From 78c890e4bb8aaaae71dc69035358e0101bdb9e5f Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Mon, 5 Oct 2026 08:25:49 +0200 Subject: [PATCH] REPORT: the 2026-10-05 night-fixes session Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS --- REPORT.md | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/REPORT.md b/REPORT.md index 8223c82..d3b4ac6 100644 --- a/REPORT.md +++ b/REPORT.md @@ -1,19 +1,19 @@ -# REPORT — agent v0.143.0: the config bundle (R-840) — 2026-10-04 +# REPORT — agent v0.144.0 + v0.144.1 (2026-10-05): the night's fixes -**What:** a signed route for a box's root-owned files. `felhom-os-apply` gained mode `bundle` (signed -`agent_config_update`, verified by the wrapper itself) and `--install-bundle` (the installer's root entry); -`BUNDLE_FILES` is the one table of 22 paths; `scripts/build-config-bundle.py` builds it reproducibly; -`release-agent.sh` publishes it beside the binary; the agent reports `system.config_bundle`; `felhom-opsign` signs it. -Also `build-golden.sh` 3.2.0 (`GOLDEN_GUEST_PKGS`). +Brief: the 2026-10-05 night-fixes brief (operator), Parts C, D, E. Full session report: +`felhom.eu/REPORT-night-fixes-2026-10-05.md`. Architecture read: `11-os-updates.md` (§5.4.1 R8, §8.1–8.3). -**Released:** v0.143.0, binary `41c0d306…`, bundle `8d7273cf…` (reproducible), vouched in the hub with golden 0.293.0. -**Delivered:** demo-hp and demo-felhom (signed `agent_update`), then the one-file bootstrap, then the bundle by the -signed route (0 written of 22; probe 71/71). demo-hp also: a wrong sha refused, a one-line change and its undo, a replay -rejected. Tester 2: the signed `agent_update` queued (operator ruling 97); its bundle waits for the operator's -bootstrap (R-862). +| Row | Fix | Proof | +|---|---|---| +| R-865 | R8: `--print-uris` WITHOUT `-s` (with `-s` apt lists no URIs → 0 B) | fake answers like real apt (verbatim 9202 output); red-proof; live: the installed wrapper read 12 802 456 B for 13 pending upgrades on demo-hp | +| R-868 | the wrapper keeps its apply report beside the plan; the agent sends kept copies (start + every 5 min) and deletes them; pass lock (flock) | v0.144.0 measured NOT to work live (the wrapper died on a broken stderr pipe); v0.144.1: survives a dead reader + the 5-min look; live A5 shape on demo-hp → ONE `applied` report (13 packages) at the hub | +| R-866 | the daemon saves the hub's block; the selftest uses it with the hub away and says so | live on demo-felhom with the hub blackholed: `block=SAVED(…)`, pass ran; its kept reports reached the hub at the next start | -**Tests:** `configs/test_felhom_config_bundle.py` 43 (22 of 22 mutants red), Go `internal/osupdate/bundle_test.go`, -`internal/hub/bundle_record_test.go`; `go vet ./... && go test ./...` rc=0; gates green. -**Found:** R-861 — the sudoers already lets the agent user reach root (read, not exploited). -Evidence and the full report: `felhom.eu/documentation/audits/r840-config-bundle-2026-10-04/`, -`felhom.eu/REPORT-r840-config-bundle-2026-10-04.md`. +Released by `scripts/release-agent.sh`: v0.144.0 (`f18093c3…`, bundle `6acf42fe…`) and v0.144.1 (`6ccd521d…`, bundle +`e89a9ddf…`), both verified by download. Delivered by signed `agent_update` + `agent_config_update` to demo-hp, +demo-felhom and tester-1 (71/71 capability probe after each bundle). Vouched: agent 0.144.1, golden 0.294.0, +min_agent 0.131.0. A second release in one session is `09` decision 108. + +**Found, not fixed: R-876 (P2)** — after a power cut mid-update (Part E, demo-hp) `dpkg --audit` is clean but dpkg's +update journal is not; `repair()` skips, every pass fails until `dpkg --configure -a` by hand. Next agent release. +Also R-875 (P4): the kept-report reason text is wrong for the hub-away case.