@@ -1,20 +1,32 @@
# REPORT — agent, evening/night brief 2026-10-19 (code + tests + commit only, NOT released )
# REPORT — agent v0.161.0 released and delivered (2026-10-20 )
Commit `56aabc7` (CHANGELOG „Unreleased"), scanner wiring `84ef581` . No sudoers, wrapper or config-bundle change.
The release is the operator's word (STATUS morning list: „R elease agent 0.161.0?"), then the vouch.
**What: ** the three fixes committed on 2026-10-19 (`56aabc7` ) — R-921 `host_busy` on `GET /backup/status` , R-1070 a
missing tunnel container is `absent` , R-1010 the janitor forces a half-removed vzdump snapshot once — r eleased as
0.161.0 on the operator's yes (2026-10-20 morning answers) and delivered to the three test hosts. **Not vouched ** (the
operator's act).
- -921 — `host_busy` on `GET /backup/status` :** whether the host-wide heavy-operation gate is held ( `{busy, what}` ),
the state in which `POST /backup` answers 409. Controller 0.335.0 (the floor) reads it before any stop. Test
`TestBackupStatus_R921_HostBusy` , red-proved (assignment removed → `free gate: host_busy = <nil>` ).
- **R-1070 — tunnel `absent` :** Docker 29 prints „error: no such object" in lower case; the case-sensitive match read
a missing cloudflared container as `unknown` , which failed the host OS-update rule (Tester4, 2026-10-15). Now a
missing container is `absent` , and the host rule passes it only when the reading from before the step also had no
cloudflared container. Tests `TestHostHealthVerdict_R1070_NoTunnelSetUp` , `TestClassifyTunnel` (Docker 29's wording,
measured on demo-hp), red-proved both ways.
- **R-1010 — the janitor's forced snapshot delete:** on „Failed to find logical volume …_vzdump" only, one retry with
the API's `force=1` (`DeleteSnapshotForce` ; `pvesh usage … -command delete` lists `--force` ). Tests
`TestStaleLock_R1010_ForcesOnceOnlyWhenTheVolumeIsGone` (6 rows), `TestDeleteSnapshotForce_R1010` , red-proved.
- **R-986 — the security-scan gate** (tooling): the shared `felhom.eu/scripts/security_scan_gate.py` in the fast set;
`.security-accepted` holds 15 accepted test constants; decoys in `test_gate_decoys.py` .
**Release: ** `scripts/release-agent.sh 0.161.0` from a clean clone at `5152123` ; package published and verified by
download; tag `v0.161.0` pushed.
- binary sha256 `ff4e6dc52dd70234913445ecdeb88d31dea8e394d77c48704d26ff19b999d3b5`
- config bundle sha256 `485f36c957d83f772aa22cac24e5e73f44da5cf8b957b1fd513bec2bc1d12c47`
Gates: `go build/vet/test ./...` green; `agent_gates.py --fast` OK; decoys 36 cases OK. CI 2103, 2110 success.
**Delivery (signed `agent_update`, one job per box): ** demo-hp 06:38 UTC, Tester 1 06:54, demo-felhom 06:55 — each
`signed op COMPLETED` , `capabilities self-check ok=76 total=76` , `selfupdate: update committed` ; the hub reports 0.161.0
for all three.
**Live checks on demo-hp ** (felhom.eu `documentation/audits/night2-2026-10-20/P1/` ):
- R-921: from inside 9201 with its own token (leaf pinned by the bootstrap fingerprint), `host_busy` read every 15 s
over a „Mentés most" press (`POST /api/guest-backup/trigger` ): 3 × `{"busy": false}` , 24 × `{"busy": true, "what":
"backup:local"}` , 21 × `{"busy": false}` ; the backup completed (7.15 GB, 06:42→06:49 UTC).
- R-1070: the agent's own probe in 9202 (no tunnel) answers `error: no such object: cloudflared` (rc 1) — the exact
`TestClassifyTunnel` fixture row; 9201 answers `running` .
- R-1010: by its tests (`TestStaleLock_R1010_ForcesOnceOnlyWhenTheVolumeIsGone` , `TestDeleteSnapshotForce_R1010` ) —
a half-removed snapshot on `pve/data` was not made (rule 6).
- Gates: `agent_gates.py --fast` green on `5152123` before the release.
**R-1083 left out, and why: ** the code would be small (a root-only subcommand that mints the token and adds the
`local_api` block to an existing guest's `bootstrap.json` ), but handing 9202 a key is not safe tonight: its controller
would then book the agent's whole-guest backups, and one of those tiers writes to ep0 (a change on ep0 the brief
forbids); 9202 is also outside the `felhom` pool. The R-1083 row holds what it needs.
**Teardown: ** the probe script removed from 9201 and `/tmp` on demo-hp. Nothing else provisioned.
admin