felhom-agent/REPORT.md

REPORT — agent v0.78.0: DELETE /escrow/stage-secret (fork-4 hygiene) — DEPLOYED

Date: 2026-07-09 · Class: implementation (agent, small). Baseline: v0.77.0 → v0.78.0, live on felhom-pve (felhom-agent 0.78.0, capabilities self-check 56/56, degraded=0). Part of the offsite hardening bundle: pairs with controller v0.107.0 (calls this on every EscrowState flip to escrowed) and hub v0.39.0 (F4/F2/F5).

What shipped

internal/localapi: DELETE /escrow/stage-secret (withGuest, bearer-authed) — removes the staged offsite restic repo password (+ any stale .tmp partial). Idempotent: an absent file is a clean 200 {removed:false}. Closes the fork-4 hygiene gap where a confirm WITHOUT a fresh ceremony (the password already escrowed — the live e2e's Option-A close) left the transient 0600 staging file behind indefinitely (only the escrow-create ceremony wiped it before).

Tests

TestWipeStagedEscrowSecret: stage → wipe (EFFECT: file GONE) → idempotent re-wipe (removed:false) → 401 unauthenticated. Full suite green (go build && go vet && go test ./...).

Live validation

The endpoint was exercised for the one-off cleanup: the lingering /var/lib/felhom-agent/escrow-stage/restic_repo_password (left by the e2e) was wiped through the controller container over the pinned local-API channel → {"removed":true}, file verified GONE on felhom-pve; an immediate re-wipe returned {"removed":false} (idempotency proven live). No secret value was ever printed or logged.

Deploy

Standard flow: built on 180 (-X main.version=0.78.0), scp'd via local → felhom-pve, .bak-0.77.0 kept, install -m0755 + restart. configs/ unchanged → no sudoers/wrapper shipping needed. NOT published to Gitea (no Day-0 vouch change; the Day-0 manifest still vouches 0.76.0).