# felhom.eu — task reports

> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).

## SPIKE — PBS DR tier auto-provisioning, SLICE 0: the three load-bearing mechanisms — 2026-07-10

**No production code — findings record at
`documentation/audits/SPIKE-pbs-tier-provisioning-2026-07-10.md`.** All three unproven mechanisms of the
"PBS DR tier" epic got empirical answers; every probe artifact was `spike-*`-named and torn down (asserted);
the demo's real `felhom-offsite`/`felhom-pbs` storages re-verified active afterwards. Viktor approved the
one 🛑 (the ep0 touch) mid-run.

- **Probe 1 (demo host): path-scoped token create is IMPOSSIBLE.** `POST/PUT/DELETE /storage*` all 403 with
  `Permission check failed (/storage, Datastore.Allocate)` — the whole entry-lifecycle CRUD checks the
  `/storage` ROOT; `/storage/<id>` ACLs govern usage only. **Probe 1b settled the fallback:** a pinned-id
  sudoers alias (`pvesm add/set/remove <id>`, `pveum acl modify /storage/<id>`) — full cycle green as the
  `felhom-agent` user via `sudo -n`, unpinned id denied. Gotcha: sudo logs argv → the token secret must go
  through a stdin-reading root wrapper, never `sudo pvesm add --password …`.
- **Probe 2 (ep0, 🛑): the tenancy op-set + secret transport PROVEN.** Recon recorded the surface (one
  `restrict`+forced-command key, one sudoers line; the peersync user can sudo nothing else — live-proven).
  Throwaway `spike-tenant` on the real `felhom-offsite`: namespace + privsep token + dual-grant, the token
  secret returned over SSH stdout (36 bytes, never persisted on ep0, never displayed), S4 isolation asserts
  green incl. a real cross-tenant WRITE 403. Ordering gotchas recorded (token-before-ACL; delete-token purges
  its ACLs; no `--output-format` on generate-token). Slice-1 recommendation: a second forced-command surface
  (`felhom-tenantsync`, own keypair + sudoers line), peersync untouched.
- **Probe 3 (demo host): `pvesm add pbs … --encryption-key autogen` works end-to-end.** Entry active, K born
  at `/etc/pve/priv/storage/<id>.enc` (0600, = `PBSEncKeyPath` on demo), vzdump of a small guest lands as
  **ciphertext** PBS-side (`crypt-mode: encrypt` — the doc-06 property), `escrow-create` would find K.
  **⚠ `pvesm remove` DELETES the `.enc` (K!) + `.pw`** → the epic's re-apply must be `pvesm set`-only.
- **Flags surfaced (pre-existing):** orphan `root@pam!spike` DatastoreAdmin on ep0 `/datastore/scratch`;
  the demo host is missing the §4b step-3 `/storage/felhom-pbs|felhom-offsite` FelhomAgentStore grants
  (backups still green — needs a deliberate re-assert before slice 2 codifies the self-grant); 180's
  `felhom@pbs!n100` is datastore-wide DatastoreAdmin (dev-grade, don't copy).
- **Epic slice map** (hub tenantsync + consume-once → agent apply-bridge with stdin-wrapper + set-only
  re-apply → DR schedule/monitoring → Peti ceremony one-liner) in the record §5.