felhom.eu/REPORT.md

felhom.eu — task reports

Overwrite this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in hub/CHANGELOG.md; the scripts history lives in scripts/CHANGELOG.md.

SPIKE — controller-driven escrow ceremony (daemon-context invocation mechanics) — 2026-07-13

Docs-only commit; findings at documentation/audits/SPIKE-controller-escrow-2026-07-13.md. No production code written; agent/controller repos untouched. All five mechanisms under test: GO — the production spec (local-API ceremony endpoint + --output=json + job/one-shot-R-claim) can be written on observed behavior.

• Target: the drill VM (qm 300, 192.168.0.152, take-two end state, agent 0.87.0); full probe plan P0–P8 ran, nothing skipped; demo host + live demo escrow untouched (hub row verified).
• SQ1 (load-bearing): the PTY-driven PBS re-key works with NO controlling terminal — 3/3 ceremonies exit 0 under systemd-run --uid=felhom-agent + sudo -n (the daemon shape), ~2.3 s each, self-verify included.
• Refusal matrix 5/5: the fixed-argv sudoers line refused every altered argv (value change, extra flag, reorder, --config omitted, alternate config path) — direct self-invocation is sound; no guarded wrapper needed. Caller must pin argv order + -- spelling byte-exact.
• R pipe-capture round-trip PROVEN: R parsed from the captured stdout opened the blob via escrow-consume (fingerprint-gated, recovered key = live key size). Banner parsing is brittle → --output=json is mandatory for production.
• env_reset clean (pinned --config; WG key auto-captured; hub upload authenticated); --upload hub-verified (host_escrow row timestamped to the second, 383 B blob, empty restic_pw_sha256 — no staged secret existed, as gated in P0).
• Timings: 2.28–2.37 s incl. upload → job pattern with 2 s poll / 60 s timeout recommended; ceremony process peaks ~264 MiB.
• Correction to the task premise: capability probes are LIST-mode (sudo -n -l), never executing (manifest.go, verified live) — the escrow grant can get a normal probe entry.
• Hygiene: zero R fragments in journal/auth logs/state dir; all probe artifacts removed (sudoers drop-in gone + post-removal refusal re-proven; scratch shredded; VM left running).
• Recorded side effect (deliberate, drill scratch): the drill box's take-two escrow blob is superseded by a hash-less one; the take-two paper R no longer opens the CURRENT blob.