v0.30.0: AGENT-001 anti-retarget wipe fix (version bump + CHANGELOG)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -3,6 +3,24 @@
 All notable changes to **felhom-agent** are recorded here. Update on every code
 change that gets pushed.
 
+## v0.30.0 — AGENT-001: anti-retarget re-resolution for inline customer-confirmed wipe (2026-06-13)
+
+**Security fix (from the 2026-06-13 deep-sweep audit).** The inline customer-confirmed wipe in
+`internal/localapi/disks.go` `handleDiskFormat` inspected and gate-bound the device by its durable id
+but then ran `mkfs` on the caller-supplied mutable `/dev` path (`req.Device`). A USB re-enumeration
+reassigning that `/dev` node to a different physical disk between inspection and `mkfs` (a
+classify→mkfs TOCTOU) could wipe the wrong drive.
+
+- New `internal/localapi/wipe_reresolve.go`: `antiRetargetResolve` (injected-deps, unit-tested) mirrors
+  `signedjobs.WipeExecutor.Execute` — resolve the confirmed durable id → current device, re-derive the
+  device's durable id and require an exact match, re-inspect (still data-bearing), and return the
+  re-resolved device. `(*Server).reresolveDurableForWipe` wires the real storage funcs.
+- `handleDiskFormat` now formats the **re-resolved** device, never `req.Device`; any refusal →
+  `409 Conflict`, no `mkfs`. Injectable `reresolveWipe` seam on `Server` (defaults to the real path).
+- Tests: `wipe_reresolve_test.go` covers happy-path, empty/gone/blank, re-inspect-error, and the core
+  `retarget-mismatch-refused` case. Round-trip safe for legitimate wipes (`DeviceDurableID` ↔
+  `ResolveDurableDevice` schemes match). Agent-only deploy; no golden rebake. See `AGENT-001-FIX-NOTES.md`.
+
 ## v0.29.1 — lanresolver: RESTART dnsmasq on change (not reload) — fixes stale split-horizon IP (2026-06-13)
 
 **Bug:** after a guest's DHCP IP moved (e.g. the v0.29.0 9201 re-provision: .151 → .141), the LAN

cmd/felhom-agent/main.go

@@ -43,7 +43,7 @@ import (
 
 // version is the agent version. Overridable at build time with
 // -ldflags "-X main.version=<v>"; defaults to the in-repo CHANGELOG version.
-var version = "0.29.1"
+var version = "0.30.0"
 
 func main() {
 	var (