v0.80.0: PBS DR tier slice 2 — the apply-bridge (pbs_dr consumer, felhom-pbs-apply set-only wrapper, verify-pin-before-consume, adoption-first, loud consumed-failed, escrow seed)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

CHANGELOG.md

@@ -1,3 +1,35 @@
+## v0.80.0 — PBS DR tier SLICE 2: the apply-bridge (2026-07-10)
+
+Consumes hub v0.44.0's `pbs_dr` desired-state descriptor (slice 1): hub tick → the box grows the
+pbs storage entry + K, hands-free. Laws encoded (spike 00afadc + the offsite bridge precedent),
+each red-proof-verified (REPORT.md):
+
+- **`internal/pbsdr`** — the bridge (wgtunnel Loop shape; raw-consumer seam; report stanza
+  `pbs_dr`). Flow: **adoption probe first** (existing healthy entry → grant + marker, NO consume;
+  **tenancy identity is entry-owned** — a descriptor naming a different namespace never repoints a
+  live entry: the demo's manual `felhom-offsite` case) → fresh path: **verify-pin-BEFORE-consume**
+  (bare TLS dial pinned to the descriptor fingerprint, `pbs.ProbeFingerprint`) → consume
+  (`POST /api/v1/hosts/{id}/pbs/consume-token`, PLURAL /hosts/ — the slice-1 route; typed
+  `ErrNoPBSSecret`) → wrapper `create` (secret on STDIN; `--encryption-key autogen` → K born; .enc/
+  .pw placed into `backup.pbs_secret_dir` when overridden — the spike §4 escrow-path flag) →
+  `grant` (the Part-0-evidenced dual-grant, exactly) → post-apply active probe → **seed
+  `escrow.pbs_storage_id`** (bare ceremony one-liner; an operator-set different value is never
+  clobbered; unknown config keys preserved) → descriptor-hash marker. **Consumed-but-failed is
+  LOUD**: persistent `consumed_failed` report state, no silent retry — recovery only via the hub
+  Re-issue (a fresh staged secret).
+- **`configs/felhom-pbs-apply`** (root wrapper, `/usr/local/sbin`, the guarded-mkfs shape) + ONE
+  pinned sudoers alias `FELHOM_PBSDR` (create/reconcile/grant). **THE SET-ONLY LAW**: no deletion
+  verb exists (entry deletion destroys K = un-decryptable backups); re-apply is `pvesm set`-only —
+  grep-gated by `TestSetOnlyLaw` over the shipped file. Secret via wrapper stdin (sudo logs argv).
+- Wire: `WirePBSDR` on `WireDesiredState` (field-exact with hub `pbsDRDescriptor`, pinned by
+  `TestWireFieldNames`); nil-safe on pre-v0.44.0 hubs. Report: `PBSDRStatus` stanza (adopted/
+  applied/waiting_secret/verify_failed/consumed_failed/disabled) via the `PBSDRReporter` seam.
+- Capability manifest: `pbsdr-create`/`pbsdr-reconcile`/`pbsdr-grant` (non-critical, the
+  selfupdate rationale). `config.Config.SourcePath` records the loaded file for the escrow seed.
+- Part 0 (recorded in REPORT.md): status reads ride `FelhomAgentBase` (`Datastore.Audit@/`); the
+  WRITE path 403s without `FelhomAgentStore` on `/storage/<id>` → the grant op = the §4b dual-grant
+  exactly. Demo's purged grants re-asserted; token vzdump to the PBS entry live-proven OK.
+
 ## v0.79.0 — SLICE 3: escrow upload carries sha256 of the sealed restic password (2026-07-09)
 
 The hub-verified escrow auto-confirm chain, agent third: the escrow-create ceremony now records WHICH