From f22f70ce5884c029fa75bc9bd6c6793124183155 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Sat, 18 Jul 2026 21:00:09 +0200 Subject: [PATCH] =?UTF-8?q?docs(report):=20R-39=20=E2=80=94=20the=20demo?= =?UTF-8?q?=20box=20is=20healed=20and=20proven?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Supersedes the "not yet healed" hand-off section. Viktor clicked "Re-issue PBS credentials" and the chain closed in 9 seconds: hub re-issued 20:28:44 -> agent consumed 20:28:51 -> `pbsdr: converged state=applied` 20:28:53, with the PATCHED wrapper. consumed-failed.json cleared automatically, marker.json rewritten. The agent picked it up unaided because marker.json was absent, so the L235 hash short-circuit did not apply. Proof the tier is alive rather than merely reporting alive: pvesm status 401/inactive -> ACTIVE token /version 401 -> 200 real backup none -> felhom-pbs:backup/ct/9201/ 2026-07-18T18:31:06Z, 9744319312 B, 13m36s Encrypted under fingerprint 7e:a6:af:f7:ea:6d:3e:d9 — the ESCROWED key, the one customer zero holds the recovery code for. First real DR-tier backup on the reborn box. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01Nn3VgQk9iwEGgyx6QJ2NvE --- REPORT.md | 40 +++++++++++++++++++++++++++------------- 1 file changed, 27 insertions(+), 13 deletions(-) diff --git a/REPORT.md b/REPORT.md index 2d7e0eb..1dcdd2f 100644 --- a/REPORT.md +++ b/REPORT.md @@ -80,23 +80,37 @@ of which actually fired during authoring, which is the argument for running a pr Both ride the spec'd R-39 agent train. Recorded, not improvised. -## Live state of the demo box at hand-off +## The demo box — HEALED and proven (2026-07-18) -The wrapper is **hotfixed on the N100** (`/usr/local/sbin/felhom-pbs-apply`, backup kept at +The wrapper is hotfixed on the N100 (`/usr/local/sbin/felhom-pbs-apply`, backup kept at `.bak-20260718-preR39`, `bash -n` clean) so the repo and the box agree. -**The box is not yet healed, and cannot be by CC.** During diagnosis the agent was made to re-apply -(marker moved aside — never deleted, the R-22 precedent), which proved the mechanism but consumed -the one pending secret against the still-unfixed wrapper. The agent parked correctly in -`consumed-failed.json` with `NOT retrying silently` — **no burn loop**, the fail-safe worked. +Diagnosis had consumed the one pending secret against the still-unfixed wrapper; the agent parked +correctly in `consumed-failed.json` with `NOT retrying silently` — **no burn loop**, the fail-safe +worked. Viktor then clicked **"Re-issue PBS credentials"** (the one password-gated action CC cannot +perform) and the whole chain closed itself in **9 seconds**: -Healing needs one password-gated operator action CC cannot perform: +| Time (CEST) | Event | +|---|---| +| 20:28:44 | hub: `tenantsync: reissue ok` → `pbsdr credentials re-issued … fresh consume-once secret stored` | +| 20:28:51 | agent: `one-time token secret consumed`, wrapper `reconcile` invoked — **now the patched one** | +| 20:28:53 | agent: **`pbsdr: converged state=applied`** — no CONSUMED-BUT-FAILED this time | -> **Viktor: click "Re-issue PBS credentials" for `demo-felhom` on the hub.** +`consumed-failed.json` was cleared automatically by `finishConverged` and `marker.json` rewritten. +The agent picked the re-issue up unaided because `marker.json` was absent, so the L235 hash +short-circuit did not apply. -The agent will then pick it up unaided — `marker.json` is absent, so the L235 short-circuit does not -apply — consume the fresh secret, and the patched wrapper will now apply it. Verification to run -afterwards: `pvesm status` shows `felhom-pbs` **active**, then one on-demand PBS backup of guest 9201 -confirmed in the PBS-side listing (the tier's first real backup on the reborn box). +**Proof the tier is genuinely alive, not merely reported alive:** -Nothing was destroyed: `.pw`, `.enc` (K), and the `storage.cfg` entry are all intact and verified. +| Check | Before | After | +|---|---|---| +| `pvesm status` | `401 Unauthorized` / `inactive` | **`active`** | +| Direct token probe, `/api2/json/version` | `401` | **`200`** | +| Real backup | none possible | **`felhom-pbs:backup/ct/9201/2026-07-18T18:31:06Z`, 9 744 319 312 B, finished in 13m36s** | + +The backup is encrypted under key fingerprint `7e:a6:af:f7:ea:6d:3e:d9` — the **escrowed** key, i.e. +the one customer zero holds the recovery code for. This is the DR tier's **first real backup on the +reborn box**. + +Nothing was destroyed at any point: `.pw`, `.enc` (K), and the `storage.cfg` entry were verified +intact after the rejected `pvesm set` (PVE rejects atomically, so the set-only law held).