response.status_code == 200
+    retry_steps = [step.id for step in spawned_runs[0].steps]
+    assert retry_steps == [
+        "bao-preflight",
+        "workstation",
+        "initial-passkey",
+        "setup-request",
+        "configure",
+        "passkey",
+        "verify",
+        "checkpoint-3",
+    ]
+
+
 def test_retry_seeds_openbao_redactions(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None:

From d7b00ac8c78bcdd12bc6a34efda2b416f3ac507d Mon Sep 17 00:00:00 2001
From: znerol2 <6800371+znerol2@users.noreply.github.com>
Date: Tue, 27 Oct 2026 16:19:31 +0100
Subject: [PATCH 2/4] fix: remove duplicate setup pause annotation

Signed-off-by: znerol2 <6800371+znerol2@users.noreply.github.com>
---
 src/dmf_init/orchestrate.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/src/dmf_init/orchestrate.py b/src/dmf_init/orchestrate.py
index 85a62c6..4a5a263 100644
--- a/src/dmf_init/orchestrate.py
+++ b/src/dmf_init/orchestrate.py
@@ -24,7 +24,6 @@ class CommandStep:
     cwd: Path | None = None
     env: dict[str, str] | None = None
     setup_request_pause_id: str | None = None
-    setup_request_pause_id: str | None = None
 
 
 @dataclass(frozen=True)

From ad4abe03d91b6f8e453a3cf6012bb879afb20933 Mon Sep 17 00:00:00 2001
From: znerol2 <6800371+znerol2@users.noreply.github.com>
Date: Tue, 27 Oct 2026 16:22:37 +0100
Subject: [PATCH 3/4] test: cover setup receipt gate on disk resume

Signed-off-by: znerol2 <6800371+znerol2@users.noreply.github.com>
---
 tests/test_resume.py | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/tests/test_resume.py b/tests/test_resume.py
index deb55f4..3b7ed52 100644
--- a/tests/test_resume.py
+++ b/tests/test_resume.py
@@ -39,8 +39,12 @@ def _real_build_steps() -> list[Step]:
         CommandStep(id="unseal", argv=["ignored"]),
         CommandStep(id="seed-bao", argv=["ignored"]),
         CommandStep(id="post-seed", argv=["ignored"]),
-        CommandStep(id="configure", argv=["ignored"]),
         PauseStep(id="workstation", title="Prepare your workstation"),
+        PauseStep(id="initial-passkey", title="Establish your first passkey"),
+        PauseStep(id="setup-request", title="Authorize setup inventory"),
+        CommandStep(
+            id="configure", argv=["ignored"], setup_request_pause_id="setup-request"
+        ),
         PauseStep(id="passkey", title="Complete passkey enrollment"),
         CommandStep(id="verify", argv=["ignored"]),
         CheckpointStep(id="checkpoint-3", n=3),
@@ -211,13 +215,19 @@ def test_retry_disk_resume_after_gc(
     assert [s.id for s in spawned[0].steps] == [
         "bao-preflight",
         "post-seed",
-        "configure",
         "workstation",
+        "initial-passkey",
+        "setup-request",
+        "configure",
         "passkey",
         "verify",
         "checkpoint-3",
     ]
     assert spawned[0].env_id == env_id
+    configure = next(step for step in spawned[0].steps if step.id == "configure")
+    assert configure.setup_request_pause_id == "setup-request"
+    assert "DMF_SETUP_REQUEST_ID" not in (configure.env or {})
+    assert all("DMF_SETUP_REQUEST_ID" not in arg for arg in configure.argv)
 
 
 def test_retry_stale_run_id_with_env_id_falls_back_to_disk(

From a14d8a59274139a4992cfd2d3704928401e5497e Mon Sep 17 00:00:00 2001
From: znerol2 <6800371+znerol2@users.noreply.github.com>
Date: Fri, 30 Oct 2026 09:26:20 +0100
Subject: [PATCH 4/4] fix(bootstrap): redact the setup request id and check the
 first passkey on the server

Register the setup request id for redaction before configure runs, so output that echoes it stays out of events and error hints.

