hub v0.44.0: PBS DR tier SLICE 1 — felhom-tenantsync surface (script+client) + hub provisioning flow (consume-once host secret, pbs_dr desired-state descriptor, fail-closed + idempotent, re-issue)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

hub/internal/store/pbsdr.go

@@ -0,0 +1,40 @@
+package store
+
+// PBS DR tier (SLICE 1): the HOST-scoped one-time PBS token secret — the host/agent twin of the
+// customer-scoped one_time_secrets pair (SaveOneTimeSecret/ConsumeOneTimeSecret). The hub stores
+// the tenantsync-returned token secret here; the agent consumes it EXACTLY ONCE with its per-host
+// key. Transient custody: never logged, never in desired-state or any served config.
+
+// SaveHostPBSSecret stores (last-write-wins) the one-time PBS token secret for a host, resetting
+// the consumed flag (a re-issue supersedes any prior unconsumed value). Never logged.
+func (s *Store) SaveHostPBSSecret(hostID, value string) error {
+	_, err := s.db.Exec(`
+		INSERT INTO host_pbs_secrets (host_id, value, created_at, consumed_at)
+		VALUES (?, ?, datetime('now'), NULL)
+		ON CONFLICT(host_id) DO UPDATE SET value = excluded.value, created_at = datetime('now'), consumed_at = NULL`,
+		hostID, value)
+	return err
+}
+
+// ConsumeHostPBSSecret returns the host's one-time PBS token secret and marks it consumed in the
+// SAME transaction (single use). A second call — or a call when none is stored — returns
+// ("", sql.ErrNoRows). The value is never logged.
+func (s *Store) ConsumeHostPBSSecret(hostID string) (string, error) {
+	tx, err := s.db.Begin()
+	if err != nil {
+		return "", err
+	}
+	defer tx.Rollback()
+	var value string
+	err = tx.QueryRow(`SELECT value FROM host_pbs_secrets WHERE host_id = ? AND consumed_at IS NULL`, hostID).Scan(&value)
+	if err != nil {
+		return "", err // sql.ErrNoRows when absent OR already consumed
+	}
+	if _, err := tx.Exec(`UPDATE host_pbs_secrets SET consumed_at = datetime('now') WHERE host_id = ?`, hostID); err != nil {
+		return "", err
+	}
+	if err := tx.Commit(); err != nil {
+		return "", err
+	}
+	return value, nil
+}