REPORT: v0.80.0 slice-2 deployed + adoption-proven + published; Peti phase pending
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
This commit is contained in:
@@ -1,29 +1,63 @@
|
|||||||
# REPORT — agent v0.79.0: SLICE 3 escrow upload carries the sealed password's hash — DEPLOYED
|
# REPORT — agent v0.80.0: PBS DR tier SLICE 2, the apply-bridge — DEPLOYED + ADOPTION-PROVEN + PUBLISHED
|
||||||
|
|
||||||
**Date:** 2026-07-09 · **Class:** implementation (agent, small). Baseline v0.78.0 → **v0.79.0**, live on
|
**Date:** 2026-07-10/11 · **Class:** implementation (agent) + demo live check + publish. Baseline
|
||||||
felhom-pve (`felhom-agent 0.79.0`, capabilities self-check **56/56, degraded=0**). The hub-verified escrow
|
v0.79.0 → **v0.80.0**, live on felhom-pve (`felhom-agent 0.80.0`, capabilities **59/59, degraded=0**),
|
||||||
auto-confirm chain, agent third — pairs with hub v0.40.0 (stores + serves) and controller v0.108.0
|
**PUBLISHED** to Gitea (sha `f2ba62ca6aca6e24a8d08706ea0dc3ae43940a63e9bdf57d4606ad1756cf06d2`;
|
||||||
(matches + auto-confirms). All three deployed live.
|
anon round-trip verified; the deployed demo binary is byte-identical).
|
||||||
|
Consumes hub v0.44.0 (slice 1). **PENDING: the supervised Peti phase** —
|
||||||
|
`felhom.eu/documentation/pilot/RUNBOOK-peti-pbsdr-2026-07-11.md` (Viktor + Peti; his box has no
|
||||||
|
tunnel/OOB yet, so box prep is his hands).
|
||||||
|
|
||||||
## What shipped
|
## Part 0 — grant diagnosis (the carried spike §6 flag), evidence recorded
|
||||||
- `internal/escrow.HashResticPassword` — the CANONICAL hasher: sha256 hex over the TRIMMED password string,
|
|
||||||
exactly the value `AttachResticPassword` seals into the identity blob. **Pinned cross-repo test vector**
|
|
||||||
(`TestHashResticPassword_PinnedVector` — the identical vector is asserted in felhom-controller's backup
|
|
||||||
package), so the two hashers can never drift silently (newline/encoding/trim).
|
|
||||||
- `cmd/felhom-agent`: the escrow-create ceremony computes the hash when a staged password is folded in and
|
|
||||||
includes it in the blob upload — `escrowUploadRequest.restic_pw_sha256,omitempty`. No staged password →
|
|
||||||
field OMITTED (hub stores NULL → the controller stays pending; correct — the blob doesn't cover the key).
|
|
||||||
The hash of a 256-bit random secret is non-reversible — safe to upload/serve; the password itself is
|
|
||||||
never logged or uploaded in the clear (it rides only inside the R-wrapped blob, as before).
|
|
||||||
- `TestEscrowUploadContract` updated in lockstep with the hub's mirror (same commit-pair) + asserts the
|
|
||||||
omitted-when-unstaged behavior.
|
|
||||||
- Ceremony flow (create / self-verify / R banner / staged-file wipe) untouched beyond the hash.
|
|
||||||
|
|
||||||
## NOT yet live-exercised
|
- Status reads (`/nodes/.../storage/.../status`) pass with NO storage grant — `FelhomAgentBase`
|
||||||
A real ceremony with a staged password recording the hash — happens at the next real offsite enable (Peti
|
(`Datastore.Audit` at `/`, propagate) covers them. That + the demo's `local` backup target is
|
||||||
onboarding). The demo's escrow row remains a legacy NULL-hash blob (covered by the deprecated manual
|
why the purged grants never showed.
|
||||||
confirm; verified live that the controller no-ops on it).
|
- The WRITE path is the gap: token vzdump → **403 `(/storage/felhom-pbs, Datastore.AllocateSpace)`**.
|
||||||
|
After the §4b dual-grant re-assert (both entries, user+token): token vzdump of 9001 → `stopped OK`
|
||||||
|
(9001 also joined `/pool/felhom` — the VM.Backup half; pool-default conformance).
|
||||||
|
- The bridge's `grant` op therefore codifies EXACTLY the dual-grant, nothing more.
