66. Rollback, clones and clock jumps

This guide describes Lawliet 1.6.3.b (the current release, a beta: earlier releases are beta. The first stable release will be 2.0.0). Screens, commands and procedures may change in later versions; the usage guide is updated with each release. Check the version your server runs under Settings > Platform or with ./lawliet version, and see the Releases page for what changed.

This chapter covers what Lawliet does when the server or an endpoint is restored from an older snapshot, when a virtual machine is cloned, and when a clock jumps. In every case agents keep defending; none of them silently re-enrols or goes blind.

Task	Where	Four-eyes
Recover the fleet after a server rollback	`./lawliet fleet resync --confirm` on the server	-
Re-admit one rolled-back endpoint	The host's pending re-admit entry in the console	Where configured
Handle a cloned host	Approve the new pending agent, or remove the clone	Where configured

66.1 The server was rolled back#

If the server is restored from an older snapshot, it detects this. Each agent carries a proof of the server epoch, signed by the server, and the server verifies it. When an agent shows a newer epoch than the restored server knows, the server raises a loud status: server rolled back - fleet resync required.

While that status stands, agents hold:

They keep running detections and sending telemetry.
They take no new commands and no new policy.
They do not re-enrol.

Procedure: resync the fleet#

Confirm the restore was intended and the server is the one you want to keep.
On the server, run:
```
./lawliet fleet resync --confirm
```
The command reopens the enrolment window for the whole fleet. Each agent re-binds by proving the key it pinned at enrolment. No agent is re-admitted blind.
Watch the hosts leave the hold state. The server rolled back status clears when the fleet has resynced.

To also replace every agent token with a new one (a clean slate), add --rotate. It is opt-in; without it tokens are kept.

./lawliet fleet resync --confirm --rotate

Without --confirm the command changes nothing.

66.2 An endpoint was rolled back#

If one endpoint is restored to an older credential state, it shows pending re-admit in the console. It keeps defending while it waits. It never re-enrols on its own.

Procedure: re-admit a rolled-back endpoint#

Open the host in the console and find its pending re-admit entry.
Check that the rollback was expected (a snapshot revert, a restore from backup).
Choose Approve. Where four-eyes is configured, a second approver must confirm (15. Users, roles and approvals).

An agent can also re-admit through a one-time pickup that is pinned to the agent's key, without the console step.

66.3 A cloned host#

A virtual machine copied from a golden image or template detects that its hardware identity has changed. It does not collide with the machine it was copied from. It comes back as a new pending agent, labelled cloned host. The source agent is untouched and keeps working.

What to do:

If the clone is a real new machine, approve the new pending agent.
If it is a stray copy, remove the clone (10.7 Removing a host).

66.4 Clock jumps#

A snapshot restored hours or days later, or a host with no time synchronisation, does not cause a false dead-man blackout, an early close of the token window, or a fleet-wide offline sweep. This is expected behaviour. No action is needed.

If a host is still shown offline or skewed, see 60. Agent health.