hub v0.51.0: DR-tier-by-default — per-customer dr_tier flag (default ON, legacy backfill from reality), cascade stages, WG-registration auto-provision hook, offsite-requires-DR guard (F-6 policy), host-page capability chips (inactive=neutral)

Claude-Session: https://claude.ai/code/session_01NptTCFtu7dz2Ru89qHRagN

hub/internal/api/handler.go

@@ -2,6 +2,7 @@ package api
 
 import (
 	"bytes"
+	"context"
 	"crypto/subtle"
 	"database/sql"
 	"encoding/base64"
@@ -58,6 +59,13 @@ type Handler struct {
 	// claimEngine is the customer-claim code engine (v0.50.0). nil = claim arc disabled: no codes
 	// issued, no claim field in ACKs/configs — pre-arc behavior exactly.
 	claimEngine *claim.Engine
+
+	// wgRegisteredHook (v0.51.0, DR-tier-by-default scenario A) fires after a host's FIRST WG
+	// peer registration — main.go wires it to the web server's PBSDRAutoProvision so a DR-ON
+	// customer's pbs_dr descriptor lands hands-free (WG registers → provision → the agent's next
+	// desired-state tick). nil = no cascade hook (pre-v0.51.0 behavior). Runs in a detached
+	// goroutine; must never delay or fail the registration response.
+	wgRegisteredHook func(ctx context.Context, customerID string)
 }
 
 // SetClaimEngine wires the customer-claim code engine (nil-safe everywhere it is used).
@@ -65,6 +73,11 @@ func (h *Handler) SetClaimEngine(e *claim.Engine) {
 	h.claimEngine = e
 }
 
+// SetWGRegisteredHook wires the post-WG-registration cascade hook (v0.51.0; nil-safe).
+func (h *Handler) SetWGRegisteredHook(f func(ctx context.Context, customerID string)) {
+	h.wgRegisteredHook = f
+}
+
 // SetLatestVersionProvider wires the registry version checker so the controller report ACK can
 // advertise the latest available version (Phase 2). nil-safe (no latest_version field emitted).
 func (h *Handler) SetLatestVersionProvider(p LatestVersionProvider) {