v0.155.0: CHANGELOG release entry (sha, bundle, tag)

CHANGELOG.md

@@ -1,3 +1,30 @@
+## v0.155.0 — the household can turn the machine off: POST /host/poweroff (R-998); the escrow reply race fixed (2026-10-13)
+
+Released by `scripts/release-agent.sh`: binary sha256 `bb339e944eff4aa6d10ae09158e0943de2e5c3777f52bf993c796d57e46800c3`, bundle
+`795f2ab41661e993e3fc4ce65df4f11ce94280d94871ab2e5cf1993ae3fbff7d` (tag `v0.155.0`). **Not vouched** (the operator's act).
+**The bundle changes `felhom-agent.sudoers`** (no new path — no step bundle): delivery is a signed `agent_update` +
+`agent_config_update`. Design: felhom.eu `documentation/architecture/14-host-power-off.md`.
+
+- **`POST /host/poweroff`** (local API, `withGuest`-scoped like `/guest/reboot`) — the controller's „A gép kikapcsolása"
+  (controller v0.310.0). Refused (409, a stable `reason`) in the first 10 min after boot; a second time in one boot
+  (`internal/poweroff`, a file keyed by `/proc/stat` btime); while ANY other guest or VM runs on the host (read from
+  `/proc`: `lxc-start -n N`, `kvm -id N` — demo-hp's scratch guest and Tester 1 VM block it); while the heavy-operation
+  gate is held (backup, restore test, OS step, sweep, trim), a backup job, a controller swap, a drive format, a NAS verify
+  or an escrow ceremony runs, or Proxmox runs a vzdump of the guest. Every check fails closed.
+- On acceptance: the record first; the heavy gate TAKEN and kept; a host report carrying `deliberate_off.requested_at`
+  accepted by the hub (bounded 60 s, `Loop.SetReportedHook`); then before each step the jobs and other guests are
+  checked again — a job waits (≤ 15 min), another guest cancels at once, a job still running after the wait cancels
+  (gate released, box stays on); `pct shutdown <vmid> --timeout 120`; `systemctl poweroff`.
+- **Sudoers:** `FELHOM_POWEROFF` = `/usr/bin/systemctl poweroff`; `pct ^shutdown [0-9]+ --timeout [0-9]+$` joins
+  `FELHOM_GUESTHOOK`; nine injection cases (`--forceStop`, `poweroff --force`, `reboot`, `halt`, `kexec`…).
+  **New `TestEveryAliasIsGranted`:** an alias missing from the grant line passed the coverage check before.
+- **Host report:** `deliberate_off` (omitempty; the cross-repo golden unchanged). Hub v0.149.0 holds its silence alarms
+  for 14 days on it.
+- **Fixed without a row:** `go test -race` found a data race in the escrow ceremony start reply (it read `job.Phase`
+  while the job goroutine wrote it); the reply fields are copied first. Red before, green 3/3 after.
+- Security review (three passes the same evening): other guests, a gate not held, fail-open unwired checks, jobs and
+  guests starting after acceptance — each fixed and red-proofed (`hostpoweroff_test.go`, 11 tests).
+
 ## v0.154.0 — no OS leg after a household press; the after-boot kernel report carries the real ring (R-899); no „wrong code" when older packages were not checked (R-304); the last backup survives a restart in the host report; the Secure Boot meta-package leaves the Proxmox lane (2026-10-09)
 
 Released by `scripts/release-agent.sh`: binary sha256 `36a54ad20e896cd61d7b9944e2a521f4209c2b76940d8f1827af05b645463226`, bundle