felhom-agent/REPORT.md

REPORT — AGENT-001 anti-retarget wipe fix: merge + deploy (v0.30.0)

Date: 2026-06-13 (supervised deploy session) Outcome: SUCCESS — merged to main, built v0.30.0, deployed to the demo Proxmox host, verified non-destructively. No rollback.

What shipped

v0.30.0 — AGENT-001 fix (from the 2026-06-13 deep-sweep audit). The inline customer-confirmed wipe in internal/localapi/disks.go handleDiskFormat previously ran mkfs on the caller-supplied mutable /dev path (req.Device); a USB re-enumeration between inspection and mkfs could wipe the wrong disk (classify→mkfs TOCTOU). Now it re-resolves the confirmed durable id → current device, requires a re-derived exact match, re-inspects data-bearing, and formats the re-resolved device — at parity with signedjobs.WipeExecutor. New internal/localapi/wipe_reresolve.go (antiRetargetResolve, injectable reresolveWipe seam); refusals → 409, no mkfs. Merged from fix/agent-001-wipe-durable-reresolve.

Deploy

• Build server (192.168.0.180, go1.26.0): green gate on the branch (build/vet/test clean; TestAntiRetargetResolve incl. retarget-mismatch-refused PASS). Built v0.30.0 (ldflags -X main.version=0.30.0).
• Demo Proxmox host (felhom-pve): binary verified by sha256 at each hop; backed up the running binary to /usr/local/bin/felhom-agent.bak-0.29.1; installed the new binary; systemctl restart felhom-agent.service.
• Rollback target was v0.29.1 (not needed).
• Pin check before the live run: served PVE leaf-cert SHA-256 prefix matches the pinned value (BA:7C:99:7D:45:D0…).
• Scope: agent-only. No golden rebake, no re-provision, no controller change. Guest 9201 controller stayed online through a brief local-API blip.

Verification (non-destructive)

Check	Result
Service active + version	felhom-agent.service active/running; --version = 0.30.0; clean startup logs (local-api on :8443, hub desired gen=2, PBS verify ok)
Local API reachable (full chain)	controller→agent /disks proxy returns the disk list (vmid 9201); guest 9201 controller healthy on the hub
Regression A — data-bearing device, NO confirmation	REFUSED (HTTP 409, needs_confirmation:true, formatted:false); no mkfs
Regression B — confirmed + WRONG durable_id	REFUSED (HTTP 409, formatted:false); a non-matching confirmation did not authorize a wipe; no mkfs
Data safety	felhom-usb (/dev/sdb1, RomM data) still mounted, used_bytes unchanged — untouched
Blank-device benign-format	SKIPPED — no disposable blank device available on the host
Happy-path destructive wipe	SKIPPED — HUMAN-only (never wipe real data to verify); covered by the unit test

Note: reresolveWipe's post-gate refusal runs only when the gate ALLOWS (a correctly-matching confirmation), which on a real device leads to the destructive success path — so it is not safely live-triggerable and is verified by the unit test retarget-mismatch-refused. Live, both the no-confirmation (A) and wrong-confirmation (B) gate refusals confirm no un-gated destructive path.

Branch / commits

• main merge + version bump pushed. Branch fix/agent-001-wipe-durable-reresolve left in place (per the runbook) until the operator confirms.
• felhom.eu audit record (documentation/audits/deep-sweep-2026-06-13.md) updated: AGENT-001 → MERGED + DEPLOYED (agent v0.30.0).