# REPORT — controller v0.108.0: SLICE 3 hub-verified escrow auto-confirm — DEPLOYED

**Date:** 2026-07-09 · **Class:** implementation. Baseline v0.107.0 → **v0.108.0** (live on 9201,
`Up (healthy)`). The chain pairs: **agent v0.79.0** (ceremony uploads `restic_pw_sha256`) + **hub v0.40.0**
(stores it; report ACK serves `escrow:{identity_blob_present, restic_pw_sha256, created_at}`) — both live.

## What shipped (controller)
`report.EscrowAutoConfirmer` — runs on every report ACK; flips offbox `EscrowState` pending→escrowed ONLY
when `sha256(local repo_password) == restic_pw_sha256` from the ACK. Verifies the RIGHT fact: not "a blob
exists" but "the blob covers the CURRENT key" (a stale blob — re-provision, inject, drive history — must
never truthfully-claim; that would re-open the exact un-recoverable-ciphertext gap fork-4 closed).
- Match → flip + wipe the agent-staged secret (the v0.107.0 DELETE path; best-effort, loud on failure).
- Mismatch → stays pending + LOUD warn naming the fix ("run the escrow ceremony"), deduped per distinct
  hash (not per 15-min cycle).
- No row / NULL hash / hash-without-identity-blob / no local password file → silently pending (fail-closed).
- Non-pending → total no-op — **auto-UN-confirm does not exist**.
- `backup.HashResticPassword` (canonical: sha256 hex of the TRIMMED string) + `Manager.OffboxRepoPasswordHash`;
  **pinned cross-repo test vector** (same in felhom-agent) so the two hashers can never drift silently.
- Manual `POST /backup/offbox/confirm-escrow` → documented **deprecated fallback** (legacy hash-less blobs).

## Tests + companion red-proof (ALL-GREEN, red-proof fired)
Scenarios: A match→flip+wipe (+repeat ACK no-op); B stale-blob stays pending + warn-once-per-hash (+new
hash warns again); C all silent-pending cases; E never acts outside pending (even a mismatch on an escrowed
target is silent); wipe-failure keeps the confirm. **Red-proof:** modeled the blob-present-only check → the
stale-blob AND hash-less scenarios flipped when they must not → both tests FAILED. Reverted.
Pinned vector + trim convention asserted in `internal/backup` (mirrors the agent's).

## Live state check (deployed, no operator action)
Hub 0.40.0 Synced/Healthy; migration applied (`host_escrow.restic_pw_sha256` present; all 3 legacy rows
NULL — demo included). Controller 0.108.0 healthy; the startup report went through the new hub and the
demo's `escrowed` state produced **zero `escrow-confirm` log lines** — Scenario E proven live for free.
Agent 0.79.0 on felhom-pve (56/56 capabilities).

## NOT yet live-exercised
The full auto-confirm chain (fresh enable → ceremony records the hash → ACK → auto-flip) — first real
offsite enable proves it (Peti onboarding runbook). Unit red-proofs carry the logic per the task.

## NEXT
SLICE 4 (soft-quota on `quota_gb`), Peti onboarding runbook (will live-exercise auto-confirm + F4),
NEW-box restore round-trip → retire the old-box archive.