host-install v1.7.0: 3b-fix — Datastore.Audit box-wide (restore drive visibility)

v1.6.0 put Datastore.Audit in the per-storage Store role, hiding the enrolled
drives (felhom-usb/felhom-flash) from the agent's storage enumeration → false
detach alerts. Move Datastore.Audit (read-only) to box-wide Base; keep write
privs (Allocate/AllocateSpace) per-storage → visibility restored, write
containment unchanged. apply_scoped_acl reordered Base-before-Store (gap-free
re-apply). Live-repaired felhom-pve (role modify, no agent stop): drives back,
alerts cleared, write-containment + guest-403 re-confirmed. bash -n + shellcheck
clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Felhom scripts — Changelog
 
+## felhom-host-install.sh v1.7.0 — 3b-fix: `Datastore.Audit` box-wide (restore drive visibility) (2026-07-01)
+
+Fixes a regression the v1.6.0 pool-scoped ACL introduced: `Datastore.Audit` was placed in the
+per-storage `Store` role (granted only on `local`/`local-lvm`/`felhom-pbs`), which **excluded the
+enrolled removable drives** `felhom-usb`/`felhom-flash`. The agent enumerates storage via
+`ListStorage`/`NodeStorage` (both gated by `Datastore.Audit` — `internal/storage/observe.go`), so it
+could no longer SEE the drives → false "Meghajtó leválasztva" (drive detached) alerts + drives absent
+from the agent-view. (The v1.6.0 swap's "felhom-usb → 403" was mis-read as blast-radius success;
+felhom-usb is Felhom's OWN customer drive, not an out-of-scope object.)
+
+- **`Datastore.Audit` moved from Store → Base** (`PVE_PRIVS_BASE` now `"Sys.Audit SDN.Use
+  Datastore.Audit"`; `PVE_PRIVS_STORE` now `"Datastore.Allocate Datastore.AllocateSpace"`). Audit is
+  read-only metadata, so box-wide Audit restores visibility of ALL storages (incl. dynamically-enrolled
+  drives — no per-drive grant ever needed) while the **write** privs (`Allocate`/`AllocateSpace`) stay
+  per-storage → write/allocate blast-radius containment is UNCHANGED. Confirmed at source: the agent
+  creates no PVE storage (no `POST /storage`/`pvesm add`); drives are dir-storages it observes + mounts
+  via host ops, so they need only Audit, never Allocate.
+- **`apply_scoped_acl` reordered** Base-before-Store (role + grant) so a RE-APPLY on a live box adds
+  `Audit@/` before Store drops its per-storage Audit → gap-free (the agent never loses enumeration).
+- `remove_scoped_acl` / `--uninstall` / `--rescope-acl` operate by role NAME and inherit the corrected
+  privs automatically (no other change).
+- **Live-repaired felhom-pve** (two `pveum role modify`, Base first — no agent stop/restart): drives
+  reappeared (agent-view 3→5 storages), detach alerts cleared. Re-tested under the scoped token: drives
+  readable (was 403), write-containment intact (vzdump→felhom-usb still 403; out-of-pool guest 403),
+  PBS Store grant unchanged. `bash -n` + `shellcheck` clean (0 new warnings).
+- **NOT physically run** (source-confirmed, no `Datastore.Allocate` in the path): a brand-new-drive UI
+  enrollment (needs a spare USB) — the host-ops/Audit path is unchanged from pre-3b.
+
 ## felhom-host-install.sh v1.6.0 — pool-scoped token ACL (3-role) + `--rescope-acl` retrofit (2026-07-01)
 
 Colleague-safety batch #4 phase b (script half; agent half = v0.53.0). Moves the agent token's dangerous