# felhom.eu — task reports

> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).

---

# REPORT — S3 wrap-up (docs-only in this repo; the slice lives in felhom-agent v0.64.0) (2026-07-04)

felhom.eu carried **no code** in S3 — hub v0.33.0 (S2) already served the registration endpoint
+ merged `wireguard` block. This commit records the S3 outcome in the design of record:

- `documentation/architecture/06-offsite-connectivity.md`: roadmap row **S3 → SHIPPED**
  (agent v0.64.0; `wg_tunnel.enabled` defaults FALSE until the production endpoint exists);
  §3.5 gains the **agent-side revocation semantics** (register-once marker; block-absent-from-
  present-state = disable + marker kept + never self-re-register; re-add via
  `POST /hosts/{id}/wg` with the global key — the raw registry add does NOT bump the host
  generation, found live) and the rollout gate.
- `CONTEXT.md`: S3 entry (end-to-end handshake live on demo: keygen → register → block →
  wg-quick → PBS page in 3 s; revocation drill + 30-min soak + reboot persistence).

Full evidence: **felhom-agent REPORT.md** (journal excerpts, five red-proofs, the
hub-poll-constant gotcha, the re-add-path insight). Still open: CGNAT/mobile-hotspot smoke
(operator-assisted appendix), S4 PBS-over-tunnel, S5 DR consume, S6 tunnel-health alerting +
the two S6 backlog notes (make `defaultHostPollSeconds` configurable + log first-cycle adoption;
make the admin registry-add bump the bound owner or mark it registry-plumbing in the UI).