docs: S1 shipped — hub v0.32.0/0.32.1 CHANGELOG, peersync v1.0.0, 06 S1 status, CONTEXT, REPORT

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

scripts/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Felhom scripts — Changelog
 
+## felhom-peersync.sh v1.0.0 — the offsite endpoint's WG reconcile script (2026-07-04)
+
+S1 (doc 06 §5): the forced-command target the hub's wgsync pushes to (runbook
+`offsite-endpoint.md` step 5 installs it as `/usr/local/bin/felhom-peersync`, root:root 0755,
+invoked via a one-line sudoers grant from the `felhom-peersync` user's `restrict,command=`
+authorized_keys entry). Validate-FIRST design: jq contract check (version 1, interface wg0,
+44-b64 pubkeys, `10.77.0.x/32` allowed_ips, never the endpoint's own .1) rejects on stderr with
+exit 1 before touching anything; then head-file + generated `[Peer]` blocks into a same-fs tmp,
+`wg syncconf <(wg-quick strip …)` from the TMP (exact-match: adds/removes without bouncing the
+interface), and only on success the atomic `mv` to `/etc/wireguard/wg0.conf` — runtime and boot
+config can never diverge in the failure direction. Zero-peer payload = valid wipe. Never reads
+or prints the private key; no `wg-quick save`; no second mode. shellcheck-clean. Live-proven on
+felhom-hetzner incl. the negatives (malformed JSON / bad pubkey / own-IP peer → exit 1, wg state
+byte-identical) and reboot persistence.
+
 ## docs — architecture Part 06: offsite connectivity design-of-record (2026-07-03)
 
 `documentation/architecture/06-offsite-connectivity.md` — the settled offsite-backup-transport