From 238ec0275456d3c2e825aa699cf7baabdb932b80 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Sat, 13 Jun 2026 23:05:36 +0200 Subject: [PATCH] docs(claude): refresh stale version banner v0.13.0 -> v0.30.0 (current state summary) Co-Authored-By: Claude Opus 4.8 (1M context) --- CLAUDE.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/CLAUDE.md b/CLAUDE.md index 35f8791..8cb44be 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -15,7 +15,13 @@ - Module `gitea.dooplex.hu/admin/felhom-agent`; binary `felhom-agent` (`cmd/felhom-agent/`). - **Pure Go stdlib + `golang.org/x/crypto` only** — no web frameworks. - `go.mod` directive **go 1.25.0**; dep `golang.org/x/crypto v0.52.0` (declares go 1.25, will NOT build on Go 1.24). The **build server (192.168.0.180) runs go1.26.0** (upstream Go on PATH, backward-compatible). Build/run the agent there for live tests (same LAN as the demo host). -- Version: `version` var in `cmd/felhom-agent/main.go`, overridable via `-ldflags "-X main.version="`; `--version` flag. **Current: v0.13.0** (slice 8B.2: `/backup/status` gains a **`snapshotted`** phase — `BackupRunner.BackupWithSnapshotHook` tails the vzdump task log for the `create storage snapshot` marker (snapshot mode only) and fires a hook so the controller resumes its app at snapshot-taken, not backup-done. Plus slice 8C Phase A: the `/disks` endpoints — `internal/localapi/disks.go` + `internal/storage` `mkfs` executor + `InspectDevice`/`DeviceProbe` data-bearing detection. **Security centerpiece**: `POST /disks/format` inspects the device itself; data-bearing → `ClassStorageWipe` → gate → `pending_signature` refused (caller's claim ignored); blank → benign `mkfs`. `FELHOM_FORMAT` sudoers. Controller de-privileging is `felhom-controller` v0.37.0. Plus slice 8B: `internal/localapi` `/backup/due` real **cadence** policy + `/backup/status` **phases** (idle|running|done|failed) + `POST /backup` single-flight job id — the app-consistent backup the controller's quiesce loop drives; `backup.backup_cadence_seconds`. Plus slice 8A: the per-guest **local-API server** `internal/localapi` — the doc 03 §6 authorization gate, 7 self-scoped endpoints, hashed per-guest token store, persisted self-signed leaf w/ stable pin; the **provisioning back-half** `internal/provision` — mint token → render `bootstrap.json` → write 0600 → `chown 100000:100000` → `pct set` bind mount, host-side/F3, no registry cred in guest; `--selftest=provision`; `build-golden.sh` now bakes the controller. Plus v0.9.0's PBS escrow. Runtime dep: `proxmox-backup-client`). Bump on meaningful changes + add a CHANGELOG entry. +- Version: `version` var in `cmd/felhom-agent/main.go`, overridable via `-ldflags "-X main.version="`; `--version` flag. Bump on meaningful changes + add a CHANGELOG entry. **See `CHANGELOG.md` (top only) for the authoritative current state.** +- **Current: v0.30.0** (2026-06-13; deployed on demo host `felhom-pve`). Recent state (summarized from the CHANGELOG top — verify there, not here): + - **v0.30.0** — **AGENT-001** security fix: the inline customer-confirmed wipe (`localapi handleDiskFormat`) re-resolves the confirmed durable id → current device, re-derives+matches, re-inspects, and formats the **re-resolved** device (never the mutable `req.Device`), closing a classify→mkfs TOCTOU. At parity with `signedjobs.WipeExecutor` (`internal/localapi/wipe_reresolve.go`). + - **v0.29.x** — OS / Docker-data storage **split** (golden bakes split rootfs + Docker-data volume; provision) + `lanresolver` split-horizon DNS fix (RESTART, not reload, dnsmasq on a guest IP change). + - **v0.28.0** — backup re-target to offsite **`felhom-pbs`** (DR) + operator-signed **decommission**. + - **v0.23–0.27** — device-**ROLE** classification + tiered storage-wipe gate (system/backup operator-only, user-data customer-confirmable); eject role-gate; user-data drive **enroll/bind** into the guest (slice 10 P2/P3); self-heal watchdog + 4-state intent model. + - **Foundations (slice 8–10):** per-guest **local-API server** (`internal/localapi`, self-scoped endpoints, hashed per-guest token store, pinned self-signed leaf); the `/disks` data-bearing classifier + signed-job destructive gate (`POST /disks/format` inspects the device itself; data-bearing → gate → `pending_signature` refused, caller's claim ignored; blank → benign `mkfs`); the provisioning back-half (`internal/provision`: mint token → `bootstrap.json` 0600 → `chown 100000:100000` → `pct set` bind, no registry cred in guest); host metrics; hub desired-state; operator-signed completion + offline signing CLI; PBS escrow + identity-restore (slice 10D). Runtime dep: `proxmox-backup-client`. ## Layout