# felhom.eu — task reports

> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).

## Hub v0.46.0 — observability pass: per-box log pulls, bundle custody, TTL + secret gate — 2026-07-11

felhom.eu's third of the cross-repo observability task (agent v0.83.0 + controller v0.116.1 shipped
in their repos). Commits: hub `e35b1ae`, manifest bump + conventions runbook `7c038df`.
**Deployed:** `felhom-hub:0.46.0`, ArgoCD `Synced/Healthy`, rollout complete (17:03 CEST).

### What shipped

- **Store** (`hub/internal/store/logbundle.go` + schema): `log_bundle_requests` (pending intent per
  scope+component — controller scope = customer_id / report ACK; agent scope = host_id / heartbeat
  envelope) + `log_bundles` (gzip, newest-3, **72 h TTL** purged on the existing 60 s sweep).
  `SaveLogBundle` runs the **token-pattern secret gate BEFORE storing**: a hit stores a
  `blocked: possible secret` flag row and NO payload (fail-closed, WARN hub-side); `[REDACTED]`
  shapes + public checksums pass by design.
- **Channels** (additive both directions): report ACK `controller_log_requested` + ingest of
  `controller_log_tail`; heartbeat envelope `log_tail_requested` + ingest of `log_tail`.
  Consume-once on arrival. A pre-0.83 agent never fulfills → the request stays visibly `pending`
  (S6-tested, harmless).
- **UI** (host detail, English per the hub operator surface): Diagnostics section — "Request
  controller logs" / "Request agent logs" (CSRF forms), state rows (`pending` with the honest
  latency hint: controller ≤ ~15 min report interval, agent ≈ heartbeat cadence; `available` with
  View/Download; `blocked`), 72 h custody note. The hosts "read-only" invariant is amended by test:
  these two forms are the ONLY actions.
- **Conventions codified:** `documentation/runbooks/logging-conventions.md` (levels, logs-are-
  English, keys-never-values, capture layers, pull posture) + a one-liner in each repo CLAUDE.md.

### Red-proofs (demonstrated, restored)

| Scenario | Reverted shape | Failure seen |
|---|---|---|
| S4 secret gate | gate disabled | `secret-shaped token not blocked` |
| S2/consume-once | clear-on-arrival removed | `request survived fulfillment` (store + API tests) |

S5 TTL: injectable clock — kept at +71 h, purged at +73 h. Keep-newest-3 + byte-cap belts tested.

### Live evidence / honest latencies

- Hub 0.46.0 live (ArgoCD Synced/Healthy, image verified, clean startup log).
- Box halves live-proven from 9201: controller ring + agent ring both readable at
  `logging.level=info` through the new Debug tabs (see felhom-controller/REPORT.md timestamps).
- **Operator follow-up (HUMAN — hub UI is password-gated, CC cannot log in):** on
  `hub.felhom.eu/hosts/<demo host>` click both request buttons; expect the agent bundle within one
  heartbeat (~15 min) and the controller bundle on the next report (≤ ~15 min); download both and
  confirm the controller bundle carries the NAS-add phase lines + the `operator log pull served`
  INFO line. The full round-trip is already proven by `internal/api/logbundle_ack_test.go`.
- Blocked-secret branch: test-level only by design (no real secret planted live).

### Open / observations

- Hub bearer key rotation still DUE (pre-existing; manifests/hub.yaml + screenshot-exposed).
- `log_bundles` UI states `requested → pending` are merged (a request IS pending from the box's
  view); `expired` renders as absence after the purge — states documented in the template hint.