v0.96.0 — R-50 island NIC: provision attaches the guest island net1

- LocalAPIConfig.island_bridge + island_guest_addr (+ IslandEnabled, Validate
  all-or-nothing + CIDR guard)
- buildBringUpConfig attaches static net1 (island) on provision + DR when set;
  absent otherwise (pre-R-50 byte-for-byte). Plumbed from cfg.LocalAPI at both
  RunBringUp sites. Endpoint already follows listen_addr (A0: no template change).
- healer stays eth0-only (A3 verify-only) — red-proof test locks the scoping
- example config + firewall example rewritten for the island; REUSE updated
- 3 non-hollow tests; full green. MinAgent unchanged.

Coupling: host-install island config requires agent >= 0.96.0 (vouch first).

internal/config/config.go

@@ -235,6 +235,16 @@ type LocalAPIConfig struct {
 	// TokenStore is the durable, hashed token→guest map (only a HASH of each token is
 	// persisted; the plaintext exists transiently at mint→write-to-mount, then is discarded).
 	TokenStore string `json:"token_store"` // default /var/lib/felhom-agent/local-tokens.log
+	// IslandBridge + IslandGuestAddr configure the R-50 host-internal control-plane bridge. When
+	// BOTH are set, the provisioner attaches each guest a static net1 on IslandBridge with
+	// IslandGuestAddr, so the controller reaches the agent over a fixed private address that no
+	// LAN/DHCP/site move can invalidate (the F1 fix — AUDIT-vacation-remote-ops-2026-07-20). Empty
+	// (the default) = LAN-only, byte-for-byte the pre-R-50 behaviour. On an island install ListenAddr
+	// is the host side (169.254.253.1:8443); IslandGuestAddr is the guest side (169.254.253.2/30 — a
+	// /30 is exactly host + one guest). Additive-only: it never removes a NIC, so a guest restored on
+	// a non-island host (both empty) is unaffected.
+	IslandBridge    string `json:"island_bridge"`     // e.g. "vmbr9" (portless host-internal bridge)
+	IslandGuestAddr string `json:"island_guest_addr"` // guest net1 CIDR, e.g. "169.254.253.2/30"
 }
 
 // Default local-API file locations (under the agent's state dir).
@@ -249,6 +259,12 @@ func (l LocalAPIConfig) Enabled() bool {
 	return l.Enable && strings.TrimSpace(l.ListenAddr) != ""
 }
 
+// IslandEnabled reports whether the provisioner should attach a guest island NIC (net1). True only
+// when BOTH the bridge and the guest CIDR are set (R-50); empty = pre-R-50 LAN-only behaviour.
+func (l LocalAPIConfig) IslandEnabled() bool {
+	return strings.TrimSpace(l.IslandBridge) != "" && strings.TrimSpace(l.IslandGuestAddr) != ""
+}
+
 // TokenStorePath returns the configured token-store path (default applied).
 func (l LocalAPIConfig) TokenStorePath() string {
 	if l.TokenStore != "" {
@@ -283,6 +299,17 @@ func (l LocalAPIConfig) Validate() error {
 	if _, _, err := net.SplitHostPort(l.ListenAddr); err != nil {
 		return fmt.Errorf("config: local_api.listen_addr %q is not host:port: %w", l.ListenAddr, err)
 	}
+	// R-50: island fields are all-or-nothing, and the guest addr must be a CIDR (the net1 ip= value).
+	// A half-set island (bridge without guest addr, or vice versa) is a provisioning mistake, not a
+	// silent LAN fallback — fail loudly so a botched install config is caught at load, not at day-0.
+	if (strings.TrimSpace(l.IslandBridge) != "") != (strings.TrimSpace(l.IslandGuestAddr) != "") {
+		return fmt.Errorf("config: local_api.island_bridge and local_api.island_guest_addr must be set together (got bridge=%q guest_addr=%q)", l.IslandBridge, l.IslandGuestAddr)
+	}
+	if l.IslandEnabled() {
+		if _, _, err := net.ParseCIDR(strings.TrimSpace(l.IslandGuestAddr)); err != nil {
+			return fmt.Errorf("config: local_api.island_guest_addr %q is not a CIDR (want e.g. 169.254.253.2/30): %w", l.IslandGuestAddr, err)
+		}
+	}
 	return nil
 }
 

internal/config/config_test.go

@@ -171,3 +171,46 @@ func TestDeploymentModeEnvOverlay(t *testing.T) {
 		t.Errorf("env overlay did not set deployment_mode: %q", cfg.DeploymentMode)
 	}
 }
+
+// R-50: the island NIC fields are all-or-nothing and the guest addr must be a CIDR. A half-set or
+// malformed island must fail at config load (a botched install) rather than silently fall back to
+// LAN-only, which would leave a guest with an island bind and no island NIC — the exact silent break
+// R-50 exists to kill. Covers LocalAPIConfig.Validate + IslandEnabled.
+func TestLocalAPIConfig_IslandValidation(t *testing.T) {
+	base := LocalAPIConfig{Enable: true, ListenAddr: "169.254.253.1:8443"}
+
+	// both empty → fine (pre-R-50 default), IslandEnabled false
+	if err := base.Validate(); err != nil {
+		t.Errorf("no island config must validate: %v", err)
+	}
+	if base.IslandEnabled() {
+		t.Errorf("IslandEnabled must be false when unset")
+	}
+	// both set, valid CIDR → fine, IslandEnabled true
+	ok := base
+	ok.IslandBridge, ok.IslandGuestAddr = "vmbr9", "169.254.253.2/30"
+	if err := ok.Validate(); err != nil {
+		t.Errorf("valid island config must validate: %v", err)
+	}
+	if !ok.IslandEnabled() {
+		t.Errorf("IslandEnabled must be true when both set")
+	}
+	// bridge only → rejected (all-or-nothing)
+	half := base
+	half.IslandBridge = "vmbr9"
+	if err := half.Validate(); err == nil {
+		t.Errorf("half-set island (bridge only) must be rejected")
+	}
+	// guest addr only → rejected
+	half2 := base
+	half2.IslandGuestAddr = "169.254.253.2/30"
+	if err := half2.Validate(); err == nil {
+		t.Errorf("half-set island (guest addr only) must be rejected")
+	}
+	// both set but guest addr is not a CIDR → rejected
+	bad := base
+	bad.IslandBridge, bad.IslandGuestAddr = "vmbr9", "169.254.253.2" // missing /30
+	if err := bad.Validate(); err == nil {
+		t.Errorf("island guest addr without a CIDR mask must be rejected")
+	}
+}