felhom-controller/REPORT.md

REPORT — controller v0.106.1 + offsite provisioning LIVE end-to-end validation — PASS

Date: 2026-07-09 · Class: operational validation (supervised runbook) + hotfix. Baseline v0.106.0 → v0.106.1 (live on guest 9201). Pairs with hub v0.38.1. Full record: felhom.eu/documentation/audits/VALIDATION-offsite-provisioning-e2e-2026-07-09.md.

What happened

First live run of the SLICE 2 apply-bridge, driven end-to-end through the real pipeline (no hand-set state): hub provisioned sub-account 269008 (u629488-sub1) on the new dedicated-project pool box (611714) → descriptor v6 + one-time password → controller config-refresh (15-min report ACK) → self-restart → bridge applied cleanly: scan + fingerprint verify (BEFORE consume) → keypair → consume-once → sshpass -e ssh-copy-id -s -f with the pinned known_hosts (StrictHostKeyChecking=yes) → SFTP key-auth verify → offbox configured → EscrowState="pending" → marker persisted.

v0.106.1 — the one live bug (F3)

ssh-copy-id -s (SFTP mode) mktemp's its batch file under ~/.ssh; the container image ships without /root/.ssh → the install died locally after the password was consumed. Fail-safe held exactly as designed (loud "password is spent" log, no marker, no offbox config; the password never left the box). Fix: SSHCopyIDInstaller ensures ~/.ssh (0700) exists. Container probes (throwaway key + wrong password, no secrets) isolated the bug AND proved the pin chain sound: pinned single-line known_hosts verifies cleanly; wrong password fails as Permission denied (sshpass exit 5).

Live proofs (all green)

• Consume-once: hub one_time_secrets.consumed_at set, single row (read-only DB check).
• Fail-safe, twice: the stale-v4 descriptor run hit consume→404 → clean abort + retry note; the F3 run hit install-fail → "password is spent — reset on the hub", no marker, no half-configured offbox.
• fork-4 run gate: manual POST /backup/offbox/run while pending → refused ("A NAS-mentés a kulcs letétbe helyezésére vár."). No ciphertext before escrow.
• Restart idempotency: bootstrap restart → zero bridge activity (marker no-op), no re-consume.
• Closing the loop (Option A, Viktor-approved): the repo password was already escrowed (preserved by WriteOffboxSecrets — the DR-inject seam), so confirm-escrow was truthful without a new ceremony → escrowed → first run: restic repo initialized, 2 apps (audiobookshelf, immich), 2 snapshots, 34s — independently verified by SFTP-listing the repo objects with the bridge-installed key + pinned host key.

Standing state

Demo offbox targets the NEW box (u629488-sub1…:/home/felhom-repo), escrowed, un-paused, daily schedule. Old-box offsite (u629193-sub1) untouched — frozen archive until a NEW-box restore round-trip is verified.

Open follow-ups (controller-relevant)

• F2 (hub): fresh-subaccount DNS lag → first-save scan 502; retry-with-backoff in ProvisionOffsite.
• F4 (hub): no password-reset path — the recovery the controller's "reset on the hub" message references doesn't exist yet; today's recovery is delete-subaccount + re-save.
• SLICE 3 (escrow auto-confirm — replaces the manual confirm exercised here), SLICE 4 (soft-quota).
• NEW-box restore round-trip, then retire the old sub-account.