spike: PBS DR tier provisioning SLICE 0 — all 3 mechanisms settled (token-create impossible -> pinned sudoers; ep0 tenancy op-set + stdout secret transport proven; encryption-key autogen births K, pvesm remove deletes it)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
2026-07-10 20:12:26 +02:00
parent 4703b9ec4e
commit 00afadc1fe
3 changed files with 204 additions and 17 deletions
@@ -3,6 +3,17 @@
 > Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub),
 > `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`.

+- **2026-07-10 — SPIKE: PBS DR tier auto-provisioning SLICE 0 — all three mechanisms SETTLED.** Record:
+  `documentation/audits/SPIKE-pbs-tier-provisioning-2026-07-10.md`. (1) PVE token storage-create **impossible**
+  (create/modify/delete all check `/storage` root) → **sudoers vector proven** (pinned-id alias, cycle green as
+  the agent user, unpinned denied; secret must ride a stdin-wrapper, never sudo argv). (2) ep0 tenancy op-set +
+  one-time-secret-over-SSH-stdout **proven live on ep0** (🛑 Viktor-approved; read/write cross-tenant 403s);
+  current peersync channel can't carry it → slice 1 ships a second forced-command surface (`felhom-tenantsync`).
+  (3) `pvesm add pbs --encryption-key autogen` births K at `PBSEncKeyPath` + vzdump lands ciphertext (doc-06
+  property) + escrow-create finds K. **⚠ `pvesm remove` DELETES K** → re-apply must be set-only. All spike
+  artifacts torn down; flags: orphan `root@pam!spike` on ep0 scratch; demo's §4b step-3 storage grants absent.
+  Epic slice map in the record §5.
+
 - **2026-07-10 — new-box restore round-trip VALIDATED + old-box archive RETIRED.** Record:
  `documentation/audits/VALIDATION-newbox-restore-2026-07-10.md`. Both toggled apps restored from the
  production pool box via the real endpoint — **9/9 sha256-identical** (immich 44MB db-dump exact,