# REPORT — felhom-agent v0.90.0 (agent train: guest RAM resize R-24 + fast-tick R-28)

**Date:** 2026-07-17 · **Baseline:** v0.89.0 (`9127f54`) → **v0.90.0** (`ac112c9`, pushed) · **MinAgent coupling:** felhom-controller v0.143.0 gates its guest-memory-resize UI on this agent.

## 1. What shipped

Two ruled features on one train (Viktor's one-train/one-floor ruling), plus a diagnosis passenger.

- **R-24 guest RAM resize (controller-direct)** — new self-scoped local-API surface `GET`/`POST /guest/memory`
  (`internal/localapi/guestmemory.go`). The agent is the security boundary: bounds recomputed FRESH per
  request from a live read; applies via PVE `SetConfig` (live cgroup apply, no reboot); verify-after-apply.
- **R-28 fast-tick-until-first-convergence** — `internal/fasttick/`, wired over four cached sources; pulses
  the shared out-of-band trigger every 30 s while unapplied, self-disarms on convergence. Seams added:
  `reconcile.Engine.LastResult()`, `wgtunnel.Manager.TunnelConvergence()`.
- **Guests-0/0** — diagnosed live, hypothesis REFUTED (no code change).

## 2. Phase-0 probe (the gate — PASSED)

Prerequisite: prove `PUT /nodes/{node}/lxc/{vmid}/config memory=X` hot-applies under the AGENT token. Run on
the nested demo box `demo-vm-felhom-4846bc` (hostname `felhom-appliance`, guest LXC 9201) — reached via the
hub-vaulted G1 break-glass root credential (the box's root PW was unknown; retrieved operator-side from the
hub SQLite `host_recovery` table, then shredded). Transcript:

```
node=felhom-appliance vmid=9201 token_user=felhom-agent@pve
BEFORE  config.memory=2890 MB | status.maxmem=3030384640 B (2890 MB) | status=running | host-uptime=8226s
BEFORE  guest MemTotal: 2959360 kB | guest /proc/uptime=8227.76
--- PUT memory=3146 (agent token) ---   PUT data field: None (empty == synchronous apply, no UPID)
AFTER   config.memory=3146 MB | status.maxmem=3298820096 B (3146 MB) | status=running | host-uptime=8229s
AFTER   guest MemTotal: 3221504 kB | guest /proc/uptime=8231.54
VERDICT maxmem_grew=True guest_running=True guest_not_rebooted=True
REVERT  memory=2890 → maxmem 3030384640 B (2890 MB), running; guest MemTotal 2959360 kB
```

Proven: live cgroup apply (maxmem moves, guest running), **no reboot** (guest /proc/uptime keeps climbing),
synchronous (no UPID), agent token has the privilege (no 403), and **/proc/meminfo ripples via lxcfs** — the
mechanism that makes the controller's deploy-page memory math follow for free. The gate PASSED → the resize
leg was implemented.

## 3. Files created / modified

- `internal/localapi/guestmemory.go` (new) + `guestmemory_test.go` (new); `internal/localapi/server.go`
  (Options.Memory + fields + routes); `cmd/felhom-agent/main.go` (wire Memory=px; construct + launch fasttick).
- `internal/fasttick/fasttick.go` + `fasttick_test.go` (new).
- `internal/reconcile/engine.go` (`LastResult`/`recordResult`) + `lastresult_test.go` (new).
- `internal/wgtunnel/manager.go` (`TunnelConvergence` + cached snapshot refresh in `Apply`).
- `CHANGELOG.md`, `REPORT.md` (this), `CONTEXT.md`, `REUSE.md`.

## 4. Tests + red-proofs (all restored green)

- localapi memory: GET fields, grow, shrink-above-floor, the three refusals (each asserting **SetConfig
  count == 0**), cross-guest 403, fresh-bounds-per-request, verify-not-reflected 502, nil-config 503.
- fasttick: pulse-while-unconverged, silent-when-converged, the ruled disarm-on-convergence, full-channel
  non-blocking drop, first-reason. reconcile: `LastResult` effect + pre-first-run ok=false.
- **Red-proofs (run-fail-restore):** (i) floor guard removed → below_usage_floor 412 test fails; (ii) max
  guard removed → above_max test fails; (iii) fast-tick ignores convergence (always pulse) → the silent +
  disarm tests fail. All confirmed red, then restored. Full suite: `go build ./... && go vet ./... &&
  go test ./...` — all 28 packages pass.

## 5. Guests-0/0 diagnosis — hypothesis REFUTED, no fix

Live read-only checks on the nested box: pool `felhom` `members: [9201]`; the agent token's ListLXC sees
`[9201]` (VM.Audit comes from the `/pool/felhom` grant — so pool membership IS the visibility mechanism);
hub reports 1/1. The agent log shows the observed 0/0 was the **pre-provision window**: `16:11 stale-lock …
pool=felhom listed=0` + `desired … guests=0`, then `16:16 lanresolver … vmid=9201` (guest created). No guest
existed yet → empty list, no error (the silent shape) — correct, not a bug. The existing `PoolAddVMID`
re-assert (`bringup.go:498`) already covers the known restore-over-existing edge (campaign-2 R2). **Item 2's
fast-tick is precisely the mitigation** — it shortens the pre-provision reporting window from ≤15 min to ~30 s.

## 6. Deploy verification (BOTH hosts)

Built on 180 (`go build -ldflags -X main.version=0.90.0`), deployed to both Proxmox hosts (backup + install +
restart):

- **felhom-pve** (the N100): `felhom-agent 0.90.0` active; `capabilities self-check ok=63 total=63 degraded=0`;
  **`fast-tick armed: 30s out-of-band cadence while desired-state is unapplied`**; poke listener + local-api up.
- **demo-vm-felhom-4846bc** (nested, 192.168.0.135): `felhom-agent 0.90.0` active; `capabilities self-check
  ok=63 degraded=0`; `fast-tick armed: 30s …`; local-api on 192.168.0.135:8443. (Converged box → fast-tick
  quiet after the startup line, as designed.)

## 7. NOT yet live-validated / operator GO

- **Fast-tick real-onboarding proof:** the fast-tick's value shows on a REAL fresh box's pre-tunnel window
  (the rehearsal S5 bind sequence should now be visibly instant). Not manufacturable non-destructively here;
  both agents show the armed startup line + the unit tests prove the pulse/disarm.
- **Floor LAST (operator GO):** both demo agents verifiably run 0.90.0 (the safety gate) and the controller
  coupling is PROVEN LIVE via the X-Felhom-Agent-Version header (see the controller REPORT's live refusals).
  Publishing 0.90.0 to Gitea + the hub Day-0 manifest **vouch + MinAgent-floor raise to 0.90.0** are set via
  the operator-password-gated Day-0 manifest UI (CC cannot log in) — the operator (Viktor) GO step, matching
  the v0.89 train's "publish/vouch = operator follow-up".

## 8. Observations

- The nested demo host is tiny (4 GB): its resize bounds are degenerate (`max_mb 1866 < min_mb 2048 <
  current 2890`) — no resize *succeeds* through the bounded endpoint there (all refused correctly). The
  successful apply is Phase-0-proven at the agent layer; the controller live-validation exercised the
  refusals (above_max, below_min) end-to-end.
- REUSE.md gained the fasttick Source pattern + the localapi MemoryOps seam.