felhom.eu/REPORT.md

felhom.eu — task reports

Overwrite this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in hub/CHANGELOG.md; the scripts history lives in scripts/CHANGELOG.md.

DR-tier-by-default batch — installer v1.15.0 + hub v0.51.0 (+ agent v0.86.0) — 2026-07-12

Spec: the DR-tier-by-default batch (uniform deployment, hub-controlled activation). Closes drill findings F-1/F-2/F-3/F-7/F-8/F-9/F-10 shipped + F-6 closed by policy (decision 4: identity-only escrow PARKED). Baselines re-confirmed at start: password arc fully deployed (hub 0.50.0 live, ctrl 0.122.0 + floor raised, drill box claimed); hub target shifted 0.50.0→0.51.0 (the arc took the spec's number — the 0.48→0.49 precedent).

Shipped (this repo)

• scripts/felhom-host-install.sh v1.15.0 — F-7 ships felhom-pbs-apply (wrapper pattern, uninstall parity); F-10 installs age; F-9/decision-5 renders wg_tunnel.enabled: true BOTH modes (byo wg-off assert retired; consent = typed disclosure ack, WG now on the disclosed list); default ACL keeps felhom-pbs (byo missing-storage refusal exempts it — pre-positioned grant); F-1 single SCRIPT_VERSION source; F-2 honest dry-run auth lines; F-8 loud root@pam rotation pointer (4b + final summary). bash -n clean; mode-harness 31/31 green.
• scripts/hostinstall_gates.py (NEW committed gate) — version single-source + hub-const cross-check, age, pbs-apply ship+remove, wg default-on + assert retirement, felhom-pbs in ACL. All red-proofed; the age assertion hardened TWICE by its own red-proof (prefix regex matched agekit; loose regex matched the dry-run print).
• Hub v0.51.0 — per-customer dr_tier flag (column + one-time backfill from descriptor reality; new-customer default ON); cascade-not-error semantics + per-stage status (scenario D); PBSDRAutoProvision fired by the WG-registration hook (scenario A hands-free); offsite- requires-DR guard with the exact F-6 message (scenario C); host-page capability chips (inactive = neutral, degraded stays loud + migration hint); Setup-tab copy 1.15.0. Green gate: build/vet/test — 14 packages ok. Red-proofs: coupling guard, flag default, backfill enabled-check, auto-provision unhook — all proven red then restored.
• Docs: day0-install.md (ACL narrowing advice REVERSED — the drill 403; DR-default note; commands drop --acl-storages; byo wg disclosure), RUNBOOK-escrow-ceremony.md (decision-4 policy block), PETI-tester-agreement.md + GO-LIVE-PACKAGE.md D3 (WG disclosure/supersede), CONTEXT.md (decisions 1–5 verbatim), DRILL-day0-vm §7 F-disposition table, REUSE.md rows (+ path-citation fixes; reuse_refs_check green).

Sibling repo (felhom-agent v0.86.0, commit c20814e)

Capability inactive state ("disabled by configuration"; broken plumbing stays degraded) gated by pbsdr.Manager.DRConfigured (marker-backed); F-3 root-run provision parent chown (--reference, non-recursive). felhom-pve's latent F-3 state confirmed + fixed live; Peti's box unreachable (check deferred).

Deployed + LIVE-VALIDATED (same evening)

All three artifacts deployed: hub 0.51.0 (ArgoCD Synced/Healthy, auto-provision hook armed), agent 0.86.0 (felhom-pve ok=62 degraded=0, published d77355c5…, Day-0 manifest vouched), installer v1.15.0 served. §13 take-two re-drill EXECUTED with Viktor (GO given): the entire drill §5 sequence completed with ZERO fix-and-continue stops in 1h 22m (vs 1h 55m) — all F-fixes proven on a fresh box, scenario A hands-free cascade fired 1 s after WG registration, auto-confirm 6m 39s, floor-driven self-update 0.120→0.122 FIRST LIVE PROOF, offsite round-trip proven (1 snapshot → 48K verification restore). Full record + metrics + new findings (F-14 tenancy re-attach dead-end, F-15 reset-code lag — operator must-fix, F-16 hub native confirm()): documentation/audits/DRILL-day0-take2-2026-07-12.md.