3.3 KiB
REPORT — three agent fixes, committed and NOT released (2026-10-18 evening)
Task: the evening brief of 2026-10-18, Part 4 (felhom.eu REPORT-evening-2026-10-18.md). Baseline: 27bbdaa (v0.159.2
released). Commits: f7b7308 + 0963bae (R-1093), 8561dc8 (R-978), f17e197 (R-973). CHANGELOG under „Unreleased";
the release and its vouch are the operator's. Gates green per commit (go build/vet/test ./..., agent_gates.py --fast);
CI job 2062 success for f17e197.
R-1093 — an empty partition is blank
lsblk reports the PARENT disk's PTTYPE for a partition. InspectDevice now ignores that PTTYPE only when blkid -p on the
partition exited 0, printed PART_ENTRY_NUMBER, and its PART_ENTRY_SCHEME equals lsblk's PTTYPE. Every error path
stays data-bearing: blkid exit 2 / I/O error / missing binary keep „device has a partition table"; an lsblk answer that
exits 0 but does not parse or names no device is „could not be reliably inspected" (an older fail-open, closed here after
a background security review flagged the probe). No new sudo command, no config bundle.
Test TestInspect_R1093_PartitionVerdicts (14 rows); three red-proofs. Live on demo-hp (a 1 GB loop file in /root,
removed after; felhom.eu audits/agent-fixes-2026-10-18/r1093-loop-check.txt): the empty GPT partition → lsblk
pttype "gpt" (the bug's input), blkid rc 0 with only PART_ENTRY_* (the fix's condition holds); ext4 → TYPE=ext4; a
dos table inside the partition → PTTYPE=dos. Not walked: the whole /api/storage/init call (the agent refuses loop
devices; it needs a VM with a spare disk running a build of this commit).
R-978 — the new escrow package reaches the hub only at the claim
A ceremony started again no longer replaces the hub's package at create time. The package travels with the pending
ceremony and is uploaded when the code is claimed, before the code is handed out; an upload failure is 502 and the code
stays claimable; a ceremony abandoned by TTL, a new start or a restart leaves the first code opening the hub's package.
Ceremony output is version 2 (PendingUpload); the sudo argv is unchanged. Tests TestEscrowCeremony_R978_* and three
cmd tests; four red-proofs. Residual (filed): the typed-back check is the browser's, so a household that opens the
new code and closes the page without writing it down has still replaced the package.
R-973 — a cadence cap on POST /backup
Per guest and tier, successful runs only: the daily (local) tier at most 3 per rolling 24 h (the night run, one
„Mentés most", the next night — 07 §6; since R-899 a press never costs the night); the longer tier at most one per
max(cadence − 24 h, cadence / 2) = 6 days for the weekly off-site tier. A refusal is 429 with the next allowed time,
WARN-logged, kept in backup-success-state.json (survives a restart), and for 24 h the host report carries the CRITICAL
degraded status localapi:backup-cadence-cap (the hub's operator-only agent_capability_degraded). Tests TestBackupCap_*
and others; three red-proofs. Limits (filed): keep-last 3 lets three local points be replaced within one day; the
off-site namespace's keep-last 2 is a count — a time-bucketed prune on ep0 is the operator's.
Decided by CC unattended — operator may reverse: the numbers 3 / 24 h and 6 days, and counting successes only.