felhom.eu/REPORT.md

felhom.eu — task reports

Overwrite this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in hub/CHANGELOG.md; the scripts history lives in scripts/CHANGELOG.md.

TASK — offsite SLICE 3: hub-verified escrow auto-confirm — 2026-07-09 — DEPLOYED

Shipped (felhom.eu): hub v0.40.0 49d1233 + bump c24d4af — LIVE (Synced/Healthy). Chain pairs: agent v0.79.0 (felhom-pve, 56/56) + controller v0.108.0 (9201, healthy) — all live. Operator-free task (Viktor ran nothing).

The verification chain: the ceremony hashes the staged repo password it seals (agent) → the hub stores restic_pw_sha256 alongside the escrow blob (additive migration; NULL on legacy rows) and serves escrow:{identity_blob_present, restic_pw_sha256, created_at} in the report ACK → the controller flips offbox EscrowState pending→escrowed ONLY on sha256(local repo_password) match. Blob-presence alone never confirms — a stale blob (re-provision/inject/history) would be a false custody claim re-opening the fork-4 gap; this is the red-proofed core (blob-present-only check → stale-blob test flips → FAIL). Mismatch → pending + loud warn naming the ceremony (deduped per hash); never un-confirms. On flip the agent-staged secret is wiped (v0.107.0 path). The two hashers are pinned by the SAME cross-repo test vector (trimmed-string sha256). Manual confirm-escrow → documented deprecated fallback for legacy hash-less blobs.

Hub specifics: host_escrow.restic_pw_sha256 migration; SaveHostEscrow/HostEscrow/GetHostEscrow NULL-safe; GetEscrowStatusForCustomer (hosts⋈host_escrow, latest-updated wins); ACK object omitted when no escrow row (fresh customers stay silently pending); TestEscrowUploadContract mirrors agent v0.79.0.

Live state check (no operator action): migration applied on the production DB — all 3 legacy rows (demo included) read hash-NULL; the demo's escrowed target produced zero escrow-confirm controller log lines after reports through the new hub (Scenario E — never-revisit — proven live for free); no hub errors.

NOT yet live-exercised: the full happy chain (fresh enable → ceremony records the hash → ACK → auto-flip) — the first real offsite enable (Peti onboarding) proves it; unit red-proofs carry the logic.

NEXT: SLICE 4 (soft-quota on quota_gb), Peti onboarding runbook (live-exercises auto-confirm + F4 re-issue), NEW-box restore round-trip → retire the old-box archive.