v0.88.0: controller-driven escrow ceremony — --output=json machine mode (escrowCeremony extraction, text mode byte-identical), the ONE fixed argv (escrow.CeremonyArgs, shared by exec+manifest+FELHOM_ESCROW sudoers, pin-tested), localapi ceremony job (single-flight, 60s) + one-shot in-memory R claim (10min TTL, unclaimed_void) + preflight; escrow-ceremony capability (Critical, pbs_dr-gated)

internal/capability/manifest.go

@@ -12,7 +12,11 @@
 // by a sudoers pattern, catching authoring gaps in CI before they ship.
 package capability
 
-import "strings"
+import (
+	"strings"
+
+	"gitea.dooplex.hu/admin/felhom-agent/internal/escrow"
+)
 
 // Capability is one privileged command the agent depends on. Name is a stable id; Feature is the
 // human-readable thing that breaks if the grant is missing (used in logs + the operator alert).
@@ -158,6 +162,15 @@ var manifest = []Capability{
 	{"pbsdr-reconcile", "PBS DR storage-entry reconcile (set-only)", "/usr/local/sbin/felhom-pbs-apply", []string{"reconcile", "felhom-pbs", "10.77.0.1", "ns0", "felhom@pbs!ns0", reprFingerprint, "/etc/pve/priv/storage"}, false, ""},
 	{"pbsdr-grant", "PBS DR storage ACL self-grant", "/usr/local/sbin/felhom-pbs-apply", []string{"grant", "felhom-pbs"}, false, ""},
 
+	// ---- Escrow ceremony (FELHOM_ESCROW, controller-driven, v0.88.0). Critical: the customer
+	// wizard's whole run path IS this one grant — a dropped line silently breaks every ceremony.
+	// GatedBy is set EXPLICITLY (the name deliberately says "escrow", not "pbsdr-": the feature is
+	// the ceremony, but it only exists behind the DR tier — no PBS key, no ceremony). ReprArgs is
+	// the SHARED argv constant (internal/escrow/ceremony.go) — the exec runner uses the same one,
+	// so runner ↔ manifest can't drift, and TestManifestCoveredBySudoers locks manifest ↔ sudoers.
+	// List-mode probe only (`sudo -n -l`), spike-confirmed side-effect-free — never a real ceremony.
+	{"escrow-ceremony", "customer recovery-code ceremony (controller-driven)", escrow.CeremonyBinary, escrow.CeremonyArgs(), true, GatePBSDR},
+
 	// ---- Agent self-update (FELHOM_SELFUPDATE, D1). NON-critical: self-update is an occasional
 	// operator-driven op, not a steady-state serving path — a degraded grant means "can't
 	// self-update" (fall back to a manual SSH deploy), not a serving outage. The apply repr uses a

internal/capability/manifest_test.go

@@ -2,9 +2,12 @@ package capability
 
 import (
 	"os"
+	"reflect"
 	"regexp"
 	"strings"
 	"testing"
+
+	"gitea.dooplex.hu/admin/felhom-agent/internal/escrow"
 )
 
 // sudoersPath is the in-repo allowlist, relative to this test file (internal/capability/).
@@ -217,6 +220,50 @@ func TestRedProof_DroppedControllerSwapTeeFailsCheck(t *testing.T) {
 	}
 }
 
