hub v0.51.0: DR-tier-by-default — per-customer dr_tier flag (default ON, legacy backfill from reality), cascade stages, WG-registration auto-provision hook, offsite-requires-DR guard (F-6 policy), host-page capability chips (inactive=neutral)

Claude-Session: https://claude.ai/code/session_01NptTCFtu7dz2Ru89qHRagN
2026-07-12 20:37:00 +02:00
parent 007946faf4
commit 448a68237a
18 changed files with 824 additions and 87 deletions
@@ -1,5 +1,43 @@
 # Felhom Hub — Changelog

+## v0.51.0 — DR-tier-by-default: per-customer flag + hands-free cascade + offsite coupling + capability chips (2026-07-12)
+
+Hub half of the DR-tier-by-default batch (DRILL-day0-vm-2026-07-12; operator decisions 1–5:
+capability BAKED on every install, activation is THIS flag, DR defaults ON for new customers,
+identity-only escrow PARKED by policy, WG is base infrastructure). Companion: installer v1.15.0
+ agent v0.86.0 (capability `inactive` state).
+
+- **Per-customer `dr_tier` flag** (customer_configs column + form checkbox in the renamed
+  "DR tier (PBS, ep0)" section, replacing the old `pbsdr_enabled` form field). NEW customers
+  default ON; legacy rows were initialized FROM REALITY by a one-time migration backfill
+  (host carries an enabled pbs_dr descriptor → ON, else OFF — never auto-cascade a legacy box;
+  backfill runs only on the ALTER that adds the column, so later operator opt-outs survive).
+- **Cascade semantics** (scenario D): an UNMET precondition (no host / no WG peer / no
+  tenantsync) is no longer a save-blocking error — the flag stores the intent and the edit form
+  shows per-stage status (host enrolled → WG peer → descriptor provisioned → escrow present),
+  reusing the fail-closed guard wording. REAL provisioning failures stay fail-closed (tenantsync
+  error, token-exists → Re-issue).
+- **Hands-free auto-provision** (scenario A): a host's FIRST WG peer registration fires
+  `PBSDRAutoProvision` (api `SetWGRegisteredHook`, wired when tenantsync is enabled) — a DR-ON
+  customer's descriptor provisions with ZERO operator steps and applies on the agent's next
+  desired-state tick. Detached goroutine; never delays/fails the registration response.
+- **Offsite requires the DR tier** (scenario C, drill F-6 CLOSED BY POLICY): `applyOffsite`
+  refuses without the flag — exact message "Offsite backup requires the DR tier — enable it
+  first (the escrow ceremony depends on the PBS key)". No more provisioning into the
+  EscrowState-pending-forever dead end.
+- **Capability chips on the host page** (NEW render surface): the agent's privileged-capability
+  self-check is now visible — ok (blue), degraded (warn / error when critical), and the agent
+  v0.86.0 `inactive` state as a NEUTRAL chip (disabled ≠ degraded). The pre-v1.15.0 pbsdr
+  "binary not found" signature surfaces the migration one-liner (never silently pretend).
+  `.badge-ok` finally defined in style.css (was referenced, fell back to bare `.badge`).
+- Setup-tab installer copy: `hostInstallVersion` 1.12.0 → **1.15.0** (drill F-1), now gated
+  against the installer's SCRIPT_VERSION by `scripts/hostinstall_gates.py`.
+- Tests + red-proofs (all four mutations proven red): coupling gate (guard removed → refused
+  case fails), flag default (default flipped → form test fails), backfill
+  (enabled:false ignored → disabled case fails), auto-provision (hook unhooked → scenario A
+  test fails); plus cascade-wait, chips render (inactive-neutral / degraded-stays / migration
+  hint), and the one-time-backfill-survives-reopen case.
+
 ## v0.50.0 — customer-claim password arc: code engine + email + ACK/config delivery (2026-07-12)

 Hub half of the customer-claim password gate (closes DRILL-day0-vm F-4/F-5; needs controller