77 lines
4.4 KiB
Markdown
77 lines
4.4 KiB
Markdown
# REPORT — v0.93.0 publish train executed: built, published, vouched, deployed fleet-wide (2026-07-22)
|
||
|
||
**The previous report's "NOT built or deployed" line dies here.** v0.93.0 (hyphen-free escrow
|
||
wordlist, `a452dc33`, red-proofed 2026-07-21) is now the fleet agent. No code changed this train —
|
||
this was the build/publish/deploy leg. Full operational record:
|
||
`felhom.eu/documentation/pilot/RUNBOOK-publish-agent-0.93-2026-07-22.md`.
|
||
|
||
## Confirmed baselines (re-verified at live source before acting)
|
||
|
||
- `main` = `eba040d0` = origin/main, clean tree; v0.93.0 delta vs 0.92.1 = escrow code + tests +
|
||
docs only, **no `configs/` change** → binary-only deploy (sudoers/wrapper untouched).
|
||
- Both boxes 0.92.1 + active (hub `hosts` table AND direct `--version`); Day-0 manifest agent
|
||
0.92.1/`7424bc1c…`; floor 0.156.0; hub 0.70.0; package `felhom-agent/0.93.0` = 404 pre-publish.
|
||
|
||
## Artifact
|
||
|
||
```
|
||
AGENT_VERSION=0.93.0
|
||
AGENT_SHA256=a68b2ff73200622ea9e23aed71a0a8ff885808626cab9e9d554a5a5df5ced28f (13 817 690 bytes)
|
||
```
|
||
|
||
Built on DooPlex from `eba040d0` (`CGO_ENABLED=0`, ldflags version); published via
|
||
`scripts/publish-agent.sh` (pre-delete 404 → PUT 201 → round-trip sha match); **sha-chain identical
|
||
at three independent points** incl. an anonymous GET of the package URL.
|
||
|
||
## Tests
|
||
|
||
Green gate on the exact built HEAD: `go build ./... && go vet ./... && go test ./...` — green.
|
||
**The formerly-flaky escrow package: `-count=10` fresh → 10/10 pass (135.2 s).** The ~1/5 flake WAS
|
||
the hyphenated-word defect (see the 2026-07-21 report), so a clean 10× run is direct evidence the
|
||
fix is in the built artifact.
|
||
|
||
## Manifest vouch (rule 1 — before any box moved)
|
||
|
||
Viktor saved Day-0 artifacts (password-gated UI, the train's one STOP); CC verified in the live hub
|
||
DB before deploying: agent **0.93.0 / a68b2ff7…**. Golden, floor and wrapper sha **byte-identical
|
||
before/after** (0.153.0 / 0.156.0 / `104db0a4…`). **Deviation, ruled:** MinAgent moved
|
||
0.92.1→0.93.0 at the save (spec said do-not-touch); flagged before deploy, ruled leave-as-is —
|
||
transient held-floor window only, both boxes already ran controller ≥ floor.
|
||
|
||
## Deploys — felhom-pve first, then demo-hp
|
||
|
||
Channel per the 0.90 train: scp one hop → on-box sha256 verify (= `a68b2ff7…` both) →
|
||
`.bak-0.92.1` → `install -m0755` → restart. demo-hp reached over the hub-vaulted G1 break-glass
|
||
(no key baked; secret handled file→file via `SSH_ASKPASS`, shredded after, never printed).
|
||
|
||
Per-box clean-restart verification — **5/5 green on both** (journal times host-local CEST):
|
||
|
||
| Check | felhom-pve (restart 06:56:49Z) | demo-hp (restart 06:57:48Z) |
|
||
|---|---|---|
|
||
| active / no restart loop | ✅ active, NRestarts=0, clean startup `version=0.93.0` | ✅ same |
|
||
| capabilities | ✅ 68/68 ok, degraded=0, inactive=0 | ✅ 68/68 ok, degraded=0, inactive=0 |
|
||
| ReassertGuestBinds | ✅ only enrolled `uuid:47a3361a…` (`/mnt/hdd_1`→9201) | ✅ only enrolled `uuid:91d2dc2d…` (`/mnt/nvme-1tb`→9201) |
|
||
| guestnet sweep | ✅ watchdog up; sweeps quiet, 0 ERROR/WARN since restart | ✅ same |
|
||
| hub `agent_version` | ✅ 0.93.0 (report at startup, 06:56:52Z) | ✅ 0.93.0 (06:57:52Z) |
|
||
|
||
Escape hatch not needed; `.bak-0.92.1` retained on both boxes. `peti-felhom` deliberately not
|
||
deployed to (down; gets 0.93.0 via Friday's reinstall + the vouched manifest — by design).
|
||
|
||
## Explicit statements (per the train spec)
|
||
|
||
- Controller floor and MinAgent handling: floor **byte-identical** before/after (0.156.0); golden
|
||
entry byte-identical; MinAgent's 0.93.0 value is the one ruled deviation above.
|
||
- No escrow ceremony was run as "verification" — the proof is the generation-path tests + version
|
||
reporting, per the spec.
|
||
- This train discharges `RUNBOOK-onboarding-draft-v4.md` §A item 5 (agent ≥ 0.93.0 box-side before
|
||
the first real tester's escrow ceremony) — annotated there.
|
||
|
||
## Observations (recorded, not acted on)
|
||
|
||
- The spec's "ROADMAP wordlist row" does not exist in `felhom.eu/documentation/backlog/ROADMAP.md`;
|
||
the gate discharge was annotated at its real home (onboarding runbook §A5) instead.
|
||
- demo-hp's 1TB NVMe is now **enrolled** (reasserted into 9201) — TASK-H's "unenrolled/NTFS, do not
|
||
touch" note is outdated.
|
||
- demo-hp remains key-less; break-glass deploy worked cleanly. Tailnet key-expiry toggle still open.
|
||
- CONTEXT.md's stale "agent DOWN at remote site / deployed 0.90.0" bullet superseded this train.
|