From 68a2130681f9628659380f00b88eceb2db9d0c75 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Tue, 13 Oct 2026 20:18:21 +0200 Subject: [PATCH] v0.155.0: CHANGELOG release entry (sha, bundle, tag) --- CHANGELOG.md | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index dc7e3bd..0b5ab87 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,30 @@ +## v0.155.0 — the household can turn the machine off: POST /host/poweroff (R-998); the escrow reply race fixed (2026-10-13) + +Released by `scripts/release-agent.sh`: binary sha256 `bb339e944eff4aa6d10ae09158e0943de2e5c3777f52bf993c796d57e46800c3`, bundle +`795f2ab41661e993e3fc4ce65df4f11ce94280d94871ab2e5cf1993ae3fbff7d` (tag `v0.155.0`). **Not vouched** (the operator's act). +**The bundle changes `felhom-agent.sudoers`** (no new path — no step bundle): delivery is a signed `agent_update` + +`agent_config_update`. Design: felhom.eu `documentation/architecture/14-host-power-off.md`. + +- **`POST /host/poweroff`** (local API, `withGuest`-scoped like `/guest/reboot`) — the controller's „A gép kikapcsolása" + (controller v0.310.0). Refused (409, a stable `reason`) in the first 10 min after boot; a second time in one boot + (`internal/poweroff`, a file keyed by `/proc/stat` btime); while ANY other guest or VM runs on the host (read from + `/proc`: `lxc-start -n N`, `kvm -id N` — demo-hp's scratch guest and Tester 1 VM block it); while the heavy-operation + gate is held (backup, restore test, OS step, sweep, trim), a backup job, a controller swap, a drive format, a NAS verify + or an escrow ceremony runs, or Proxmox runs a vzdump of the guest. Every check fails closed. +- On acceptance: the record first; the heavy gate TAKEN and kept; a host report carrying `deliberate_off.requested_at` + accepted by the hub (bounded 60 s, `Loop.SetReportedHook`); then before each step the jobs and other guests are + checked again — a job waits (≤ 15 min), another guest cancels at once, a job still running after the wait cancels + (gate released, box stays on); `pct shutdown --timeout 120`; `systemctl poweroff`. +- **Sudoers:** `FELHOM_POWEROFF` = `/usr/bin/systemctl poweroff`; `pct ^shutdown [0-9]+ --timeout [0-9]+$` joins + `FELHOM_GUESTHOOK`; nine injection cases (`--forceStop`, `poweroff --force`, `reboot`, `halt`, `kexec`…). + **New `TestEveryAliasIsGranted`:** an alias missing from the grant line passed the coverage check before. +- **Host report:** `deliberate_off` (omitempty; the cross-repo golden unchanged). Hub v0.149.0 holds its silence alarms + for 14 days on it. +- **Fixed without a row:** `go test -race` found a data race in the escrow ceremony start reply (it read `job.Phase` + while the job goroutine wrote it); the reply fields are copied first. Red before, green 3/3 after. +- Security review (three passes the same evening): other guests, a gate not held, fail-open unwired checks, jobs and + guests starting after acceptance — each fixed and red-proofed (`hostpoweroff_test.go`, 11 tests). + ## v0.154.0 — no OS leg after a household press; the after-boot kernel report carries the real ring (R-899); no „wrong code" when older packages were not checked (R-304); the last backup survives a restart in the host report; the Secure Boot meta-package leaves the Proxmox lane (2026-10-09) Released by `scripts/release-agent.sh`: binary sha256 `36a54ad20e896cd61d7b9944e2a521f4209c2b76940d8f1827af05b645463226`, bundle