# REPORT — agent v0.146.0 / v0.146.1: the agent's root grants narrowed (R-861), the step bundle (R-880) — 2026-10-05

Brief: "an open-items batch … and the agent permission fix (R-861) as its own Part" (Part F). Full session report:
`felhom.eu/REPORT-hub-safety-2026-10-05.md`. Design: `felhom.eu/documentation/architecture/03-host-agent.md` §3.1.
Evidence: `felhom.eu/documentation/audits/hub-safety-2026-10-05/partF/`, delivery `…/partH/`.

## Baseline and commits

- Baseline `61345790ed` (v0.145.0).
- `6ab1e7c` R-861 narrowing → released **v0.146.0** (binary `b860af46…`, bundle `161c737e…`) — **never vouched, never
  delivered**: a background security review of that commit found three holes.
- `fdd8717` the review fixes → released **v0.146.1** (binary `badd6c9a2e40c8bfe856d2d1a203443b21b7eb92ecc35d6090ab44518d4d082a`,
  bundle `42333e969028867ad8142335e6c1bc4040eec231de0d8d330c2d4b2cf7bc3442`). Two releases in one session, against "one
  release per repo" — the first one was unsafe to deliver.
- `e4b5cf9` `scripts/build-step-bundle.py` (R-880, tooling). Step bundle `0.146.1-step1`, sha `8482851e…`.

## What changed

- **Exact sudo patterns** for every varying argument list (sudo regex `^…$`). Measured with real sudo 1.9.16: the
  v0.145.0 sudoers allowed **23 of 29** attack lines; v0.146.1 allows **0** and still allows all **64** commands the
  capability check uses (container, and live on both demo boxes).
- **`felhom-priv-apply`** (new root wrapper in the bundle) installs mount units, dnsmasq drop-ins, the WireGuard config
  and the OOB sshd config + key only after checking the CONTENT against the agent's own renderers.
- **Fixed bundle files:** the guest pre-start hook and the shared drive parent (script + unit); the agent only checks
  and registers / enables.
- **The signed update is checked as root:** `felhom-os-apply` mode `agent_update` (signature, host, window, nonce; the
  staged bytes read once, hashed, copied to a root-owned dir); `felhom-selfupdate-guarded apply` left the agent's
  sudoers and accepts only that root-owned dir.
- **The root escrow run** pins its paths, refuses a storage id that is a path, and reads its staged files by walking
  the path with `openat(O_NOFOLLOW)`.
- **NFS/SMB options** gain `nosuid,nodev`.

## Tests

`go build/vet/test ./...` green; `configs/test_felhom_priv_apply.py` 32 tests, `test_felhom_config_bundle.py` (incl.
`AgentUpdate`, `SelfupdateWrapperConfinement`, `StepBundle`), `test_felhom_os_apply.py` green; Go contract tests feed each
renderer's real output to the checker (`internal/privapplytest`); `TestSudoersRefusesTheR861Injections`,
`TestManifestCoveredBySudoers` (regex-aware). Red-proofs F1–F9 and S1–S3: `partF/red-proof.txt` (F1's first run did NOT
convict — masked by the name rule — and the test was strengthened; F3's first run errored rather than failed — the test
now asserts cleanly).

## Delivered (signed jobs, key felhom-op-1)

Per box: `agent_update` 0.146.1 → `agent_config_update` 0.146.1-step1 → `agent_config_update` 0.146.1. See the session
report §5 for each box's result. Tester 2: offline (DOWN), nothing sent.

## Not done / open

- R-861 stays open, narrowed to three named residuals (`03` §3.1): the controller-swap image ref is guest-scoped; the
  felhom-op SSH key is hub-delivered, unsigned (felhom-op's sudo is scoped); the escrow ceremony hands the agent R by
  design.
- R-881: the installer's uninstall does not remove `felhom-priv-apply`.