# felhom.eu — task reports

> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md).

---

## REPORT — hub v0.13.0: DR recipe (assemble + store + view)

**TASK — DR recipe slice (hub half).** Receive the two secret-free recipe halves, assemble them into one
customer recipe, store PLAINTEXT in a dedicated table, and expose an operator view/download. Grounded in
`documentation/audits/SPIKE-dr-recipe-2026-06-16.md`. Pairs with felhom-agent v0.38.0 (storage/guest/PBS
half) + felhom-controller v0.73.0 (customer/apps half, the boundary-enforcing emitter).

### Store (`hub/internal/store/dr_recipe.go`)

- New `dr_recipe` table (migrate()) — DEDICATED, separate from the opaque `host_escrow` and from the
  dropped `infra_backup*` tables. Keyed by `customer_id`; columns `recipe_version, host_id,
  host_half_json, app_half_json, updated_at`.
- `SaveDRRecipeHostHalf` / `SaveDRRecipeAppHalf` — each upserts its half and PRESERVES the other
  (last-write-wins per half; a re-report of one half never clobbers the other).
- `AssembleDRRecipe(rec)` — stitches the two halves into `AssembledRecipe{recipe_version, customer,
  guests, pbs, drives, pve_storage, apps}`. Sub-sections pass through as `json.RawMessage` (verbatim);
  **ignore-unknown** at the top level + version-skew tolerant (`recipe_version` = max) for forward-compat
  across the three repos. Pure → unit-tested.

### Ingest (`hub/internal/api/handler.go`)

- `handleHostReport` persists the `dr_recipe` host-half (keyed by the host's customer).
- `handleReport` persists the `dr_recipe` app-half (keyed by `customer_id`), mirroring the
  `app_telemetry` pattern. Both backward-compatible (old agents/controllers omit the field) and never
  fatal to the heartbeat.

### View (`hub/internal/web/dr_recipe.go` + customer page)

- A DR-recipe panel on the customer detail page (which half landed + last-updated) with a
  **Download recipe (JSON)** link.
- `GET /customers/{id}/dr-recipe.json` serves the assembled recipe (operator dashboard-auth, pretty
  JSON, `Content-Disposition` attachment). No decrypt, nothing to redact.

### Boundary

The recipe is PLAINTEXT-at-rest because it carries NO secrets — only identifiers/intents/sizes/
coordinates. The PBS key stays in escrow, the access token in identity-escrow, the restic password in
escrow. This is the clean inverse of the retired infra-backup (which shipped `restic_password`/
`cf_api_token` and was a zero-knowledge violation). The leak-preventing allowlist is enforced at the
controller emitter; the hub adds a defense-in-depth no-secrets sweep.

### Tests

`TestDRRecipe_StoreRoundTrip`, `TestAssembleDRRecipe_MatchesGolden` (assembled shape pinned in
`testdata/dr-recipe.golden.json`), `TestAssembleDRRecipe_IgnoreUnknownAndVersionSkew`,
`TestAssembleDRRecipe_PartialHalves`, `TestAssembleDRRecipe_NoSecrets`. `go build`/`go vet`/`go test ./...`
green.

### Cross-repo golden discipline

The recipe wire spans three repos. The agent's `host-report.golden.json` `dr_recipe` section and the
hub's host-half test literal must stay key-consistent; the controller's emitter and the hub's app-half
test literal likewise. On any wire change, manually checksum-diff the golden across the three repos
(there is no shared types module yet).

### Deploy

Built + pushed `felhom-hub:0.13.0`; manifest tag bumped + ArgoCD `felhom` app synced.