docs: DR-tier-by-default batch — decisions 1-5 in CONTEXT, day0 ACL advice reversed, ceremony decision-4 policy block, WG disclosure (tester agreement + GO-LIVE D3), drill F-disposition table, REPORT

Claude-Session: https://claude.ai/code/session_01NptTCFtu7dz2Ru89qHRagN
2026-07-12 20:43:25 +02:00
parent 448a68237a
commit fda783bdaf
7 changed files with 126 additions and 68 deletions
@@ -19,14 +19,20 @@
 ## Prerequisites (check BEFORE scheduling with the customer)
 - **Agent version:** ≥ v0.79.0 (the ceremony records `restic_pw_sha256` — older agents produce a blob
  auto-confirm can never match).
- **⚠ No-PBS hosts: the ceremony CANNOT run.** The previously documented "identity-only mode
-  (≥ v0.80.0)" was NEVER implemented — v0.80.0's actual feature was seeding `escrow.pbs_storage_id`
-  on PBS hosts. `escrow-create` hard-requires a PBS storage id + its key file (drill-proven
-  2026-07-12, finding F-6 of DRILL-day0-vm-2026-07-12.md). Until identity-only ships, a box MUST
-  have the PBS DR tier (which itself requires the WG tunnel peer first) before any escrow/offsite
-  arc can complete.
- **Host packages:** `age` must be installed (identity wrap dependency; NOT installed by
-  host-install as of v1.14.0 — drill finding F-10). `apt-get install -y age`.
+- **⚠ No-PBS hosts: the ceremony CANNOT run — and that is now POLICY, not a gap.** The previously
+  documented "identity-only mode (≥ v0.80.0)" was NEVER implemented — v0.80.0's actual feature was
+  seeding `escrow.pbs_storage_id` on PBS hosts. `escrow-create` hard-requires a PBS storage id +
+  its key file (drill-proven 2026-07-12, finding F-6 of DRILL-day0-vm-2026-07-12.md).
+  **Operator decision 2026-07-12 (DR-tier-by-default, decision 4): identity-only escrow is
+  formally PARKED — F-6 is closed by policy, not by implementation.** Every install ships the
+  full DR plumbing (host-install ≥ v1.15.0); activation is the hub's per-customer DR-tier flag
+  (default ON), and offsite backup REQUIRES that flag (hub v0.51.0 enforces the coupling:
+  "Offsite backup requires the DR tier"). A box therefore always reaches the ceremony THROUGH
+  the tier: WG peer → PBS-DR descriptor applied → ceremony. Revisit identity-only ONLY if a
+  customer class demands lean-tier offsite — this line is here so a future session knows the
+  absence is a decision, not an oversight.
+- **Host packages:** `age` must be installed (identity wrap dependency; installed by host-install
+  since v1.15.0 — drill finding F-10 closed. Pre-v1.15.0 boxes: `apt-get install -y age`).
 - **K gate (PBS hosts):** `escrow.pbs_storage_id` set and the key file present
  (`cfg.Backup.PBSEncKeyPath(<id>)`).
 - **Staged secret (offsite):** offsite enabled → `EscrowState="pending"` on the controller and the staged