slice 8C Phase A: agent disk endpoints + data-bearing classifier gate + mkfs (v0.12.0)

internal/storage: mkfs executor (Format, device-pinned, narrow FELHOM_FORMAT
sudoers) + data-bearing device inspection (InspectDevice/DeviceProbe via
blkid+lsblk; conservative — ambiguous=data-bearing). internal/localapi: /disks
(+ data-bearing flag), /disks/assign (EnsureMount), /disks/eject (Unmount +
dependent guests), /disks/format. SECURITY CENTERPIECE: the agent inspects the
device itself; data-bearing format -> ClassStorageWipe gate -> pending_signature
refused; the caller's claim is never trusted. Additive (no controller change yet).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CHANGELOG.md

@@ -3,6 +3,42 @@
 All notable changes to **felhom-agent** are recorded here. Update on every code
 change that gets pushed.
 
+## v0.12.0 — slice 8C Phase A: disk endpoints + data-bearing classifier gate + mkfs executor (2026-06-10)
+
+The agent half of slice 8C, Phase A (additive). Adds the host disk-management endpoints the
+controller's disk UI drives — with the **8C security invariant**: the agent decides
+data-bearing-ness by **inspecting the actual device** (agent-internal evidence), NEVER from the
+caller's claim. A compromised controller asserting "this drive is blank" cannot wipe a data-bearing
+drive. (Controller rewire + disk-subsystem retirement + de-privilege are Phases B/C, `felhom-controller`.)
+
+### Added
+- **`internal/storage` — `mkfs` executor + data-bearing inspection.** `SudoHostOps.Format(device,
+  fstype)` (device-pinned, `ValidateBlockDevice`+`ValidateFSType`, narrow `FELHOM_FORMAT` sudoers —
+  `mkfs.ext4 -F` / `mkfs.xfs -f` on a `/dev/*` path the agent fine-validates first).
+  `SudoHostOps.InspectDevice(device)` → `DeviceProbe` (filesystem signature via `blkid -p`, partition
+  table / partitions / mount via `lsblk -J`). **`DeviceProbe.DataBearing()` is conservative**: any
+  signature / partition table / partition / mount — OR a probe that did not read cleanly — is
+  data-bearing (fail-safe; an unreadable device is never called blank).
+- **`internal/localapi` — the §6 disk endpoints**, all self-scoped (token→guest; cross-guest 403):
+  - `GET /disks` — host drives + a **data-bearing flag** (UI hint). Read-only/benign.
+  - `POST /disks/assign` — attach a drive as a mount (benign, additive → `EnsureMount`). Self-serve.
+  - `POST /disks/eject` — safe-unmount (benign, data preserved) + the **dependent guests** that
+    mount it (so the controller can warn which apps lose that storage).
+  - `POST /disks/format` — **the security centerpiece**: the agent **inspects the device itself**;
+    blank → benign → `mkfs`; **data-bearing → ClassStorageWipe → the slice-4 gate → refused
+    `pending_signature`** (the operator-signed completion is slice 10). The caller's claim is
+    ignored — only a device the agent reads as blank is formatted.
+- `storageGateAdapter` bridges the format path to the slice-4 reversibility gate (no new gate/crypto).
+
+### Tests
+- localapi (security matrix): blank device → **mkfs called, gate not consulted**; a **data-bearing
+  device → 403, mkfs NEVER called**, gate consulted (`pending_signature`); an **ambiguous/unprobed
+  device → treated destructive** (fail-safe); even a gate that *allows* does not format data-bearing
+  in 8C; assign → `EnsureMount`; eject → `Unmount` + dependent guests; cross-guest → 403; bad
+  device/fstype → 400; unconfigured → 503.
+- storage: `ValidateBlockDevice`/`ValidateFSType` (whitelist + injection rejection); `InspectDevice`
+  blank/filesystem/partition-table/mounted/failed-probe-fail-safe; `Format` invokes the right `mkfs.*`.
+
 ## v0.11.0 — slice 8B: app-consistent backup — /backup/due policy + /backup/status phases (2026-06-10)
 
 The agent half of slice 8B (doc 03 §8). Turns the 8A thin backup stubs into the real policy the