Check the live passkey count in the resume route for initial-passkey, and resume initial-passkey and setup-request only while the worker waits on them. A direct call can no longer run configure early or without the first passkey.

Claude-Session: https://claude.ai/code/session_01Rq1iSvhmEwbNUF43rtXVY4
Signed-off-by: znerol2 <6800371+znerol2@users.noreply.github.com>
---
 src/dmf_init/bootstrap_steps.py |   6 +-
 src/dmf_init/main.py            |  34 ++++-
 src/dmf_init/orchestrate.py     |  15 +++
 tests/test_orchestrate.py       |  43 ++++++
 tests/test_resume_gates.py      | 229 ++++++++++++++++++++++++++++++++
 5 files changed, 325 insertions(+), 2 deletions(-)
 create mode 100644 tests/test_resume_gates.py

diff --git a/src/dmf_init/bootstrap_steps.py b/src/dmf_init/bootstrap_steps.py
index e5d1e55..548ef9c 100644
--- a/src/dmf_init/bootstrap_steps.py
+++ b/src/dmf_init/bootstrap_steps.py
@@ -630,6 +630,10 @@ def build_passkey_payload(ctx: BootstrapContext) -> dict[str, Any]:
 # on a *proven, current* download (enforced server-side in /api/bootstrap/resume).
 CHECKPOINT_EXPORT_GATE_ID = "checkpoint-2-export-gate"
 
+# The first passkey must exist before configure runs. The resume route checks
+# the live passkey count itself rather than trusting the browser.
+INITIAL_PASSKEY_GATE_ID = "initial-passkey"
+
 
 def build_checkpoint_export_gate_payload(ctx: BootstrapContext) -> dict[str, Any]:
     return {
@@ -689,7 +693,7 @@ def build_bootstrap_steps(ctx: BootstrapContext) -> list[Step]:
             payload_fn=lambda run, ctx=ctx: build_workstation_payload(ctx),
         ),
         PauseStep(
-            id="initial-passkey",
+            id=INITIAL_PASSKEY_GATE_ID,
             title="Establish your first passkey",
             payload_fn=lambda run, ctx=ctx: build_passkey_payload(ctx),
         ),
diff --git a/src/dmf_init/main.py b/src/dmf_init/main.py
index 715d3b3..d1e443c 100644
--- a/src/dmf_init/main.py
+++ b/src/dmf_init/main.py
@@ -40,6 +40,7 @@
 from .bootstrap_steps import (
     BAO_PREFLIGHT_ID,
     CHECKPOINT_EXPORT_GATE_ID,
+    INITIAL_PASSKEY_GATE_ID,
     BootstrapContext,
     build_bao_preflight_step,
     build_bootstrap_steps,
@@ -76,6 +77,7 @@
     build_action_run,
 )
 from .orchestrate import (
+    SETUP_REQUEST_PAUSE_ID,
     BootstrapRun,
     CheckpointStep,
     PauseStep,
@@ -532,6 +534,10 @@ def _manage_action_wrapper(
             session.wipe_secrets()
 
