hub v0.153.0: off-site and PBS-DR re-issues session only too (R-1059 = A, operator 2026-10-15); R-1059 closed

Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

documentation/architecture/05-hub-architecture.md

@@ -553,7 +553,7 @@ Configuration, which `floor:read` opens; the mail hold is a banner, and held mai
 | `vouch` | — | `POST /configuration/artifacts` (golden, agent, MinAgent) |
 | `customers` | new/edit forms, DR recipe (secret-free) | block/unblock, geo disable (create, edit, create-config, claim resend: session only since v0.153.0, decision 252) |
 | `hosts` | host page, log bundles, log tails | operator actions, log-bundle and log-tail requests |
-| `offsite` | run the key check now (it reads, changes no key) | window grant, weekly windows on/off, off-site and PBS-DR re-issue, freeze |
+| `offsite` | run the key check now (it reads, changes no key) | window grant, weekly windows on/off, freeze (the two re-issues: session only since v0.153.0, R-1059) |
 | `os` | the fleet queue (`/os/fleet`) | approve (guest, Docker, Proxmox, kernel), ring, on/off |
 | `mailhold` | — | release |
 
@@ -624,9 +624,9 @@ method (405), so a token gets 403.
 | `/offsite/windows-enabled` | — | `offsite:write` |  |
 | `/os/{id}` | `os:read` | `os:write` |  |
 | `/offsite/key-audit` | — | `offsite:read` | Runs the daily key check now: it reads keys and reports, it changes none. |
-| `/configs/{id}/offsite-reissue` | — | `offsite:write` |  |
+| `/configs/{id}/offsite-reissue` | — | **session only** | Resets the household's off-site password and stages a fresh one-time secret for the box (R-1059, ruling 2026-10-15). |
 | `/configs/{id}/claim-resend` | — | **session only** | Sends a fresh claim code to the household's e-mail (R-1055, operator ruling 2026-10-15 13:20). |
-| `/configs/{id}/pbsdr-reissue` | — | `offsite:write` |  |
+| `/configs/{id}/pbsdr-reissue` | — | **session only** | Re-keys the household's PBS-DR token and stages a fresh one-time secret for the box (R-1059, ruling 2026-10-15). |
 | `/configs/{id}/offsite-freeze` | — | `offsite:write` |  |
 | `/configs/{id}/preview` | **session only** | — | The preview is the generated controller config — it carries the controller API key. |
 | `/configs/{id}/regen-password` | — | **session only** |  |
@@ -634,7 +634,7 @@ method (405), so a token gets 403.
 | `/configs/{id}` | `overview:read` | `overview:read` |  |
 
 **Session only, by reason:** a household credential or link is sent, minted or its e-mail changed (claim resend,
-customer create and edit, create-config — `09` §3 decision 252, `TestToken_CredentialAndLinkRoutesAreSessionOnly`); a
+customer create and edit, create-config, the off-site and PBS-DR re-issues — `09` §3 decision 252, `TestToken_CredentialAndLinkRoutesAreSessionOnly`); a
 secret is shown or minted (reveal recovery credential; the customer page — it embeds the
 owner passphrase and the controller API key; the config preview — the generated controller config carries that key;
 regen-password; the self-bind link; an appliance bind — it delivers the passphrase to the box that asks); something is
@@ -665,9 +665,8 @@ replace the global key yet (R-1054).
   takeover path. Closed in v0.153.0 (operator ruling 2026-10-15 13:20, `09` §3 decision 252, R-1055): every route that
   sends, mints or reveals a household credential or link, or changes the e-mail, is session only. The group keeps block,
   unblock and geo disable.
-- **An `offsite:write` token** can re-issue a household's off-site or PBS-DR credential (a fresh one-time secret staged
-  for the box). It never sees the secret; it can break a household's backup until the box picks the new one up. Open
-  for the operator (R-1059).
+- **An `offsite:write` token** could, in v0.152.0, re-issue a household's off-site or PBS-DR credential and so stop its
+  backup for a while. Session only since v0.153.0 (operator 2026-10-15, R-1059); the group keeps the windows and freeze.
 - **No token** can reach the break-glass password, the escrow, the off-site keys, or any destructive verb.
 
 ### 17.6 No operator password configured = closed

documentation/architecture/09-update-architecture.md

@@ -945,6 +945,8 @@ its length, and both fixes cost something the household would notice — operato
      self-bind link), create-config from a report (mints passphrase + API key) — plus the three already session only:
      the self-bind link, regen-password, appliance bind. „Customers: write" keeps block, unblock and geo disable. Pinned by
      `TestToken_CredentialAndLinkRoutesAreSessionOnly` (hub v0.153.0, `05` §17.3). Amends decision 251's groups.
+     **Extended the same day (operator, R-1059 = A):** the off-site and PBS-DR re-issues (they mint a household
+     credential for the box) are session only too; „Off-site: write" keeps the windows and freeze.
 
 ### 2026-10-15 (07:48–08:20) — bake first; Plex through its own key; HSTS one day (recorded before the media build)
 

documentation/architecture/13-threat-model.md

@@ -65,7 +65,7 @@ OS packages (exact versions, apt-signed), the installer script (by tag, R-980).
 | **added (R-1007):** controller → an app's own job queue | holds — nothing new | the `after_unclean_boot` commands run inside the app's container through the docker socket the controller already holds, and read the app's database with a read-only session: no key into the household's account, nothing a compromised controller could not already do (exec in any app, read its database). The household's lost-file names stay on the box (`app.yaml`, the app page); the operator event carries counts only, and a failing command's output is never logged (security review of controller `8d862e4`, fixed in `3b85a0c`) |
 | **added:** agent ↔ root on the host | holds by the sudoers | every root verb is one regex-anchored line or a root wrapper that re-checks its input (`03` §3); agent v0.156.1 adds one delete: `felhom-vzdump-partial-clean` removes only a DEAD half-written vzdump of the named guest on a `dir` storage (no vzdump on the host, nothing holding it open) — a compromised agent gains the deletion of a leftover that is not a backup |
 | agent ↔ hub | holds for destructive ops | signed jobs verified in the documented order; unsigned spec has no size bounds (R-984) |
-| **added 2026-10-15:** operator script ↔ hub UI | holds from hub v0.152.0 | scripts used the operator password, which can do everything; now a scoped, expiring, hashed token (`05` §17); a token never reaches a secret, a delete or `/api/v1`. No token sends, mints or reveals a household credential or link since v0.153.0 (`09` §3 decision 252, R-1055 closed); open: an `offsite:write` token can re-issue a household's off-site credential (R-1059); the global API key is still one all-powerful bearer (R-1054) |
+| **added 2026-10-15:** operator script ↔ hub UI | holds from hub v0.152.0 | scripts used the operator password, which can do everything; now a scoped, expiring, hashed token (`05` §17); a token never reaches a secret, a delete or `/api/v1`. No token sends, mints or reveals a household credential or link since v0.153.0 (`09` §3 decision 252, R-1055 closed) — the off-site re-issues included (R-1059); the global API key is still one all-powerful bearer (R-1054) |
 | controller ↔ hub | **did not hold until 2026-10-12** | the global key was public (R-950, rotated) and three routes needed no key (R-951, fixed); per-box keys are bound to their box (R-955) |
 | box ↔ PBS | holds as written | ciphertext only; the zero-knowledge wording is stronger than a live box allows (R-985) |
 | guest ↔ Proxmox host | holds | the guest has no Proxmox credentials (measured) |