admin db25b469ba Host report keeps the last backup across a restart; Secure Boot meta-package leaves the Proxmox lane ...

Found in the 2026-10-09 kernel-night read-back:
- demo-felhom: the kernel step restarted the host 4 minutes after the night
  backup; the in-memory backup list was empty after the restart, so the hub
  alarmed "host tier: newest backup is 48h old". The report now adds R-894's
  saved newest success per tier (one shared instance).
- demo-hp: proxmox-secure-boot-support pulled shim-signed-common into the
  ring-0 Proxmox plan; the step was refused R6 and the kernel step skipped.
  It joins HOST_SLOW_RE with shim and GRUB.

Red-proved: TestCollectBackups_SavedSuccessSurvivesARestart,
TestR894_LastKnownBackupsIsWiredIntoTheDaemon,
test_ring0_pending_pve_leaves_the_secure_boot_meta_out.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

2026-10-09 06:47:58 +02:00

..

testdata

contract: the desired-state golden gains host_release (byte-identical with hub v0.131.0); TestOSUpdateGolden_Decodes checks it

2026-10-04 13:18:43 +02:00

bundle_record_test.go

R-840: the config bundle — a signed agent_config_update brings a box's root-owned files (sudoers, wrappers, units)

2026-10-04 19:36:58 +02:00

client_test.go

…

client.go

OS updates, guest fast lane (11 §8 step 2): felhom-os-apply wrapper (R1-R13 refusals, repair first, snapshot.debian.org fallback), FELHOM_OSAPPLY sudoers, the OS leg after the primary backup, hub os_update block + os-report, --selftest=os-update

2026-10-04 10:44:29 +02:00

cloudflared_test.go

OS updates host fast lane + true tunnel status + fast leg: wrapper host layer (R12 appliance proof from the root-owned install record, R14 kernel/boot/firmware refused), select pending-fast, one call per layer, host-side version checks, restart scan only after an install, reboot-needed for PID 1/lxc-start; the leg runs the host step after a healthy guest step; GuestTunnelProber reads the cloudflared container + its readiness check (R-841)

2026-10-04 12:54:02 +02:00

cloudflared.go

OS updates host fast lane + true tunnel status + fast leg: wrapper host layer (R12 appliance proof from the root-owned install record, R14 kernel/boot/firmware refused), select pending-fast, one call per layer, host-side version checks, restart scan only after an install, reboot-needed for PID 1/lxc-start; the leg runs the host step after a healthy guest step; GuestTunnelProber reads the cloudflared container + its readiness check (R-841)

2026-10-04 12:54:02 +02:00

collect_agentsha_test.go

R-349: the host report carries the sha256 of the RUNNING agent binary

2026-10-05 21:16:11 +02:00

collect_disktrim_test.go

R-444: weekly guest disk trim (pct fstrim) outside the night, under the heavy-op gate

2026-10-06 11:24:45 +02:00

collect_guestnet_test.go

OS updates host fast lane + true tunnel status + fast leg: wrapper host layer (R12 appliance proof from the root-owned install record, R14 kernel/boot/firmware refused), select pending-fast, one call per layer, host-side version checks, restart scan only after an install, reboot-needed for PID 1/lxc-start; the leg runs the host step after a healthy guest step; GuestTunnelProber reads the cloudflared container + its readiness check (R-841)

2026-10-04 12:54:02 +02:00

collect_knownbackups_test.go

Host report keeps the last backup across a restart; Secure Boot meta-package leaves the Proxmox lane

2026-10-09 06:47:58 +02:00

collect_mgmtplane_test.go

OS updates host fast lane + true tunnel status + fast leg: wrapper host layer (R12 appliance proof from the root-owned install record, R14 kernel/boot/firmware refused), select pending-fast, one call per layer, host-side version checks, restart scan only after an install, reboot-needed for PID 1/lxc-start; the leg runs the host step after a healthy guest step; GuestTunnelProber reads the cloudflared container + its readiness check (R-841)

