41 lines
3.3 KiB
Markdown
41 lines
3.3 KiB
Markdown
# REPORT — three agent fixes, committed and NOT released (2026-10-18 evening)
|
||
|
||
Task: the evening brief of 2026-10-18, Part 4 (felhom.eu `REPORT-evening-2026-10-18.md`). Baseline: `27bbdaa` (v0.159.2
|
||
released). Commits: `f7b7308` + `0963bae` (R-1093), `8561dc8` (R-978), `f17e197` (R-973). CHANGELOG under „Unreleased";
|
||
the release and its vouch are the operator's. Gates green per commit (`go build/vet/test ./...`, `agent_gates.py --fast`);
|
||
CI job 2062 success for `f17e197`.
|
||
|
||
## R-1093 — an empty partition is blank
|
||
|
||
lsblk reports the PARENT disk's PTTYPE for a partition. `InspectDevice` now ignores that PTTYPE only when `blkid -p` on the
|
||
partition exited 0, printed `PART_ENTRY_NUMBER`, and its `PART_ENTRY_SCHEME` equals lsblk's PTTYPE. Every error path
|
||
stays data-bearing: blkid exit 2 / I/O error / missing binary keep „device has a partition table"; an lsblk answer that
|
||
exits 0 but does not parse or names no device is „could not be reliably inspected" (an older fail-open, closed here after
|
||
a background security review flagged the probe). No new sudo command, no config bundle.
|
||
Test `TestInspect_R1093_PartitionVerdicts` (14 rows); three red-proofs. **Live on demo-hp** (a 1 GB loop file in `/root`,
|
||
removed after; felhom.eu `audits/agent-fixes-2026-10-18/r1093-loop-check.txt`): the empty GPT partition → lsblk
|
||
`pttype "gpt"` (the bug's input), blkid rc 0 with only `PART_ENTRY_*` (the fix's condition holds); ext4 → `TYPE=ext4`; a
|
||
dos table inside the partition → `PTTYPE=dos`. Not walked: the whole `/api/storage/init` call (the agent refuses loop
|
||
devices; it needs a VM with a spare disk running a build of this commit).
|
||
|
||
## R-978 — the new escrow package reaches the hub only at the claim
|
||
|
||
A ceremony started again no longer replaces the hub's package at create time. The package travels with the pending
|
||
ceremony and is uploaded when the code is claimed, before the code is handed out; an upload failure is 502 and the code
|
||
stays claimable; a ceremony abandoned by TTL, a new start or a restart leaves the first code opening the hub's package.
|
||
Ceremony output is version 2 (`PendingUpload`); the sudo argv is unchanged. Tests `TestEscrowCeremony_R978_*` and three
|
||
`cmd` tests; four red-proofs. **Residual (filed):** the typed-back check is the browser's, so a household that opens the
|
||
new code and closes the page without writing it down has still replaced the package.
|
||
|
||
## R-973 — a cadence cap on `POST /backup`
|
||
|
||
Per guest and tier, successful runs only: the daily (local) tier at most **3 per rolling 24 h** (the night run, one
|
||
„Mentés most", the next night — `07` §6; since R-899 a press never costs the night); the longer tier at most one per
|
||
max(cadence − 24 h, cadence / 2) = **6 days** for the weekly off-site tier. A refusal is 429 with the next allowed time,
|
||
WARN-logged, kept in `backup-success-state.json` (survives a restart), and for 24 h the host report carries the CRITICAL
|
||
degraded status `localapi:backup-cadence-cap` (the hub's operator-only `agent_capability_degraded`). Tests `TestBackupCap_*`
|
||
and others; three red-proofs. **Limits (filed):** keep-last 3 lets three local points be replaced within one day; the
|
||
off-site namespace's keep-last 2 is a count — a time-bucketed prune on ep0 is the operator's.
|
||
|
||
*Decided by CC unattended — operator may reverse:* the numbers 3 / 24 h and 6 days, and counting successes only.
|