felhom-controller/REPORT.md

REPORT — controller v0.108.0: SLICE 3 hub-verified escrow auto-confirm — DEPLOYED

Date: 2026-07-09 · Class: implementation. Baseline v0.107.0 → v0.108.0 (live on 9201, Up (healthy)). The chain pairs: agent v0.79.0 (ceremony uploads restic_pw_sha256) + hub v0.40.0 (stores it; report ACK serves escrow:{identity_blob_present, restic_pw_sha256, created_at}) — both live.

What shipped (controller)

report.EscrowAutoConfirmer — runs on every report ACK; flips offbox EscrowState pending→escrowed ONLY when sha256(local repo_password) == restic_pw_sha256 from the ACK. Verifies the RIGHT fact: not "a blob exists" but "the blob covers the CURRENT key" (a stale blob — re-provision, inject, drive history — must never truthfully-claim; that would re-open the exact un-recoverable-ciphertext gap fork-4 closed).

• Match → flip + wipe the agent-staged secret (the v0.107.0 DELETE path; best-effort, loud on failure).
• Mismatch → stays pending + LOUD warn naming the fix ("run the escrow ceremony"), deduped per distinct hash (not per 15-min cycle).
• No row / NULL hash / hash-without-identity-blob / no local password file → silently pending (fail-closed).
• Non-pending → total no-op — auto-UN-confirm does not exist.
• backup.HashResticPassword (canonical: sha256 hex of the TRIMMED string) + Manager.OffboxRepoPasswordHash; pinned cross-repo test vector (same in felhom-agent) so the two hashers can never drift silently.
• Manual POST /backup/offbox/confirm-escrow → documented deprecated fallback (legacy hash-less blobs).

Tests + companion red-proof (ALL-GREEN, red-proof fired)

Scenarios: A match→flip+wipe (+repeat ACK no-op); B stale-blob stays pending + warn-once-per-hash (+new hash warns again); C all silent-pending cases; E never acts outside pending (even a mismatch on an escrowed target is silent); wipe-failure keeps the confirm. Red-proof: modeled the blob-present-only check → the stale-blob AND hash-less scenarios flipped when they must not → both tests FAILED. Reverted. Pinned vector + trim convention asserted in internal/backup (mirrors the agent's).

Live state check (deployed, no operator action)

Hub 0.40.0 Synced/Healthy; migration applied (host_escrow.restic_pw_sha256 present; all 3 legacy rows NULL — demo included). Controller 0.108.0 healthy; the startup report went through the new hub and the demo's escrowed state produced zero escrow-confirm log lines — Scenario E proven live for free. Agent 0.79.0 on felhom-pve (56/56 capabilities).

NOT yet live-exercised

The full auto-confirm chain (fresh enable → ceremony records the hash → ACK → auto-flip) — first real offsite enable proves it (Peti onboarding runbook). Unit red-proofs carry the logic per the task.

NEXT

SLICE 4 (soft-quota on quota_gb), Peti onboarding runbook (will live-exercise auto-confirm + F4), NEW-box restore round-trip → retire the old-box archive.