From 5cebb766e3a6401e3da05e1c5648d552542172cb Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Tue, 10 Nov 2026 16:16:42 +0100 Subject: [PATCH] =?UTF-8?q?v0.173.0=20released=20(not=20vouched):=20CHANGE?= =?UTF-8?q?LOG,=20REPORT,=20CONTEXT=20=E2=80=94=20the=20folder=20clean-up?= =?UTF-8?q?=20measured=20on=20three=20boxes,=20the=20rollback=20proven=20o?= =?UTF-8?q?n=20Tester=201?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS --- CHANGELOG.md | 19 ++++++++++++--- CONTEXT.md | 2 ++ REPORT.md | 68 +++++++++++++++++++++++++++++++++++++++------------- 3 files changed, 69 insertions(+), 20 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 719917f..a1bd1cd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,4 +1,4 @@ -## Unreleased (2026-11-10) — R-1368 part 2: the self-update folder keeps what it needs and no more — COMMITTED, NOT RELEASED (no version, no build, no vouch; it waits for a release session) +## v0.173.0 (2026-11-10) — R-1368 part 2: the self-update folder keeps what it needs and no more — RELEASED 2026-11-10, NOT VOUCHED YET (release-agent.sh from a clean clone of `776025c`; agent sha256 752b2727fb6043417ae5f342acbda52330521b21bb799fda90760b960feef7ea, bundle sha256 51ebc1f4c66d87918c87c035b4297c0e40e10ed31e3250c3837dfeaa0002e1c1) - **The defect (measured 2026-11-10, space list place H12).** `Execute` downloads each new agent to `/selfupdate/felhom-agent-` and removed that file only when the download or its checksum failed. @@ -18,8 +18,21 @@ wrapper's REAL `commit` and `rollback` verbs, run from a sandboxed copy, still put the previous binary back after four pruned updates. **Red seen three times:** no prune call; no pending refusal; no regular-file check. - **Not reached.** `/usr/local/bin/felhom-agent.bak-*` (place H13): root-owned, in a folder the agent cannot write, made - by a person. R-1368 part 4 stays open. A box gets the clean-up at its first good update AFTER the one that brings - this code; nothing was run on a box. + by a person. R-1368 part 4 stays open. +- **Corrected 2026-11-10 (measured on three boxes).** This entry said: „A box gets the clean-up at its first good update + AFTER the one that brings this code". That was wrong. The commit runs in the NEW binary, so the box cleans the folder + at the commit of the update that brings the code. +- **Delivered 2026-11-10 to the three test boxes by a signed `agent_update` each (no bundle job: `configs/` did not + change since v0.172.1).** The folder before → after, read on each box: demo-hp 49 entries / 722,596 KB → 1 / 16,028 KB + (commit 14:59:19 UTC, `removed=49`); demo-felhom 48 / 706,968 KB → 1 / 16,028 KB (commit 14:51:50 UTC, `removed=48`); + Tester 1 33 / 497,244 KB → 1 / 16,028 KB (commit 15:00:19 UTC, `removed=33`). After each: `pending.json` absent, + `/usr/local/bin/felhom-agent.prev` = 0.172.1, the unit active with no restart. +- **A rollback still works after the clean-up (Tester 1, 2026-11-10 15:14 UTC).** A signed `agent_update` to 0.172.1 + (the vouched version; it has no prune code) was installed with its pending marker. One `SEGV` in the 60-second dwell + → the unit's `OnFailure` → the wrapper's `rollback` → 0.173.0 ran again 9 seconds after the install, `pending.json` + gone, no failed unit. The failed version's staged file stays (by design, until the next good update): the folder + holds 2 files, 32,040 KB. Evidence: felhom.eu `documentation/audits/release-space-fixes-2026-11-10/agent/`. +- **Still to do:** the operator's vouch. Until then a new install gets the vouched version before this one. ## v0.172.1 (2026-11-07) — proxmox-grub joins the boot-chain lane: the nightly pve step stops being refused R6 — RELEASED and VOUCHED 2026-11-07 (release-agent.sh from `39db030`; agent sha256 505a0594a2fb117f359e329a0b7ae2c7a6902b74c51f52c1883145f3c2ac72f8, bundle 3e7acaee4500893bfaf567b1d427790ef89bf41f08cb6a1419ee528aeb40ddc3) diff --git a/CONTEXT.md b/CONTEXT.md index 6d79241..6be9afe 100644 --- a/CONTEXT.md +++ b/CONTEXT.md @@ -1,5 +1,7 @@ # CONTEXT — felhom-agent working state +> **2026-11-10 (afternoon, attended) — v0.173.0 RELEASED, NOT VOUCHED YET; on the three test boxes.