575 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
admin	0683cc2dab	REPORT: the 2026-10-26 afternoon run. Docs only.	2026-10-26 14:38:15 +01:00
admin	b1bc63dd32	R-1285: the new agent runs the bundle policy pass once after its self-update commits — in the normal two-job delivery the old process installs the bundle. Test in the real order (commit, then one bundle-policy plan); red-proved. Commit only, not released.	2026-10-26 12:44:25 +01:00
admin	e66a48f2b7	REPORT: the 2026-10-26 attended release run. Docs only.	2026-10-26 10:38:03 +01:00
admin	b890b57540	v0.166.0 released and vouched by the operator (10:04:55 CET): CHANGELOG header (R-1280 live, R-1285 back to OPEN — the bundle job runs in the old process); D50 day0_agent pin → 0.166.0. Docs only.	2026-10-26 10:07:15 +01:00
admin	aa69114d18	REPORT: the 2026-10-25 night — committed fixes, CI by hash, teardown. Docs only. v0.166.0	2026-10-25 23:54:07 +01:00
admin	abcc1e6833	R-1285: after every bundle install the agent asks the wrapper now on disk for the appliance-only policy pass, so a BYO host upgraded from an older wrapper loses our SSH drop-in in one update. Red-proved. Commit only, not released.	2026-10-25 21:46:38 +01:00
admin	d912307bb7	R-1280: a signed job's validity window is at most 24 h — the verifier, the root wrapper and felhom-opsign. Red-proved. Commit only, not released.	2026-10-25 21:42:18 +01:00
admin	feaaa0e8ff	D50 = A (R-1290): the published gate asserts the newest 5 released versions plus the pinned MinAgent (0.158.1) and day-0 agent (0.165.0); a pin with no tag fails; decoys red-proved. No binary change.	2026-10-25 20:20:30 +01:00
admin	6b6ba0c17f	v0.165.0 vouched by the operator (18:38:49 CET); REPORT: release, delivery to four hosts, the BYO proof (removal one bundle late, felhom.eu R-1285). Docs only.	2026-10-25 19:02:48 +01:00
admin	4697f8ac9e	v0.165.0: CHANGELOG names the release (R-1257 D43 = A, R-1250); released from a clean clone, sha256 e9d04a47…, bundle 8dea1f34…; not vouched	2026-10-25 17:00:02 +01:00
admin	4a1a84941c	D43 = A run close-out: REPORT and CONTEXT. Docs only. v0.165.0	2026-10-24 21:04:19 +02:00
admin	c8d3c17b13	D43 = A (R-1257): the root-key-only sshd drop-in only on an appliance; on BYO nothing is written and our copy is removed; the in-force check reads the LAN addresses (X3); a failing sshd -t undoes only the SSH step (X4). Commit only, not released.	2026-10-24 20:47:17 +02:00
admin	f5c3d77a61	Review round 2: .claude/rules/unprompted-work.md aligned with its four siblings (the missing 'A version number is pushed once' fact paragraph); no code change	2026-10-24 15:50:59 +02:00
admin	5e05627c4e	REPORT: R-1250 test on request, live proof on demo-hp	2026-10-24 13:48:07 +02:00
admin	1e087bb158	linetest: waiting_for_quiet needs the full watched window (R-1250) ... The live proof found a fresh agent answering waiting before it had watched one minute; a quiet box's torrent app would be held for nothing.	2026-10-24 13:24:41 +02:00
admin	29bcf4403e	linetest: a test on request for a box that seeds all day (R-1250) ... GET /host/line-test reports waiting_for_quiet (due, in the window, tunnel up, only the quiet missing); POST /host/line-test/run runs one measurement with a 5 s settle and a 10 s quiet check instead of 10 quiet minutes, runs 5 s apart (~55 s). Every other weekly rule holds. Commit only; the release rides the next train.	2026-10-24 13:18:59 +02:00
admin	08ca67861f	CHANGELOG: v0.164.0 released (the weekly upload line test, R-1247), delivered to the three test boxes, vouched by the operator; REPORT	2026-10-24 09:46:00 +02:00
admin	f7e1dcbb27	R-1247: the weekly upload line test — the agent's own iperf3 client to ep0's tunnel-only server, Tuesday 10:00-15:59 after 10 quiet minutes, under the heavy-op gate, best of 3; line_test stanza + GET /host/line-test; 15 tests red-proved; unreleased (next v0.164.0) v0.164.0	2026-10-24 08:59:42 +02:00
admin	2d4b1930df	REPORT: day 2026-10-23 — agent 0.163.0 released, delivered (step bundle), vouched by the operator	2026-10-23 11:08:14 +02:00
admin	b4721eee11	CHANGELOG: v0.163.0 released (D30, D4 root SSH by key only, R-1204)	2026-10-23 08:44:19 +02:00
