From 10ca63aa3243904beca341a4e8f71842d0b52d3e Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Tue, 13 Oct 2026 21:41:30 +0200 Subject: [PATCH] REPORT: power-off (R-998) released and proven on the N100 --- REPORT.md | 39 ++++++++++++++++++++++++++------------- 1 file changed, 26 insertions(+), 13 deletions(-) diff --git a/REPORT.md b/REPORT.md index 23e1a3c..a2ff582 100644 --- a/REPORT.md +++ b/REPORT.md @@ -1,15 +1,28 @@ -# REPORT — v0.154.0 released and delivered (2026-10-09) +# REPORT — v0.155.0 released and delivered: the household can turn the machine off (2026-10-13) -Built from the 2026-10-09 kernel-night read-back: (1) the host report now adds the saved newest backup success per tier -(R-894's file, one shared instance), so a restart right after a night backup no longer empties the hub's evidence — on -demo-felhom it had caused a false „newest backup is 48h old" alarm; (2) `proxmox-secure-boot-support` joins the -boot-chain lane, so it no longer pulls `shim-signed-common` into the ring-0 Proxmox plan (demo-hp's step was refused R6 -and its kernel step skipped). Red-proofs: `TestCollectBackups_SavedSuccessSurvivesARestart`, -`TestR894_LastKnownBackupsIsWiredIntoTheDaemon`, `test_ring0_pending_pve_leaves_the_secure_boot_meta_out`. +Baseline `86adbca` (v0.154.0). Code `3403c87`, `f38b03c`, `c6d9435`, `bdf25f0`; release entry `68a2130`; tag `v0.155.0`. +Task: „The turn the machine off button" (R-998). Design: felhom.eu `documentation/architecture/14-host-power-off.md`. -`scripts/release-agent.sh 0.154.0`: sha `36a54ad2…`, bundle `93487989…`, tag `v0.154.0` = `db25b46`, verified by -download. CI 1576 (code) success; 1579 (CHANGELOG) failed in its fetch step (Gitea answered 500), re-run → success. -Signed `agent_update` → demo-hp, demo-felhom, Tester 1 (07:16–07:18 local); signed `agent_config_update` → `BUNDLE DONE -written=1 same=26 self-check=ok`, capability probe 68/68 on all three. NOT vouched (the vouch needs a golden at or above -the fleet's controller; no golden today). Live: demo-felhom's first report after the update carries the 02:40Z backup. -Evidence: `felhom.eu/documentation/audits/release-2026-10-09/delivery/`. +## What it does + +`POST /host/poweroff` (local API, token-scoped): record → hub told (a report carrying `deliberate_off`, accepted) → +`pct shutdown --timeout 120` → `systemctl poweroff`. Refused in the first 10 min after boot, a second time in a +boot, while any other guest or VM runs, and while any backup/restore/OS/controller-update/drive/escrow job or a vzdump +runs. After acceptance the heavy gate is held; before each step the jobs and the guests are read again (wait ≤ 15 min, +or cancel). Every check fails closed. Sudoers: two exact vectors (`FELHOM_POWEROFF`). + +## Proof + +- Tests: `internal/localapi/hostpoweroff_test.go` (11), `internal/poweroff/state_test.go`, `internal/hub/deliberate_off_test.go`, + `internal/capability` (9 injection cases, new `TestEveryAliasIsGranted`). Each guard red-proofed by removing it. +- Three security-review passes the same evening; every finding fixed and red-proofed (other guests, gate not held, + fail-open, jobs and guests starting after acceptance). +- Fixed without a row: an escrow-ceremony reply data race (`go test -race` red before, green 3/3 after). +- Live, real sudo on the N100 after the bundle: the two new vectors ALLOWED; `poweroff --force`, `-ff`, `reboot`, `halt`, + `pct shutdown` with `--forceStop` or without `--timeout` refused. +- Live press on the N100 through the dashboard endpoint: 202 at 18:52:34Z, no ping 18:53:02Z, 0 W from 18:53:07Z. + +## Delivered + +Signed `agent_update` 0.155.0 + `agent_config_update` (bundle `795f2ab4…`) to demo-felhom, demo-hp, Tester 1. N100: +committed 18:37:45Z, bundle installed 18:51:54Z (capability probe 70/70). **Not vouched** — the operator's act.