felhom-agent/REPORT.md

REPORT — agent v0.80.0: PBS DR tier SLICE 2, the apply-bridge — DEPLOYED + ADOPTION-PROVEN + PUBLISHED

Date: 2026-07-10/11 · Class: implementation (agent) + demo live check + publish. Baseline v0.79.0 → v0.80.0, live on felhom-pve (felhom-agent 0.80.0, capabilities 59/59, degraded=0), PUBLISHED to Gitea (sha f2ba62ca6aca6e24a8d08706ea0dc3ae43940a63e9bdf57d4606ad1756cf06d2; anon round-trip verified; the deployed demo binary is byte-identical). Consumes hub v0.44.0 (slice 1). PENDING: the supervised Peti phase — felhom.eu/documentation/pilot/RUNBOOK-peti-pbsdr-2026-07-11.md (Viktor + Peti; his box has no tunnel/OOB yet, so box prep is his hands).

Part 0 — grant diagnosis (the carried spike §6 flag), evidence recorded

• Status reads (/nodes/.../storage/.../status) pass with NO storage grant — FelhomAgentBase (Datastore.Audit at /, propagate) covers them. That + the demo's local backup target is why the purged grants never showed.
• The WRITE path is the gap: token vzdump → 403 (/storage/felhom-pbs, Datastore.AllocateSpace). After the §4b dual-grant re-assert (both entries, user+token): token vzdump of 9001 → stopped OK (9001 also joined /pool/felhom — the VM.Backup half; pool-default conformance).
• The bridge's grant op therefore codifies EXACTLY the dual-grant, nothing more.

What shipped (laws + red-proofs)

• internal/pbsdr bridge (adoption-first / verify-pin-before-consume / set-only / loud consumed-failed / escrow seed / descriptor-hash marker) + configs/felhom-pbs-apply + FELHOM_PBSDR sudoers + 3 capability entries + WirePBSDR/PBSDRStatus wire/report + hub.ConsumePBSToken (PLURAL /hosts/ route). Details: CHANGELOG v0.80.0.
• Red-proofs (all run, mutations reverted, gate green):
  • set-only: a remove+re-add path in the re-apply → TestSetOnlyLaw FAILS (recorded verbs [remove, create, grant] ≠ set-only) — the K-destruction guard bites.
  • stdin secret: secret passed as argv → TestFreshPath_SecretOnStdinNeverArgv FAILS with the secret visible in Args.
  • verify-before-consume: consume reordered before the probe → TestVerifyPinBeforeConsume FAILS (consume calls = 1, want 0).

Demo live check — the ADOPTION path (2026-07-10 22:00 CEST)

Enabled "PBS DR tier" on demo-felhom with storage-id felhom-offsite (hub v0.44.0 UI, logged-in browser). The full slice-1+2 chain fired live:

• hub: tenantsync: provision ok (ns=demo-felhom) on ep0 → secret staged consume-once → descriptor → generation 10.
• agent: fetched gen 10 → ADOPTED the manually-built felhom-offsite entry — journal: adopted entry keeps its own tenancy (namespace "demo-felhom-01"; descriptor says "demo-felhom" — entry wins, never repointed) → converged state=adopted.
• Asserts: staged secret UNCONSUMED (host_pbs_secrets.consumed_at = NULL in the hub DB — the no-consume law held); pvesm status felhom-offsite active (demo DR green); escrow.pbs_storage_id=felhom-offsite seeded into agent.json.
• Live finding, fixed same session (3d1323c): the escrow seed's tmp+rename failed — /etc/felhom-agent is root-owned while agent.json is agent-owned, so rename (a directory mutation) is impossible for the non-root agent. Rewritten as park-a-recovery-copy-in-state-dir + in-place O_TRUNC write; re-proven live (marker removed → re-adopt → seed OK). The warn-and- converge fail-safe behaved as designed in between.
• Benign note: the report pbs_dr stanza appears from the SECOND heartbeat after a restart (the startup collect races the first bridge Apply).

Publish train + pending

• 0.80.0 published (publish-agent.sh on 180): pre-delete 404 → PUT 201 → round-trip sha match. Demo's live binary sha == published sha (the GL never-vouch-unpublished rule holds).
• PENDING (the committed runbook, Viktor+Peti): box prep (sudoers+wrapper+wg_tunnel enable — his box has NO WG peer/OOB today), opsign signed update to 0.80.0, hub-UI tier enable (the FRESH path: verify → consume → K born → degradation clears), then the ceremony one-liner (fresh R, Peti keeps) → auto-confirm → first offsite run. Operator follow-up: Day-0 manifest vouch of 0.80.0 when it becomes the floor target.