felhom.eu/REPORT.md

felhom.eu — task reports

Overwrite this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in hub/CHANGELOG.md; the scripts history lives in scripts/CHANGELOG.md.

---

REPORT — S3 wrap-up (docs-only in this repo; the slice lives in felhom-agent v0.64.0) (2026-07-04)

felhom.eu carried no code in S3 — hub v0.33.0 (S2) already served the registration endpoint

• merged wireguard block. This commit records the S3 outcome in the design of record:

• documentation/architecture/06-offsite-connectivity.md: roadmap row S3 → SHIPPED (agent v0.64.0; wg_tunnel.enabled defaults FALSE until the production endpoint exists); §3.5 gains the agent-side revocation semantics (register-once marker; block-absent-from- present-state = disable + marker kept + never self-re-register; re-add via POST /hosts/{id}/wg with the global key — the raw registry add does NOT bump the host generation, found live) and the rollout gate.
• CONTEXT.md: S3 entry (end-to-end handshake live on demo: keygen → register → block → wg-quick → PBS page in 3 s; revocation drill + 30-min soak + reboot persistence).

Full evidence: felhom-agent REPORT.md (journal excerpts, five red-proofs, the hub-poll-constant gotcha, the re-add-path insight). Still open: CGNAT/mobile-hotspot smoke (operator-assisted appendix), S4 PBS-over-tunnel, S5 DR consume, S6 tunnel-health alerting + the two S6 backlog notes (make defaultHostPollSeconds configurable + log first-cycle adoption; make the admin registry-add bump the bound owner or mark it registry-plumbing in the UI).