 
+# Pauses that resume only while the worker waits on them.
+SERVER_GATED_PAUSE_IDS = frozenset({INITIAL_PASSKEY_GATE_ID, SETUP_REQUEST_PAUSE_ID})
+
+
 def create_app(settings: Settings | None = None) -> FastAPI:
     settings = settings or load_settings()
     settings.data_root.mkdir(parents=True, exist_ok=True)
@@ -938,7 +944,7 @@ def _clear_active() -> None:
                         payload_fn=lambda run, ctx=ctx: build_workstation_payload(ctx),
                     ),
                     PauseStep(
-                        id="initial-passkey",
+                        id=INITIAL_PASSKEY_GATE_ID,
                         title="Establish your first passkey",
                         payload_fn=lambda run, ctx=ctx: build_passkey_payload(ctx),
                     ),
@@ -1111,6 +1117,32 @@ async def bootstrap_resume(payload: BootstrapResumeRequest) -> JSONResponse:
                     "lost during the long unattended phases)"
                 ),
             )
+        # The first passkey and the setup request are checked here, not only in
+        # the browser: a direct call must not run configure early or without the
+        # first passkey. Both pauses resume only while the worker waits on them.
+        if payload.pause_id in SERVER_GATED_PAUSE_IDS:
+            if payload.pause_id in run.pauses and not run.is_waiting_on(payload.pause_id):
+                raise HTTPException(
+                    status_code=status.HTTP_409_CONFLICT,
+                    detail=f"the run is not waiting on '{payload.pause_id}' yet",
+                )
+        if payload.pause_id == INITIAL_PASSKEY_GATE_ID:
+            if not run.env_id:
+                raise HTTPException(
+                    status_code=status.HTTP_409_CONFLICT, detail="run env_id unavailable"
+                )
+            ctx = BootstrapContext.from_data_root(settings.data_root, run.env_id, run.remotes)
+            status_payload = build_passkey_payload(ctx)
+            confirmed = int(status_payload.get("confirmed", 0) or 0)
+            required = int(status_payload.get("required", 0) or 0)
+            if status_payload.get("note") or required <= 0 or confirmed < required:
+                raise HTTPException(
+                    status_code=status.HTTP_409_CONFLICT,
+                    detail=(
+                        "your first passkey is not confirmed yet — enroll it, "
+                        "then continue"
+                    ),
+                )
         try:
             run.resume(payload.pause_id, payload.payload)
         except (KeyError, ValueError) as exc:
diff --git a/src/dmf_init/orchestrate.py b/src/dmf_init/orchestrate.py
index 4a5a263..b0a91ad 100644
--- a/src/dmf_init/orchestrate.py
+++ b/src/dmf_init/orchestrate.py
@@ -91,6 +91,10 @@ class BootstrapRun:
     secrets: set[str] = field(default_factory=set)
     pauses: dict[str, threading.Event] = field(init=False)
     pause_payloads: dict[str, dict[str, Any]] = field(default_factory=dict)
+    # The pause the worker is blocked on right now, set before the pause event
+    # is emitted. Lets the server refuse to resume a pause the run has not
+    # reached yet.
+    waiting_pause: str | None = None
     terminal: bool = False
     final_status: str | None = None
     passphrase: str | None = None
@@ -148,6 +152,10 @@ def wipe_secrets(self) -> None:
             self.passphrase = None
             self.secrets.clear()
 
