# REPORT — controller v0.107.0: offsite hardening (key-auth-first + staged-secret wipe) — DEPLOYED

**Date:** 2026-07-09 · **Class:** implementation. Baseline v0.106.1 → **v0.107.0** (live on guest 9201,
`Up (healthy)`, clean logs). Part of the offsite hardening bundle: pairs with **hub v0.39.0** (F4 re-issue +
F2 scan retry + F5 save UX) and **agent v0.78.0** (`DELETE /escrow/stage-secret`) — both also deployed live.

## What shipped (controller)
- **Key-auth-first bridge** (`internal/offsiteapply`): new `KeyAuthProber` seam + `SFTPKeyAuthProber` (probes
  the already-installed key against the descriptor target, pinned to the freshly-scanned known_hosts,
  BatchMode + 20s budget). On a descriptor change where the key still authenticates: re-pin + reconfigure
  + marker — **no consume, no install**. Kills the stale-descriptor consume-404 loop (seen twice in the live
  e2e) and shrinks the F4 blast radius to genuinely-fresh guests. The probe NEVER weakens identity: scan +
  fingerprint verify still precede it, and a mismatch refuses before any probe (test-asserted with a
  panicking prober). Fresh guests fall through to the unchanged full path.
- **Staged-secret wipe:** `agentapi.WipeStagedEscrowSecret` (DELETE, agent ≥ v0.78.0); the confirm-escrow
  handler wipes the agent-staged repo password on every flip to `escrowed` — best-effort (failure logs a
  loud "NOT wiped" ERROR, never fails the confirm; re-confirm retries). Seam-injectable (`wipeStagedEscrowFn`).

## Tests + companion red-proofs (ALL-GREEN, both red-proofs fired)
- `TestBridge_KeyAuthFirstSkipsConsume` — probe-success: consumer PANICS if called; enabler gets the
  EXISTING key + fresh pin; marker updated. **Red-proof:** deleted the key-auth-first block → the panicking
  consumer fired → FAIL. Reverted.
- `TestBridge_FreshGuestFallsThroughToFullPath` — probe-fail: consume+install exactly once with the
  GENERATED key. **Red-proof:** made probe-fail return early → `cons=0 inst=0` → FAIL. Reverted.
- `TestBridge_HostKeyMismatchRefuses` — now also proves the probe never runs on a failed identity check.
- `TestOffboxWeb_ConfirmWipesStagedSecret` — confirm wipes exactly once; a failing wipe still confirms +
  logs "NOT wiped".

## Live validation (this deploy)
- v0.107.0 on 9201 healthy; the bridge no-ops on the unchanged descriptor (marker match — no probe needed).
- **One-off cleanup executed via the NEW endpoint:** the staged file left behind by the e2e's Option-A
  confirm (`/var/lib/felhom-agent/escrow-stage/restic_repo_password`) was wiped through the controller
  container → agent `DELETE /escrow/stage-secret` → `{"removed":true}`; the file is GONE on felhom-pve, and
  an idempotent re-wipe returned `{"removed":false}`. Token handled in a shell var only.

## NOT exercised live
Hub F4 re-issue (would reset a real credential — the demo's working offsite must not be touched; a live
exercise needs a throwaway customer under supervision). Unit-tested with the exactly-1-scope red-proof.
F5 (submit-disable JS) ships in the hub template — visible on the next operator save.

## NEXT
SLICE 3 (escrow auto-confirm — inherits the wipe-on-escrowed), SLICE 4 (soft-quota), NEW-box restore
round-trip → retire the old-box archive, Peti onboarding runbook.