admin
3f37c5fc23
staleLockController.Guests() = ListLXC ∩ GET /pools/felhom members (ownership PROVEN via the pool registry, never assumed from enumeration scope); pool-read failure fail-safes the whole recovery through the existing guest-list guard. New Client.Pool read (needs Pool.Audit — host-install v1.9.0; Pool.Allocate does NOT satisfy it, spike T2). Composed pve:pool-read capability (non-critical) + --selftest pool-read line. Red-proofed negative tests drive the REAL controller over a broad-token-shaped fake. Per SPIKE-a1-pool-membership-read-2026-07-03.md; audit A1 (AUDIT-blast-radius-hostroot-localapi-2026-07-02). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
2.4 KiB
2.4 KiB
CONTEXT — felhom-agent working state
Snapshot of the current state + open threads. Authoritative history lives in
CHANGELOG.md(top entry = current); the end-of-task detail lives inREPORT.md.
Current
- v0.62.0 (2026-07-03) — audit A1 RESOLVED: the stale-lock reaper's scan is now
pool-intersected (
staleLockController.Guests()=ListLXC∩Client.Pool("felhom")members), fail-safe skip on pool-read failure;pve:pool-readcapability (non-critical) +--selftest"pool read" line. Companion host-install v1.9.0 addsPool.AudittoFelhomAgentGuest— deploy order on any box: rescope ACL first, then this agent. PerSPIKE-a1-pool-membership-read-2026-07-03.md; red-proofed tests in stalelock_pool_test.go. - 2026-07-03 — CLAUDE.md refreshed: version narrative removed (state lives HERE + CHANGELOG top), layout completed (all 17 internal packages + cmd/felhom-opsign); deploy runbook now in the
felhom-build-deployskill (felhom.eu/skills/). - 2026-07-03 —
REUSE.mdexists at the repo root (canonical helpers / format-safety guards / traps / seams, code-verified); maintenance rule active: update it in the same commit that changes a shared helper. - v0.61.0 (2026-07-03) — blast-radius audit fixes B1 + D1 + D2 + D3 from
felhom.eu/documentation/audits/AUDIT-blast-radius-hostroot-localapi-2026-07-02.md: random temp staging for root-installed scripts (+ sudoers/manifest glob updates), mkfs-wrapper member/RO re-checks (validated byscripts/mkfs-guarded-harness.sh), classifyClaim empty-lsblk fail-safe, and the blank-format anti-retarget (durable-id-bound, AGENT-001's benign-branch twin). - Deployed on demo host
felhom-pve(nodedemo-felhom), non-rootfelhom-agentservice user, pool-scoped token (felhompool).
Open threads
- Deferred audit items (housekeeping/design, all INFO): C1 (controller-swap version floor), C2 (NAS server allowlist), A2 (gate journal cross-check), B2–B5, E1/E2.
- Drive-enrollment leftovers: (a)
runStorageInitslow-device detached-format polling; (b) Impl-3 shared-box operator format gate. - BUNDLE leftover: non-root agent can't read the PBS key; migration must preserve cert/key/tokens.
- Not run (needs a supervised session): the destructive D1/D3 live proofs (real mkfs on a crafted member; a live /dev re-enumeration race during a real format).