+    def is_waiting_on(self, pause_id: str) -> bool:
+        with self.cond:
+            return self.waiting_pause == pause_id and not self.pauses[pause_id].is_set()
+
     def resume(self, pause_id: str, payload: dict[str, Any] | None = None) -> None:
         with self.cond:
             if pause_id not in self.pauses:
@@ -201,6 +209,9 @@ def run_worker(run: BootstrapRun) -> None:
                         request_id
                     ):
                         raise ValueError("a fresh setup request id is required before configure")
+                    # The task can echo its environment, and configure output is
+                    # streamed and kept in error hints, so redact the id first.
+                    run.add_secret(request_id)
                     command_env = dict(step.env or {})
                     command_env["DMF_SETUP_REQUEST_ID"] = request_id
                     command_step = replace(step, env=command_env)
@@ -235,6 +246,8 @@ def run_worker(run: BootstrapRun) -> None:
                 run.emit({"event": "step_complete", "step": step.id, "status": "ok"})
             else:
                 payload = step.payload_fn(run) if step.payload_fn else {}
+                with run.cond:
+                    run.waiting_pause = step.id
                 run.emit(
                     {
                         "event": "pause",
@@ -244,6 +257,8 @@ def run_worker(run: BootstrapRun) -> None:
                     }
                 )
                 run.pauses[step.id].wait()
+                with run.cond:
+                    run.waiting_pause = None
                 run.emit({"event": "resume", "pause_id": step.id})
                 run.emit({"event": "step_complete", "step": step.id, "status": "ok"})
         checkpoints = [step.n for step in run.steps if isinstance(step, CheckpointStep)]
diff --git a/tests/test_orchestrate.py b/tests/test_orchestrate.py
index 0482a56..8c77a9e 100644
--- a/tests/test_orchestrate.py
+++ b/tests/test_orchestrate.py
@@ -328,3 +328,46 @@ def test_hint_empty_when_no_log_lines_before_failure() -> None:
     events = _decode_stream(run)
     error_event = next(ev for ev in events if ev["event"] == "error")
     assert error_event["hint"] == ""
+
+
+def _setup_request_run(executor: Any) -> BootstrapRun:
+    steps: list[Step] = [
+        PauseStep(id="setup-request", title="Authorize setup inventory"),
+        CommandStep(
+            id="configure",
+            argv=["run-playbook.sh", "configure"],
+            setup_request_pause_id="setup-request",
+        ),
+    ]
+    return BootstrapRun(run_id="run-redact", steps=steps, executor=executor)
+
+
+@pytest.mark.parametrize("exit_code", [0, 1])
+def test_setup_request_id_is_redacted_from_configure_output(exit_code: int) -> None:
+    """A task that echoes the one-use request id must not leak it into events,
+    whether configure succeeds or fails (failure output is kept in the hint)."""
+    request_id = "b" * 32
+
+    class EchoingExecutor:
+        def run(self, step):
+            echoed = step.env["DMF_SETUP_REQUEST_ID"]
+            yield f"request id is {echoed}", None
+            yield f"stderr: bad id {echoed}", None
+            yield "", exit_code
+
+    run = _setup_request_run(EchoingExecutor())
+    worker = threading.Thread(target=run_worker, args=(run,))
+    worker.start()
+    _wait_for(lambda: any(event.get("pause_id") == "setup-request" for event in run.events))
+    run.resume("setup-request", {"request_id": request_id})
+    worker.join(timeout=2)
+    assert not worker.is_alive()
+
+    assert run.terminal
+    assert any(event["event"] == "log" for event in run.events)
+    assert all(request_id not in json.dumps(event) for event in run.events)
+    if exit_code:
+        error = run.events[-1]
+        assert error["event"] == "error"
+        assert error["hint"]
+        assert request_id not in error["hint"]
diff --git a/tests/test_resume_gates.py b/tests/test_resume_gates.py
new file mode 100644
index 0000000..78f4002
--- /dev/null
+++ b/tests/test_resume_gates.py
@@ -0,0 +1,229 @@
+"""Server-side enforcement for the first-passkey and setup-request pauses.
+
+The browser polls the passkey status before it resumes, but the server must not