|
||||||
|
|
||||||
## Deploy
|
## What shipped (laws + red-proofs)
|
||||||
Standard: built on 180, `.bak-0.78.0` kept, `install -m0755` + restart. `configs/` unchanged. NOT published
|
|
||||||
to Gitea (Day-0 manifest still vouches 0.76.0).
|
- `internal/pbsdr` bridge (adoption-first / verify-pin-before-consume / set-only / loud
|
||||||
|
consumed-failed / escrow seed / descriptor-hash marker) + `configs/felhom-pbs-apply` +
|
||||||
|
`FELHOM_PBSDR` sudoers + 3 capability entries + `WirePBSDR`/`PBSDRStatus` wire/report +
|
||||||
|
`hub.ConsumePBSToken` (PLURAL `/hosts/` route). Details: CHANGELOG v0.80.0.
|
||||||
|
- **Red-proofs (all run, mutations reverted, gate green):**
|
||||||
|
- set-only: a remove+re-add path in the re-apply → `TestSetOnlyLaw` FAILS (recorded verbs
|
||||||
|
`[remove, create, grant]` ≠ set-only) — the K-destruction guard bites.
|
||||||
|
- stdin secret: secret passed as argv → `TestFreshPath_SecretOnStdinNeverArgv` FAILS with the
|
||||||
|
secret visible in Args.
|
||||||
|
- verify-before-consume: consume reordered before the probe → `TestVerifyPinBeforeConsume`
|
||||||
|
FAILS (`consume calls = 1, want 0`).
|
||||||
|
|
||||||
|
## Demo live check — the ADOPTION path (2026-07-10 22:00 CEST)
|
||||||
|
|
||||||
|
Enabled "PBS DR tier" on demo-felhom with storage-id `felhom-offsite` (hub v0.44.0 UI, logged-in
|
||||||
|
browser). The full slice-1+2 chain fired live:
|
||||||
|
- hub: `tenantsync: provision ok (ns=demo-felhom)` on ep0 → secret staged consume-once → descriptor
|
||||||
|
→ generation 10.
|
||||||
|
- agent: fetched gen 10 → **ADOPTED** the manually-built `felhom-offsite` entry — journal:
|
||||||
|
`adopted entry keeps its own tenancy (namespace "demo-felhom-01"; descriptor says "demo-felhom"
|
||||||
|
— entry wins, never repointed)` → `converged state=adopted`.
|
||||||
|
- **Asserts:** staged secret UNCONSUMED (`host_pbs_secrets.consumed_at = NULL` in the hub DB — the
|
||||||
|
no-consume law held); `pvesm status felhom-offsite` active (demo DR green);
|
||||||
|
`escrow.pbs_storage_id=felhom-offsite` seeded into agent.json.
|
||||||
|
- **Live finding, fixed same session (3d1323c):** the escrow seed's tmp+rename failed —
|
||||||
|
`/etc/felhom-agent` is root-owned while agent.json is agent-owned, so rename (a directory
|
||||||
|
mutation) is impossible for the non-root agent. Rewritten as park-a-recovery-copy-in-state-dir +
|
||||||
|
in-place O_TRUNC write; re-proven live (marker removed → re-adopt → seed OK). The warn-and-
|
||||||
|
converge fail-safe behaved as designed in between.
|
||||||
|
- Benign note: the report `pbs_dr` stanza appears from the SECOND heartbeat after a restart (the
|
||||||
|
startup collect races the first bridge Apply).
|
||||||
|
|
||||||
|
## Publish train + pending
|
||||||
|
|
||||||
|
- 0.80.0 published (`publish-agent.sh` on 180): pre-delete 404 → PUT 201 → round-trip sha match.
|
||||||
|
Demo's live binary sha == published sha (the GL never-vouch-unpublished rule holds).
|
||||||
|
- **PENDING (the committed runbook, Viktor+Peti):** box prep (sudoers+wrapper+wg_tunnel enable —
|
||||||
|
his box has NO WG peer/OOB today), opsign signed update to 0.80.0, hub-UI tier enable (the FRESH
|
||||||
|
path: verify → consume → **K born** → degradation clears), then the ceremony one-liner (fresh R,
|
||||||
|
Peti keeps) → auto-confirm → first offsite run. Operator follow-up: Day-0 manifest vouch of
|
||||||
|
0.80.0 when it becomes the floor target.
|
||||||
|
|||||||
Reference in New Issue
Block a user