felhom-agent/REPORT.md

REPORT — S5: host-loss DR (recovered WG-key install + directive→PLAN; safe halves shipped)

Date: 2026-07-04 · Class: implementation (safe halves) + diagnosis + a prepared, operator-present destructive drill (NOT executed by CC). Design of record: doc-06 §3.5 + S5 row; doc-01 §9.

1. Baselines & commits (felhom-agent → main)

Start: 567cf9f (v0.68.0). bd4bced v0.69.0 — the two safe DR halves (Parts 1-2). This commit — REPORT + CONTEXT + doc-06 S5 row.

2. Part 1 (SAFE, shipped) — install the recovered WG key

wgtunnel.InstallRecoveredKey(stateDir, privB64) writes an escrow-recovered WG private key (32-byte base64, re-encoded canonical) to the key file so the tunnel re-establishes with the same identity/pubkey → same hub /32, no fresh keygen. CREATE-ONLY — refuses if a key file exists (a present key may be a live identity); the value is never logged. Wired into --selftest=identity-consume -install-wg-key (opt-in; installs bundle.WGPrivateKey after UnwrapIdentityBundle; a pre-S3 blob with no WG key → logged fallback to fresh keygen + re-register, which keeps the /32 via hub re-key-in-place). Test + red-proof: install→EnsureKey LOADS it (same pubkey, no keygen); a second install REFUSES (create-only — red-proofed against dropping the exists-check); invalid key → error, nothing written.

3. Part 2 (SAFE, shipped) — consume restore_directive → PLAN

New internal/dr: the host_loss restore_directive (was logged-and-ignored in syncer.go) is consumed via the desired.Syncer.AddConsumer raw seam into an inspectable RestorePlan — per guest {vmid, archive, target storage, sizing}, per drive {durable_id → expected mount}, + the offsite PBS coord. Derive-and-surface only: the Consumer holds NO restore/destroy dependency, so "execute nothing" is structural. guest_loss/absent → no plan; recipe fetched on-demand (rare directive) via a fresh Collect. Test + red-proof: host_loss builds the expected plan; guest_loss/absent/nil-recipe → none (red-proofed against a relaxed mode gate); the consumer surfaces on host_loss + clears otherwise + consults the recipe only then. Full go test ./... green; deployed 0.69.0; -install-wg-key flag live; daemon starts clean (dr consumer wired).

4. Part 3 — hub escrow export: NOT needed

The operator has a clean blob-export path already: sqlite3 … "SELECT writefile('/tmp/blob', blob), writefile('/tmp/idblob', identity_blob) FROM host_escrow WHERE host_id='demo-felhom-01'" on a kubectl cp'd hub.db. No hub change (respects the read-only-unless-no-clean-way gate).

5. Part 4-A — re-attach wrong-disk safety: ALREADY PROVEN (no new probe built)

The re-attach matcher is storage.ResolveStorageDevice (the uuid:<fs-uuid> scheme DR drives use). Its wrong-disk guard is unit-established: TestResolveStorageDevice_ToleratesDeviceLetterMove (a MATCHING UUID resolves to the current /dev path) + TestResolveStorageDevice_AbsentAndScheme (an absent/mismatched UUID ERRORS — "skips a gone drive instead of fail-mounting"; a bare node / non-uuid: scheme is refused). It resolves ONLY the exact UUID's symlink — never a "nearest" disk. Combined with S4.1's restore-to-scratch proof, the composition's safety is established; a new live scratch+marker-drive probe would add confidence but not new safety, so it was not built (recorded).

6. Part 4-B — the destructive in-place 9201 drill: PREPARED + OPERATOR-GATED (not executed)

Pre-flight GREEN (non-destructive): offsite ct/9201 snapshots present (the restore source); 9201 running; the escrow blob is on the hub (383 B + 499 B identity, offsite key b0:fe:2a…), exportable via sqlite3 writefile; S4.1 already proved 9201 restores from offsite (pass:true). The destructive drill (destroy 9201 → restore in place from offsite → re-attach the data drive by durable_id) is operator-present + STOP-gated: the operator runs the R-consume steps (escrow-consume + identity-consume -install-wg-key, R via env — CC never runs these, §9-4a) and confirms the destroy at the STOP checkpoint. Prepared procedure + the go/no-go is with the operator (destroying the live demo controller is their decision, even with the backup confirmed recoverable).

7. NOT yet live-validated / observations

• The live consume→install→tunnel→restore pipeline (the Part 4-B drill) — operator-present, pending the operator's go-ahead + R-run. Parts 1-2 are unit-proven + deployed; their live consume path is exercised only in that drill (R-gated).
• Deferred (per slice scope): guest_loss DR; hub-driven full-auto DR (the hub issuing recovery-mode + directive itself); multi-guest host-loss. true-CGNAT-SIM retest still parked.
• Observation: the DR plan is surfaced via structured log + Consumer.LastPlan(); a report field (so the hub/operator sees the plan without the box's journal) is a small future refinement.