hub v0.68.0 — auth_failed self-heal, consumed_at honesty gauge, wrapper drift (R-39 + R-50b(a))

Completes the hub half of R-39's fleet fix on top of the generation core (c484aa2).

pbsdrheal gains an auth_failed TRIGGER — a new trigger in the existing machine, not a
new machine. A box whose credential PBS rejects escalates to a fresh mint, never a
re-stage (which would re-feed the secret PBS just rejected), through the EXISTING damper:
a 401 flap must not become a secret-minting chain. With the generation stamp this closes
the loop end to end — agent proves the 401, hub re-keys, generation advances, descriptor
hash moves, agent re-consumes.

consumed_at honesty gauge: a staged secret still unconsumed past a 15-minute grace while
the box reports `applied` is surfaced with its own event. That is the exact 2026-07-18
fingerprint and a disagreement no single tier can see alone. Deliberately a SURFACE, not
a heal — auto-re-issuing on it would mint a second secret on top of an unconsumed one,
which is the mint/consume race R-39(a) already recorded. One event per distinct report,
and an honestly-stuck box does not double-report (its unconsumed secret is the symptom
being healed, not a contradiction).

R-50b(a): ArtifactManifest.WrapperSHA256 + operator field + host-page drift surface. The
PBS wrapper is root-owned 0755 and the pinned sudoers vector, yet installed unversioned
from raw/branch/main and absent from every manifest. Agents >=0.91.0 report the installed
hash; a mismatch is surfaced. An unknown on EITHER side reads as quiet, never as drift —
lighting every host amber on rollout day is how a warning becomes background noise. The
delivery channel itself stays R-50b(b)/(c).

Compatibility unchanged: safe for 0.90.0 agents (unknown JSON key dropped); the re-arm
and auth-honesty guarantees need agent >=0.91.0, so MinAgent moves only after the fleet
has self-updated.

Tests: auth_failed escalate/debounce/recovery-forgets-streak; honesty gauge incl. grace
window, the restage edge (consumed_at deliberately NULLed), consumed-never-alarms, and
honest-stuck-no-double-report; wrapper drift incl. both unknown directions. Red-proof run
at the assertion level: removing the auth_failed arm fails the escalation tests with
reissues=0.

hub/internal/web/configs.go

@@ -1019,6 +1019,12 @@ func normalizeSHA256(raw string) (string, bool) {
 // that version's sha256 from Gitea itself (never trusting a client-supplied checksum), so there is no
 // hand-copied sha to get wrong. When no Gitea client is configured (no registry creds) it falls back
 // to the submitted sha256 (legacy manual path). Empty version clears that artifact.
+// sha256HexRe validates an operator-typed sha256 (R-50b(a) wrapper hash): exactly 64 lowercase hex
+// characters. The agent/golden hashes are resolved from the package registry instead, so this is the
+// only manifest field a human types by hand — and a truncated paste must be refused, not stored as a
+// hash that can never match.
+var sha256HexRe = regexp.MustCompile(`^[0-9a-f]{64}$`)
+
 func (s *Server) handleSetArtifacts(w http.ResponseWriter, r *http.Request) {
 	if err := r.ParseForm(); err != nil {
 		http.Error(w, "Bad request", http.StatusBadRequest)
@@ -1037,18 +1043,27 @@ func (s *Server) handleSetArtifacts(w http.ResponseWriter, r *http.Request) {
 		http.Redirect(w, r, "/configuration?flash=artifact_sha_invalid", http.StatusSeeOther)
 		return
 	}
+	// R-50b(a): the PBS-DR wrapper hash is operator-typed, not resolved from the package registry —
+	// unlike the agent binary and the golden, this artifact is not published there at all. It is
+	// installed from raw/branch/main, which is exactly the drift this field makes visible.
+	wrapperSHA := strings.ToLower(strings.TrimSpace(r.FormValue("wrapper_sha256")))
+	if wrapperSHA != "" && !sha256HexRe.MatchString(wrapperSHA) {
+		http.Redirect(w, r, "/configuration?flash=artifact_sha_invalid", http.StatusSeeOther)
+		return
+	}
 	if err := s.store.SetArtifactManifest(store.ArtifactManifest{
 		AgentVersion:  agentVer,
 		AgentSHA256:   agentSHA,
 		GoldenVersion: goldenVer,
 		GoldenSHA256:  goldenSHA,
 		MinAgent:      minAgent,
+		WrapperSHA256: wrapperSHA,
 	}); err != nil {
 		s.logger.Printf("[ERROR] Failed to set artifact manifest: %v", err)
 		http.Error(w, "Internal error", http.StatusInternalServerError)
 		return
 	}
-	s.logger.Printf("[INFO] Artifact manifest set: agent=%s golden=%s min_agent=%q", agentVer, goldenVer, minAgent)
+	s.logger.Printf("[INFO] Artifact manifest set: agent=%s golden=%s min_agent=%q wrapper_sha=%t", agentVer, goldenVer, minAgent, wrapperSHA != "")
 	// Agent-plane immediate-sync (Direction-2a, v0.59.0): a MinAgent-floor / vouched-agent change is
 	// a fleet-wide agent-plane intent shift. Fire-and-forget nudge every box so it re-reports at
 	// once (the self-update train's signed op / floor re-evaluation lands in seconds, not ≤15 min).