# felhom.eu — task reports

> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).

## TASK H1 — OOB operator access (hub + installer + endpoint half) — hub v0.35.0 (2026-07-05)

**Baseline:** felhom.eu @ `a3ee93e` → pushed. Hub `0.34.1` → **`0.35.0`** (live via ArgoCD). Agent half
= felhom-agent v0.72.0. The merged E1+H1 operator-SSH-access feature. Provenance: both
`SPIKE-{felhom-sshd,oob-wg-operator-peer}-2026-07-05`.

### Shipped
- **Operator OOB peer** (`store/wg_operator.go`): the fleet operator peer as an UNBOUND `wg_peers` row
  (host_id '', note operator-oob) at an EXPLICIT /32; validated; last-write-wins rotation; rides
  ListWGPeers → peersync pushes it to the endpoint. `PUT/GET /admin/wg/operator-peer` (global key);
  PUT also takes `ssh_pubkey` (hub_settings) + bumps every host's generation.
- **Desired-state** (`api/wg.go` mergeWireguard): the served wireguard block gains `oob_peer_ip`
  (rendered into the box's AllowedIPs — survives self-heal [OF-1]) + `oob_operator_ssh_key` (agent
  writes felhom-sshd's authorized_keys). Absent operator peer → byte-identical pass-through.
- **OOB health** (`monitor/host_oob.go`): ingests the agent `oob` heartbeat stanza; transition-based
  `oob_degraded`/`oob_recovered` warning (felhom-sshd down while the operator peer is configured, OR
  config invalid). Unconfigured OOB never alerts.
- **host-install** (`scripts`): `--enable-oob` + `install_oob` install the static felhom-sshd + belt +
  `felhom-op` user (RuntimeDirectory-guarded); uninstall removes them.
- **Doc 06 §4.5/§4.6 amended**: forwarding ON but per-pair allow-listed, box↔box drop now explicit;
  the `oob` health stanza + `oob_degraded` alert. Endpoint runbook §9 added (forward chain + operator
  peer registration).

### Tests + red-proofs (all green: `go build/vet/test ./...`)
- store: operator-peer round-trip/rotate/unbound + validation (reserved/taken/out-of-subnet); merge
  includes oob_peer_ip when configured (absent = byte-identical).
- api: operator-peer PUT self-scoped-global-only; ssh_pubkey validation.
- monitor: degraded/recovered transitions; config-invalid alerts; unconfigured-never-alerts;
  no-stanza-ignored. Red-proof: neuter the emit → the alert test fails.

### Live validation (felhom-pve + dev endpoint)
Endpoint set up first (ip_forward=1 + per-pair forward chain + operator peer registered → pushed to
wg0). Both spikes' key probes re-run as acceptance — all pass: operator→box SSH as felhom-op with
scoped sudo; the OF-1 self-heal /32 survival; coexistence (stock :22 PID 922 unchanged, distinct host
keys, felhom-op denied on :22); the belt (LAN→port dropped, :22 untouched); box↔box drop (counter) +
peersync survival; PBS unaffected throughout; the healthy `oob` stanza reaches the hub +
`oob_degraded`/`oob_recovered` fired around a real felhom-sshd downtime. Full detail + the 5
live-found-and-fixed agent bugs: felhom-agent `REPORT.md`.

### Notes
- CGNAT still unproven; IPv6/AAAA out of scope; operator-key auto-rotation is a manual re-PUT; the
  "customer network fully down" case is explicitly OUT OF SCOPE / accepted risk. Operator (global) key
  = hub `report_api_key`. felhom-pve's operator peer + felhom-sshd + endpoint forwarding stay live.