admin 64f704d0f7 R-349: the host report carries the sha256 of the RUNNING agent binary ...

A hand-built proof binary and the published artifact share a version string
but not their bytes, so no version check could see the divergence. The agent
now reports agent_sha256 (hash of /proc/self/exe, once per process; empty =
unknown) beside agent_version, the same mechanism as host.wrapper_sha256.
The hub half (compare against the vouched agent_sha256, surface drift) is
owed in the hub repo.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

2026-10-05 21:16:11 +02:00

..

testdata

contract: the desired-state golden gains host_release (byte-identical with hub v0.131.0); TestOSUpdateGolden_Decodes checks it

2026-10-04 13:18:43 +02:00

bundle_record_test.go

R-840: the config bundle — a signed agent_config_update brings a box's root-owned files (sudoers, wrappers, units)

2026-10-04 19:36:58 +02:00

client_test.go

…

client.go

OS updates, guest fast lane (11 §8 step 2): felhom-os-apply wrapper (R1-R13 refusals, repair first, snapshot.debian.org fallback), FELHOM_OSAPPLY sudoers, the OS leg after the primary backup, hub os_update block + os-report, --selftest=os-update

2026-10-04 10:44:29 +02:00

cloudflared_test.go

OS updates host fast lane + true tunnel status + fast leg: wrapper host layer (R12 appliance proof from the root-owned install record, R14 kernel/boot/firmware refused), select pending-fast, one call per layer, host-side version checks, restart scan only after an install, reboot-needed for PID 1/lxc-start; the leg runs the host step after a healthy guest step; GuestTunnelProber reads the cloudflared container + its readiness check (R-841)

2026-10-04 12:54:02 +02:00

cloudflared.go

OS updates host fast lane + true tunnel status + fast leg: wrapper host layer (R12 appliance proof from the root-owned install record, R14 kernel/boot/firmware refused), select pending-fast, one call per layer, host-side version checks, restart scan only after an install, reboot-needed for PID 1/lxc-start; the leg runs the host step after a healthy guest step; GuestTunnelProber reads the cloudflared container + its readiness check (R-841)

2026-10-04 12:54:02 +02:00

collect_agentsha_test.go

R-349: the host report carries the sha256 of the RUNNING agent binary

2026-10-05 21:16:11 +02:00

collect_guestnet_test.go

OS updates host fast lane + true tunnel status + fast leg: wrapper host layer (R12 appliance proof from the root-owned install record, R14 kernel/boot/firmware refused), select pending-fast, one call per layer, host-side version checks, restart scan only after an install, reboot-needed for PID 1/lxc-start; the leg runs the host step after a healthy guest step; GuestTunnelProber reads the cloudflared container + its readiness check (R-841)

2026-10-04 12:54:02 +02:00

collect_mgmtplane_test.go

OS updates host fast lane + true tunnel status + fast leg: wrapper host layer (R12 appliance proof from the root-owned install record, R14 kernel/boot/firmware refused), select pending-fast, one call per layer, host-side version checks, restart scan only after an install, reboot-needed for PID 1/lxc-start; the leg runs the host step after a healthy guest step; GuestTunnelProber reads the cloudflared container + its readiness check (R-841)

2026-10-04 12:54:02 +02:00

collect_test.go

OS updates host fast lane + true tunnel status + fast leg: wrapper host layer (R12 appliance proof from the root-owned install record, R14 kernel/boot/firmware refused), select pending-fast, one call per layer, host-side version checks, restart scan only after an install, reboot-needed for PID 1/lxc-start; the leg runs the host step after a healthy guest step; GuestTunnelProber reads the cloudflared container + its readiness check (R-841)

2026-10-04 12:54:02 +02:00

collect.go

R-349: the host report carries the sha256 of the RUNNING agent binary

2026-10-05 21:16:11 +02:00

contract_test.go

v0.119.0 — the host report carries the box's addresses

2026-07-31 08:40:58 +02:00

cputemp_test.go

…

cputemp.go

…

desired_client_test.go

…

desired_contract_test.go

…

dr_recipe_test.go

R-124 recipe root namespace as PBS spells it; R-118 no root size for an absent drive; R-269 rotated-out token rejected at once; R-317 dnsmasq install probed by its unit (burn-down round 2)

2026-10-05 18:56:13 +02:00

dr_recipe.go

R-124 recipe root namespace as PBS spells it; R-118 no root size for an absent drive; R-269 rotated-out token rejected at once; R-317 dnsmasq install probed by its unit (burn-down round 2)

2026-10-05 18:56:13 +02:00

hostaddr_test.go

v0.119.0 — the host report carries the box's addresses

2026-07-31 08:40:58 +02:00

hostaddr.go

v0.119.0 — the host report carries the box's addresses

2026-07-31 08:40:58 +02:00

hostmetrics_test.go

OS updates host fast lane + true tunnel status + fast leg: wrapper host layer (R12 appliance proof from the root-owned install record, R14 kernel/boot/firmware refused), select pending-fast, one call per layer, host-side version checks, restart scan only after an install, reboot-needed for PID 1/lxc-start; the leg runs the host step after a healthy guest step; GuestTunnelProber reads the cloudflared container + its readiness check (R-841)

2026-10-04 12:54:02 +02:00

loop_logtail_test.go

v0.83.0: observability pass — always-DEBUG capture ring + GET /debug/logs + heartbeat log-pull + gap-fill sweep

2026-07-11 16:24:07 +02:00

loop_test.go

agent: report served local-API leaf fingerprint (hub re-key detection, Part A) v0.48.0

2026-06-29 23:14:52 +02:00

loop.go

v0.89.0: pbsdr self-grant (R-22) + escrow config live-reload + agent-plane poke listener (Direction-2a)

2026-07-16 22:47:22 +02:00

mock_test.go

OS updates host fast lane + true tunnel status + fast leg: wrapper host layer (R12 appliance proof from the root-owned install record, R14 kernel/boot/firmware refused), select pending-fast, one call per layer, host-side version checks, restart scan only after an install, reboot-needed for PID 1/lxc-start; the leg runs the host step after a healthy guest step; GuestTunnelProber reads the cloudflared container + its readiness check (R-841)

2026-10-04 12:54:02 +02:00

osupdate_contract_test.go

contract: the desired-state golden gains host_release (byte-identical with hub v0.131.0); TestOSUpdateGolden_Decodes checks it

2026-10-04 13:18:43 +02:00

report_test.go

v0.119.0 — the host report carries the box's addresses

2026-07-31 08:40:58 +02:00

report.go

R-349: the host report carries the sha256 of the RUNNING agent binary

2026-10-05 21:16:11 +02:00

restoretest_merge_test.go

v0.122.0: three ways the signals lied about themselves (R-189, R-188, R-186)

2026-08-03 16:40:18 +02:00

wg_client_test.go

wgtunnel: S3 Part 1 — pure-Go keygen + hub wire (WireWireguard, report stanza, RegisterWG)

2026-07-04 07:00:19 +02:00

wg_contract_test.go

wgtunnel: S3 Part 1 — pure-Go keygen + hub wire (WireWireguard, report stanza, RegisterWG)

2026-07-04 07:00:19 +02:00