capability: agent privileged-capability self-probe (manifest + build-test + runtime snapshot) v0.44.0

New internal/capability: Manifest of required sudo -n grants + Prober that LISTS each
via 'sudo -n -l' (never executes) + binary-exists check → ok/degraded snapshot on the hub
report. Build-time test asserts manifest⊆sudoers (red-proof: dropping lxc-info FAILs the
gate). Startup logs N/N ok + ERROR per degraded. Serve-degraded; no allowlist change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EPZ4GJ8L5Jqf8UiPwbn1kt

cmd/felhom-agent/main.go

@@ -26,6 +26,7 @@ import (
 
 	"gitea.dooplex.hu/admin/felhom-agent/internal/authz"
 	"gitea.dooplex.hu/admin/felhom-agent/internal/backup"
+	"gitea.dooplex.hu/admin/felhom-agent/internal/capability"
 	"gitea.dooplex.hu/admin/felhom-agent/internal/config"
 	"gitea.dooplex.hu/admin/felhom-agent/internal/desired"
 	"gitea.dooplex.hu/admin/felhom-agent/internal/escrow"
@@ -44,7 +45,7 @@ import (
 
 // version is the agent version. Overridable at build time with
 // -ldflags "-X main.version=<v>"; defaults to the in-repo CHANGELOG version.
-var version = "0.43.0"
+var version = "0.44.0"
 
 // runGuestHook is the PVE pre-start hook body (`felhom-agent guest-hook <vmid> <phase>`). On the
 // pre-start phase it creates placeholder dirs for any absent bind-mount source so the guest always boots
@@ -266,6 +267,18 @@ func (r *gateRemounter) Remount(ctx context.Context, t storage.KnownTarget) {
 	r.logger.Info("storage: re-mounted returned target", "target", t.Name, "where", t.MountPath)
 }
 
+// logCapabilities logs the privileged-capability self-check at startup: one INFO summary, plus an
+// ERROR per degraded capability naming the gated feature (so a missing grant is loud at cutover,
+// not days later). It never exits — serve-degraded.
+func logCapabilities(statuses []capability.Status, logger *slog.Logger) {
+	ok, total, degraded := capability.Summarize(statuses)
+	logger.Info("capabilities self-check", "ok", ok, "total", total, "degraded", len(degraded))
+	for _, d := range degraded {
+		logger.Error("capability DEGRADED — privileged grant missing (feature impaired until fixed)",
+			"capability", d.Name, "feature", d.Feature, "reason", d.Reason, "critical", d.Critical)
+	}
+}
+
 // runDaemon is the default mode: collect a host-report and POST it to the hub on a
 // loop. Requires both proxmox (to collect) and hub config.
 func runDaemon(cfg config.Config, logger *slog.Logger) int {
@@ -310,6 +323,14 @@ func runDaemon(cfg config.Config, logger *slog.Logger) int {
 	pbsTargets := pbsTargetsFromPVE(cfg, px, logger)
 	pbsReporter := pbs.NewLiveSnapshotReporter(pbsTargets, pbsStore, pbs.DefaultLiveSnapshotTimeout, logger)
 	collector := hub.NewCollector(px, hub.SystemctlProber{}, observer, backupStore, backupStore, pbsReporter, cfg.Hub.HostID, version, logger)
+	// Privileged-capability self-check (v0.44.0): probe the sudoers grants the non-root agent
+	// depends on. The probe runs `sudo -n -l` LITERALLY (a policy LIST, never executing the
+	// command), so it uses a DIRECT runner regardless of the agent's privileged mode. Probe once at
+	// startup (loud on any denial) and attach the snapshot to every hub report; the hub owns the
+	// ok→degraded alert. Serve-degraded — a missing grant never blocks startup.
+	capProber := capability.Prober{Runner: &proxmox.ExecRunner{Mode: proxmox.RunnerDirect}}
+	logCapabilities(capProber.Probe(context.Background()), logger)
+	collector.SetCapabilityProber(capProber.Probe)
 	loop := hub.NewLoop(collector, client, time.Duration(hcfg.PollSeconds)*time.Second, logger)
 	interval := time.Duration(hcfg.PollSeconds) * time.Second
 
@@ -713,14 +734,14 @@ func buildLocalAPIServer(cfg config.Config, px *proxmox.Client, store *backup.St
 		Tokens:        tokens,
 		BackupCadence: cfg.Backup.BackupCadence(),
 		// Disk management (slice 8C): the privileged host surface + the data-bearing wipe gate.
-		Disks:       hostOps,
-		DiskGate:    storageGateAdapter{gate: gate, hostID: cfg.Hub.HostID},
-		Guests2:     px,
+		Disks:          hostOps,
+		DiskGate:       storageGateAdapter{gate: gate, hostID: cfg.Hub.HostID},
+		Guests2:        px,
 		GuestAttach:    guestBinder, // slice 10 P2: bind enrolled data drives into the guest
 		ControllerSwap: guestBinder, // Phase 1: agentic controller update — in-guest image swap
 		Intent:         intent,      // slice 10 P3: record enroll/eject intent for self-heal
-		GuestBinds:  guestBinds,  // F9: per-guest bind record for the startup re-assert
-		FormatJobs:  formatJobs,  // F20-BUG3: detached-format job record + restart recovery
+		GuestBinds:     guestBinds,  // F9: per-guest bind record for the startup re-assert
+		FormatJobs:     formatJobs,  // F20-BUG3: detached-format job record + restart recovery
 
 		// Host metrics (slice 9): the shared collector serves GET /host/metrics — a fresh host +
 		// per-storage view to the customer's monitoring page (reuses the slice-4 collector).