felhom-agent/REPORT.md

REPORT — agent v0.135.0: the restore test proves only backups of a guest (R-689, 2026-09-27)

Baseline: main 7403c2a838db, v0.134.0 on both demo hosts. Commits: d4be12c (fix + tests), 9ff937d (CHANGELOG, after the release). Released by scripts/release-agent.sh: tag v0.135.0, sha256 ad4e75f16d338552f4588d3fe64c51cbf9651220b9d223b5386b85b6c37fd4c3, verified by download. NOT vouched (operator).

Tests: full suite rc=0; agent gates OK after the release. TestR689_TheRestoreTestNeverPicksTheGolden red-proofed (without the check it picks local:backup/felhom-golden-0.236.0.tar.zst); TestR689_GuestBackupArchiveShapes; two older picker fixtures moved to real archive names.

Delivered by signed agent_update (felhom-opsign, key felhom-op-1): demo-felhom committed 12:22:53 CEST, demo-hp 12:29:02 CEST (felhom.eu/documentation/audits/version-travel-2026-09-26/D1/).

Then v0.136.0 (16dbc83, sha256 2eb0b5eb…fa6d755, NOT vouched): the scheduler's read-only verdict on demo-hp (-selftest=restore-test-due, D1/D1-selftest-due-demo-hp.txt) skipped the golden but picked a leftover archive of guest 9100 (deleted in August). The guest must now exist; red-proof D1/RP-r689-deleted-guest.txt. Signed-delivered to both hosts. The verdict after 0.136.0: D1/D1-selftest-due-after-0136.txt.

Then v0.137.0 (3ef095f): 0.136.0's lookup met PVE's 403 "permission denied" (the token sees only its pool), not "does not exist", so the local tier read UNKNOWN every evaluation (D1/D1-selftest-due-after-0136.txt) — a regression of 0.136.0, fixed: a guest the agent cannot read is not one it manages. Red-proof D1/RP-r689-acl.txt; verified read-only on demo-hp with the pre-release binary before the release (D1/D1-selftest-due-0137-pre.txt): both leftovers skipped, the off-site tier due on 9201, the local tier waiting for today's 9201 archive to settle. Three agent releases in one session — each the smallest fix of what the box showed.