v0.4.0: slice 4 Phase B — reversibility gate + signed-op consuming layer

The security core of slice 4: hub-supplied intent is no longer trusted for
destructive change. The gate fronts the per-guest queue's executor, so every
mutation passes it. Reuses internal/authz for all crypto (surface untouched).

- Classifier (doc 03 §4): benign vs destructive by provenance + data-bearing-
  ness, NOT by verb. Destroy/overwrite of customer data is destructive unless
  agent-internal provenance (same-journaled-txn create, or agent-tagged scratch)
  makes it benign — and that provenance is journal-recorded, NEVER hub-sourced.
  Unknown op class fails safe to destructive.
- Reversibility gate: benign -> allowed unsigned; destructive -> requires a
  verified, role-scoped, action-bound operator signature, else pending_signature
  and never executed. Every decision audited (signal, never the guard).
- Signed-op consuming layer over authz.Verifier.Verify (locked pipeline
  untouched): role-scoping (doc 04 §4 — recovery=rotation only, operational=
  ordinary destructive + planned rotation) + op-to-action binding (op+host+
  guest+params must match the gated action).
- Signed-job orchestration: idempotency dedupe by nonce + journal-wrapped
  execution via an injected DestructiveExecutor (nil this slice — inert).
- Crash recovery (Note 1): Engine.Recover consumes the journal InFlight() set at
  startup (resume-or-rollback) — covers an op that crashed after the POST and
  before its terminal record, which idempotency dedupe alone cannot. Added
  TaskStatusOnce to the GuestAPI seam. Wired into daemon startup.
- Note 2: memory comparison canonicalized to MiB (desiredMemoryMiB) so a
  non-MiB-aligned MemoryBytes converges in one pass, not perpetual drift.
- Daemon: builds the verifier from config signers (none = nil verifier, the
  common slice-4 state), the gate (+SlogAudit), runs Recover before mutating.

Adversarial matrix proven against the REAL authz.Verifier with in-test-minted
SSHSIGs (framing replicated in reconcile's test binary; authz untouched, no
signing added to the verify-only package): unsigned job + unsigned desired-state
delta -> pending_signature; unknown signer/expired/replay-across-restart/wrong
host -> typed authz rejections; wrong guest/op/params -> binding_mismatch;
recovery key on ordinary destructive -> role_denied; hub-supplied scratch tag
ignored -> refused; valid+role+target+fresh nonce -> accepted then replay
rejected. Full module race-clean + vet-clean on the Linux build server.

Inert this slice: no destructive deltas served until slice 10; the destructive
path is classified, gated, and tested but not wired to live execution.

CHECKPOINT: Phase B complete (slice 4 done). Awaiting validation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

cmd/felhom-agent/main.go

@@ -19,6 +19,7 @@ import (
 	"syscall"
 	"time"
 
+	"gitea.dooplex.hu/admin/felhom-agent/internal/authz"
 	"gitea.dooplex.hu/admin/felhom-agent/internal/config"
 	"gitea.dooplex.hu/admin/felhom-agent/internal/hub"
 	applog "gitea.dooplex.hu/admin/felhom-agent/internal/log"
@@ -28,7 +29,7 @@ import (
 
 // version is the agent version. Overridable at build time with
 // -ldflags "-X main.version=<v>"; defaults to the in-repo CHANGELOG version.
-var version = "0.4.0-rc1"
+var version = "0.4.0"
 
 func main() {
 	var (
@@ -137,14 +138,35 @@ func runDaemon(cfg config.Config, logger *slog.Logger) int {
 			defer journal.Close()
 		}
 	}
+	// The reversibility gate (slice 4 Phase B) sits in front of every mutation. With
+	// no signers pinned (the common slice-4 state) the verifier is nil: benign actions
+	// pass, destructive intents are refused pending_signature — and reconcile only
+	// produces benign actions, so nothing is gated away. A misconfigured signer key is
+	// a security misconfig and is fatal.
+	verifier, nonceStore, err := buildVerifier(cfg, logger)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "daemon: authz verifier:", err)
+		return 2
+	}
+	if nonceStore != nil {
+		defer nonceStore.Close()
+	}
+	gate := reconcile.NewGate(verifier, cfg.Hub.HostID, reconcile.SlogAudit{Logger: logger}, logger)
+
 	engine := reconcile.NewEngine(reconcile.EngineOptions{
 		API:      px,
 		Queue:    queue,
 		Journal:  journal,
 		Provider: reconcile.EmptyProvider{}, // slice 4: no live desired-state source
+		Gate:     gate,
+		HostID:   cfg.Hub.HostID,
 		Logger:   logger,
 	})
 
+	// Crash recovery (doc 03 §10): resolve any op that was in flight when the agent
+	// last died BEFORE issuing new mutations. With an empty journal this is a no-op.
+	engine.Recover(ctx)
+
 	// Run reconcile and the hub loop concurrently; either returning ends the daemon.
 	errc := make(chan error, 2)
 	go func() { errc <- engine.Run(ctx, interval) }()
@@ -170,6 +192,35 @@ func reconcileJournalPath(cfg config.Config) string {
 	return "/var/lib/felhom-agent/journal.log"
 }
 
+// buildVerifier constructs the operator-signed-op verifier from config. With no signers
+// pinned it returns (nil, nil, nil) — the gate then refuses any destructive intent as
+// pending_signature (and reconcile serves none). With signers it requires a durable
+// nonce-store path (anti-replay must survive restarts) and parses every pinned key —
+// a bad key or missing path is a fatal security misconfig.
+func buildVerifier(cfg config.Config, logger *slog.Logger) (reconcile.OpVerifier, *authz.FileNonceStore, error) {
+	if len(cfg.Authz.Signers) == 0 {
+		logger.Info("daemon: no operator signers pinned; destructive ops will be refused pending_signature")
+		return nil, nil, nil
+	}
+	if cfg.Authz.NonceStorePath == "" {
+		return nil, nil, fmt.Errorf("authz.nonce_store_path is required when signers are configured")
+	}
+	signers := make([]authz.AllowedSigner, 0, len(cfg.Authz.Signers))
+	for _, s := range cfg.Authz.Signers {
+		as, err := authz.NewAllowedSigner(s.KeyID, authz.KeyRole(s.Role), s.PublicKey)
+		if err != nil {
+			return nil, nil, fmt.Errorf("pinned signer %q: %w", s.KeyID, err)
+		}
+		signers = append(signers, as)
+	}
+	store, err := authz.OpenFileNonceStore(cfg.Authz.NonceStorePath)
+	if err != nil {
+		return nil, nil, fmt.Errorf("nonce store: %w", err)
+	}
+	logger.Info("daemon: operator signers pinned", "count", len(signers))
+	return authz.New(signers, store, cfg.Hub.HostID), store, nil
+}
+
 // runSelftestHub validates hub config, does ONE collect + report, and prints the
 // report it would send plus the envelope it got back.
 func runSelftestHub(ctx context.Context, cfg config.Config, logger *slog.Logger) int {