felhom.eu/REPORT.md

felhom.eu — task reports

Overwrite this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in hub/CHANGELOG.md; the scripts history lives in scripts/CHANGELOG.md.

TASK — offsite provisioning hardening (F2/F4/F5 + key-auth-first + staged-secret wipe) — 2026-07-09 — DEPLOYED

Shipped (felhom.eu): hub v0.39.0 17cc67f + bump 17d9af5 — LIVE (Synced/Healthy, provisioner enabled). Bundle pairs: controller v0.107.0 (key-auth-first bridge + wipe-on-escrowed; live on 9201) + agent v0.78.0 (DELETE /escrow/stage-secret; live on felhom-pve, 56/56). All three green-gated with companion red-proofs.

Hub changes:

• F4 (pilot-gating) — "Re-issue offsite credentials": Provisioner.ReissueCredentials + UI button (confirm-gated, shown only when provisioned) + POST /configs/{id}/offsite-reissue. Resets the sub-account password (or dedicated-box password via the new hetznerapi.ResetBoxPassword), stores a FRESH one-time secret, re-saves the config unchanged → ConfigVersion bump → the stuck guest's next refresh re-runs the bridge. Hard-scoped: refuses unless the felhom-customer=<id> label lookup finds exactly 1 resource (red-proofed). Explicit action only — never implicit rotation. Password never logged.
• F2: scanWithRetry — the host-key scan retries through fresh-subaccount DNS lag (2/4/8/16/30s ≈ 60s, inside the F1 3-min detached ctx; fail-closed past budget; red-proofed).
• F5: the config form disables its submit buttons + shows an in-flight notice on submit (the re-click bait that caused live F1).

One-off cleanup (executed): the staged secret lingering on felhom-pve from the e2e's Option-A confirm was wiped through the NEW agent endpoint (controller container → pinned local API → {"removed":true}), verified gone; idempotent re-wipe returned {"removed":false}. No secret printed.

Deliberately NOT exercised live: the F4 reset itself (it would rotate the demo's working credential — touching it is forbidden; a live exercise needs a throwaway customer under supervision). Unit red-proofs cover the guards. F5 is template JS — verified on the next operator save.

NEXT: SLICE 3 (escrow auto-confirm — inherits wipe-on-escrowed), SLICE 4 (soft-quota on quota_gb), NEW-box restore round-trip → retire the old-box archive, Peti onboarding runbook.