REPORT: the machine came back by its power button; the hub ended the hold (R-998 live proof complete)

CHANGELOG.md

@@ -1,3 +1,30 @@
+## v0.155.0 — the household can turn the machine off: POST /host/poweroff (R-998); the escrow reply race fixed (2026-10-13)
+
+Released by `scripts/release-agent.sh`: binary sha256 `bb339e944eff4aa6d10ae09158e0943de2e5c3777f52bf993c796d57e46800c3`, bundle
+`795f2ab41661e993e3fc4ce65df4f11ce94280d94871ab2e5cf1993ae3fbff7d` (tag `v0.155.0`). **Not vouched** (the operator's act).
+**The bundle changes `felhom-agent.sudoers`** (no new path — no step bundle): delivery is a signed `agent_update` +
+`agent_config_update`. Design: felhom.eu `documentation/architecture/14-host-power-off.md`.
+
+- **`POST /host/poweroff`** (local API, `withGuest`-scoped like `/guest/reboot`) — the controller's „A gép kikapcsolása"
+  (controller v0.310.0). Refused (409, a stable `reason`) in the first 10 min after boot; a second time in one boot
+  (`internal/poweroff`, a file keyed by `/proc/stat` btime); while ANY other guest or VM runs on the host (read from
+  `/proc`: `lxc-start -n N`, `kvm -id N` — demo-hp's scratch guest and Tester 1 VM block it); while the heavy-operation
+  gate is held (backup, restore test, OS step, sweep, trim), a backup job, a controller swap, a drive format, a NAS verify
+  or an escrow ceremony runs, or Proxmox runs a vzdump of the guest. Every check fails closed.
+- On acceptance: the record first; the heavy gate TAKEN and kept; a host report carrying `deliberate_off.requested_at`
+  accepted by the hub (bounded 60 s, `Loop.SetReportedHook`); then before each step the jobs and other guests are
+  checked again — a job waits (≤ 15 min), another guest cancels at once, a job still running after the wait cancels
+  (gate released, box stays on); `pct shutdown <vmid> --timeout 120`; `systemctl poweroff`.
+- **Sudoers:** `FELHOM_POWEROFF` = `/usr/bin/systemctl poweroff`; `pct ^shutdown [0-9]+ --timeout [0-9]+$` joins
+  `FELHOM_GUESTHOOK`; nine injection cases (`--forceStop`, `poweroff --force`, `reboot`, `halt`, `kexec`…).
+  **New `TestEveryAliasIsGranted`:** an alias missing from the grant line passed the coverage check before.
+- **Host report:** `deliberate_off` (omitempty; the cross-repo golden unchanged). Hub v0.149.0 holds its silence alarms
+  for 14 days on it.
+- **Fixed without a row:** `go test -race` found a data race in the escrow ceremony start reply (it read `job.Phase`
+  while the job goroutine wrote it); the reply fields are copied first. Red before, green 3/3 after.
+- Security review (three passes the same evening): other guests, a gate not held, fail-open unwired checks, jobs and
+  guests starting after acceptance — each fixed and red-proofed (`hostpoweroff_test.go`, 11 tests).
+
 ## v0.154.0 — no OS leg after a household press; the after-boot kernel report carries the real ring (R-899); no „wrong code" when older packages were not checked (R-304); the last backup survives a restart in the host report; the Secure Boot meta-package leaves the Proxmox lane (2026-10-09)
 
 Released by `scripts/release-agent.sh`: binary sha256 `36a54ad20e896cd61d7b9944e2a521f4209c2b76940d8f1827af05b645463226`, bundle

REPORT.md

@@ -1,15 +1,32 @@
-# REPORT — v0.154.0 released and delivered (2026-10-09)
+# REPORT — v0.155.0 released and delivered: the household can turn the machine off (2026-10-13)
 
