admin 3403c87c80 Host power-off for the household (R-998): POST /host/poweroff ...

The guest's controller asks; the agent refuses in the first 10 min after boot, a second time in
one boot (persisted, keyed by /proc/stat btime), and while a backup, restore test, OS step,
controller update, drive format, NAS verify, escrow ceremony or vzdump runs (each a named 409
reason). On acceptance: the record first, a host report carrying deliberate_off accepted by the
hub (bounded 60 s), then pct shutdown --timeout 120, then systemctl poweroff.

Sudoers: two exact vectors (pct ^shutdown N --timeout N$, systemctl poweroff) in FELHOM_POWEROFF;
nine injection cases. New TestEveryAliasIsGranted: a defined alias missing from the grant line
passed the coverage check before. Every new test red-proofed.

2026-10-13 19:29:52 +02:00

..

agent.example.json

v0.96.0 — R-50 island NIC: provision attaches the guest island net1

2026-07-25 14:16:23 +02:00

build-golden.sh

CHANGELOG v0.143.0 (R-840); build-golden.sh 3.2.0: GOLDEN_GUEST_PKGS — the approved guest release at bake time, first-night count

2026-10-04 20:08:16 +02:00

crash-guard.conf

Docker engine slow lane (live-restore once by reload; ring-0 pending-docker under a root-owned ring-0 mark; ring 1 and undo only by a signed os_docker_step the wrapper re-verifies against a root-owned signers file; same-container-id health), the version report (facts mode -> host report system stanza, R-852), guest restart scan every pass (R-849), the crash guard (kernel.panic=10, the 3rd unclean stop in 60 min stays off, 24 h re-arm)

2026-10-04 16:14:36 +02:00

felhom-agent-limits.conf

feat(configs): D1 Part 1 — self-update host artifacts (guarded wrapper, rollback unit, limits drop-in, sudoers alias)

2026-07-05 15:20:37 +02:00

felhom-agent-rollback.service

feat(configs): D1 Part 1 — self-update host artifacts (guarded wrapper, rollback unit, limits drop-in, sudoers alias)

2026-07-05 15:20:37 +02:00

felhom-agent.service

v0.43.0: canonical systemd unit + publish agent binary + golden to Gitea (BUNDLE slice)

2026-06-28 08:38:01 +02:00

felhom-agent.sudoers

Host power-off for the household (R-998): POST /host/poweroff

2026-10-13 19:29:52 +02:00

felhom-backup-target-apply

v0.113.0 — E-2a: guarded backup-target wrapper + POST /backup/target

2026-07-29 09:05:59 +02:00

felhom-crash-guard

Docker engine slow lane (live-restore once by reload; ring-0 pending-docker under a root-owned ring-0 mark; ring 1 and undo only by a signed os_docker_step the wrapper re-verifies against a root-owned signers file; same-container-id health), the version report (facts mode -> host report system stanza, R-852), guest restart scan every pass (R-849), the crash guard (kernel.panic=10, the 3rd unclean stop in 60 min stays off, 24 h re-arm)

2026-10-04 16:14:36 +02:00

felhom-crash-guard-check.service

Docker engine slow lane (live-restore once by reload; ring-0 pending-docker under a root-owned ring-0 mark; ring 1 and undo only by a signed os_docker_step the wrapper re-verifies against a root-owned signers file; same-container-id health), the version report (facts mode -> host report system stanza, R-852), guest restart scan every pass (R-849), the crash guard (kernel.panic=10, the 3rd unclean stop in 60 min stays off, 24 h re-arm)

2026-10-04 16:14:36 +02:00

felhom-crash-guard-check.timer

Docker engine slow lane (live-restore once by reload; ring-0 pending-docker under a root-owned ring-0 mark; ring 1 and undo only by a signed os_docker_step the wrapper re-verifies against a root-owned signers file; same-container-id health), the version report (facts mode -> host report system stanza, R-852), guest restart scan every pass (R-849), the crash guard (kernel.panic=10, the 3rd unclean stop in 60 min stays off, 24 h re-arm)

2026-10-04 16:14:36 +02:00

felhom-crash-guard.service

Docker engine slow lane (live-restore once by reload; ring-0 pending-docker under a root-owned ring-0 mark; ring 1 and undo only by a signed os_docker_step the wrapper re-verifies against a root-owned signers file; same-container-id health), the version report (facts mode -> host report system stanza, R-852), guest restart scan every pass (R-849), the crash guard (kernel.panic=10, the 3rd unclean stop in 60 min stays off, 24 h re-arm)

2026-10-04 16:14:36 +02:00

felhom-grub-oneshot-entries.sh

R-836: the kernel lane — one-shot boot through the ESP flag, boot good / one self-revert, night step on a told night

