admin/felhom-agent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(report): R-39 — the demo box is healed and proven

Browse Source 
Supersedes the "not yet healed" hand-off section. Viktor clicked "Re-issue PBS
credentials" and the chain closed in 9 seconds: hub re-issued 20:28:44 -> agent
consumed 20:28:51 -> `pbsdr: converged state=applied` 20:28:53, with the PATCHED
wrapper. consumed-failed.json cleared automatically, marker.json rewritten. The
agent picked it up unaided because marker.json was absent, so the L235 hash
short-circuit did not apply.

Proof the tier is alive rather than merely reporting alive:
  pvesm status        401/inactive -> ACTIVE
  token /version      401          -> 200
  real backup         none         -> felhom-pbs:backup/ct/9201/
                                      2026-07-18T18:31:06Z, 9744319312 B, 13m36s

Encrypted under fingerprint 7e:a6:af:f7:ea:6d:3e:d9 — the ESCROWED key, the one
customer zero holds the recovery code for. First real DR-tier backup on the
reborn box.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nn3VgQk9iwEGgyx6QJ2NvE
This commit is contained in:
authentik Default Admin
2026-07-18 21:00:09 +02:00
parent 9596d5a8d0
commit f22f70ce58
1 changed files with 27 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
REPORT.md
+27 -13
View File
@@ -80,23 +80,37 @@ of which actually fired during authoring, which is the argument for running a pr
Both ride the spec'd R-39 agent train. Recorded, not improvised. Both ride the spec'd R-39 agent train. Recorded, not improvised.
## Live state of the demo box at hand-off ## The demo box — HEALED and proven (2026-07-18)
The wrapper is **hotfixed on the N100** (`/usr/local/sbin/felhom-pbs-apply`, backup kept at The wrapper is hotfixed on the N100 (`/usr/local/sbin/felhom-pbs-apply`, backup kept at
`.bak-20260718-preR39`, `bash -n` clean) so the repo and the box agree. `.bak-20260718-preR39`, `bash -n` clean) so the repo and the box agree.
**The box is not yet healed, and cannot be by CC.** During diagnosis the agent was made to re-apply Diagnosis had consumed the one pending secret against the still-unfixed wrapper; the agent parked
(marker moved aside — never deleted, the R-22 precedent), which proved the mechanism but consumed correctly in `consumed-failed.json` with `NOT retrying silently` — **no burn loop**, the fail-safe
the one pending secret against the still-unfixed wrapper. The agent parked correctly in worked. Viktor then clicked **"Re-issue PBS credentials"** (the one password-gated action CC cannot
`consumed-failed.json` with `NOT retrying silently` — **no burn loop**, the fail-safe worked. perform) and the whole chain closed itself in **9 seconds**:
Healing needs one password-gated operator action CC cannot perform: | Time (CEST) | Event |
|---|---|
| 20:28:44 | hub: `tenantsync: reissue ok` → `pbsdr credentials re-issued … fresh consume-once secret stored` |
| 20:28:51 | agent: `one-time token secret consumed`, wrapper `reconcile` invoked — **now the patched one** |
| 20:28:53 | agent: **`pbsdr: converged state=applied`** — no CONSUMED-BUT-FAILED this time |
> **Viktor: click "Re-issue PBS credentials" for `demo-felhom` on the hub.** `consumed-failed.json` was cleared automatically by `finishConverged` and `marker.json` rewritten.
The agent picked the re-issue up unaided because `marker.json` was absent, so the L235 hash
short-circuit did not apply.
The agent will then pick it up unaided — `marker.json` is absent, so the L235 short-circuit does not **Proof the tier is genuinely alive, not merely reported alive:**
apply — consume the fresh secret, and the patched wrapper will now apply it. Verification to run
afterwards: `pvesm status` shows `felhom-pbs` **active**, then one on-demand PBS backup of guest 9201
confirmed in the PBS-side listing (the tier's first real backup on the reborn box).
Nothing was destroyed: `.pw`, `.enc` (K), and the `storage.cfg` entry are all intact and verified. | Check | Before | After |
|---|---|---|
| `pvesm status` | `401 Unauthorized` / `inactive` | **`active`** |
| Direct token probe, `/api2/json/version` | `401` | **`200`** |
| Real backup | none possible | **`felhom-pbs:backup/ct/9201/2026-07-18T18:31:06Z`, 9 744 319 312 B, finished in 13m36s** |
The backup is encrypted under key fingerprint `7e:a6:af:f7:ea:6d:3e:d9` — the **escrowed** key, i.e.
the one customer zero holds the recovery code for. This is the DR tier's **first real backup on the
reborn box**.
Nothing was destroyed at any point: `.pw`, `.enc` (K), and the `storage.cfg` entry were verified
intact after the rejected `pvesm set` (PVE rejects atomically, so the set-only law held).