felhom-agent

admin/felhom-agent

Fork 0

Commit Graph

Author	SHA1	Message	Date
admin	bd4bced771	dr: recovered WG-key install + host_loss directive→restore-PLAN (S5 safe halves) wgtunnel.InstallRecoveredKey: write an escrow-recovered WG private key (create- only, refuse-overwrite) so the tunnel re-establishes with the same identity/pubkey (same /32), no keygen. Wired into identity-consume -install-wg-key (opt-in; pre-S3 blob → logged fresh-keygen fallback). Value never logged. internal/dr (new): consume the host_loss restore_directive (was logged-ignored) into an inspectable RestorePlan via the AddConsumer raw seam — per guest {vmid,archive,target,sizing} + per drive {durable_id→mount} + offsite PBS coord. DERIVE-AND-SURFACE only; the Consumer has no restore/destroy dependency (execute- nothing is structural). guest_loss/absent → no plan. Tests + red-proofs (WG create-only overwrite; plan mode-gate). No secrets on argv/stdout/logs. The destructive in-place restore is a separate operator-present STOP-gated drill. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6	2026-07-04 21:06:31 +02:00
admin	fb248961c6	wgtunnel: S3 Part 2 — manager state machine + loop + desired raw-consumer seam Manager: one-shot registration (marker gate; backoff cap 15m), adopt-lost-marker, re-key-on-mismatch, REVOKED-STAYS-REVOKED teardown (marker kept, zero execs on later ticks), no-teardown-on-absent-data, hash-gated apply (zero execs steady state), restart-not-reload on conf change, self-heal enable. Status stanza with latest-handshakes-ONLY wg read. Collector WireguardReporter seam. desired.Syncer AddConsumer fan-out with panic containment. Red-proofs a/b/d run + reverted; no-key-material-in-logs asserted. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6	2026-07-04 07:09:01 +02:00
admin	8ecf8929fb	slice 10A: activate the control envelope (Down channel) + hub-backed desired provider (v0.15.0) The control envelope becomes live: the agent caches the hub's desired-state + generation and re-fetches GET /hosts/{id}/desired-state only when the generation advances. A new internal/desired Syncer maps the wire shape into a reconcile.CachingProvider feeding the engine; benign deltas reconcile, an explicit guest decommission is gated pending_signature (exec is 10B). Adds the DesiredStateResponse/WireDesiredState wire types + Client.FetchDesiredState + the loop EnvelopeObserver seam. Cross-repo golden (envelope + desired-state) byte-identical with the hub. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-10 19:02:59 +02:00

Author

SHA1

Message

Date

admin

bd4bced771

dr: recovered WG-key install + host_loss directive→restore-PLAN (S5 safe halves)

wgtunnel.InstallRecoveredKey: write an escrow-recovered WG private key (create-
only, refuse-overwrite) so the tunnel re-establishes with the same identity/pubkey
(same /32), no keygen. Wired into identity-consume -install-wg-key (opt-in;
pre-S3 blob → logged fresh-keygen fallback). Value never logged.

internal/dr (new): consume the host_loss restore_directive (was logged-ignored)
into an inspectable RestorePlan via the AddConsumer raw seam — per guest
{vmid,archive,target,sizing} + per drive {durable_id→mount} + offsite PBS coord.
DERIVE-AND-SURFACE only; the Consumer has no restore/destroy dependency (execute-
nothing is structural). guest_loss/absent → no plan.

Tests + red-proofs (WG create-only overwrite; plan mode-gate). No secrets on
argv/stdout/logs. The destructive in-place restore is a separate operator-present
STOP-gated drill.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

2026-07-04 21:06:31 +02:00

admin

fb248961c6

wgtunnel: S3 Part 2 — manager state machine + loop + desired raw-consumer seam

Manager: one-shot registration (marker gate; backoff cap 15m), adopt-lost-marker,
re-key-on-mismatch, REVOKED-STAYS-REVOKED teardown (marker kept, zero execs on
later ticks), no-teardown-on-absent-data, hash-gated apply (zero execs steady
state), restart-not-reload on conf change, self-heal enable. Status stanza with
latest-handshakes-ONLY wg read. Collector WireguardReporter seam. desired.Syncer
AddConsumer fan-out with panic containment. Red-proofs a/b/d run + reverted;
no-key-material-in-logs asserted.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

2026-07-04 07:09:01 +02:00

admin

8ecf8929fb

slice 10A: activate the control envelope (Down channel) + hub-backed desired provider (v0.15.0)

The control envelope becomes live: the agent caches the hub's desired-state +
generation and re-fetches GET /hosts/{id}/desired-state only when the
generation advances. A new internal/desired Syncer maps the wire shape into a
reconcile.CachingProvider feeding the engine; benign deltas reconcile, an
explicit guest decommission is gated pending_signature (exec is 10B). Adds the
DesiredStateResponse/WireDesiredState wire types + Client.FetchDesiredState +
the loop EnvelopeObserver seam. Cross-repo golden (envelope + desired-state)
byte-identical with the hub.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-10 19:02:59 +02:00

3 Commits