admin
4ba1b144d6
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
54 lines
4.4 KiB
Markdown
54 lines
4.4 KiB
Markdown
# CONTEXT — felhom-agent working state
|
||
|
||
> Snapshot of the current state + open threads. Authoritative history lives in `CHANGELOG.md` (top
|
||
> entry = current); the end-of-task detail lives in `REPORT.md`.
|
||
|
||
## Current
|
||
|
||
- **configs: build-golden.sh v2.0.0** (2026-07-03, @ `ceca355`; no agent version change) — **drill
|
||
findings B5 + B1 FIXED** (`DRILL-golden-098-2026-07-03.md`): the controller tag is a MANDATORY
|
||
argument (the default rotted twice — a fresh install booted a pre-floor controller, forcing the
|
||
guide's manual D.1b update) and the golden now bakes a `felhom-controller-bootstrap.path` unit
|
||
(controller deploys the moment the back-half hot-plugs the bootstrap mount — no reboot; installer
|
||
v1.9.1's reboot is a redundant belt, kept). **Golden 0.98.3** baked on the drill VM, clean-room
|
||
validated (bake integrity → isolated hot-plug proof → local-golden Day-0 → published-artifact
|
||
Day-0), published (sha256 b9a02ef1…fd01) + operator-vouched — Day-0 manifest now vouches
|
||
**agent 0.63.0 + golden 0.98.3** (the v0.63.0 vouch follow-up below is DONE). Fresh installs land
|
||
current and self-manage. NEW operator follow-up (SECURITY): the customer-config `git.token` has
|
||
Gitea package-WRITE rights — scope down + rotate (evidence-doc observation O1).
|
||
- **v0.63.0** (2026-07-03, live on felhom-pve + Gitea-published sha256 b4a89c81…) — **drill findings
|
||
B3 + B2 FIXED** (`DRILL-day0-cleanroom-2026-07-03.md`): `TokenStore.Lookup` reloads the append-only
|
||
store once on a miss (cross-process coherence with the one-shot provisioner — no more fresh-install
|
||
`/controller/swap` 401 / manual restart; size short-circuit bounds the cost; behind the
|
||
`TokenAuthority` seam) + `guesthook.InstallSnippet` issues a fenced `mkdir -p /var/lib/vz/snippets`
|
||
first (fresh boxes lacked the dir → the self-heal hook silently never installed). Sudoers gained
|
||
exactly that one grant — **ship sudoers WITH the binary** (done on felhom-pve). Red-proofed both;
|
||
Scenario-E method: compiled test suite run ON felhom-pve + live channel-health hit-path.
|
||
**OPERATOR FOLLOW-UP: bump the hub Day-0 manifest to agent 0.63.0** — until then fresh installs get
|
||
0.62.0 and the guide's D.1b restart-first step still applies (narrowed to "< v0.63.0" in the guide).
|
||
- **v0.62.0** (2026-07-03) — **audit A1 RESOLVED**: the stale-lock reaper's scan is now
|
||
pool-intersected (`staleLockController.Guests()` = `ListLXC` ∩ `Client.Pool("felhom")` members),
|
||
fail-safe skip on pool-read failure; `pve:pool-read` capability (non-critical) + `--selftest`
|
||
"pool read" line. Companion host-install **v1.9.0** adds `Pool.Audit` to `FelhomAgentGuest` —
|
||
**deploy order on any box: rescope ACL first, then this agent.** Per
|
||
`SPIKE-a1-pool-membership-read-2026-07-03.md`; red-proofed tests in stalelock_pool_test.go.
|
||
- **2026-07-03 — CLAUDE.md refreshed**: version narrative removed (state lives HERE + CHANGELOG top), layout completed (all 17 internal packages + cmd/felhom-opsign); deploy runbook now in the `felhom-build-deploy` skill (`felhom.eu/skills/`).
|
||
- **2026-07-03 — `REUSE.md` exists at the repo root** (canonical helpers / format-safety guards / traps / seams, code-verified); maintenance rule active: update it in the same commit that changes a shared helper.
|
||
- **v0.61.0** (2026-07-03) — blast-radius audit fixes **B1 + D1 + D2 + D3** from
|
||
`felhom.eu/documentation/audits/AUDIT-blast-radius-hostroot-localapi-2026-07-02.md`: random temp
|
||
staging for root-installed scripts (+ sudoers/manifest glob updates), mkfs-wrapper member/RO
|
||
re-checks (validated by `scripts/mkfs-guarded-harness.sh`), classifyClaim empty-lsblk fail-safe,
|
||
and the blank-format anti-retarget (durable-id-bound, AGENT-001's benign-branch twin).
|
||
- Deployed on demo host `felhom-pve` (node `demo-felhom`), non-root `felhom-agent` service user,
|
||
pool-scoped token (`felhom` pool).
|
||
|
||
## Open threads
|
||
|
||
- Deferred audit items (housekeeping/design, all INFO): C1 (controller-swap version floor), C2 (NAS
|
||
server allowlist), A2 (gate journal cross-check), B2–B5, E1/E2.
|
||
- Drive-enrollment leftovers: (a) `runStorageInit` slow-device detached-format polling; (b) Impl-3
|
||
shared-box operator format gate.
|
||
- BUNDLE leftover: non-root agent can't read the PBS key; migration must preserve cert/key/tokens.
|
||
- Not run (needs a supervised session): the destructive D1/D3 live proofs (real mkfs on a crafted
|
||
member; a live /dev re-enumeration race during a real format).
|