3 Commits

Include renames

Author	SHA1	Message	Date
admin	776025c824	selfupdate: the staging folder keeps what it needs and no more (R-1368 part 2) — not released ... Each good update left its staged binary in <state dir>/selfupdate for ever (49 files / 740 MB on demo-hp). After the wrapper's commit returned success, MaybeCommit now removes every staged binary but the running version's. Nothing is removed while a pending marker exists or cannot be read, at a plain start, or after a rollback. Only a regular file with the exact name Execute writes is removed. The rollback reads pending.json and felhom-agent.prev, no staged binary: pinned by a test on the wrapper's text and by a test that runs the wrapper's real commit and rollback verbs in a sandbox. Red seen three times. No version bump, no build, no vouch. /usr/local/bin/felhom-agent.bak-* is not reached (root-owned; R-1368 part 4). Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-11-10 14:10:00 +01:00
admin	b1bc63dd32	R-1285: the new agent runs the bundle policy pass once after its self-update commits — in the normal two-job delivery the old process installs the bundle. Test in the real order (commit, then one bundle-policy plan); red-proved. Commit only, not released.	2026-10-26 12:44:25 +01:00
adminandClaude Opus 4.8	8033a522cd	feat: D1 Part 2 — agent self-update Go plumbing (op class, opsign, executor, commit, report) ... - reconcile: ClassAgentUpdate op class; always Destructive (no provenance blesses replacing the root-adjacent binary). classify test + companion (TestClassify_AgentUpdateAlwaysDestructive). - opsign: `-op agent_update` with -agent-version + -sha256 (isHex64-validated); params {version,sha256}. isHex64 test (Group D). - config: SelfUpdateConfig{URLTemplate,Username,Token,StateDir,DwellSeconds} + WithDefaults + Token redaction. - internal/selfupdate: Executor (download → verify vs the SIGNED sha → sudo -n wrapper `apply`; sha is the only integrity root — mismatch refuses + removes, agent untouched); Manager (startup dwell → `commit`; version-mismatch → no commit + loud WARN + marker left for report visibility; shutdown-before-dwell leaves pending). WrapperRunner seam → tests never shell out. - hub report: additive selfupdate_pending(+version) via SetSelfUpdateReporter seam; both omitempty (Wireguard precedent) so the cross-repo golden contract stays byte-stable — no hub change. - capability manifest: 3 non-critical FELHOM_SELFUPDATE probes. - main.go: updateExec appended to the executor chain; commit-manager wired to the report seam + MaybeCommit goroutine after core init. Tests: Group A (executor happy/sha-mismatch+companion/bad-params/wrapper-fail), B (agent_update rides the real gate: pinned-key executes, non-pinned + retarget rejected), C (commit/version-mismatch/no-pending/shutdown), D (opsign). C2 companion red-proof verified (neutered Go verify → bad binary reaches apply → test fails), reverted. Full go test ./... green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6	2026-07-05 15:32:15 +02:00