# REPORT — agent v0.78.0: DELETE /escrow/stage-secret (fork-4 hygiene) — DEPLOYED

**Date:** 2026-07-09 · **Class:** implementation (agent, small). **Baseline:** v0.77.0 → **v0.78.0**, live
on felhom-pve (`felhom-agent 0.78.0`, capabilities self-check **56/56, degraded=0**). Part of the offsite
hardening bundle: pairs with controller v0.107.0 (calls this on every `EscrowState` flip to `escrowed`) and
hub v0.39.0 (F4/F2/F5).

## What shipped
`internal/localapi`: **`DELETE /escrow/stage-secret`** (withGuest, bearer-authed) — removes the staged
offsite restic repo password (+ any stale `.tmp` partial). **Idempotent:** an absent file is a clean 200
`{removed:false}`. Closes the fork-4 hygiene gap where a confirm WITHOUT a fresh ceremony (the password
already escrowed — the live e2e's Option-A close) left the transient 0600 staging file behind indefinitely
(only the escrow-create ceremony wiped it before).

## Tests
`TestWipeStagedEscrowSecret`: stage → wipe (EFFECT: file GONE) → idempotent re-wipe (`removed:false`) →
401 unauthenticated. Full suite green (`go build && go vet && go test ./...`).

## Live validation
The endpoint was exercised for the one-off cleanup: the lingering
`/var/lib/felhom-agent/escrow-stage/restic_repo_password` (left by the e2e) was wiped through the
controller container over the pinned local-API channel → `{"removed":true}`, file verified GONE on
felhom-pve; an immediate re-wipe returned `{"removed":false}` (idempotency proven live). No secret value
was ever printed or logged.

## Deploy
Standard flow: built on 180 (`-X main.version=0.78.0`), scp'd via local → felhom-pve, `.bak-0.77.0` kept,
`install -m0755` + restart. `configs/` unchanged → no sudoers/wrapper shipping needed. NOT published to
Gitea (no Day-0 vouch change; the Day-0 manifest still vouches 0.76.0).