admin	1109092def	D4 (R-982): root SSH from the LAN by key only — the bundle's sshd drop-in, try-reload-or-restart, an sshd -T read-back reported when not in force, a reload in undo (the reviewed v2 patch); unreleased v0.163.0	2026-10-23 08:22:17 +02:00
admin	b45c47be6c	REPORT: night 2026-10-22/23 (D30 live, hardened; D4 patches v2)	2026-10-23 00:06:13 +02:00
admin	b9b831fb90	D30: a wait stamp dated after now (a clock that jumped back) is dropped, never a block until that date — the commit's security review; red-proved; unreleased	2026-10-22 23:08:25 +02:00
admin	39fb9cbf6c	D30 rotation hardened after review: the key file is replaced by an fsynced rename over it (never missing or empty), the first old key stays private.key.prev, later ones dated (3 kept), the once-an-hour bound survives a restart; red-proved; CONTEXT; unreleased	2026-10-22 23:00:05 +02:00
admin	ae69ad4512	D30 (R-1204): a handshake stamped in the future for 15 min gives a new WireGuard key, registered on the existing peer path (the hub re-keys in place; its full-list push swaps the key on ep0 — nothing new on ep0); old key kept as private.key.prev; red-proved; unreleased	2026-10-22 20:52:52 +02:00
admin	e803ad2b91	night 2026-10-22: REPORT; CHANGELOG corrected — a push of the installer to main publishes nothing (R-110, tag installer-v1.35.0); D4 stays a patch because both halves need a release	2026-10-22 18:13:35 +02:00
admin	7651461be2	D4 (R-982) moved out of main into a ready patch — its installer half would publish the installer (forbidden tonight); R-1204 stays; unreleased	2026-10-22 17:10:46 +02:00
admin	a0c88e5183	R-982 (D4): root SSH from the LAN by key only — a bundle drop-in, checked and reloaded by felhom-os-apply; R-1204: the heartbeat reports a future-stamped tunnel handshake; unreleased	2026-10-22 16:58:45 +02:00
admin	2d5840ba11	v0.162.0: released (operator yes 2026-10-22), delivered to the 3 test boxes; CHANGELOG + REPORT	2026-10-22 10:39:06 +02:00
admin	b310773dbf	REPORT: the night of 2026-10-21 (host swap report, R-1194), unreleased v0.162.0	2026-10-22 00:06:21 +02:00
admin	0da792e670	R-1192 follow-up: report host swap vs the guests' swap allowance (log once, hub alarm, local API); R-1194: no OOB stanza before the first felhom-sshd pass; unreleased	2026-10-21 21:29:07 +02:00
admin	286a7e3ecf	R-1192: every guest may swap as much as its RAM (bring-up, RAM resize, once at start) — the measured 8 GB freeze; unreleased	2026-10-21 15:43:18 +02:00
admin	4e1621c650	CHANGELOG + CONTEXT + REPORT: v0.161.0 released (operator yes) and delivered to demo-hp, Tester 1, demo-felhom; not vouched; R-1083 left out	2026-10-20 09:07:30 +02:00
admin	51521230c9	REPORT: the night's agent fixes (R-921, R-1070, R-1010), not released v0.161.0	2026-10-19 21:47:40 +02:00
admin	84ef5818d5	security-scan gate (shared felhom.eu/scripts/security_scan_gate.py) in the fast set and CI, warn-first, with the accepted-hits file and decoys (R-986)	2026-10-19 21:11:46 +02:00
admin	56aabc729c	Unreleased: host_busy on GET /backup/status (R-921), a missing tunnel container is 'absent' and not-applicable after an OS update (R-1070), the janitor forces a half-removed vzdump snapshot once (R-1010)	2026-10-19 19:52:37 +02:00
admin	0cbd500154	gofmt gate in agent_gates.py with its decoys (R-1160); REPORT for the day	2026-10-19 10:26:27 +02:00
admin	1edfd8e331	gofmt -w: 14 files, formatting only, no behaviour change (R-1160)	2026-10-19 10:24:32 +02:00
admin	0bc0bc5da0	CONTEXT + REPORT: v0.160.0 released, on the three test hosts, not vouched	2026-10-19 05:41:34 +02:00
admin	45458196d1	Two texts made true after 0.160.0: the ceremony log line names the confirm order; the R-973 comments name whole_guest_backup_refused (no behaviour change)	2026-10-19 05:25:58 +02:00
admin	124164db73	CHANGELOG v0.160.0 (released: R-978, R-973, R-1093, R-1149, R-1151)	2026-10-19 03:22:00 +02:00
admin	c11e3e2a87	The new escrow package reaches the hub only after the household typed two words of the code back: POST /escrow/ceremony/confirm; an old controller keeps the claim order (R-1151, unreleased) v0.160.0	2026-10-19 03:03:37 +02:00
