docs: escrow-wizard felhom.eu leg REPORT + CONTEXT (ruling F1 recorded; operator follow-ups: supervised wizard pass drill+demo, agent 0.88.0 publish/vouch)

CONTEXT.md

@@ -3,6 +3,18 @@
 > Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub),
 > `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`.
 
+- **2026-07-13 eve — ESCROW CEREMONY WIZARD SHIPPED (agent v0.88.0 + controller v0.127.0; this
+  repo: host-install v1.16.0 + RUNBOOK rewrite).** The recovery-code ceremony is now
+  customer-driveable from the controller (`/backup/escrow`): one-shot R reveal, re-stage-first,
+  Scenario-F stale-blob re-check (fired LIVE on both boxes' hash-less blobs at first ACK; drill's
+  repaired via a real ceremony — hub hash now covers). **Ruling F1 (2026-07-13), settled:** *R
+  transiting the Cloudflare tunnel once at reveal is an accepted risk — same trust class as the
+  claim code/login password; LAN-direct delivery is PARKED.* (threat model:
+  runbooks/RUNBOOK-escrow-ceremony.md). host-install v1.16.0 = FELHOM_ESCROW rides the canonical
+  sudoers fetch; hub `hostInstallVersion` synced (gate green), **hub NOT redeployed** (const rides
+  the next train). OPEN: supervised full-browser wizard pass (Viktor's drill login; also demo, to
+  clear its legacy stale warning); agent 0.88.0 publish + Day-0 vouch at the next train.
+
 - **2026-07-13 — CLOSING BUNDLE SHIPPED: hub v0.53.0** — the last engineering items on the
   pre-tester board: F-14 gated auto-Reissue (deletion provenance `host_deletions` in-tx +
   `token_exists` gate → the EXISTING Reissue op + `pbsdr_auto_reissue` audit event; no record /

REPORT.md

@@ -2,32 +2,26 @@
 
 > **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).
 
-## SPIKE — controller-driven escrow ceremony (daemon-context invocation mechanics) — 2026-07-13
+## Controller-driven escrow ceremony — felhom.eu leg (installer + docs) — 2026-07-13
 
-Docs-only commit; findings at `documentation/audits/SPIKE-controller-escrow-2026-07-13.md`.
+Companion commits to felhom-agent **v0.88.0** (`1c3a3ef`) + felhom-controller **v0.127.0**
-No production code written; agent/controller repos untouched. **All five mechanisms under test: GO**
+(`08a966b`) — the customer-facing recovery-code wizard. felhom.eu commit `375cb08`.
-— the production spec (local-API ceremony endpoint + `--output=json` + job/one-shot-R-claim) can be
-written on observed behavior.
 
-- **Target:** the drill VM (qm 300, `192.168.0.152`, take-two end state, agent **0.87.0**); full
+- **host-install v1.16.0:** the `FELHOM_ESCROW` sudoers alias ships via the EXISTING canonical
-  probe plan P0–P8 ran, nothing skipped; demo host + live demo escrow untouched (hub row verified).
+  sudoers fetch (no new step; header documents it). Hub `hostInstallVersion` synced to 1.16.0 in
-- **SQ1 (load-bearing): the PTY-driven PBS re-key works with NO controlling terminal** — 3/3
+  the same commit (`hostinstall_gates.py` green; hub green gate run; **no hub deploy** — the
-  ceremonies exit 0 under `systemd-run --uid=felhom-agent` + `sudo -n` (the daemon shape), ~2.3 s
+  const rides the next hub train, display-only lag).
-  each, self-verify included.
+- **RUNBOOK-escrow-ceremony.md rewritten:** the controller wizard is the PRIMARY path; the CLI is
-- **Refusal matrix 5/5:** the fixed-argv sudoers line refused every altered argv (value change,
+  the operator fallback (text mode unchanged); **F1 threat-model paragraph** (R transits the CF
-  extra flag, reorder, `--config` omitted, alternate config path) — direct self-invocation is
+  tunnel once at reveal — accepted 2026-07-13, same trust class as claim code/login password;
-  sound; no guarded wrapper needed. Caller must pin argv order + `--` spelling byte-exact.
+  agent→controller leg never leaves the box; LAN-direct delivery PARKED); stale-blob warning +
-- **R pipe-capture round-trip PROVEN:** R parsed from the captured stdout opened the blob via
+  supersede/void semantics documented; CLI staged-secret rule spelled out (a CLI run without the
-  `escrow-consume` (fingerprint-gated, recovered key = live key size). Banner parsing is brittle →
+  staged secret mints a hash-less blob → the new Scenario-F warning).
-  `--output=json` is mandatory for production.
+- Deploy + live validation evidence: felhom-agent/REPORT.md + felhom-controller/REPORT.md
-- **env_reset clean** (pinned `--config`; WG key auto-captured; hub upload authenticated);
+  (agents 0.88.0 on demo host + drill VM, 63/63 capabilities; controllers 0.127.0 on both guests;
-  **`--upload` hub-verified** (`host_escrow` row timestamped to the second, 383 B blob, empty
+  Scenario F fired live on BOTH boxes' hash-less blobs; the drill blob repaired —
-  `restic_pw_sha256` — no staged secret existed, as gated in P0).
+  `restic_pw_sha256` now covers the local password; one-shot claim + 410 proven endpoint-exact).
-- **Timings:** 2.28–2.37 s incl. upload → job pattern with 2 s poll / 60 s timeout recommended;
+- **Operator follow-ups:** (1) one supervised wizard pass with Viktor's drill login (the full
-  ceremony process peaks ~264 MiB.
+  browser leg incl. re-auth + reveal — CC cannot type the customer-owned password), ideally also
-- **Correction to the task premise:** capability probes are LIST-mode (`sudo -n -l`), never
+  on the demo box to clear ITS legacy stale warning; (2) publish agent 0.88.0 + vouch in the
-  executing (manifest.go, verified live) — the escrow grant can get a normal probe entry.
+  Day-0 manifest at the next publish train (deployed hosts got direct deploys).
-- **Hygiene:** zero R fragments in journal/auth logs/state dir; all probe artifacts removed
-  (sudoers drop-in gone + post-removal refusal re-proven; scratch shredded; VM left running).
-- **Recorded side effect (deliberate, drill scratch):** the drill box's take-two escrow blob is
-  superseded by a hash-less one; the take-two paper R no longer opens the CURRENT blob.