feat(configs): D1 Part 1 — self-update host artifacts (guarded wrapper, rollback unit, limits drop-in, sudoers alias)
Design provenance SPIKE-agent-selfupdate-2026-07-05 (SF findings binding):
- felhom-selfupdate-guarded: apply <staged> <sha256> / commit / rollback.
Ordering [SF-7]: temp-sweep → path confinement (staging dir only, no '..')
→ 64-hex + sha256 RE-verify as root (BEFORE .prev) → same-fs assert →
.prev snapshot → root-owned staging copy → atomic mv → pending marker →
reset-failed [SF-4/5] → detached systemd-run restart, verbatim [SF-6].
rollback is pending-guarded (no pending → exit 0 no-op, [SF-1]) and clears
pending BEFORE its restart so per-crash OnFailure re-fires no-op. commit
idempotent, .prev retained (S3d). No env-overridable paths (path-fixedness
is the security property). shellcheck clean.
- felhom-agent-rollback.service: Type=oneshot OnFailure target; comment block
documents the systemd-257 per-crash firing reality [SF-1].
- felhom-agent-limits.conf: [Unit]-ONLY drop-in [SF-3] with the spike's tuned
values verbatim [SF-2]: StartLimitIntervalSec=120, StartLimitBurst=4,
OnFailure=felhom-agent-rollback.service.
- sudoers: FELHOM_SELFUPDATE alias (coarse apply glob per S4b — the wrapper
re-verify is the real gate) appended to the grant line. visudo -cf OK.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
admin
b7cbded429