felhom.eu/REPORT.md

felhom.eu — task reports

Overwrite this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in hub/CHANGELOG.md; the scripts history lives in scripts/CHANGELOG.md.

SPIKE — PBS DR tier auto-provisioning, SLICE 0: the three load-bearing mechanisms — 2026-07-10

No production code — findings record at documentation/audits/SPIKE-pbs-tier-provisioning-2026-07-10.md. All three unproven mechanisms of the "PBS DR tier" epic got empirical answers; every probe artifact was spike-*-named and torn down (asserted); the demo's real felhom-offsite/felhom-pbs storages re-verified active afterwards. Viktor approved the one 🛑 (the ep0 touch) mid-run.

• Probe 1 (demo host): path-scoped token create is IMPOSSIBLE. POST/PUT/DELETE /storage* all 403 with Permission check failed (/storage, Datastore.Allocate) — the whole entry-lifecycle CRUD checks the /storage ROOT; /storage/<id> ACLs govern usage only. Probe 1b settled the fallback: a pinned-id sudoers alias (pvesm add/set/remove <id>, pveum acl modify /storage/<id>) — full cycle green as the felhom-agent user via sudo -n, unpinned id denied. Gotcha: sudo logs argv → the token secret must go through a stdin-reading root wrapper, never sudo pvesm add --password ….
• Probe 2 (ep0, 🛑): the tenancy op-set + secret transport PROVEN. Recon recorded the surface (one restrict+forced-command key, one sudoers line; the peersync user can sudo nothing else — live-proven). Throwaway spike-tenant on the real felhom-offsite: namespace + privsep token + dual-grant, the token secret returned over SSH stdout (36 bytes, never persisted on ep0, never displayed), S4 isolation asserts green incl. a real cross-tenant WRITE 403. Ordering gotchas recorded (token-before-ACL; delete-token purges its ACLs; no --output-format on generate-token). Slice-1 recommendation: a second forced-command surface (felhom-tenantsync, own keypair + sudoers line), peersync untouched.
• Probe 3 (demo host): pvesm add pbs … --encryption-key autogen works end-to-end. Entry active, K born at /etc/pve/priv/storage/<id>.enc (0600, = PBSEncKeyPath on demo), vzdump of a small guest lands as ciphertext PBS-side (crypt-mode: encrypt — the doc-06 property), escrow-create would find K. ⚠ pvesm remove DELETES the .enc (K!) + .pw → the epic's re-apply must be pvesm set-only.
• Flags surfaced (pre-existing): orphan root@pam!spike DatastoreAdmin on ep0 /datastore/scratch; the demo host is missing the §4b step-3 /storage/felhom-pbs|felhom-offsite FelhomAgentStore grants (backups still green — needs a deliberate re-assert before slice 2 codifies the self-grant); 180's felhom@pbs!n100 is datastore-wide DatastoreAdmin (dev-grade, don't copy).
• Epic slice map (hub tenantsync + consume-once → agent apply-bridge with stdin-wrapper + set-only re-apply → DR schedule/monitoring → Peti ceremony one-liner) in the record §5.