docs: GL-7 closeout — tester agreement + hub 0.36.0 CHANGELOG/REPORT/CONTEXT + GO-LIVE G7 done

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

hub/CHANGELOG.md

@@ -1,5 +1,36 @@
 # Felhom Hub — Changelog
 
+## v0.36.0 — customer page: passphrase hardening + interactive install-command generator (TASK GL-7) (2026-07-09)
+
+Two coupled, security-first changes to the operator-facing customer page (`customer_unified.html` +
+`configs.go`). felhom.eu only; agent + host-install untouched.
+
+- **Passphrase hardening (ships the security win).** The per-customer retrieval passphrase was
+  rendered in cleartext twice — the visible `#retrieval-pw` node and baked into the Option-3 debug
+  curl's `X-Retrieval-Password:` header. Now: `#retrieval-pw` renders a masked bullet run by default
+  with **reveal** (`toggleSecret`) + **copy** (`copySecret`) controls, the value carried in
+  `data-secret` (the existing reveal model). The Option-3 command carries a
+  `<YOUR-RETRIEVAL-PASSWORD>` placeholder — the secret is NEVER in a copyable command block. (A
+  zero-secret-in-DOM reveal-on-demand fetch is a deliberate future follow-up, not this task.)
+- **Interactive install-command generator.** The three hard-coded install `<code>` blocks became a
+  client-side builder (vanilla JS — no framework, CDN, or network) that assembles a live-updating
+  command from form controls, emitting ONLY real host-install **v1.12.0** flags in a
+  download-then-run shape (never `curl | bash`). CustomerID is prefilled from the server
+  (`ScriptVersion`/`data-customer-id` via `pageData`); a byo selection requires `--cores`/`--memory`
+  (enforced client-side with a `.gen-req`/`gen-msg` prompt); caps/mode are placeholders, never silent
+  defaults. Graceful **JS-off static fallback**: the Option-1/2 code nodes keep a
+  `--customer-id … --mode <appliance|byo>` command. The curated control surface excludes the seven
+  dangerous/operator-only flags (`--force`, `--rotate-recovery`, `--enable-oob`, `--remove-golden`,
+  `--uninstall`, `--adopt-pool`, `--rescope-acl`) — they are never offered as controls.
+- **`configs.go`:** `const hostInstallVersion = "1.12.0"`; `pageData.ScriptVersion` added + populated.
+- **Tests** (`render_test.go`): `TestTemplates_PassphraseHardened` (secret NOT in the Option-3
+  command, placeholder present, masked-by-default bullet run, `data-secret` populated, reveal/copy
+  controls present; red-proof = revert Option-3 to the raw secret → fails) and
+  `TestTemplates_InstallGenerator` (all curated control ids present, script version + `data-customer-id`
+  rendered, static-fallback command present, and none of the seven excluded flags appear page-wide).
+- **Style** (`style.css`): `.gen-controls`/`.gen-radios`/`.gen-radio`/`.gen-check(s)`/number inputs/
+  `.gen-msg` — dark palette, 2px radius.
+
 ## v0.35.0 — OOB operator access: operator peer + oob_peer_ip/oob_operator_ssh_key + OOB health alert (TASK H1) (2026-07-05)
 
 The hub half of the merged E1+H1 operator-SSH-access feature (agent half = felhom-agent v0.72.0).