+rely on that: an authenticated caller can post to /api/bootstrap/resume directly.
+"""
+
+from __future__ import annotations
+
+import json
+import threading
+import time
+from pathlib import Path
+from typing import Any
+
+import pytest
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+
+from dmf_init.main import create_app
+from dmf_init.orchestrate import (
+    BootstrapRun,
+    CommandStep,
+    PauseStep,
+    Step,
+    run_worker,
+)
+from dmf_init.settings import Settings
+
+ENV = "sandbox-alpha"
+REQUEST_ID = "c" * 32
+
+
+class OkExecutor:
+    def run(self, step: CommandStep):
+        yield "", 0
+
+
+def _make_env_on_disk(data_root: Path) -> Path:
+    env_dir = data_root / "envs" / ENV
+    render_dir = data_root / "runs" / ENV
+    env_dir.mkdir(parents=True, exist_ok=True)
+    (render_dir / "age").mkdir(parents=True, exist_ok=True)
+    (render_dir / "age" / "keys.txt").write_text("AGE-SECRET-KEY-1TEST\n", encoding="utf-8")
+    (render_dir / "answers.yaml").write_text("operator: test\n", encoding="utf-8")
+    (render_dir / "render.json").write_text(
+        json.dumps(
+            {
+                "env_id": ENV,
+                "profile": "sandbox-single-node",
+                "schema_version": 1,
+                "render_dir": str(render_dir),
+                "age_key_path": str(render_dir / "age" / "keys.txt"),
+                "answers_file_path": str(render_dir / "answers.yaml"),
+            }
+        ),
+        encoding="utf-8",
+    )
+    return env_dir
+
+
+def _client(tmp_path: Path) -> tuple[TestClient, FastAPI]:
+    app = create_app(Settings(data_root=tmp_path / "data", tls_enabled=False))
+    _make_env_on_disk(app.state.settings.data_root)
+    client = TestClient(app)
+    token = app.state.launch_token_state.token
+    assert client.get(f"/?token={token}", follow_redirects=False).status_code in {302, 307}
+    return client, app
+
+
+def _passkey_status(monkeypatch: pytest.MonkeyPatch, **payload: Any) -> list[int]:
+    calls: list[int] = []
+
+    def fake(ctx):
+        calls.append(1)
+        return {"enrollment_url": "", "confirmed": 0, "required": 0, **payload}
+
+    monkeypatch.setattr("dmf_init.main.build_passkey_payload", fake)
+    return calls
+
+
+def _gate_steps() -> list[Step]:
+    return [
+        PauseStep(id="initial-passkey", title="Establish your first passkey"),
+        PauseStep(id="setup-request", title="Authorize setup inventory"),
+        CommandStep(id="configure", argv=["x"], setup_request_pause_id="setup-request"),
+    ]
+
+
+def _start(app: FastAPI, steps: list[Step], *, spawn: bool) -> BootstrapRun:
+    run = BootstrapRun(run_id="r1", steps=steps, env_id=ENV, executor=OkExecutor())
+    app.state.bootstrap_runs["r1"] = run
+    if spawn:
+        threading.Thread(target=run_worker, args=(run,), daemon=True).start()
+        _wait_for(lambda: any(e.get("pause_id") == steps[0].id for e in run.events))
+    return run
+
+
+def _wait_for(predicate, timeout: float = 2.0) -> None:
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        if predicate():
+            return
+        time.sleep(0.01)
+    raise AssertionError("timed out waiting for condition")
+
+
+def _resume(client: TestClient, pause_id: str, payload: dict | None = None):
+    body: dict[str, Any] = {"run_id": "r1", "pause_id": pause_id}
+    if payload is not None:
+        body["payload"] = payload
+    return client.post("/api/bootstrap/resume", json=body)
+
+
+@pytest.mark.parametrize(
+    "status",
+    [
+        {"confirmed": 0, "required": 2},
+        {"confirmed": 1, "required": 2},
+        {"confirmed": 0, "required": 0},
+        {"confirmed": 3, "required": 0},
+        {"confirmed": 2, "required": 2, "note": "could not fetch live passkey status"},
+    ],
+)
+def test_initial_passkey_refused_until_required_passkeys_confirmed(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, status: dict[str, Any]
+) -> None:
+    client, app = _client(tmp_path)
+    _passkey_status(monkeypatch, **status)
+    run = _start(app, _gate_steps(), spawn=True)
+
+    resp = _resume(client, "initial-passkey")
+
+    assert resp.status_code == 409
+    assert not run.pauses["initial-passkey"].is_set()
