felhom-agent/REPORT.md

REPORT — agent reports served leaf fingerprint (hub re-key detection, Part A), v0.48.0

Task: the last self-health leg — the agent reports its served local-API leaf fingerprint so the hub can detect an agent re-key fleet-wide (host_leaf_changed, hub v0.22.x). This repo = Part A.

Baseline: agent main @ 3844df7 (v0.47.0) → v0.48.0 @ bf8e3be, sha a3dad050….

Change

• internal/hub/report.go: new HostReport.LeafFingerprint string (json:"leaf_fingerprint") — the SHA-256 of the leaf the agent currently serves. Empty when the local API is disabled (no leaf) → the hub treats "" as unknown, never an alert. Not a secret (the fp is public; the token is never reported).
• internal/hub/collect.go + cmd/felhom-agent/main.go: Collector.SetLeafFingerprint(fp) threads the fp from EnsureLeaf (the SAME value the LOADED/REGENERATED log reports) into every report, next to Capabilities.

Tests (green: go build/vet/test ./...)

TestCollect_LeafFingerprint: the report carries the fp when set, and "" when unset (local API disabled) — companion proving the threading is what populates it. The golden + contract + field-names tests updated; the cross-repo golden mirrors leaf_fingerprint (byte-identical with the hub copy).

Live validation (felhom-pve) — PASS

Deployed 0.48.0 (leaf LOADED fp 60b5974d…, capabilities 45/45). The hub received the report with leaf_fingerprint: 60b5974d… (confirmed in the hub DB), then — during the end-to-end re-key test — a regenerated leaf (82078fab…) and its restore (60b5974d…) both rode the report stream and the hub raised host_leaf_changed on the change (see felhom.eu/REPORT.md). Final state: leaf == pin 60b5974d…, capabilities 45/45, channel recovered.

NOT changed

The pin/transport, the token store, the sudoers/capability surface, the swap, the channel-health logic. Report contract + collector threading only.