admin	1b6e31675b	The local whole-guest tier keeps one restore point per day for 3 days: keep-daily instead of keep-last (R-1149, operator D17, unreleased)	2026-10-19 02:59:34 +02:00
admin	1693da4d1a	REPORT: the three unreleased fixes (R-1093, R-978, R-973) with the R-1093 loop-device check on demo-hp	2026-10-18 21:48:03 +02:00
admin	79ba884859	CI workflow: the failure mail links the public run page, by run id (R-1135) ... The alarm step built its link from GITHUB_SERVER_URL, which on this runner is the in-cluster Gitea address, and from the run NUMBER, which Gitea 1.26 reads as a run id first (felhom.eu /actions/runs/1116 opened run id 1116 = run number 613). Now https://gitea.dooplex.hu + GITHUB_RUN_ID, and the link is printed into the job log as ALARM-LINK. Same change in all four repos.	2026-10-18 20:34:59 +02:00
admin	f17e1979bd	A cadence cap on the local-API whole-guest backup route (R-973, unreleased) ... Each successful run prunes its tier, so a compromised controller calling POST /backup in a loop pushed out every pre-compromise restore point. A tier with a cadence of at most 24 h now allows 3 successful runs per rolling 24 h (night, a press, the next night); a longer tier 1 per max(cadence - 24 h, cadence/2), 6 days for the weekly off-site tier. Only successes count. A refusal is a 429, a WARN, saved, and for 24 h a critical host-report status that the hub turns into its existing operator-only agent_capability_degraded event. The success history and the refusal are kept in the R-894 state file, so a restart does not reset the cap. No sudoers change. Tests TestBackupCap_* and the state, status and wiring tests, red-proved.	2026-10-18 19:53:15 +02:00
admin	0963bae3c3	The partition probe fails closed on every path (R-1093 review, unreleased) ... PART_ENTRY_* comes from the parent's table, so it proves nothing about a partition's contents unless blkid also completed: lsblk's PTTYPE is now set aside only on a blkid exit 0 (exit 2, an I/O error or a missing binary keep "device has a partition table"). An lsblk that exits 0 with output that does not parse into a device, or lists none, leaves the device unprobed instead of blank (a hole that predates R-1093). Six more TestInspect_R1093_PartitionVerdicts rows, each red-proved.	2026-10-18 19:47:15 +02:00
admin	8561dc8a5c	The new escrow package reaches the hub only when its code is claimed (R-978, unreleased) ... The root ceremony uploaded the new package before the new code was claimed, and the hub overwrites the current package when the sealed secrets are unchanged: a customer who started the ceremony again and walked away kept a written-down code that opened nothing. Json mode (the FELHOM_ESCROW argv, unchanged) now returns the package (CeremonyOutput v2, PendingUpload); the daemon uploads it at POST /escrow/ceremony/claim before handing out the code. A failed upload is a 502 with the code still claimable; TTL and a new start wait for an in-flight claim upload; no uploader is a 503. Text mode still uploads at once. No sudoers change. Tests TestEscrowCeremony_R978_* (localapi) and the cmd-side defer/delivery/wiring tests, red-proved.	2026-10-18 19:42:02 +02:00
admin	f7b7308c4d	An empty partition is blank: lsblk's PTTYPE on a partition is the parent's (R-1093, unreleased) ... lsblk prints the disk's table type on every partition, so InspectDevice read an empty partition as "device has a partition table" and the format path asked the typed erase confirmation. lsblk's PTTYPE is now set aside only when blkid -p on the partition itself proved it read the device and that it is a partition of a table of that exact type (PART_ENTRY_NUMBER + matching PART_ENTRY_SCHEME). A filesystem or a nested table in the partition, a silent blkid, a whole disk or a different scheme keep the data-bearing reading. Same allow-listed argv, no sudoers change. Test TestInspect_R1093_PartitionVerdicts, red-proved against the old predicate.	2026-10-18 19:35:03 +02:00
admin	27bbdaaa22	REPORT/CHANGELOG: agent 0.159.2 delivered and proven on demo-hp	2026-10-18 14:45:47 +02:00