2026-10-07 15:18:24 +02:00

felhom-grub-oneshot.sh

R-836: the kernel lane — one-shot boot through the ESP flag, boot good / one self-revert, night step on a told night

2026-10-07 15:18:24 +02:00

felhom-guest-hook.sh

R-861: narrow the agent's root grants — exact sudo patterns, felhom-priv-apply content checker, fixed hook/parent files in the bundle, signed self-update verified as root, escrow root reads pinned

2026-10-05 12:00:43 +02:00

felhom-localapi-firewall.example

v0.96.0 — R-50 island NIC: provision attaches the guest island net1

2026-07-25 14:16:23 +02:00

felhom-mgmt-watchdog.service

feat(mgmtplane): break-glass privsep-dir watchdog + mgmt_plane health (TASK G1) — v0.71.0

2026-07-05 18:49:27 +02:00

felhom-mgmt-watchdog.sh

feat(mgmtplane): break-glass privsep-dir watchdog + mgmt_plane health (TASK G1) — v0.71.0

2026-07-05 18:49:27 +02:00

felhom-mgmt-watchdog.timer

feat(mgmtplane): break-glass privsep-dir watchdog + mgmt_plane health (TASK G1) — v0.71.0

2026-07-05 18:49:27 +02:00

felhom-mkfs-guarded.sh

v0.61.0: audit fixes B1 (random temp staging) + D1 (mkfs wrapper member/RO re-checks) + D2 (empty-lsblk fail-safe) + D3 (blank-format anti-retarget)

2026-07-03 07:25:50 +02:00

felhom-oob-nft.service

feat(configs): OOB static belt table + loader unit + felhom-op sudoers (H1 Part 5)

2026-07-05 22:33:47 +02:00

felhom-oob.nft

feat(configs): OOB static belt table + loader unit + felhom-op sudoers (H1 Part 5)

2026-07-05 22:33:47 +02:00

felhom-op.sudoers

R-861 (a) A1 + (b) B2: the image ref goes to a root verb that checks it; the agent's in-guest tee grant is gone; felhom-op's pct lines are exact (09 §3 decision 165)

2026-10-07 10:19:28 +02:00

felhom-os-apply

Host report keeps the last backup across a restart; Secure Boot meta-package leaves the Proxmox lane

2026-10-09 06:47:58 +02:00

felhom-pbs-apply

v0.91.0 — the DR tier can no longer be applied and dead at the same time (R-39 + R-50b(a))

2026-07-21 10:12:31 +02:00

felhom-priv-apply

R-861 (a) A1 + (b) B2: the image ref goes to a root verb that checks it; the agent's in-guest tee grant is gone; felhom-op's pct lines are exact (09 §3 decision 165)

2026-10-07 10:19:28 +02:00

felhom-privsep.tmpfiles

feat(mgmtplane): break-glass privsep-dir watchdog + mgmt_plane health (TASK G1) — v0.71.0

2026-07-05 18:49:27 +02:00

felhom-selfupdate-guarded

R-861 review fixes: the signed update hands the A/B wrapper a root-owned copy of the hashed bytes; mount units accept no Wants/Requires/Before and no continuation lines; the escrow read walks the path without following any symlink

2026-10-05 12:13:42 +02:00

felhom-shared-parent.service

R-861: narrow the agent's root grants — exact sudo patterns, felhom-priv-apply content checker, fixed hook/parent files in the bundle, signed self-update verified as root, escrow root reads pinned

2026-10-05 12:00:43 +02:00

felhom-shared-parent.sh

R-861: narrow the agent's root grants — exact sudo patterns, felhom-priv-apply content checker, fixed hook/parent files in the bundle, signed self-update verified as root, escrow root reads pinned

2026-10-05 12:00:43 +02:00

felhom-sshd.service

feat(felhomsshd): dedicated OOB sshd instance + port-adaptive belt (H1 Parts 2-4 agent)

2026-07-05 22:27:02 +02:00

test_felhom_config_bundle.py

bundle test: the ISO first-boot files the installer names under KEPT are not installer-written (go test red since felhom.eu 85de3f9b); CHANGELOG unreleased (R-426 decoys)

2026-10-06 01:42:25 +02:00

test_felhom_crash_guard.py

R-836: the kernel lane — one-shot boot through the ESP flag, boot good / one self-revert, night step on a told night

2026-10-07 15:18:24 +02:00

test_felhom_os_apply.py

Host report keeps the last backup across a restart; Secure Boot meta-package leaves the Proxmox lane

2026-10-09 06:47:58 +02:00

test_felhom_priv_apply.py

R-861 (a) A1 + (b) B2: the image ref goes to a root verb that checks it; the agent's in-guest tee grant is gone; felhom-op's pct lines are exact (09 §3 decision 165)

2026-10-07 10:19:28 +02:00