# felhom.eu — task reports

> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).

## TASK — offsite provisioning hardening (F2/F4/F5 + key-auth-first + staged-secret wipe) — 2026-07-09 — DEPLOYED

**Shipped (felhom.eu):** hub **v0.39.0** `17cc67f` + bump `17d9af5` — LIVE (Synced/Healthy, provisioner
enabled). Bundle pairs: controller **v0.107.0** (key-auth-first bridge + wipe-on-escrowed; live on 9201) +
agent **v0.78.0** (`DELETE /escrow/stage-secret`; live on felhom-pve, 56/56). All three green-gated with
companion red-proofs.

**Hub changes:**
- **F4 (pilot-gating) — "Re-issue offsite credentials":** `Provisioner.ReissueCredentials` + UI button
  (confirm-gated, shown only when provisioned) + `POST /configs/{id}/offsite-reissue`. Resets the
  sub-account password (or dedicated-box password via the new `hetznerapi.ResetBoxPassword`), stores a
  FRESH one-time secret, re-saves the config unchanged → `ConfigVersion` bump → the stuck guest's next
  refresh re-runs the bridge. **Hard-scoped:** refuses unless the `felhom-customer=<id>` label lookup finds
  exactly 1 resource (red-proofed). Explicit action only — never implicit rotation. Password never logged.
- **F2:** `scanWithRetry` — the host-key scan retries through fresh-subaccount DNS lag (2/4/8/16/30s ≈ 60s,
  inside the F1 3-min detached ctx; fail-closed past budget; red-proofed).
- **F5:** the config form disables its submit buttons + shows an in-flight notice on submit (the re-click
  bait that caused live F1).

**One-off cleanup (executed):** the staged secret lingering on felhom-pve from the e2e's Option-A confirm
was wiped through the NEW agent endpoint (controller container → pinned local API → `{"removed":true}`),
verified gone; idempotent re-wipe returned `{"removed":false}`. No secret printed.

**Deliberately NOT exercised live:** the F4 reset itself (it would rotate the demo's working credential —
touching it is forbidden; a live exercise needs a throwaway customer under supervision). Unit red-proofs
cover the guards. F5 is template JS — verified on the next operator save.

**NEXT:** SLICE 3 (escrow auto-confirm — inherits wipe-on-escrowed), SLICE 4 (soft-quota on `quota_gb`),
NEW-box restore round-trip → retire the old-box archive, Peti onboarding runbook.