docs(G1): REPORT + scripts CHANGELOG for break-glass (hub v0.34.1 live-validated)

Auto-heal drill (agent stopped) healed /run/sshd in 30.0s; mgmt_plane_healed
warning fired end-to-end; break-glass vault→retrieve→PVE-ticket proven.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

REPORT.md

@@ -2,29 +2,50 @@
 
 > **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).
 
----
+## TASK G1 — management-plane break-glass (hub + installer half) — hub v0.34.1 (2026-07-05)
 
-# REPORT — S3.1 doc close-out: offsite-tunnel MTU decision resolved (docs-only) (2026-07-04)
+**Baseline:** felhom.eu @ `2f97ce3` → `012e5f3`. Hub `0.33.0` → **`0.34.1`** (live via ArgoCD). Agent
+half = felhom-agent v0.71.0. Prerequisite for the felhom-sshd OOB feature (H1). Provenance:
+`documentation/audits/SPIKE-felhom-sshd-2026-07-05.md` §8/#9.
 
-Docs-only companion to the S3.1 implementation (the constant change lives in **felhom-agent
-v0.65.0** — see that repo's REPORT). Resolves the OPEN DECISION the 2026-07-04 CGNAT smoke test
-left in `documentation/architecture/06-offsite-connectivity.md` §4.3.
+### Shipped
+- **Break-glass credential vault** (`store.host_recovery` + `internal/store/host_recovery.go`): a
+  per-host root@pam console password, stored at rest, operator-retrievable — the human fallback for
+  reaching the PVE web console (pveproxy :8006, a failure domain distinct from sshd) when both the
+  sshd path and the agent-independent auto-heal have failed. `PUT /hosts/{id}/recovery-credential`
+  (SELF-scoped host key — day-0 vaults it) + `GET /admin/hosts/{id}/recovery-credential` (GLOBAL key
+  only). Secret never logged (username + length only).
+- **mgmt_plane surfacing** (`internal/monitor/host_mgmtplane.go`, 60s sweep): parses the agent's
+  additive `mgmt_plane` stanza and raises `mgmt_plane_healed` WARNING on a new `privsep_healed_at`
+  (a recurring `/run/sshd` clobber surfaces before it becomes a lockout; complements host_staleness).
+  v0.34.1 fix: a heal is an EVENT — construction seeds pre-existing markers (startup false-alarm
+  guard) but a newly-observed marker alerts, so the FIRST auto-heal surfaces.
+- **host-install** (`scripts/felhom-host-install.sh`): `step_break_glass` generates a strong root@pam
+  password (`openssl rand`, never logged/filed — stdin→chpasswd + stdin→curl), sets it, and vaults it
+  via the host key; idempotent unless `--rotate-recovery`. Also installs the G1 host artifacts
+  (tmpfiles + agent-independent watchdog timer), **RuntimeDirectory-guarded** (refuses any unit that
+  declares it); uninstall removes all of them.
 
-**Decision recorded:** fleet-wide client **MTU 1280** (RFC 8200 IPv6-minimum floor; outer 1340 v4 /
-1360 v6 fits every realistic path), permanent + family-agnostic, client-only (endpoint `wg0`
-untouched — interface MTU caps box→PBS, advertised MSS caps PBS→box).
+### Tests + red-proofs (all green: `go build/vet/test ./...`)
+- store: recovery-credential round-trip + upsert + absent→nil; `GetHostMgmtPlaneStates` parses the
+  marker + old-agent report degrades to empty.
+- api: vault self-scoped (own 200, cross-host 403, unauth 401); operator read global-only (host key
+  401, absent 404); **password-never-logged** (buffer-logger red-proof).
+- monitor: first-heal-after-healthy alerts once; recurring heals each alert; pre-existing marker seeded
+  silently; no-heal never alerts. Red-proofed: neutering the emit fails the alert test.
 
-**Edits to `06-offsite-connectivity.md`:**
-- **§4.3** — replaced "OPEN DECISION (not yet made)" with the made decision + rationale + the
-  rejected alternatives (auto-probe/per-connection-type = fragility for a non-metric; MSS-clamp =
-  unneeded without forwarding). Updated "the unit ships explicit MTU 1420" → 1280.
-- **§4.3** — corrected the over-general "fixed-line customers are unaffected": sub-1500 fixed-line
-  paths (DS-Lite ~1452, some PPPoE) would also have black-holed at 1420; one 1280 floor covers all.
-- **§4.2** — noted the 1280 floor is chosen family-agnostic *specifically so* MTU correctness does
-  not depend on the v4/v6 resolution outcome; the deterministic v4-pin stays a separate, optional
-  future determinism note (not built here).
-- **§3.2 / §8 S6 row** — stale "MTU 1420" wire-field note → 1280; S6 residual list drops the
-  now-resolved MTU decision, keeping only the low-risk true-CGNAT-SIM retest.
+### Live validation (felhom-pve + hub)
+- Auto-heal drill (agent stopped): `/run/sshd` removed → agent-independent watchdog healed it in
+  **30.0 s**, new `:22` session restored with the agent still down.
+- Chain: agent report `mgmt_plane` (healed_recently + timestamp) → hub raised `mgmt_plane_healed`
+  warning (17:16:21).
+- **Break-glass drill:** day-0 vault via the host key (200) → operator retrieval via the global key →
+  the vaulted root@pam password authenticated to PVE (`POST /access/ticket` → 200 = opens the web
+  console); a host key on the admin read path → 401 (operator-only). Secret never printed/logged.
 
-**Not changed:** no code, no endpoint, no hub/controller, no JSON golden (MTU is never on the wire).
-One docs-only commit.
+### Notes
+- **felhom-pve's root@pam password is now the G1-vaulted strong value** (the intended day-0 outcome);
+  retrieve it via `GET /admin/hosts/demo-felhom-01/recovery-credential` with the operator key. CC's
+  key-based SSH is unaffected.
+- Keep the build-server PVE token fresh (the incident's secondary lesson); least-privilege console user
+  + credential auto-rotation are noted future items.

scripts/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Felhom scripts — Changelog
 
+## felhom-host-install — break-glass credential + management-plane watchdog install (TASK G1) (2026-07-05)
+
+- `step_break_glass` (new step 4b): generates a strong root@pam console password (`openssl rand`,
+  NEVER logged/filed — stdin→chpasswd + stdin→curl), sets it, and vaults it to the hub over the
+  enroll-authenticated host-key channel (`PUT /hosts/{id}/recovery-credential`). Idempotent (state
+  marker) unless `--rotate-recovery`. The human break-glass path for the PVE web console.
+- `install_mgmt_watchdog` (in step 5): installs the G1 host artifacts from the agent repo configs —
+  `felhom-privsep.tmpfiles` (boot-persistent `/run/sshd`), `felhom-mgmt-watchdog.{sh,service,timer}`
+  (agent-independent ~60s privsep-dir auto-heal). **HARD GUARD:** refuses any fetched unit declaring
+  `RuntimeDirectory=` (the SPIKE-felhom-sshd §8 incident cause). Non-fatal on a repo that predates the
+  artifacts. Uninstall (step 4b2) stops+disables the timer and removes all four artifacts + the marker.
+
 ## docs — 06-doc S3 row SHIPPED + agent-side revocation semantics (2026-07-04)
 
 Docs-only companion to **felhom-agent v0.64.0** (the S3 slice — keygen, registration,