# REPORT — slice 8C Phase A (agent half): disk endpoints + data-bearing classifier gate (v0.12.0) (2026-06-10)

> Overwrite-latest report. Cumulative history: [CHANGELOG.md](CHANGELOG.md). Implements the
> host-agent half of `TASK — Slice 8C`. The controller de-privileging + disk-subsystem retirement is
> the `felhom-controller` half (v0.37.0). No hub change.

## Outcome

The agent now owns disk execution. It serves the §6 disk-management endpoints the controller's UI
drives, with the **8C security invariant**: the agent decides data-bearing-ness by **inspecting the
actual device** (agent-internal evidence), NEVER from the caller's claim. A compromised controller
asserting "this drive is blank" cannot wipe a data-bearing drive — **proven live** (a data-bearing
device → refused `pending_signature`, `mkfs` never called, the device untouched).

## What landed

- **`internal/storage`** — `SudoHostOps.Format(device, fstype)` (device-pinned `mkfs.ext4 -F` /
  `mkfs.xfs -f`, `ValidateBlockDevice`+`ValidateFSType`, narrow `FELHOM_FORMAT` sudoers).
  `SudoHostOps.InspectDevice(device)` → `DeviceProbe` (`blkid -p` signatures + `lsblk -J`
  partitions/mount). **`DeviceProbe.DataBearing()` is conservative**: any filesystem / partition
  table / partition / mount — OR a probe that did not read cleanly — is data-bearing (fail-safe).
- **`internal/localapi` — the §6 disk endpoints**, self-scoped (token→guest; cross-guest 403):
  `GET /disks` (drives + data-bearing flag), `POST /disks/assign` (benign `EnsureMount`),
  `POST /disks/eject` (benign `Unmount` + dependent guests), `POST /disks/format`.
  **`/disks/format` is the centerpiece**: the agent inspects the device; blank → benign → `mkfs`;
  **data-bearing → `ClassStorageWipe` → the slice-4 gate → `pending_signature` (refused)**. The
  signed completion is slice 10. `storageGateAdapter` bridges to the gate (no new gate/crypto).

## Tests

`go test ./...` green; `-race` green (build server). localapi security matrix: blank → mkfs called,
gate not consulted; **data-bearing → 403, mkfs NEVER called**, gate consulted; ambiguous/unprobed →
fail-safe destructive; gate-allows still refuses in 8C; assign/eject; cross-guest 403; bad
device/fstype 400; unconfigured 503. storage: validators (whitelist + injection rejection),
`InspectDevice` (blank/fs/parttable/mounted/failed-probe-fail-safe), `Format` invokes the right mkfs.

## Live validation (demo-felhom)

A provisioned de-privileged controller (v0.37.0) drove the agent: `GET /disks` flagged the mounted
`felhom-usb` (`/dev/sdb1`) **`data_bearing: true`** and the LVM/PBS/dir storages false. `POST
/disks/format` on the mounted-vfat `/dev/sda2` → **403** `"device is data-bearing — format requires
operator authorization (pending_signature)"`; agent log `refusing format of a data-bearing device …
gate=pending_signature`; **`/dev/sda2` untouched**. Deployed to the standing demo service as v0.12.0.

## Deferred (stated, not built)

The operator-**signed completion** of a data-bearing wipe/format → **slice 10**. No spare blank
`/dev/sd*` on the demo to live-exercise an actual `mkfs` (won't format real disks — covered by unit
tests). No secrets committed.