felhom.eu/REPORT.md

felhom.eu — task reports

Overwrite this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in hub/CHANGELOG.md; the scripts history lives in scripts/CHANGELOG.md.

Reinstall-of-existing-customer arc — F2/F3/F4/2.3 (hub v0.57.0) — 2026-07-16

Closes the N100 physical-run findings (documentation/tests/VALIDATION-n100-baremetal-2026-07-16.md). Only the hub shipped — controller + scripts unchanged (both spec premises contradicted by source, below). Baseline: felhom.eu @ dd961a6, hub v0.56.0 → v0.57.0.

Fork verdicts (source-verified)

• 2.1 = FORK B. hub/internal/claim/engine.go + handler.go:413-429 (MarkClaimed, set-only): the hub stores the claim code + a claimed boolean, never the password hash (controller-owned by the arc's design). Fork A (hub delivers the hash) would violate the design → B (bump generation + email).
• 3.1 = no controller change (spec premise contradicted). controller/internal/agentapi/escrow.go EscrowPreflight fetches the prereq checklist live from the agent (GET /escrow/preflight); it never sources pbs_storage_id from hub config. The agent seeds it on PBS-DR convergence. The fresh box "lacked" it only because F4's 403 blocked convergence — Part 0 + the demo grant restore it. No controller v0.138.0.

Part 0 — live unblock (done, reversible)

Granted FelhomAgentStore on /storage/felhom-offsite (user + token) on felhom-pve. The agent's next tick converged: created the storage, ran felhom-pbs-apply grant, seeded escrow.pbs_storage_id, pbsdr: converged state=applied; pvesm shows felhom-offsite pbs active. The 403s stopped.

Part 2 — hub v0.57.0 (shipped)

• F2 claim continuity — claim.ReissueForReenroll (claimed → bump generation once + reset email; no-op unclaimed), hooked at the host-enroll mint path (single-bump-per-re-enroll). Event claim_reissued_reenroll.
• F3 offsite continuity — the re-enroll path calls web.ReissueOffsiteForCustomer (same machinery as the manual button; wired via SetOffsiteReissuer). Event offsite_reissued.
• 2.3 escrow honesty — offsite.ReissueCredentials marks the escrow stale (store.MarkEscrowStale; cleared by the next ceremony); the ACK withholds the mismatched restic_pw_sha256; the DR checklist shows stale not "done." Event escrow_stale.

Scenarios / red-proofs

• A (claim): TestReissueForReenroll — claimed rotates + reset email; unclaimed no-op. PASS.
• C (escrow, red-proof): TestReissue_InvalidatesEscrow — after a re-issue the escrow is STALE and the hash is withheld. Red-proof run-fail-revert: with MarkEscrowStale gutted → FAIL ("escrow must be STALE… advertising ceremony-done against a key the repo no longer accepts"); restored → PASS.
• Green gate: go build ./... && go vet ./... && go test ./... all clean.
• Deployed: felhom-hub:0.57.0 (manifest dd563a0, ArgoCD Synced/Healthy, rolled out, clean startup incl. the stale_at migration). Controller/scripts/agent unchanged.
• Scenario E (live demo): the agent's /escrow/preflight is all 6 green — pbs_storage_id (felhom-offsite), dr_tier applied, age_binary, hub_upload, staged_secret, sudo_grant; overall ok. The wizard's start is offered. CC STOPPED — the ceremony is Viktor's step.

Observation (agent-side, recorded not acted on)

The agent seeds escrow.pbs_storage_id into agent.json on PBS-DR convergence, but the running agent's escrow-preflight kept reporting "not configured" until a systemctl restart felhom-agent (config reload). The seed writes the file but doesn't propagate to the live preflight path — a small agent-reload gap to fold into the R-22 agent train.

F4 — NOT an installer fix (reported)

The DR storage id lives in the agent-domain pbs_dr descriptor (web/pbsdr.go), provisioned post-WG — not in the installer-fetched config — so step_agent_config() can't derive it. The block is a bootstrap circularity: the agent's token-auth pre-check GET /storage/<id> 403s and aborts before its own root-run felhom-pbs-apply grant. Root fix is agent-side → ROADMAP R-22 (agent train); the demo was unblocked live (Part 0). Default-storage-id customers (all new/Peti installs) already work — F4 only bites non-default ids. Per Viktor: do NOT flip the demo's descriptor id.

NOT done

The escrow ceremony itself — Viktor's S10 step (CC's boundary is prereqs-green; CC never runs the ceremony, touches R, or mints a recovery code).