# REPORT — controller v0.106.1 + offsite provisioning LIVE end-to-end validation — **PASS**

**Date:** 2026-07-09 · **Class:** operational validation (supervised runbook) + hotfix. Baseline v0.106.0 →
**v0.106.1** (live on guest 9201). Pairs with hub v0.38.1. **Full record:**
`felhom.eu/documentation/audits/VALIDATION-offsite-provisioning-e2e-2026-07-09.md`.

## What happened
First live run of the SLICE 2 apply-bridge, driven end-to-end through the real pipeline (no hand-set state):
hub provisioned sub-account 269008 (`u629488-sub1`) on the new dedicated-project pool box (611714) →
descriptor v6 + one-time password → controller `config-refresh` (15-min report ACK) → self-restart →
**bridge applied cleanly**: scan + fingerprint verify (BEFORE consume) → keypair → consume-once →
`sshpass -e ssh-copy-id -s -f` with the **pinned known_hosts (`StrictHostKeyChecking=yes`)** → SFTP key-auth
verify → offbox configured → `EscrowState="pending"` → marker persisted.

## v0.106.1 — the one live bug (F3)
`ssh-copy-id -s` (SFTP mode) mktemp's its batch file under `~/.ssh`; the container image ships without
`/root/.ssh` → the install died **locally** after the password was consumed. Fail-safe held exactly as
designed (loud "password is spent" log, no marker, no offbox config; the password never left the box).
Fix: `SSHCopyIDInstaller` ensures `~/.ssh` (0700) exists. Container probes (throwaway key + wrong password,
no secrets) isolated the bug AND proved the pin chain sound: pinned single-line known_hosts verifies cleanly;
wrong password fails as `Permission denied` (sshpass exit 5).

## Live proofs (all green)
- **Consume-once:** hub `one_time_secrets.consumed_at` set, single row (read-only DB check).
- **Fail-safe, twice:** the stale-v4 descriptor run hit consume→404 → clean abort + retry note; the F3 run
  hit install-fail → "password is spent — reset on the hub", no marker, no half-configured offbox.
- **fork-4 run gate:** manual `POST /backup/offbox/run` while pending → refused
  ("A NAS-mentés a kulcs letétbe helyezésére vár."). No ciphertext before escrow.
- **Restart idempotency:** bootstrap restart → zero bridge activity (marker no-op), no re-consume.
- **Closing the loop (Option A, Viktor-approved):** the repo password was already escrowed (preserved by
  `WriteOffboxSecrets` — the DR-inject seam), so confirm-escrow was truthful without a new ceremony →
  `escrowed` → first run: **restic repo initialized, 2 apps (audiobookshelf, immich), 2 snapshots, 34s** —
  independently verified by SFTP-listing the repo objects with the bridge-installed key + pinned host key.

## Standing state
Demo offbox targets the NEW box (`u629488-sub1…:/home/felhom-repo`), `escrowed`, un-paused, daily schedule.
Old-box offsite (`u629193-sub1`) untouched — frozen archive until a NEW-box restore round-trip is verified.

## Open follow-ups (controller-relevant)
- F2 (hub): fresh-subaccount DNS lag → first-save scan 502; retry-with-backoff in `ProvisionOffsite`.
- F4 (hub): no password-reset path — the recovery the controller's "reset on the hub" message references
  doesn't exist yet; today's recovery is delete-subaccount + re-save.
- SLICE 3 (escrow auto-confirm — replaces the manual confirm exercised here), SLICE 4 (soft-quota).
- NEW-box restore round-trip, then retire the old sub-account.