From 935904fa4e80e59397f696247665ecae45d03786 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Tue, 21 Jul 2026 13:39:33 +0200 Subject: [PATCH] docs(report): guest_net confirmed on the wire hub-side; STOP-3 done; damping state is in-memory only --- REPORT.md | 47 +++++++++++++++++++++++++++++++++++++---------- 1 file changed, 37 insertions(+), 10 deletions(-) diff --git a/REPORT.md b/REPORT.md index e78ecff..b60cae2 100644 --- a/REPORT.md +++ b/REPORT.md @@ -230,14 +230,40 @@ One bad probe, **no action**, then recovery. The two-consecutive-probes rule and did exactly what they exist for — a booting guest was not injected with a dhclient — and this was a genuine transient, not a scripted one. -## 6c. What could NOT be verified here +## 6c. The stanza ON THE WIRE — confirmed hub-side after STOP-3 -The `guest_net` stanza **on the wire**. `--selftest=hub` builds its own one-shot collector and never -wires the guestnet reporter, so it would print a misleading absence — using it as evidence would be -worse than having none. (That divergence between the selftest collector and the daemon's is itself -worth a small fix; the same comment already exists in the code for the pbs reporter.) The stanza is -proven through the production `Collect` path by test, and `SetGuestNetReporter` is proven called by -the AST wiring test, but seeing it in a real hub report needs the operator UI. +Initially unverifiable here: `--selftest=hub` builds its own one-shot collector and never wires the +guestnet reporter, so it would have printed a misleading absence — worse evidence than none. (That +divergence between the selftest collector and the daemon's is worth a small fix; the same caveat is +already commented in the code for the pbs reporter.) + +Closed instead by a **read-only** query of the hub's own store (`kubectl cp` of `/data/hub.db`, +opened `mode=ro`, copy deleted afterwards). The `guest_net` stanza is present, complete, and +round-trips every field: + +```json +"guest_net": { "checked_at": "2026-07-21T11:32:10Z", "guests": [ + { "vmid": 9201, "state": "healthy", "mode": "dhcp", "ip": "192.168.0.104", + "has_route": true, "dhclient_alive": true, "checked_at": "2026-07-21T11:31:07Z", + "message": "address, default route and dhclient all present" } ] } +``` + +And the report history tells the whole story of this session from the hub's side: + +| received (UTC) | agent | state | evidence | +|---|---|---|---| +| 10:30:27 | **0.92.0** | **`unknown`** | the sudoers-blind window — reported honestly as unknown, never as a false healthy and never as a false dead. The fail-safe is visible fleet-side, and this is independent confirmation that 0.92.0 was genuinely blind (so superseding it was right) | +| 10:48:12 | 0.92.1 | `healthy` | **`last_heal_at=2026-07-21T10:45:12Z`, `heals_last_hour=1`** — the STOP-2 heal, surfaced to the hub | +| 10:49:14 / 11:04:14 | 0.92.1 | `healthy` | same heal stamp, counter still 1 | +| 11:32:10 | 0.92.1 | `healthy` | heal history absent — see the limitation below | + +**A limitation this surfaced, worth stating plainly: the damping state is in-memory only.** The +counters vanished from the 11:32 report because the agent was restarted at 11:17Z (the `log_level` +revert), which resets `heals`/`lastHealAt`. So the "≥10 min apart, ≤3 per hour" ceilings hold within +one agent lifetime, not across restarts. In practice the exposure is small — a restart also re-arms +the 3-minute settle window and the two-consecutive-bad-probes rule — but a crash-looping agent could +heal more often than the ceiling implies. Not worth persisting state for today; worth knowing before +anyone quotes the ceiling as a hard guarantee. ## 7. Deliverables @@ -250,9 +276,10 @@ the AST wiring test, but seeing it in a real hub report needs the operator UI. ## 8. Operator actions outstanding 1. ~~STOP-2~~ — **DONE 2026-07-21, passed** (§6b). -2. **STOP-3** — Day-0 manifest Agent → **0.92.1** / `7424bc1c3c533eff9157e15a18d4635c624931f5a479a48126de77a94e6a3d4d` - (wrapper sha unchanged — `configs/felhom-pbs-apply` was not touched). MinAgent is the operator's - call; 0.92.1 is safe once felhom-pve has converged, which it has. +2. ~~STOP-3~~ — **DONE 2026-07-21.** Manifest Agent → **0.92.1**, sha matches the published artifact + byte for byte; MinAgent → 0.92.1; PBS wrapper sha unchanged (`104db0a4…`, correct — the wrapper + was not touched); controller floor → 0.156.0. The host page shows all four `guestnet-*` + capability rows **ok**, which is the fleet-visible proof of the sudoers grant. 3. ~~Revert `log_level` to `info`~~ — **DONE** (13:17 CEST, after the quiet window closed; agent restarted clean, caps `68/68 ok, degraded=0`, watchdog back up). The temporary raise is recorded here only so the journald volume change is explainable; `/root/agent.json.bak-debuglevel` remains