admin
1907dab296
docs(offsite): S4 SHIPPED — per-customer PBS tenancy + v4-pin/watchdog (live 2026-07-04)
- runbook offsite-endpoint.md: new §4a (endpoint per-customer tenancy) + §4b
(box-side storage + agent wiring). Confirmed minimal ACL: DatastoreBackup on
/datastore/<ds>/<ns> (NOT /ns/<ns>) to BOTH user felhom@pbs AND token
felhom@pbs!<ns> (PBS privsep = intersection); cross-tenant 403; ns-scoped
verify works with DatastoreBackup; DatastoreBackup can't prune (safety).
Box: box-born encryption key, argv-safe .pw/.enc + storage.cfg, agent PVE
FelhomAgentStore grant, pbs-secrets WARN fix, local_backup_target retarget.
- doc-06 §3.4 SHIPPED (ns-aware PBS client v0.67.0 rationale); §4.2 v4-pin +
watchdog SHIPPED v0.66.0 (closes the dual-stack trap); S4 roadmap row done +
follow-ups (restore-test WAN deadline + scratch VM.Allocate; Tier-1/Tier-2
target split).
Live: real vzdump of 9201 → ciphertext in ns over the tunnel; verify=ok under
the box's own scoped token; WARN gone; restore decrypts with the box-born key.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6