# REPORT — AGENT-001 anti-retarget wipe fix: merge + deploy (v0.30.0)

**Date:** 2026-06-13 (supervised deploy session)
**Outcome:** SUCCESS — merged to `main`, built v0.30.0, deployed to the demo Proxmox host, verified non-destructively. No rollback.

## What shipped

`v0.30.0` — AGENT-001 fix (from the 2026-06-13 deep-sweep audit). The inline customer-confirmed wipe in
`internal/localapi/disks.go` `handleDiskFormat` previously ran `mkfs` on the caller-supplied mutable
`/dev` path (`req.Device`); a USB re-enumeration between inspection and `mkfs` could wipe the wrong
disk (classify→mkfs TOCTOU). Now it re-resolves the confirmed durable id → current device, requires a
re-derived exact match, re-inspects data-bearing, and formats the **re-resolved** device — at parity
with `signedjobs.WipeExecutor`. New `internal/localapi/wipe_reresolve.go` (`antiRetargetResolve`,
injectable `reresolveWipe` seam); refusals → `409`, no `mkfs`. Merged from
`fix/agent-001-wipe-durable-reresolve`.

## Deploy

- Build server (192.168.0.180, go1.26.0): green gate on the branch (`build`/`vet`/`test` clean; `TestAntiRetargetResolve` incl. `retarget-mismatch-refused` PASS). Built `v0.30.0` (ldflags `-X main.version=0.30.0`).
- Demo Proxmox host (`felhom-pve`): binary verified by sha256 at each hop; backed up the running binary to `/usr/local/bin/felhom-agent.bak-0.29.1`; installed the new binary; `systemctl restart felhom-agent.service`.
- **Rollback target was v0.29.1** (not needed).
- Pin check before the live run: served PVE leaf-cert SHA-256 prefix matches the pinned value (`BA:7C:99:7D:45:D0…`).
- Scope: **agent-only**. No golden rebake, no re-provision, no controller change. Guest 9201 controller stayed online through a brief local-API blip.

## Verification (non-destructive)

| Check | Result |
|---|---|
| Service active + version | `felhom-agent.service` active/running; `--version` = **0.30.0**; clean startup logs (local-api on :8443, hub desired gen=2, PBS verify ok) |
| Local API reachable (full chain) | controller→agent `/disks` proxy returns the disk list (vmid 9201); guest 9201 controller healthy on the hub |
| Regression A — data-bearing device, NO confirmation | **REFUSED** (HTTP 409, `needs_confirmation:true`, `formatted:false`); no `mkfs` |
| Regression B — confirmed + WRONG durable_id | **REFUSED** (HTTP 409, `formatted:false`); a non-matching confirmation did not authorize a wipe; no `mkfs` |
| Data safety | `felhom-usb` (`/dev/sdb1`, RomM data) still mounted, `used_bytes` unchanged — untouched |
| Blank-device benign-format | SKIPPED — no disposable blank device available on the host |
| Happy-path destructive wipe | SKIPPED — HUMAN-only (never wipe real data to verify); covered by the unit test |

Note: `reresolveWipe`'s post-gate refusal runs only when the gate ALLOWS (a correctly-matching
confirmation), which on a real device leads to the destructive success path — so it is not safely
live-triggerable and is verified by the unit test `retarget-mismatch-refused`. Live, both the
no-confirmation (A) and wrong-confirmation (B) gate refusals confirm no un-gated destructive path.

## Branch / commits

- `main` merge + version bump pushed. Branch `fix/agent-001-wipe-durable-reresolve` left in place (per the runbook) until the operator confirms.
- felhom.eu audit record (`documentation/audits/deep-sweep-2026-06-13.md`) updated: AGENT-001 → MERGED + DEPLOYED (agent v0.30.0).