feat: burst/blackout mode — authorized offline periods with re-attestation window enforcement

[nielsweistra]

Problem

In classified deployments with irregular communication windows, machines must continue operating autonomously during comms blackouts, but must re-attest within a defined window after connectivity is restored. Currently there is no model for authorized offline operation periods.

Solution — Burst/Blackout Mode

Missions define a blackout_schedule during which machines may operate without attestation. Machines that fail to re-attest within re_attest_window_minutes after blackout ends are automatically quarantined.

Mission Schema Extension

# models/mission.py — extend MissionRow
class MissionRow(Base):
    ...
    blackout_schedule: list[dict] | None   # [{start_utc, end_utc, repeat: "daily"|"once"}]
    max_offline_hours: int = 72            # hard limit regardless of schedule
    re_attest_window_minutes: int = 30     # grace period after blackout ends

Enforcement

# services/blackout_enforcer.py
async def check_machine_blackout_status(machine: MachineRow) -> BlackoutStatus:
    now = utcnow()
    in_blackout = is_within_blackout(now, machine.mission.blackout_schedule)
    if in_blackout:
        return BlackoutStatus.AUTHORIZED_OFFLINE
    
    offline_since = now - machine.last_attested_at
    if offline_since > timedelta(hours=machine.mission.max_offline_hours):
        await quarantine_machine(machine.id, reason="blackout_timeout_exceeded")
        return BlackoutStatus.TIMEOUT_QUARANTINED
    
    in_re_attest_window = is_within_re_attest_window(now, machine.mission.blackout_schedule, 
                                                       machine.mission.re_attest_window_minutes)
    if not in_re_attest_window and machine.last_attested_at < blackout_end:
        await quarantine_machine(machine.id, reason="missed_re_attestation_window")
    ...

Machine-side companion

itl-tpm-register reads blackout_schedule from the delivered MachineConfig and suppresses attestation requests during blackout periods.

MITRE ATT&CK

• T1562 — Impair Defenses (mitigated: unauthorized offline time forces quarantine)

Files

• Extend: models/mission.py — blackout_schedule, max_offline_hours, re_attest_window_minutes
• New: services/blackout_enforcer.py
• Extend: routers/mission.py — accept new fields in POST /missions and PATCH /missions/{id}
• New background task: check blackout compliance every 5 minutes
• Alembic migration: add_blackout_fields_to_mission

Companion issue

• ITL.Talos.HardenedOS: itl-tpm-register blackout schedule enforcement (suppress attestation during authorized offline)

Acceptance Criteria

• Machine within blackout_schedule → attestation requests suppressed at client
• Machine offline beyond max_offline_hours → auto-quarantined
• Machine misses re_attest_window_minutes after blackout ends → auto-quarantined
• blackout_schedule supports daily repeating windows and one-shot windows
• Admin can clear quarantine with explicit override (POST /machines/{id}/unquarantine)
• Test: machine attests within window → ok; machine misses window by 1 minute → quarantined