admin 3f382bf762 v0.61.0: audit fixes B1 (random temp staging) + D1 (mkfs wrapper member/RO re-checks) + D2 (empty-lsblk fail-safe) + D3 (blank-format anti-retarget) ...

From AUDIT-blast-radius-hostroot-localapi-2026-07-02.md. Each fix ships with a
non-hollow test + a companion red-proof (shown failing on the pre-fix impl).
Sudoers install-source grants became globs — deploy the sudoers drop-in with
the binary. A1 (stale-lock pool-membership) deliberately excluded (spike).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

2026-07-03 07:25:50 +02:00

..

agent.example.json

slice 8B (agent half): /backup/due cadence policy + /backup/status phases (v0.11.0)

2026-06-10 10:44:50 +02:00

build-golden.sh

v0.43.0: canonical systemd unit + publish agent binary + golden to Gitea (BUNDLE slice)

2026-06-28 08:38:01 +02:00

felhom-agent.service

v0.43.0: canonical systemd unit + publish agent binary + golden to Gitea (BUNDLE slice)

2026-06-28 08:38:01 +02:00

felhom-agent.sudoers

v0.61.0: audit fixes B1 (random temp staging) + D1 (mkfs wrapper member/RO re-checks) + D2 (empty-lsblk fail-safe) + D3 (blank-format anti-retarget)

2026-07-03 07:25:50 +02:00

felhom-localapi-firewall.example

slice 8A (agent half): local-API server + provisioning back-half (v0.10.0)

2026-06-10 09:47:42 +02:00

felhom-mkfs-guarded.sh

v0.61.0: audit fixes B1 (random temp staging) + D1 (mkfs wrapper member/RO re-checks) + D2 (empty-lsblk fail-safe) + D3 (blank-format anti-retarget)

2026-07-03 07:25:50 +02:00