+// TestEscrowCeremonyArgvPinned locks the ceremony argv copies together (Scenario G, v0.88.0).
+// The exec runner and the manifest entry both consume escrow.CeremonyArgs() (one shared source),
+// and TestManifestCoveredBySudoers proves manifest ⊆ sudoers — so pinning the shared source to
+// the EXPECTED literal here transitively locks all three: runner == manifest == sudoers.
+// Red-proof: mutate one element of the argv in internal/escrow/ceremony.go and THIS test fails
+// (and so does the sudoers coverage); a sudoers-side mutation is caught by the existing
+// TestRedProof_* machinery.
+func TestEscrowCeremonyArgvPinned(t *testing.T) {
+	wantBinary := "/usr/local/bin/felhom-agent"
+	wantArgs := []string{"--config", "/etc/felhom-agent/agent.json", "--selftest=escrow-create", "--upload", "--output=json"}
+
+	if escrow.CeremonyBinary != wantBinary {
+		t.Errorf("escrow.CeremonyBinary = %q, want %q", escrow.CeremonyBinary, wantBinary)
+	}
+	if got := escrow.CeremonyArgs(); !reflect.DeepEqual(got, wantArgs) {
+		t.Errorf("escrow.CeremonyArgs() = %q, want %q (the sudoers line + manifest entry must stay byte-identical)", got, wantArgs)
+	}
+
+	var entry Capability
+	for _, c := range Manifest() {
+		if c.Name == "escrow-ceremony" {
+			entry = c
+		}
+	}
+	if entry.Name == "" {
+		t.Fatal("manifest missing escrow-ceremony")
+	}
+	if entry.Binary != escrow.CeremonyBinary || !reflect.DeepEqual(entry.ReprArgs, escrow.CeremonyArgs()) {
+		t.Errorf("manifest escrow-ceremony argv diverged from the shared constant: %s %q", entry.Binary, entry.ReprArgs)
+	}
+	if !entry.Critical {
+		t.Error("escrow-ceremony must be Critical (the wizard's whole run path is this one grant)")
+	}
+	if entry.GatedBy != GatePBSDR {
+		t.Errorf("escrow-ceremony GatedBy = %q, want %q (no PBS key → no ceremony; inactive, never red, on a DR-off box)", entry.GatedBy, GatePBSDR)
+	}
+	// CeremonyArgs must return a COPY — a caller mutating its slice must not poison the source.
+	mutated := escrow.CeremonyArgs()
+	mutated[0] = "--poisoned"
+	if got := escrow.CeremonyArgs(); !reflect.DeepEqual(got, wantArgs) {
+		t.Error("escrow.CeremonyArgs() shares its backing array — callers can mutate the source")
+	}
+}
+
 // TestWGCapabilityCriticality pins the exact S4 (v0.66.0) Critical set for the FELHOM_WG entries:
 // the backup path (conf install, unit enable/restart, handshake read) is operator-alert-worthy now
 // that offsite backups ride the tunnel; the one-time apt install and the deliberate disable

internal/capability/probe_test.go

@@ -130,7 +130,9 @@ func TestProbe_GateOffHealthyIsInactive(t *testing.T) {
 		GateActive: func(gate string) bool { return gate != GatePBSDR }, // DR tier OFF
 	}
 	statuses := p.Probe(context.Background())
-	for _, name := range []string{"pbsdr-create", "pbsdr-reconcile", "pbsdr-grant"} {
+	// v0.88.0: escrow-ceremony joins the gate EXPLICITLY (non-pbsdr name, GatedBy literal) —
+	// the ceremony only exists behind the DR tier (no PBS key, no ceremony).
+	for _, name := range []string{"pbsdr-create", "pbsdr-reconcile", "pbsdr-grant", "escrow-ceremony"} {
 		s := find(statuses, name)
 		if s.Status != StatusInactive || s.Reason != ReasonInactive {
 			t.Fatalf("%s = %+v, want inactive/%q", name, s, ReasonInactive)
@@ -145,8 +147,8 @@ func TestProbe_GateOffHealthyIsInactive(t *testing.T) {
 	if len(degraded) != 0 {
 		t.Fatalf("inactive leaked into degraded: %+v", degraded)
 	}
-	if ok != total-3 {
-		t.Fatalf("ok=%d total=%d, want exactly the 3 gated ones non-ok", ok, total)
+	if ok != total-4 {
+		t.Fatalf("ok=%d total=%d, want exactly the 4 gated ones non-ok", ok, total)
 	}
 }
 
@@ -181,11 +183,13 @@ func TestProbe_GateOnOrNilIsOK(t *testing.T) {
 	}
 }
 
-// The gate rides the pbsdr- name prefix: exactly the pbsdr-* manifest entries are gated, nothing
-// else (a regression here would silently un-gate the tier or gate an unrelated capability).
+// The gate covers exactly the pbsdr-* entries (name-prefix mechanism) PLUS escrow-ceremony (an
+// explicit GatedBy literal — v0.88.0: the ceremony only exists behind the DR tier, but its name
+// says what the feature is). Nothing else may be gated (a regression here would silently un-gate
+// the tier or gate an unrelated capability).
 func TestManifest_ExactlyPBSDRGated(t *testing.T) {
 	for _, c := range Manifest() {
-		wantGated := strings.HasPrefix(c.Name, "pbsdr-")
+		wantGated := strings.HasPrefix(c.Name, "pbsdr-") || c.Name == "escrow-ceremony"
 		if gated := c.GatedBy == GatePBSDR; gated != wantGated {
 			t.Fatalf("%s: GatedBy=%q, want gated=%v", c.Name, c.GatedBy, wantGated)
 		}