** sha `752b2727…`, bundle `51ebc1f4…` (`configs/` unchanged since 0.172.1, so no bundle job). Measured: a box cleans its self-update folder at the commit of the update that BRINGS the code (49 → 1, 48 → 1, 33 → 1 entries; about 16 MB stays). The line below („at the first good update AFTER that release") was wrong. A rollback after the clean-up was proven on Tester 1 with a signed update to 0.172.1 and one crash in the dwell. Next: the operator's vouch, then `pinned.day0_agent` = 0.173.0. Open: the `.bak-*` files (R-1368 part 4). + > **2026-11-10 (day, operator brief) — COMMITTED, NOT RELEASED: the self-update folder cleans itself (R-1368 part 2).** After a healthy `commit` the agent removes every staged binary but the running version's (`internal/selfupdate/prune.go`; tests `TestPrune_*`, the wrapper's real `rollback` verb run in a sandbox). No version bump, no build, no vouch: it rides the next agent release. A box cleans its folder at the first good update AFTER that release. Not reached: `/usr/local/bin/felhom-agent.bak-*` (root-owned, R-1368 part 4). The old-kernel clean-up is a design only (felhom.eu `11-os-updates.md` §5.11.1, proven by hand on demo-hp); nothing of it is in this repo. > **2026-11-07 (attended) — v0.172.1 RELEASED and VOUCHED; on the three test boxes (agent + bundle, 77/77).** `proxmox-grub` joins `HOST_SLOW_RE` (the N100's ring-0 pve step was refused R6 three nights: proxmox-grub pmx4 pulls grub-efi-amd64). sha `505a0594…`, bundle `3e7acaee…` (only `felhom-os-apply` changed vs 0.170.0, no step bundle). Done: vouch, both signed jobs on the three boxes, `pinned.day0_agent` = 0.172.1. Next: the N100's pve step on its next night (positive line: `os-apply: DONE` for `layer=pve:9201`, no R6). diff --git a/REPORT.md b/REPORT.md index 8ff31b4..f26532a 100644 --- a/REPORT.md +++ b/REPORT.md @@ -1,23 +1,57 @@ -# REPORT — the self-update folder cleans itself (R-1368 part 2) — committed, NOT released (2026-11-10, operator brief) +# REPORT — v0.173.0 released and delivered to the three test boxes; NOT vouched yet (2026-11-10, attended) -**Plain words first.** Each agent update left its downloaded file on the box for ever: 49 files and 740 MB on demo-hp. -The agent now removes the old files after an update that ended well. It keeps the file of the version that runs. -This is a commit only. No version, no build, no vouch. No box has it. It waits for the next agent release. +**Plain words first.** Each agent update left its downloaded file on the box for ever. Version 0.173.0 removes the old +files after an update that ended well. It is released and it runs on the three test boxes. The folders went from +49, 48 and 33 files to 1 file each. A rollback still works after the clean-up. The operator's vouch is still open. -The full report of the run is in `felhom.eu`: `REPORT-endings-kernels-fixes-2026-11-10.md`. +The full report of the run is in `felhom.eu`: `REPORT-release-space-fixes-2026-11-10.md`. + +## One claim that was wrong + +The CHANGELOG entry and the report of the morning said: a box cleans its folder at the first good update AFTER the +release. That was wrong. The commit runs in the new binary. So the box cleans the folder at the commit of the update +that brings the code. Measured on three