-Built from the 2026-10-09 kernel-night read-back: (1) the host report now adds the saved newest backup success per tier
-(R-894's file, one shared instance), so a restart right after a night backup no longer empties the hub's evidence — on
-demo-felhom it had caused a false „newest backup is 48h old" alarm; (2) `proxmox-secure-boot-support` joins the
-boot-chain lane, so it no longer pulls `shim-signed-common` into the ring-0 Proxmox plan (demo-hp's step was refused R6
-and its kernel step skipped). Red-proofs: `TestCollectBackups_SavedSuccessSurvivesARestart`,
-`TestR894_LastKnownBackupsIsWiredIntoTheDaemon`, `test_ring0_pending_pve_leaves_the_secure_boot_meta_out`.
+Baseline `86adbca` (v0.154.0). Code `3403c87`, `f38b03c`, `c6d9435`, `bdf25f0`; release entry `68a2130`; tag `v0.155.0`.
+Task: „The turn the machine off button" (R-998). Design: felhom.eu `documentation/architecture/14-host-power-off.md`.
 
-`scripts/release-agent.sh 0.154.0`: sha `36a54ad2…`, bundle `93487989…`, tag `v0.154.0` = `db25b46`, verified by
-download. CI 1576 (code) success; 1579 (CHANGELOG) failed in its fetch step (Gitea answered 500), re-run → success.
-Signed `agent_update` → demo-hp, demo-felhom, Tester 1 (07:16–07:18 local); signed `agent_config_update` → `BUNDLE DONE
-written=1 same=26 self-check=ok`, capability probe 68/68 on all three. NOT vouched (the vouch needs a golden at or above
-the fleet's controller; no golden today). Live: demo-felhom's first report after the update carries the 02:40Z backup.
-Evidence: `felhom.eu/documentation/audits/release-2026-10-09/delivery/`.
+## What it does
+
+`POST /host/poweroff` (local API, token-scoped): record → hub told (a report carrying `deliberate_off`, accepted) →
+`pct shutdown <vmid> --timeout 120` → `systemctl poweroff`. Refused in the first 10 min after boot, a second time in a
+boot, while any other guest or VM runs, and while any backup/restore/OS/controller-update/drive/escrow job or a vzdump
+runs. After acceptance the heavy gate is held; before each step the jobs and the guests are read again (wait ≤ 15 min,
+or cancel). Every check fails closed. Sudoers: two exact vectors (`FELHOM_POWEROFF`).
+
+## Proof
+
+- Tests: `internal/localapi/hostpoweroff_test.go` (11), `internal/poweroff/state_test.go`, `internal/hub/deliberate_off_test.go`,
+  `internal/capability` (9 injection cases, new `TestEveryAliasIsGranted`). Each guard red-proofed by removing it.
+- Three security-review passes the same evening; every finding fixed and red-proofed (other guests, gate not held,
+  fail-open, jobs and guests starting after acceptance).
+- Fixed without a row: an escrow-ceremony reply data race (`go test -race` red before, green 3/3 after).
+- Live, real sudo on the N100 after the bundle: the two new vectors ALLOWED; `poweroff --force`, `-ff`, `reboot`, `halt`,
+  `pct shutdown` with `--forceStop` or without `--timeout` refused.
+- Live press on the N100 through the dashboard endpoint: 202 at 18:52:34Z, no ping 18:53:02Z, 0 W from 18:53:07Z.
+- Back on: power button 21:48:43Z, clean boot (crash guard `last_boot_unclean: false`); the first report carried no
+  `deliberate_off`, and the hub ended the hold at 21:49:22Z (`host_deliberate_off_ended`). No crash or recovered mail.
+
+## Delivered
+
+Signed `agent_update` 0.155.0 + `agent_config_update` (bundle `795f2ab4…`) to demo-felhom, demo-hp, Tester 1. N100:
+committed 18:37:45Z, bundle installed 18:51:54Z (capability probe 70/70). **Not vouched** — the operator's act.
+demo-hp and Tester 1: agent 0.155.0, bundle installed — real `sudo -l` checks there allow the two lines and refuse
+`--force`, `--forceStop 1`, `reboot` (`felhom.eu/documentation/audits/poweroff-2026-10-13/B-sudo-live-*.txt`).