felhom-agent

authz

R-1280: a signed job's validity window is at most 24 h — the verifier, the root wrapper and felhom-opsign. Red-proved. Commit only, not released.

2026-10-25 21:42:18 +01:00

backup

fix(R-1232): the tier due-check counts only this box's archives (own key) — a reinstalled box's first whole-guest copy is not a week late

2026-10-26 20:15:39 +01:00

capability

D65 = A: reboot_guest joins the agent's closed operator-action list — guards (busy controller file, heavy gate, jobs, lock, parked, 1/hour, the brake), result with both times, GET /guest/operator-reboot for the household line; one read-only sudo vector

2026-10-29 16:04:19 +01:00

config

R-1247: the weekly upload line test — the agent's own iperf3 client to ep0's tunnel-only server, Tuesday 10:00-15:59 after 10 quiet minutes, under the heavy-op gate, best of 3; line_test stanza + GET /host/line-test; 15 tests red-proved; unreleased (next v0.164.0)

2026-10-24 08:59:42 +02:00

desired

v0.83.0: observability pass — always-DEBUG capture ring + GET /debug/logs + heartbeat log-pull + gap-fill sweep

2026-07-11 16:24:07 +02:00

dr

dr: recovered WG-key install + host_loss directive→restore-PLAN (S5 safe halves)

2026-07-04 21:06:31 +02:00

escrow

gofmt -w: 14 files, formatting only, no behaviour change (R-1160)

2026-10-19 10:24:32 +02:00

fasttick

v0.90.0 — guest RAM resize (R-24) + fast-tick-until-convergence (R-28)

2026-07-17 19:09:40 +02:00

felhomsshd

R-1192 follow-up: report host swap vs the guests' swap allowance (log once, hub alarm, local API); R-1194: no OOB stanza before the first felhom-sshd pass; unreleased

2026-10-21 21:29:07 +02:00

fstrim

R-444: weekly guest disk trim (pct fstrim) outside the night, under the heavy-op gate

2026-10-06 11:24:45 +02:00

guesthook

gofmt -w: 14 files, formatting only, no behaviour change (R-1160)

2026-10-19 10:24:32 +02:00

guestnet

v0.96.0 — R-50 island NIC: provision attaches the guest island net1

2026-07-25 14:16:23 +02:00

httpx

R-344: restore the idle-connection timeout our hand-rolled transports lost

2026-08-20 11:09:39 +02:00

hub

agent (unreleased): the hub is told what the kernel clean-up did and what the profile refresh did (R-1383)

2026-11-14 18:06:12 +01:00

lanresolver

R-124 recipe root namespace as PBS spells it; R-118 no root size for an absent drive; R-269 rotated-out token rejected at once; R-317 dnsmasq install probed by its unit (burn-down round 2)

2026-10-05 18:56:13 +02:00

linetest

linetest: waiting_for_quiet needs the full watched window (R-1250)

2026-10-24 13:24:41 +02:00

localapi

agent: gofmt (formatting only)

2026-11-14 17:47:42 +01:00

log

v0.83.0: observability pass — always-DEBUG capture ring + GET /debug/logs + heartbeat log-pull + gap-fill sweep

2026-07-11 16:24:07 +02:00

mgmtplane

gofmt -w: 14 files, formatting only, no behaviour change (R-1160)

2026-10-19 10:24:32 +02:00

osupdate

agent (unreleased): the hub is told what the kernel clean-up did and what the profile refresh did (R-1383)

2026-11-14 18:06:12 +01:00

pbs

R-124 recipe root namespace as PBS spells it; R-118 no root size for an absent drive; R-269 rotated-out token rejected at once; R-317 dnsmasq install probed by its unit (burn-down round 2)

2026-10-05 18:56:13 +02:00

pbsdr

v0.128.0 — R-221: the escrow seed is asserted every tick, not remembered once

2026-08-08 16:29:13 +02:00

poke

v0.89.0: pbsdr self-grant (R-22) + escrow config live-reload + agent-plane poke listener (Direction-2a)

2026-07-16 22:47:22 +02:00

poweroff

Host power-off for the household (R-998): POST /host/poweroff

2026-10-13 19:29:52 +02:00

privapplytest

R-861: narrow the agent's root grants — exact sudo patterns, felhom-priv-apply content checker, fixed hook/parent files in the bundle, signed self-update verified as root, escrow root reads pinned

2026-10-05 12:00:43 +02:00

provision

R-861: narrow the agent's root grants — exact sudo patterns, felhom-priv-apply content checker, fixed hook/parent files in the bundle, signed self-update verified as root, escrow root reads pinned

2026-10-05 12:00:43 +02:00

proxmox

2b (unreleased): the agent moves from a pinned Proxmox certificate to the box's root CA copy — copy, proof, then the config; the cause of a trust failure is named (R-1380)

2026-11-14 16:35:22 +01:00

pvegate

R-812 option A: the Proxmox package lane (layer pve) + the /etc/pve write gate

2026-10-07 10:19:38 +02:00

pvetrust

2b (unreleased): the agent moves from a pinned Proxmox certificate to the box's root CA copy — copy, proof, then the config; the cause of a trust failure is named (R-1380)

2026-11-14 16:35:22 +01:00

reconcile

R-1192: every guest may swap as much as its RAM (bring-up, RAM resize, once at start) — the measured 8 GB freeze; unreleased

2026-10-21 15:43:18 +02:00

restorespace

v0.133.0: a restore-test can never fill a box's disk; leftovers retried on a timer (R-672, R-673)

2026-09-24 16:23:15 +02:00

selfheal

agent v0.85.0 WIP: F12/F11/F10/F9/F2/F1 boot-recovery plane + appliance self-heal (pre-build)

2026-07-12 07:48:49 +02:00

selfupdate

selfupdate: the staging folder keeps what it needs and no more (R-1368 part 2) — not released

2026-11-10 14:10:00 +01:00

signedjobs

agent (unreleased): a refused signed job and a watchdog give-up reach the hub (R-1383, D78)

2026-11-14 17:29:53 +01:00

storage

gofmt -w: 14 files, formatting only, no behaviour change (R-1160)

2026-10-19 10:24:32 +02:00

thincheck

R-1124 + R-1012: forget a decommissioned drive that is gone; name an orphan thin device in a backup failure

2026-10-17 15:20:34 +02:00

vzpartial

After a power cut: remove the dead half-written backup (R-1006); a backup task from before the boot is not in flight (R-1008)

2026-10-14 11:29:41 +02:00

wgtunnel

R-1247: the weekly upload line test — the agent's own iperf3 client to ep0's tunnel-only server, Tuesday 10:00-15:59 after 10 quiet minutes, under the heavy-op gate, best of 3; line_test stanza + GET /host/line-test; 15 tests red-proved; unreleased (next v0.164.0)

2026-10-24 08:59:42 +02:00