felhom-controller/REPORT.md

REPORT — controller v0.107.0: offsite hardening (key-auth-first + staged-secret wipe) — DEPLOYED

Date: 2026-07-09 · Class: implementation. Baseline v0.106.1 → v0.107.0 (live on guest 9201, Up (healthy), clean logs). Part of the offsite hardening bundle: pairs with hub v0.39.0 (F4 re-issue + F2 scan retry + F5 save UX) and agent v0.78.0 (DELETE /escrow/stage-secret) — both also deployed live.

What shipped (controller)

• Key-auth-first bridge (internal/offsiteapply): new KeyAuthProber seam + SFTPKeyAuthProber (probes the already-installed key against the descriptor target, pinned to the freshly-scanned known_hosts, BatchMode + 20s budget). On a descriptor change where the key still authenticates: re-pin + reconfigure
  • marker — no consume, no install. Kills the stale-descriptor consume-404 loop (seen twice in the live e2e) and shrinks the F4 blast radius to genuinely-fresh guests. The probe NEVER weakens identity: scan + fingerprint verify still precede it, and a mismatch refuses before any probe (test-asserted with a panicking prober). Fresh guests fall through to the unchanged full path.
• Staged-secret wipe: agentapi.WipeStagedEscrowSecret (DELETE, agent ≥ v0.78.0); the confirm-escrow handler wipes the agent-staged repo password on every flip to escrowed — best-effort (failure logs a loud "NOT wiped" ERROR, never fails the confirm; re-confirm retries). Seam-injectable (wipeStagedEscrowFn).

Tests + companion red-proofs (ALL-GREEN, both red-proofs fired)

• TestBridge_KeyAuthFirstSkipsConsume — probe-success: consumer PANICS if called; enabler gets the EXISTING key + fresh pin; marker updated. Red-proof: deleted the key-auth-first block → the panicking consumer fired → FAIL. Reverted.
• TestBridge_FreshGuestFallsThroughToFullPath — probe-fail: consume+install exactly once with the GENERATED key. Red-proof: made probe-fail return early → cons=0 inst=0 → FAIL. Reverted.
• TestBridge_HostKeyMismatchRefuses — now also proves the probe never runs on a failed identity check.
• TestOffboxWeb_ConfirmWipesStagedSecret — confirm wipes exactly once; a failing wipe still confirms + logs "NOT wiped".

Live validation (this deploy)

• v0.107.0 on 9201 healthy; the bridge no-ops on the unchanged descriptor (marker match — no probe needed).
• One-off cleanup executed via the NEW endpoint: the staged file left behind by the e2e's Option-A confirm (/var/lib/felhom-agent/escrow-stage/restic_repo_password) was wiped through the controller container → agent DELETE /escrow/stage-secret → {"removed":true}; the file is GONE on felhom-pve, and an idempotent re-wipe returned {"removed":false}. Token handled in a shell var only.

NOT exercised live

Hub F4 re-issue (would reset a real credential — the demo's working offsite must not be touched; a live exercise needs a throwaway customer under supervision). Unit-tested with the exactly-1-scope red-proof. F5 (submit-disable JS) ships in the hub template — visible on the next operator save.

NEXT

SLICE 3 (escrow auto-confirm — inherits the wipe-on-escrowed), SLICE 4 (soft-quota), NEW-box restore round-trip → retire the old-box archive, Peti onboarding runbook.