2026-10-04 12:54:02 +02:00

collect_test.go

OS updates host fast lane + true tunnel status + fast leg: wrapper host layer (R12 appliance proof from the root-owned install record, R14 kernel/boot/firmware refused), select pending-fast, one call per layer, host-side version checks, restart scan only after an install, reboot-needed for PID 1/lxc-start; the leg runs the host step after a healthy guest step; GuestTunnelProber reads the cloudflared container + its readiness check (R-841)

2026-10-04 12:54:02 +02:00

collect.go

Host report keeps the last backup across a restart; Secure Boot meta-package leaves the Proxmox lane

2026-10-09 06:47:58 +02:00

contract_test.go

v0.119.0 — the host report carries the box's addresses

2026-07-31 08:40:58 +02:00

cputemp_test.go

…

cputemp.go

…

desired_client_test.go

…

desired_contract_test.go

…

dr_recipe_test.go

R-124 recipe root namespace as PBS spells it; R-118 no root size for an absent drive; R-269 rotated-out token rejected at once; R-317 dnsmasq install probed by its unit (burn-down round 2)

2026-10-05 18:56:13 +02:00

dr_recipe.go

R-124 recipe root namespace as PBS spells it; R-118 no root size for an absent drive; R-269 rotated-out token rejected at once; R-317 dnsmasq install probed by its unit (burn-down round 2)

2026-10-05 18:56:13 +02:00

hostaddr_test.go

v0.119.0 — the host report carries the box's addresses

2026-07-31 08:40:58 +02:00

hostaddr.go

v0.119.0 — the host report carries the box's addresses

2026-07-31 08:40:58 +02:00

hostmetrics_test.go

OS updates host fast lane + true tunnel status + fast leg: wrapper host layer (R12 appliance proof from the root-owned install record, R14 kernel/boot/firmware refused), select pending-fast, one call per layer, host-side version checks, restart scan only after an install, reboot-needed for PID 1/lxc-start; the leg runs the host step after a healthy guest step; GuestTunnelProber reads the cloudflared container + its readiness check (R-841)

2026-10-04 12:54:02 +02:00

loop_logtail_test.go

v0.83.0: observability pass — always-DEBUG capture ring + GET /debug/logs + heartbeat log-pull + gap-fill sweep

2026-07-11 16:24:07 +02:00

loop_test.go

agent: report served local-API leaf fingerprint (hub re-key detection, Part A) v0.48.0

2026-06-29 23:14:52 +02:00

loop.go

v0.89.0: pbsdr self-grant (R-22) + escrow config live-reload + agent-plane poke listener (Direction-2a)

2026-07-16 22:47:22 +02:00

mock_test.go

OS updates host fast lane + true tunnel status + fast leg: wrapper host layer (R12 appliance proof from the root-owned install record, R14 kernel/boot/firmware refused), select pending-fast, one call per layer, host-side version checks, restart scan only after an install, reboot-needed for PID 1/lxc-start; the leg runs the host step after a healthy guest step; GuestTunnelProber reads the cloudflared container + its readiness check (R-841)

2026-10-04 12:54:02 +02:00

osupdate_contract_test.go

contract: the desired-state golden gains host_release (byte-identical with hub v0.131.0); TestOSUpdateGolden_Decodes checks it

2026-10-04 13:18:43 +02:00

report_test.go

v0.119.0 — the host report carries the box's addresses

2026-07-31 08:40:58 +02:00

report.go

R-836: the kernel lane — one-shot boot through the ESP flag, boot good / one self-revert, night step on a told night

2026-10-07 15:18:24 +02:00

restoretest_merge_test.go

v0.122.0: three ways the signals lied about themselves (R-189, R-188, R-186)

2026-08-03 16:40:18 +02:00

wg_client_test.go

wgtunnel: S3 Part 1 — pure-Go keygen + hub wire (WireWireguard, report stanza, RegisterWG)

2026-07-04 07:00:19 +02:00

wg_contract_test.go

wgtunnel: S3 Part 1 — pure-Go keygen + hub wire (WireWireguard, report stanza, RegisterWG)

2026-07-04 07:00:19 +02:00