spike: PBS DR tier provisioning SLICE 0 — all 3 mechanisms settled (token-create impossible -> pinned sudoers; ep0 tenancy op-set + stdout secret transport proven; encryption-key autogen births K, pvesm remove deletes it)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

REPORT.md

@@ -2,22 +2,34 @@
 
 > **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).
 
-## TASK — hub v0.43.1: Git Sync form hint (credentials optional) — 2026-07-10
+## SPIKE — PBS DR tier auto-provisioning, SLICE 0: the three load-bearing mechanisms — 2026-07-10
 
-**Pairs with controller v0.112.0 (anonymous registry self-update — full report in
-felhom-controller/REPORT.md).** One template string, no behavior change: the config editor's Git Sync
-section looked load-bearing, but the credentials matter only for a PRIVATE app catalog — since
-controller v0.112.0 version discovery + self-update work without them (anonymous Docker v2 token flow).
+**No production code — findings record at
+`documentation/audits/SPIKE-pbs-tier-provisioning-2026-07-10.md`.** All three unproven mechanisms of the
+"PBS DR tier" epic got empirical answers; every probe artifact was `spike-*`-named and torn down (asserted);
+the demo's real `felhom-offsite`/`felhom-pbs` storages re-verified active afterwards. Viktor approved the
+one 🛑 (the ep0 touch) mid-run.
 
-- `config_form.html` Git Sync section gains the hint: **"Opcionális — csak privát
-  alkalmazás-katalógushoz. A verziófrissítés enélkül is működik."**
-- Deployed via GitOps: image `0.43.1`, manifest bump, ArgoCD sync → Synced/Healthy, rollout complete.
-- Green gate green; render tests cover template parse.
-
-**Pending operator step (per the controller task spec):** after the floor bump rolls Peti to 0.112.0,
-delete the temporary Git Sync creds from Peti's hub config → next config pull → Peti's settings page
-shows "Registry: nyilvános (hitelesítés nélkül)" with zero credentials on the box. (Verified live on
-the credential-less demo box already: anonymous check OK, latest resolved, mode line renders.)
-
-*(Previous report — hub v0.43.0 remote app-log diagnostics incl. the completed live tail round-trip —
-is recorded in hub/CHANGELOG.md v0.43.0 and the git history of this file.)*
+- **Probe 1 (demo host): path-scoped token create is IMPOSSIBLE.** `POST/PUT/DELETE /storage*` all 403 with
+  `Permission check failed (/storage, Datastore.Allocate)` — the whole entry-lifecycle CRUD checks the
+  `/storage` ROOT; `/storage/<id>` ACLs govern usage only. **Probe 1b settled the fallback:** a pinned-id
+  sudoers alias (`pvesm add/set/remove <id>`, `pveum acl modify /storage/<id>`) — full cycle green as the
+  `felhom-agent` user via `sudo -n`, unpinned id denied. Gotcha: sudo logs argv → the token secret must go
+  through a stdin-reading root wrapper, never `sudo pvesm add --password …`.
+- **Probe 2 (ep0, 🛑): the tenancy op-set + secret transport PROVEN.** Recon recorded the surface (one
+  `restrict`+forced-command key, one sudoers line; the peersync user can sudo nothing else — live-proven).
+  Throwaway `spike-tenant` on the real `felhom-offsite`: namespace + privsep token + dual-grant, the token
+  secret returned over SSH stdout (36 bytes, never persisted on ep0, never displayed), S4 isolation asserts
+  green incl. a real cross-tenant WRITE 403. Ordering gotchas recorded (token-before-ACL; delete-token purges
+  its ACLs; no `--output-format` on generate-token). Slice-1 recommendation: a second forced-command surface
+  (`felhom-tenantsync`, own keypair + sudoers line), peersync untouched.
+- **Probe 3 (demo host): `pvesm add pbs … --encryption-key autogen` works end-to-end.** Entry active, K born
+  at `/etc/pve/priv/storage/<id>.enc` (0600, = `PBSEncKeyPath` on demo), vzdump of a small guest lands as
+  **ciphertext** PBS-side (`crypt-mode: encrypt` — the doc-06 property), `escrow-create` would find K.
+  **⚠ `pvesm remove` DELETES the `.enc` (K!) + `.pw`** → the epic's re-apply must be `pvesm set`-only.
+- **Flags surfaced (pre-existing):** orphan `root@pam!spike` DatastoreAdmin on ep0 `/datastore/scratch`;
+  the demo host is missing the §4b step-3 `/storage/felhom-pbs|felhom-offsite` FelhomAgentStore grants
+  (backups still green — needs a deliberate re-assert before slice 2 codifies the self-grant); 180's
+  `felhom@pbs!n100` is datastore-wide DatastoreAdmin (dev-grade, don't copy).
+- **Epic slice map** (hub tenantsync + consume-once → agent apply-bridge with stdin-wrapper + set-only
+  re-apply → DR schedule/monitoring → Peti ceremony one-liner) in the record §5.