# felhom.eu — task reports

> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).

## SPIKE — immediate-sync transport (hub→box "sync now") — 2026-07-16

**Docs-only spike.** No production code, no image, no manifest change. Every live mutation on the
demo arc was inventoried and reverted; the arc was re-verified green. Findings doc:
[`documentation/audits/SPIKE-immediate-sync-transport-2026-07-16.md`](documentation/audits/SPIKE-immediate-sync-transport-2026-07-16.md).
Baselines re-confirmed at session start: felhom.eu `a50822af` v0.57.0 · felhom-agent `c040c180`
v0.88.0 · felhom-controller `8f3564c1` v0.138.0.

### Question
Viktor's ruling: a user-triggered config change must round-trip in **seconds**, not the 15-min
report cycle. Measure the two candidate "sync now" transports empirically before any Task-2 spec.

### Verdict — both GO, and complementary (not competing)
- **(b) long-poll — recommended primary for user config.** A hanging GET the hub completes on
  change. Reaches the **controller** (the config puller) with a **hub-only** change, **no ep0
  coupling, no WG dependency, no agent train**. **Binding ceiling today = 60 s**, from TWO places
  measured/sourced: nginx `proxy_read_timeout` **60 s** (proven from the upstream-timeout log line;
  ingress-nginx's default single retry pushes the client-visible 504 to ~120 s) **and** the hub's
  in-code `http.Server{WriteTimeout: 60s}` (`hub/cmd/hub/main.go:339-341`). Both are config lifts.
- **(a) ep0-relayed poke — reserved as the agent-plane nudge.** Hub → forced-command on ep0 → ep0
  originates a contentless UDP datagram → box. Reaches the **agent** (WG terminates host-side),
  **~0.42 s** per fresh SSH session (~0.40 s of that is SSH setup; a pooled session → ~27 ms + 18 ms).
  Needs **zero infra change on ep0 or the box** and is cryptographically confined to registered
  peers — but needs an agent train (UDP listener → heartbeat trigger).
- **Interval shortening stays REJECTED** (fleet-wide continuous load, no true immediacy).

### Evidence highlights
- **Viktor's Q2:** `hub.felhom.eu` is **DNS-only** (CNAME → `dooplex.hopto.org` → the operator home
  line `37.191.56.193`), **no Cloudflare**; split-horizon to the `nginx-internal` LB `192.168.0.192`
  on-LAN. Real chain: client → operator home-NAT → nginx-internal → hub pod.
- **P1** ep0→box origination works with **`ip_forward` and the `forward` chain untouched** (endpoint-
  originated traffic never transits the forward chain); ~29 ms last hop; negative proven at the
  kernel crypto layer (`EKEYREJECTED` to an unregistered `/32`).
- **P2** 5/5 pokes delivered end-to-end; the hub image is Alpine (no ssh/bash/python) → a production
  poke must reuse the in-process `x/crypto/ssh` client (the `wgsync` pattern); a lost poke is
  harmless by construction.
- **P3** tuned ingress holds cleanly to **600 s on-LAN**, and **the operator home NAT holds an idle
  held connection the full 600 s** — so the NAT is not the constraint (≤10 min); only the twin 60 s
  config limits are.

### Ground-truth drift caught since the 07-05 OOB spike (recorded as findings)
- ep0 `ip_forward` is now **1** (was 0) — the OOB operator-peer feature has shipped; a **second real
  box** (`10.77.0.3`) is now on the arc (untouched).
- The operator `/32` (`10.77.0.250`) is now **durably rendered** into the box's `wg-felhom` conf —
  the 07-05 finding-1 gap is closed.
- Cleanup bar was set to the **live** baseline (`ip_forward=1`, root ak = 2), not the plan's stale
  "must be 0" assumption.

### Cleanup (verified)
ep0 forced-command line removed (root ak 2→2, 0 spike lines), poke script shredded, `ip_forward`
still 1, forward chain empty; k8s sleeper (deploy/svc/ingress/cm) deleted; throwaway keypair
shredded; box nft empty, no listeners, no temp files. Arc green: tunnel live (`felhom-offsite`
active), guest 9201 controller healthy, hub pod 1/1, reconciler still pushing 3 peers.