felhom.eu/REPORT.md

# REPORT — hub v0.72.0: R-70 + R-71(c) — the offsite last mile becomes visible, burned credentials heal themselves (2026-07-23)

**Spec:** R-70 + R-71(c) prompt (project Claude, 2026-07-23). Companion controller leg: v0.161.0
(see `felhom-controller/REPORT.md`). Origin: `documentation/audits/DIAG-f10-demo-hp-offsite-2026-07-23.md`.
R-71(a) (day-0 ordering) untouched — separate upcoming spec.

## Baselines

| Repo | start | shipped |
|---|---|---|
| felhom.eu | `c801cee6`, hub 0.71.0 | hub **0.72.0** (code + separate manifest chore commit), ArgoCD Synced/Healthy |
| felhom-controller | `0eba37d5`, v0.160.0 | **v0.161.0** (`ce85314`), deployed BOTH boxes, healthy |

## What shipped (one detector, four consumers)

1. **Detector** — `internal/offsite/delivery.go` `DeliveryStateFor`: `applied` /
   `consumed_awaiting_apply` / `staged_awaiting_consume` / `no_secret` from the secret-row
   timestamps × report offsite-presence. Applied wins (the box's own report is the strongest
   evidence); applied+unconsumed-staged (demo-felhom) = `applied` + `StaleStagedSince` flag.
   New store reads (`GetOneTimeSecretInfo` — timestamps only, value never selected;
   `LatestReportOffsitePresence`; `CountReportsOffsiteSince`; `LastEventAt`) + the PBSDR-style
   test back-dater.
2. **Customer card** — `deliveryViewFor` + `config_form_body.html`: the static "delivered to the
   controller once" claim is deleted; the card renders state + age (badge `n-ok/n-warn/n-neutral`,
   consumed goes amber past 30 min, stale-staged info line). Render test per branch.
3. **Loud event** — `offsite_delivery_stuck` (WARNING) at ≥ 1 h of consumed_awaiting_apply;
   24 h/customer cooldown, durable via the events table (restart-proof).
4. **Self-heal (R-71c)** — `monitor.OffsiteDeliveryChecker` on the shared 60 s ticker invokes
   `web.Server.ReissueOffsiteForCustomer` behind the narrow `monitor.OffsiteReissuer` interface
   (pbsdrheal precedent; armed only when the provisioner exists — else a restaged event would
   lie about a silent no-op). Trigger: consumed ≥ 1 h + ≥ 4 consecutive offbox-less reports +
   zero offbox evidence since consume. One restage/customer/24 h (durable); every firing emits
   `offsite_credential_restaged` (WARNING). **R-39(a) guard**: the heal re-reads the secret row
   immediately before acting and refuses over an unconsumed row — the store's
   `SaveOneTimeSecret` clobber semantics are untouched (Re-issue depends on supersede; the guard
   lives in the caller, exactly as specced).

## Red-proofs (run, observed, restored — verbatim failures)

1. **THE CLOBBER RED-PROOF** — R-39(a) guard block removed from `maybeHeal`; the TOCTOU test
   (operator Re-issue staged mid-tick via the onEvent hook) failed with:
   `reissue calls = 1, want 0 — the R-39(a) guard must refuse over an unconsumed secret`
   — i.e. the operator's fresh unconsumed secret would have been clobbered
   (the fake reissuer mimics the production `SaveOneTimeSecret` side effect, so the clobber is
   observed on the row, not inferred). Guard restored → green.
2. **Heal rate-limit** — `LastEventAt`/`healCooldown` check removed; failed with:
   `reissue calls after recurrence = 2, want STILL 1 (one restage per customer per 24h)`. Restored.
3. **Stuck-event cooldown** — cooldown check removed; failed with:
   `stuck events = 2, want exactly 1 (24h per-customer cooldown)`. Restored.

Plus: the full-Check demo-felhom-shape test (applied + stale staged → zero events, zero calls,
row byte-untouched), evidence gates (<4 reports → no heal but stuck event still fires; mixed
offbox history → no heal), young-consumed silence, disabled/blocked skip, dispatcher severity
tests (warning routes operator-only; an info variant would be silent — pinned beside the v0.71.0
guard, `severityNotifies` untouched), 5 card render tests + `deliveryViewFor` amber derivation.
Green gates: hub 17 packages ok + `hub_confirm_gate.py`; controller 25 packages ok + all template
gates (the pre-existing R-29 `docker_run_volume_path_gate` red noted, untouched).

## Live validation (read-only, both fixtures intact)

- **Checker silence:** 10 min of 60 s ticks on the live fleet → **0** `offsite-delivery` log
  lines, **0** detector events in the DB — both fixtures are healthy and the detector agrees.
- **Fixture states from live data** (fresh DB copy, shredded after):
  demo-hp `latest_report_offsite=True, secret consumed 09:53:41` → **applied**;
  demo-felhom `latest_report_offsite=True, secret_row=(2026-07-21 08:29:29, None)` →
  **applied + stale-staged since 07-21** — the live specimen SURVIVED the train untouched
  (`consumed_at` still NULL, created_at unchanged); peti-felhom → applied.
- **demo-hp controller page** (authed endpoint fetch inside the guest, ASCII-safe greps):
  banner count 0, `felhom-offsite-card` id count 0 (configured + 1 toggled app → no card at all),
  configured markers present. v0.161.0 healthy on both boxes.
- **Method:** endpoint-level + DB-input derivation (no browser on DooPlex). The rendered card is
  pinned by render tests; the operator's 10-second residual: demo-hp Edit page shows
  `applied`, demo-felhom shows `applied` + the stale-staged note (since 2026-07-21).
- **The self-heal is NOT live-fired** — no broken box exists and none was broken for it (F9
  rule). It ships unit-proven + red-proofed, PARTIAL/IMPLEMENTED on the ROADMAP with the
  explicit "fires on next natural occurrence or a staged drill" note — never PROVEN-LIVE.
  The controller banner leg is likewise unit-proven/live-pending (no box occupies the
  enabled+no-offbox window; the next fresh onboarding is its natural live leg).

## Rulings recorded (CONTEXT.md)

State precedence (applied wins; stale-staged is a flag, never a downgrade); durable cooldowns via
the events table (restart-proof by design); both detector events operator-only (no
customerMessages entry, not in allowedEventTypes — the pbsdr_* precedent) until the mechanism has
history; heal disabled without a provisioner.

## Observed, not acted on

- R-29: `docker_run_volume_path_gate` red on `appexport/estimate.go:179` (pre-existing, has its
  own row — the 3-line allowlist fix remains undone by design of this train's scope).
- The `szolg` single-hit on the demo-hp page grep is an accent-truncated unrelated word (the
  ASCII-only-grep trap documented in felhom-controller/CLAUDE.md — verified benign via the
  card-id count of 0).