From eb38d78945c40c71930f29e3c7d709ac7fb74d58 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Sat, 17 Oct 2026 17:29:50 +0200 Subject: [PATCH] REPORT/CONTEXT: agent 0.159.1, the catalog allow-list (controller v0.328.0), its catalog gate (2026-10-17) Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS --- CONTEXT.md | 5 +++++ REPORT.md | 24 +++++++++++++++++------- 2 files changed, 22 insertions(+), 7 deletions(-) diff --git a/CONTEXT.md b/CONTEXT.md index 32ecce3..20e9511 100644 --- a/CONTEXT.md +++ b/CONTEXT.md @@ -1,5 +1,10 @@ # CONTEXT — felhom-agent working state +> **2026-10-17 — v0.159.1 RELEASED (0.159.0 superseded, do not vouch).** Go 1.27.2; R-1124 a decommissioned drive that is +> gone is forgotten (`ForgetRetiredDrives`, root verb `unit-forget`); R-1012 the read-only `felhom-thin-check` names an +> orphan thin device in a failed backup's text; the signed decommission prunes the guest-bind record. Bundle adds a path → +> step bundle `0.159.0-step1`. Proven on demo-hp; delivered by signed jobs on the operator's yes. Vouch: the operator's. + > **2026-10-16 — v0.158.1 RELEASED and VOUCHED (storage identity build B; 0.158.0 superseded, do not vouch).** The internal > data place (root helper `felhom-internal-place`, the record in the state dir, mounted at /mnt/belso like a drive), the > signed `add_internal_place`, partitions in `/disks/candidates` (`formattable` only while nothing on the disk is mounted), diff --git a/REPORT.md b/REPORT.md index ead0342..89f3f29 100644 --- a/REPORT.md +++ b/REPORT.md @@ -1,12 +1,22 @@ -# REPORT — the agent on Go 1.27.2 (R-972, 2026-10-16) — NOT released +# REPORT — agent 0.159.1: forget a gone decommissioned drive (R-1124), name an orphan thin device (R-1012), Go 1.27.2 (2026-10-17) -Written in ASD-STE100 Simplified Technical English. Part of burndown 2 (felhom.eu `REPORT-burndown2-2026-10-16.md`). +Written in ASD-STE100 Simplified Technical English. Session report: felhom.eu `REPORT-agent-allowlist-rotation-2026-10-17.md`. +Evidence: felhom.eu `documentation/audits/agent-allowlist-rotation-2026-10-17/P1/`. -- **What changed:** `go.mod` `go 1.27.2` and golang.org/x/crypto v0.58.0. No code change. -- **Proof:** `go build ./...`, `go vet ./...`, `go test ./...` rc 0 on Go 1.27.2; `agent_gates.py --fast` all OK. -- **Not done, on purpose:** no release and no deploy — agent releases wait for the operator's vouch. R-972 stays - NARROWED for the agent: the next vouched release carries the new Go. +- **Released:** v0.159.0 (superseded — do not vouch) and **v0.159.1** (sha256 `de8f6ad9…aff9`, bundle `2af3d27d…7cd6`). + Step bundle `0.159.0-step1` (`1d65edb3…d6cf`) for a box on the v0.158.1 bundle (the new bundle adds `felhom-thin-check`). +- **R-1124:** `ForgetRetiredDrives` (start + 20-s tick) disables and removes, through the new root verb + `felhom-priv-apply unit-forget`, the unit of a DECOMMISSIONED drive that is absent and unmounted. A present one keeps its + unit (one-click re-enroll). v0.159.1: the signed decommission also prunes the guest-bind record. +- **R-1012:** read-only root helper `felhom-thin-check `; `internal/thincheck` (two reads, fails open); + `BackupRunner.SetThinCheck` appends the plain-word finding to a failed snapshot backup's error. Never removes. +- **Proof on demo-hp:** loop-backed test drive forgotten 8 s after the unplug; on 0.159.1 the bind-record warning stopped + (0 lines, control 3); scratch thin pool: a made orphan listed, a foreign metadata snapshot refused; `pve/data` read and + released; a 9201 whole-guest backup ran the check first and finished green. All red-proofs in P1. +- **Delivery:** demo-hp done (0.159.1 + bundle, 75/75). Tester 1 and demo-felhom: by signed jobs on the operator's yes. + **The vouch is the operator's.** ## Observations -1. The release script needs no change: it builds with the toolchain `go.mod` names. NOT-A-FINDING: GOTOOLCHAIN=auto on DooPlex fetched go1.27.2 for this build and will for a release build. +1. The operator-signed decommission did not prune the guest-bind record (the self-serve one did). NOT-A-FINDING: fixed in this session in v0.159.1 (the size rule), test red-proved. +2. A loop device reads as role „system", so the self-serve decommission refuses it. NOT-A-FINDING: correct (fail safe to protected); the live proof used the operator-signed path.