admin
b7cbded429
Design provenance SPIKE-agent-selfupdate-2026-07-05 (SF findings binding): - felhom-selfupdate-guarded: apply <staged> <sha256> / commit / rollback. Ordering [SF-7]: temp-sweep → path confinement (staging dir only, no '..') → 64-hex + sha256 RE-verify as root (BEFORE .prev) → same-fs assert → .prev snapshot → root-owned staging copy → atomic mv → pending marker → reset-failed [SF-4/5] → detached systemd-run restart, verbatim [SF-6]. rollback is pending-guarded (no pending → exit 0 no-op, [SF-1]) and clears pending BEFORE its restart so per-crash OnFailure re-fires no-op. commit idempotent, .prev retained (S3d). No env-overridable paths (path-fixedness is the security property). shellcheck clean. - felhom-agent-rollback.service: Type=oneshot OnFailure target; comment block documents the systemd-257 per-crash firing reality [SF-1]. - felhom-agent-limits.conf: [Unit]-ONLY drop-in [SF-3] with the spike's tuned values verbatim [SF-2]: StartLimitIntervalSec=120, StartLimitBurst=4, OnFailure=felhom-agent-rollback.service. - sudoers: FELHOM_SELFUPDATE alias (coarse apply glob per S4b — the wrapper re-verify is the real gate) appended to the grant line. visudo -cf OK. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
22 lines
1.3 KiB
Desktop File
22 lines
1.3 KiB
Desktop File
# felhom-agent-rollback.service — the OnFailure= target that auto-reverts a crash-looping agent
|
|
# self-update (TASK D1; SPIKE-agent-selfupdate-2026-07-05).
|
|
#
|
|
# Install as /etc/systemd/system/felhom-agent-rollback.service. It is referenced by the
|
|
# felhom-agent-limits.conf drop-in's OnFailure= line.
|
|
#
|
|
# THE PER-CRASH-FIRING REALITY [SF-1]: on systemd 257, OnFailure= fires on EVERY crash of the main
|
|
# unit — even while it is merely `activating (auto-restart)`, long before (and regardless of) the
|
|
# terminal start-limit `failed` state. During one crash incident this unit therefore runs MANY
|
|
# times. That is safe BY DESIGN: the wrapper's rollback verb is pending-marker-guarded — the first
|
|
# fire after a bad update reverts the binary and clears the marker; every later fire (and any fire
|
|
# with no update in flight at all) is a logged no-op that touches nothing. Consequence: a bad
|
|
# update is rolled back at the FIRST crash (~seconds), not after the start-limit burst — the tuned
|
|
# start-limit in the drop-in is the terminal BACKSTOP (e.g. an environmental crash loop of the
|
|
# known-good binary), not the rollback trigger.
|
|
[Unit]
|
|
Description=Felhom agent self-update auto-rollback (pending-guarded; fires per crash, no-ops without a pending update)
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/local/sbin/felhom-selfupdate-guarded rollback
|