felhom-agent/REPORT.md

REPORT — agent v0.161.0 released and delivered (2026-10-20)

What: the three fixes committed on 2026-10-19 (56aabc7) — R-921 host_busy on GET /backup/status, R-1070 a missing tunnel container is absent, R-1010 the janitor forces a half-removed vzdump snapshot once — released as 0.161.0 on the operator's yes (2026-10-20 morning answers) and delivered to the three test hosts. Not vouched (the operator's act).

Release: scripts/release-agent.sh 0.161.0 from a clean clone at 5152123; package published and verified by download; tag v0.161.0 pushed.

• binary sha256 ff4e6dc52dd70234913445ecdeb88d31dea8e394d77c48704d26ff19b999d3b5
• config bundle sha256 485f36c957d83f772aa22cac24e5e73f44da5cf8b957b1fd513bec2bc1d12c47

Delivery (signed agent_update, one job per box): demo-hp 06:38 UTC, Tester 1 06:54, demo-felhom 06:55 — each signed op COMPLETED, capabilities self-check ok=76 total=76, selfupdate: update committed; the hub reports 0.161.0 for all three.

Live checks on demo-hp (felhom.eu documentation/audits/night2-2026-10-20/P1/):

• R-921: from inside 9201 with its own token (leaf pinned by the bootstrap fingerprint), host_busy read every 15 s over a „Mentés most" press (POST /api/guest-backup/trigger): 3 × {"busy": false}, 24 × {"busy": true, "what": "backup:local"}, 21 × {"busy": false}; the backup completed (7.15 GB, 06:42→06:49 UTC).
• R-1070: the agent's own probe in 9202 (no tunnel) answers error: no such object: cloudflared (rc 1) — the exact TestClassifyTunnel fixture row; 9201 answers running.
• R-1010: by its tests (TestStaleLock_R1010_ForcesOnceOnlyWhenTheVolumeIsGone, TestDeleteSnapshotForce_R1010) — a half-removed snapshot on pve/data was not made (rule 6).
• Gates: agent_gates.py --fast green on 5152123 before the release.

R-1083 left out, and why: the code would be small (a root-only subcommand that mints the token and adds the local_api block to an existing guest's bootstrap.json), but handing 9202 a key is not safe tonight: its controller would then book the agent's whole-guest backups, and one of those tiers writes to ep0 (a change on ep0 the brief forbids); 9202 is also outside the felhom pool. The R-1083 row holds what it needs.

Teardown: the probe script removed from 9201 and /tmp on demo-hp. Nothing else provisioned.