+
+
+def test_initial_passkey_resumes_when_confirmed_meets_required(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    client, app = _client(tmp_path)
+    _passkey_status(monkeypatch, confirmed=2, required=2)
+    run = _start(app, _gate_steps(), spawn=True)
+
+    assert _resume(client, "initial-passkey").status_code == 200
+    assert run.pauses["initial-passkey"].is_set()
+
+
+def test_initial_passkey_refused_before_the_worker_reaches_it(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    client, app = _client(tmp_path)
+    _passkey_status(monkeypatch, confirmed=2, required=2)
+    steps: list[Step] = [
+        PauseStep(id="workstation", title="Prepare your workstation"),
+        *_gate_steps(),
+    ]
+    run = _start(app, steps, spawn=True)  # worker waits on workstation
+
+    resp = _resume(client, "initial-passkey")
+
+    assert resp.status_code == 409
+    assert not run.pauses["initial-passkey"].is_set()
+
+
+def test_setup_request_refused_before_the_worker_reaches_it(tmp_path: Path) -> None:
+    client, app = _client(tmp_path)
+    run = _start(app, _gate_steps(), spawn=True)  # worker waits on initial-passkey
+
+    resp = _resume(client, "setup-request", {"request_id": REQUEST_ID})
+
+    assert resp.status_code == 409
+    assert not run.pauses["setup-request"].is_set()
+    assert run.pause_payloads == {}
+
+
+def test_setup_request_resumes_while_active(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    client, app = _client(tmp_path)
+    _passkey_status(monkeypatch, confirmed=1, required=1)
+    run = _start(app, _gate_steps(), spawn=True)
+    assert _resume(client, "initial-passkey").status_code == 200
+    _wait_for(lambda: any(e.get("pause_id") == "setup-request" for e in run.events))
+
+    assert _resume(client, "setup-request", {"request_id": REQUEST_ID}).status_code == 200
+
+
+def test_retry_recreated_gates_enforce_the_same_checks(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    client, app = _client(tmp_path)
+    data_root = app.state.settings.data_root
+    (data_root / "envs" / ENV / "openbao-keys.json").write_text("{}", encoding="utf-8")
+    real_steps: list[Step] = [
+        CommandStep(id="post-seed", argv=["x"]),
+        PauseStep(id="workstation", title="Prepare your workstation"),
+        PauseStep(id="initial-passkey", title="Establish your first passkey"),
+        PauseStep(id="setup-request", title="Authorize setup inventory"),
+        CommandStep(id="configure", argv=["x"], setup_request_pause_id="setup-request"),
+    ]
+    # Retry from configure: the original gates are behind the cursor, so the
+    # route recreates them.
+    monkeypatch.setattr("dmf_init.main.build_bootstrap_steps", lambda ctx: list(real_steps))
+    monkeypatch.setattr("dmf_init.main.make_checkpoint_fn", lambda ctx: lambda run, n: {})
+    spawned: list[BootstrapRun] = []
+    monkeypatch.setattr("dmf_init.main.run_worker", lambda run: spawned.append(run))
+    failed = BootstrapRun(run_id="failed", steps=list(real_steps), env_id=ENV)
+    failed.failed_step_id = "configure"
+    failed.emit({"event": "error", "step": "configure", "error": "x", "hint": ""}, terminal=True)
+    app.state.bootstrap_runs["failed"] = failed
+
+    resp = client.post("/api/bootstrap/retry", json={"run_id": "failed"})
+    assert resp.status_code == 200
+    retry = spawned[0]
+    assert [s.id for s in retry.steps][:3] == ["workstation", "initial-passkey", "setup-request"]
+    retry.executor = OkExecutor()
+    app.state.bootstrap_runs["r1"] = retry
+    threading.Thread(target=run_worker, args=(retry,), daemon=True).start()
+    _wait_for(lambda: any(e.get("pause_id") == "workstation" for e in retry.events))
+
+    assert _resume(client, "initial-passkey").status_code == 409  # not active yet
+    assert _resume(client, "workstation").status_code == 200
+    _wait_for(lambda: any(e.get("pause_id") == "initial-passkey" for e in retry.events))
+
+    _passkey_status(monkeypatch, confirmed=0, required=2)
+    assert _resume(client, "initial-passkey").status_code == 409
+    _passkey_status(monkeypatch, confirmed=2, required=2)
+    assert _resume(client, "initial-passkey").status_code == 200
+