admin
b7cbded429
Design provenance SPIKE-agent-selfupdate-2026-07-05 (SF findings binding): - felhom-selfupdate-guarded: apply <staged> <sha256> / commit / rollback. Ordering [SF-7]: temp-sweep → path confinement (staging dir only, no '..') → 64-hex + sha256 RE-verify as root (BEFORE .prev) → same-fs assert → .prev snapshot → root-owned staging copy → atomic mv → pending marker → reset-failed [SF-4/5] → detached systemd-run restart, verbatim [SF-6]. rollback is pending-guarded (no pending → exit 0 no-op, [SF-1]) and clears pending BEFORE its restart so per-crash OnFailure re-fires no-op. commit idempotent, .prev retained (S3d). No env-overridable paths (path-fixedness is the security property). shellcheck clean. - felhom-agent-rollback.service: Type=oneshot OnFailure target; comment block documents the systemd-257 per-crash firing reality [SF-1]. - felhom-agent-limits.conf: [Unit]-ONLY drop-in [SF-3] with the spike's tuned values verbatim [SF-2]: StartLimitIntervalSec=120, StartLimitBurst=4, OnFailure=felhom-agent-rollback.service. - sudoers: FELHOM_SELFUPDATE alias (coarse apply glob per S4b — the wrapper re-verify is the real gate) appended to the grant line. visudo -cf OK. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
20 lines
1.1 KiB
Plaintext
20 lines
1.1 KiB
Plaintext
# felhom-agent-limits.conf — start-limit + rollback-trigger drop-in for felhom-agent.service
|
|
# (TASK D1). Install as /etc/systemd/system/felhom-agent.service.d/felhom-agent-limits.conf
|
|
# and `systemctl daemon-reload`.
|
|
#
|
|
# Values are the SPIKE-agent-selfupdate-2026-07-05 tuned set, verbatim [SF-2]: with the unit's
|
|
# Restart=on-failure + RestartSec=5s and systemd 257's compiled defaults (10s/5), a crash-looping
|
|
# binary NEVER trips the start limit and loops forever (35 starts/180s measured). 120s/4 gives a
|
|
# terminal `failed` ≈20s after the first crash.
|
|
#
|
|
# PLACEMENT TRAP [SF-3]: these keys MUST be in [Unit]. On systemd 257 a [Service] placement is
|
|
# HALF-APPLIED — StartLimitBurst is accepted while StartLimitIntervalSec is silently ignored
|
|
# (journal warning only). Never split them; never put them in [Service].
|
|
#
|
|
# OnFailure fires on EVERY crash on systemd 257 [SF-1] — see the comment block in
|
|
# felhom-agent-rollback.service for why that is safe (pending-marker guard).
|
|
[Unit]
|
|
StartLimitIntervalSec=120
|
|
StartLimitBurst=4
|
|
OnFailure=felhom-agent-rollback.service
|