boxes; the CHANGELOG entry is corrected. + +## The release | | | |---|---| -| Change | `internal/selfupdate/prune.go` (new); the call in `MaybeCommit` (`commit.go`); one lock in `Execute` (`executor.go`) | -| Rule | After the wrapper's `commit` returned success: remove every staged binary but the running version's | -| Never removed | anything while `pending.json` exists or cannot be read; anything at a plain start or after a rollback; `pending.json`; a folder; a symlink; a name the code does not know | -| Rollback | Needs `pending.json` and `/usr/local/bin/felhom-agent.prev`. It reads no staged binary (`configs/felhom-selfupdate-guarded`, read first) | -| Tests | `TestPrune_*`, 6 tests. One runs the wrapper's real `commit` and `rollback` verbs from a sandboxed copy | -| Red seen | 3 times: no prune call; no pending refusal; no regular-file check | -| Gates | `python3 scripts/agent_gates.py --fast`: all OK | -| Not reached | `/usr/local/bin/felhom-agent.bak-*`: root-owned, made by a person. R-1368 part 4 stays open | -| Not proven | On a box. A box cleans its folder at the first good update AFTER the release that brings this code | -| Machines | None touched by this change | +| Version | 0.173.0, `scripts/release-agent.sh` from a clean clone of `776025c8` (tag `v0.173.0`) | +| Agent sha256 | `752b2727fb6043417ae5f342acbda52330521b21bb799fda90760b960feef7ea` | +| Bundle sha256 | `51ebc1f4c66d87918c87c035b4297c0e40e10ed31e3250c3837dfeaa0002e1c1` | +| CI | `776025c8`: run 2608, `gates #311`, success (read by commit on the public Actions page) | +| Delivery | one signed `agent_update` per box. No bundle job: `configs/` did not change since v0.172.1 | +| Vouch | **not given yet.** `pinned.day0_agent` stays 0.172.1 until the vouch is read back from the hub | -**Next.** A release session builds and vouches it. After two updates on a test box, read the folder: it must hold one -binary. +## The folder `/var/lib/felhom-agent/selfupdate`, before and after + +| Box | Before (on 0.172.1) | After the commit of 0.173.0 | Commit (UTC) | +|---|---|---|---| +| demo-hp | 49 entries, 722,596 KB | 1 entry, 16,028 KB | 14:59:19, `removed=49` | +| demo-felhom | 48 entries, 706,968 KB | 1 entry, 16,028 KB | 14:51:50, `removed=48` | +| Tester 1 | 33 entries, 497,244 KB | 1 entry, 16,028 KB | 15:00:19, `removed=33` | + +After each commit: `pending.json` absent, `/usr/local/bin/felhom-agent.prev` = 0.172.1, the unit active, no restart. + +## The rollback proof (Tester 1) + +1. A signed `agent_update` to 0.172.1 (the vouched version) was uploaded at 15:01:19 UTC. The box took it at its next + report, 15:14:31 UTC. The wrapper installed 0.172.1 and wrote the pending marker. +2. At 15:14:40 UTC, inside the 60-second dwell, one `systemctl kill -s SEGV` hit the agent's main process. +3. The unit's `OnFailure` ran the wrapper's `rollback`. Journal: `rolled back to previous binary and restarted + felhom-agent.service`. 0.173.0 started at 15:14:40 UTC. +4. Read at 15:15:56 UTC: agent 0.173.0, active, `pending.json` absent, no failed unit. The folder holds 2 files + (32,040 KB): the running version's and the failed 0.172.1. The failed file stays by design, until the next good + update. + +This is the path the repo already has. No second version was released for the proof. + +## What stays open + +- The operator's vouch. +- `/usr/local/bin/felhom-agent.bak-*` (R-1368 part 4): demo-felhom holds 11 such files, demo-hp 1. The agent cannot + reach them. +- After a rollback, `/usr/local/bin/felhom-agent.prev` holds the same version as the running binary. That is how the + wrapper works; it is not new. + +Evidence: felhom.eu `documentation/audits/release-space-fixes-2026-11-10/agent/`.