burn-down night: hub v0.138.0 source (R-879 seal + roll-back, R-136, R-283, R-349/R-276 hub halves), gates R-315/R-422 closed, R-325/R-426 partial, decisions 132-133, 05 §16 (195 -> 193)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

hub/CHANGELOG.md

@@ -1,3 +1,35 @@
+## v0.138.0 — secrets sealed at rest, a cookie no sibling can plant, the box's own claim state, agent-binary drift (burn-down night: R-879, R-136, R-283, R-349, R-276) (2026-10-05)
+
+**Operator action on deploy: log in again once** (the session cookie is renamed). **Roll-back needs one extra step
+first:** `felhom-hub -unseal-box-secrets` in the running pod (see R-879 below and `05` §16.2), then the old image.
+
+- **R-879 (security):** the box API keys (`hosts.api_key`), the controller API keys and owner passphrases
+  (`customer_configs.api_key` / `retrieval_password`) and the PBS-DR token values (`host_pbs_secrets.value`) are sealed at
+  rest with the R-821/R-133 seal (`OFFSITE_SECRET_KEY`). The API keys get an `api_key_hash` lookup column (SHA-256,
+  backfilled at every start without the key), so a box authenticates even when the sealing key is missing or wrong;
+  legacy rows are sealed at start-up by `SealLegacyBoxSecrets` (idempotent, non-fatal). A sealed value that does not open
+  marks the record unreadable: the config/recovery/artifacts/enroll/appliance paths answer 500, saves refuse it (no
+  blanking), and a PBS token is not consumed. No key: new secrets are refused, never written in plaintext (`09` §3
+  decision 132). Tests `TestR879_*` (store, api, configgen, cmd/hub); six red-proofs.
+- **R-879 roll-back:** `felhom-hub -unseal-box-secrets` (same `-config` and `OFFSITE_SECRET_KEY` as the server) opens the
+  four columns back to plaintext and exits — all or nothing (exit 1 = a value did not open, nothing changed; exit 2 = key
+  missing), idempotent, counts only in the log; `api_key_hash` is kept, so 0.137.0 can be put back.
+- **R-136 (security):** the operator session cookie is `__Host-hub_session` — always Secure, `Path=/`, no Domain — so a
+  sibling subdomain cannot plant a session cookie the hub would read first. Every operator is logged out once; a browser
+  login over plain HTTP no longer keeps a session (accepted); Basic auth for scripts is unchanged.
+- **R-283:** the customer page's claim card shows the box's own claim state from its latest report (claimed / not claimed
+  yet / unknown), with an amber warning when the hub says claimed and the box says not — the shape a guest rebuild
+  leaves. Nothing un-claims: the hub's claim stays set-only by design.
+- **R-349 (hub half):** the host page compares the agent's reported `agent_sha256` (the running binary, agent R-349) with
+  the vouched agent sha when the box reports the vouched agent version — „matches vouched" or an amber DRIFT naming both
+  hashes. Empty hash (older agent) = unknown, never drift.
+- **R-276 (hub half):** deleting a host asks the WireGuard peer sync for an immediate full-list push (as the customer
+  delete does since R-600), so the off-site endpoint drops the removed box's peer at once instead of on the next tick.
+- **scripts:** `wire_contract_gate.py` checks the mirrored escrow roots field by field and prints each root's check
+  (R-315); `hub_copy_gate.py` accepts the controller gate importing the shared vocabulary (R-325, felhom.eu half);
+  `reuse_refs_check.py` checks `.md` citations (R-422); the instructions gate's decoy is in the suite, exemptions 20 → 16
+  (R-426, partial).
+
 ## v0.137.0 — small fixes from the burn-down: right numbers, right flashes, one create per press, the delete says when it opens (R-277, R-581, R-600, R-544, R-855, R-134, R-92, R-292, R-599, R-725, R-728, R-208; R-124 fixture) (2026-10-05)
 
 **Operator action on deploy: none.** One new operator flash (`artifact_version_missing`) and one new customer i18n key