P7 spec rev2: honest unblock semantics, WG addressing/keygen model (browser-side keygen, CIDR AllowedIPs), ticket-set fixes

BACKLOG.md

@@ -478,7 +478,7 @@ Tickets DC-046 through DC-049 implement pluggable auth + email magic link. Sami
   person record. Tests: orchestration order (mocked provider), reversibility,
   last-admin guard integration, audit entries written.
 
-### DC-143 cleanup note: access map module itself is DC-145.
+**Note (not a ticket):** the access map module itself is DC-145.
 
 ### DC-144: Groups (DashCaddy-side) + resources
 - **status:** todo
@@ -525,24 +525,30 @@ Tickets DC-046 through DC-049 implement pluggable auth + email magic link. Sami
 
 ### DC-149: WireGuard provider — hub management
 - **status:** todo
-- **details:** `providers/wireguard.js`: wg-quick iface `dcnet0`, address pool
-  10.d.c.0.0/16 stable assignment, keygen on hub, peer store, systemd unit
-  if missing. All execFile-mocked in tests. Tests: pool assignment stability,
-  peer add/remove, unit generation, error paths (missing wg binary).
+- **details:** `providers/wireguard.js`: wg-quick iface `dcnet0` at 10.53.0.1/16
+  (client pool 10.53.0.0/16, one /32 per device, stable assignment), HUB keypair
+  generated host-side, peer store (pubkeys only), systemd unit if missing,
+  net.ipv4.ip_forward=1 for hub-and-spoke, no NAT on dcnet0. All execFile-mocked
+  in tests. Tests: pool assignment stability, peer add/remove, unit generation,
+  error paths (missing wg binary).
 
 ### DC-150: WireGuard invites (QR) + client config
 - **status:** todo
-- **details:** one-time token (7d TTL, single-use) → redemption page rendering
-  client config + QR (qrencode -t ansiutf8 → pre? no: PNG served) with Address,
-  DNS=Technitium hub IP, AllowedIPs = private zone only (split tunnel). Private
-  key shown once, never stored server-side. Tests: token lifecycle, config
-  template correctness (allowed-ips, DNS), single-use enforcement, expiry.
+- **details:** one-time token (7d TTL, single-use) → redemption page. Client
+  keypair generated IN THE BROWSER (WebCrypto X25519, ECDSA-P256 fallback);
+  server receives the public key only, registers the peer /32, returns config
+  (Address, DNS=10.53.0.1, hub PublicKey, AllowedIPs=10.53.0.0/16 — a CIDR,
+  never a DNS zone). Config + QR rendered client-side; private key never
+  transits or rests on the server. Tests: token lifecycle, single-use
+  enforcement, expiry, server-rejects-private-key-posts, config template
+  correctness.
 
 ### DC-151: WireGuard firewall matrix (nftables)
 - **status:** todo
 - **details:** per-resource nft sets (net_dc_res_<name>), peer IPs per grant,
   transactional apply (build temp ruleset → `nft -c` → `nft -f` → verify →
-  rollback file), host admin ports restricted to admin peers. Tests: ruleset
+  rollback file), baseline: dcnet0 input = WG UDP + ICMP from 10.53.0.0/16 +
+  per-resource ports; host admin ports restricted to admin peers. Tests: ruleset
   golden text, transactional failure injection (nft -c fails → no apply),
   verify-step failure, admin-port isolation.