docs: v0.79.0 REPORT — deployed felhom-pve (56/56)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

REPORT.md

@@ -1,29 +1,29 @@
-# REPORT — agent v0.78.0: DELETE /escrow/stage-secret (fork-4 hygiene) — DEPLOYED
+# REPORT — agent v0.79.0: SLICE 3 escrow upload carries the sealed password's hash — DEPLOYED
 
-**Date:** 2026-07-09 · **Class:** implementation (agent, small). **Baseline:** v0.77.0 → **v0.78.0**, live
-on felhom-pve (`felhom-agent 0.78.0`, capabilities self-check **56/56, degraded=0**). Part of the offsite
-hardening bundle: pairs with controller v0.107.0 (calls this on every `EscrowState` flip to `escrowed`) and
-hub v0.39.0 (F4/F2/F5).
+**Date:** 2026-07-09 · **Class:** implementation (agent, small). Baseline v0.78.0 → **v0.79.0**, live on
+felhom-pve (`felhom-agent 0.79.0`, capabilities self-check **56/56, degraded=0**). The hub-verified escrow
+auto-confirm chain, agent third — pairs with hub v0.40.0 (stores + serves) and controller v0.108.0
+(matches + auto-confirms). All three deployed live.
 
 ## What shipped
-`internal/localapi`: **`DELETE /escrow/stage-secret`** (withGuest, bearer-authed) — removes the staged
-offsite restic repo password (+ any stale `.tmp` partial). **Idempotent:** an absent file is a clean 200
-`{removed:false}`. Closes the fork-4 hygiene gap where a confirm WITHOUT a fresh ceremony (the password
-already escrowed — the live e2e's Option-A close) left the transient 0600 staging file behind indefinitely
-(only the escrow-create ceremony wiped it before).
+- `internal/escrow.HashResticPassword` — the CANONICAL hasher: sha256 hex over the TRIMMED password string,
+  exactly the value `AttachResticPassword` seals into the identity blob. **Pinned cross-repo test vector**
+  (`TestHashResticPassword_PinnedVector` — the identical vector is asserted in felhom-controller's backup
+  package), so the two hashers can never drift silently (newline/encoding/trim).
+- `cmd/felhom-agent`: the escrow-create ceremony computes the hash when a staged password is folded in and
+  includes it in the blob upload — `escrowUploadRequest.restic_pw_sha256,omitempty`. No staged password →
+  field OMITTED (hub stores NULL → the controller stays pending; correct — the blob doesn't cover the key).
+  The hash of a 256-bit random secret is non-reversible — safe to upload/serve; the password itself is
+  never logged or uploaded in the clear (it rides only inside the R-wrapped blob, as before).
+- `TestEscrowUploadContract` updated in lockstep with the hub's mirror (same commit-pair) + asserts the
+  omitted-when-unstaged behavior.
+- Ceremony flow (create / self-verify / R banner / staged-file wipe) untouched beyond the hash.
 
-## Tests
-`TestWipeStagedEscrowSecret`: stage → wipe (EFFECT: file GONE) → idempotent re-wipe (`removed:false`) →
-401 unauthenticated. Full suite green (`go build && go vet && go test ./...`).
-
-## Live validation
-The endpoint was exercised for the one-off cleanup: the lingering
-`/var/lib/felhom-agent/escrow-stage/restic_repo_password` (left by the e2e) was wiped through the
-controller container over the pinned local-API channel → `{"removed":true}`, file verified GONE on
-felhom-pve; an immediate re-wipe returned `{"removed":false}` (idempotency proven live). No secret value
-was ever printed or logged.
+## NOT yet live-exercised
+A real ceremony with a staged password recording the hash — happens at the next real offsite enable (Peti
+onboarding). The demo's escrow row remains a legacy NULL-hash blob (covered by the deprecated manual
+confirm; verified live that the controller no-ops on it).
 
 ## Deploy
-Standard flow: built on 180 (`-X main.version=0.78.0`), scp'd via local → felhom-pve, `.bak-0.77.0` kept,
-`install -m0755` + restart. `configs/` unchanged → no sudoers/wrapper shipping needed. NOT published to
-Gitea (no Day-0 vouch change; the Day-0 manifest still vouches 0.76.0).
+Standard: built on 180, `.bak-0.78.0` kept, `install -m0755` + restart. `configs/` unchanged. NOT published
+to Gitea (Day-0 manifest still vouches 0.76.0).