adminandClaude Opus 5.5
8bd137787e
gates / gates (push) Successful in 33s
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
57 lines
3.4 KiB
Markdown
57 lines
3.4 KiB
Markdown
# REPORT — v0.172.1 released, NOT vouched (2026-11-07, attended)
|
||
|
||
**Plain words first.** Since 2026-11-05 the N100 refused its nightly Proxmox updates. One GRUB package
|
||
(`proxmox-grub`) was in the wrong update group, and it pulled the main GRUB package with it. A safety check then
|
||
stopped the whole group. Agent 0.172.1 puts `proxmox-grub` with the other boot packages. It is published. It waits
|
||
for the operator's vouch and two signed jobs per box.
|
||
|
||
| | |
|
||
|---|---|
|
||
| Built from | `39db030`, `release-agent.sh` (gates green; tag `v0.172.1` pushed) |
|
||
| Agent sha256 | `505a0594a2fb117f359e329a0b7ae2c7a6902b74c51f52c1883145f3c2ac72f8` |
|
||
| Bundle sha256 | `3e7acaee4500893bfaf567b1d427790ef89bf41f08cb6a1419ee528aeb40ddc3` |
|
||
| Re-checked | both downloaded again and hashed; the binary prints `felhom-agent 0.172.1`; the bundle's `felhom-os-apply` holds the fix |
|
||
| Bundle vs 0.170.0 | no path added or removed; only `felhom-os-apply` changed — no step bundle needed (R-880) |
|
||
| Test | `test_ring0_pending_pve_leaves_proxmox_grub_out` — red before the fix, green after; wrapper suite 149/149; `go test -count=1 ./internal/osupdate/` ok |
|
||
| Design | `felhom.eu/documentation/architecture/11-os-updates.md` (the lanes, §5.4.2 bundle) |
|
||
|
||
**Evidence.** `felhom.eu/documentation/audits/demo-check-2026-11-07/n100-pve-step-R6.txt`: the three nights' refusals
|
||
and a read-only `apt-get -s` that shows `proxmox-grub` pulling `grub-efi-amd64`.
|
||
|
||
## For the operator — deliver it (PowerShell, on the Windows machine)
|
||
|
||
0. Hub → Configuration → Day-0 artifacts: vouch agent **0.172.1** (sha and bundle above).
|
||
1. Check the key. The last word before the comment must be `…B63tlLw+` (the pinned signer `felhom-op-1`):
|
||
```powershell
|
||
Get-Content $HOME\.ssh\felhom-op-operational.pub
|
||
```
|
||
2. Set up (the hub key is the hub's global key, the `report-api` one; it is asked, not typed on a line):
|
||
```powershell
|
||
cd $HOME\.ssh
|
||
$Hub = "https://hub.felhom.eu"
|
||
$Ver = "0.172.1"
|
||
$Sha = "505a0594a2fb117f359e329a0b7ae2c7a6902b74c51f52c1883145f3c2ac72f8"
|
||
$Bundle = "3e7acaee4500893bfaf567b1d427790ef89bf41f08cb6a1419ee528aeb40ddc3"
|
||
$Key = "$HOME\.ssh\felhom-op-operational"
|
||
$Boxes = "demo-felhom-8363b5", "demo-hp-bb76ea", "tester-1-d70be4"
|
||
$s = Read-Host "Hub global key" -AsSecureString
|
||
$HubKey = [System.Net.NetworkCredential]::new("", $s).Password
|
||
```
|
||
3. The agent (each box takes it in 4–15 min):
|
||
```powershell
|
||
foreach ($b in $Boxes) { .\felhom-opsign.exe -op agent_update -host $b -key-id felhom-op-1 -key $Key -agent-version $Ver -sha256 $Sha -ttl 45m -upload $Hub -hub-key $HubKey }
|
||
```
|
||
4. Wait until the hub's System page shows agent 0.172.1 on all three (about 15 min). Then the root files:
|
||
```powershell
|
||
foreach ($b in $Boxes) { .\felhom-opsign.exe -op agent_config_update -host $b -key-id felhom-op-1 -key $Key -agent-version $Ver -bundle-sha256 $Bundle -ttl 45m -upload $Hub -hub-key $HubKey }
|
||
```
|
||
5. Clean up: `Remove-Variable HubKey, s`
|
||
|
||
**After the vouch (CC, D50):** set `pinned.day0_agent` = 0.172.1 in `scripts/retention-policy.json`.
|
||
|
||
## Also in this session (no agent change)
|
||
|
||
- demo-hp: the whole-guest LOCAL tier had been refused by the space preflight for 9 days. With the operator's yes,
|
||
the journal was shrunk to 500 MB (whole journal saved first, off-git on DooPlex) and the August test archive of
|
||
guest 9100 removed: 9.5 GB → 14 GB free. Recorded under R-548 (the product half stays open).
|