admin b1bc63dd32 R-1285: the new agent runs the bundle policy pass once after its self-update commits — in the normal two-job delivery the old process installs the bundle. Test in the real order (commit, then one bundle-policy plan); red-proved. Commit only, not released.

2026-10-26 12:44:25 +01:00

..

commit_test.go

feat: D1 Part 2 — agent self-update Go plumbing (op class, opsign, executor, commit, report)

2026-07-05 15:32:15 +02:00

commit.go

R-1285: the new agent runs the bundle policy pass once after its self-update commits — in the normal two-job delivery the old process installs the bundle. Test in the real order (commit, then one bundle-policy plan); red-proved. Commit only, not released.

2026-10-26 12:44:25 +01:00

executor_test.go

R-861: narrow the agent's root grants — exact sudo patterns, felhom-priv-apply content checker, fixed hook/parent files in the bundle, signed self-update verified as root, escrow root reads pinned

2026-10-05 12:00:43 +02:00

executor.go

R-861: narrow the agent's root grants — exact sudo patterns, felhom-priv-apply content checker, fixed hook/parent files in the bundle, signed self-update verified as root, escrow root reads pinned

2026-10-05 12:00:43 +02:00

selfupdate.go

feat: D1 Part 2 — agent self-update Go plumbing (op class, opsign, executor, commit, report)

2026-07-05 15:32:15 +02:00