felhom-agent/REPORT.md

REPORT — agent v0.86.0: DR-tier-by-default (capability inactive + F-3 parent ownership)

Date: 2026-07-12 · Baselines: agent v0.85.0 (bcb8dad) → v0.86.0. Source of truth: the DR-tier-by-default batch spec + felhom.eu/documentation/audits/DRILL-day0-vm-2026-07-12.md. Scope: agent half of the batch — the capability inactive state (disabled ≠ degraded) and the F-3 provision parent-dir ownership fix. No escrow/ceremony changes (decision 4: identity-only escrow is PARKED by policy). Green gate: go build ./... && go vet ./... && go test ./... — all 26 packages ok.

What shipped

1. Capability inactive state (internal/capability/probe.go, manifest.go):
   • StatusInactive = "inactive", ReasonInactive = "disabled by configuration".
   • Capability.GatedBy + Prober.GateActive(gate) — a HEALTHY probe of a gated capability whose gate is off is downgraded ok→inactive. Degraded (binary missing / sudo denied) is NEVER downgraded: an un-migrated pre-v1.15.0 box must not masquerade as deliberately off.
   • The 3 pbsdr-* entries are gated via the stable name prefix in Manifest() (a future pbsdr-* op is gated automatically; nothing else ever is — pinned by test).
   • Summarize counts only real degraded; logCapabilities logs an inactive count at INFO and now runs AFTER the pbsdr wiring so the startup snapshot equals the first report's.
2. pbsdr.Manager.DRConfigured() (internal/pbsdr/manager.go): the gate's answer — live descriptor state (anything but disabled), falling back to the persisted converged marker before the first desired-state fetch (an applied box never flaps inactive across a restart).
3. F-3 (internal/provision/backhalf.go): a root-run provision chowns guests/ + guests/<vmid>/ to the state-dir's owner (chown --reference, non-recursive; bootstrap leaf stays guest-root). Non-root (daemon) runs skip it via the geteuid seam.

Tests + red-proofs (all three mutations proven red, then restored)

Test	Red-proof mutation	Result
TestProbe_GateOffHealthyIsInactive (+ BinaryMissingStaysDegraded, GateOnOrNilIsOK, ExactlyPBSDRGated)	gate branch in Probe disabled (if false)	inactive case FAILED; degraded case stayed green ✓
TestDRConfigured_Lifecycle (unconfigured→applied→restart-marker→disabled)	DRConfigured ignores the disabled state	disabled case FAILED ✓
TestProvision_RootRunOwnsGuestsParents (root issues, non-root doesn't, never -R)	F-3 chown block removed	root case FAILED ✓

Live state touched

• felhom-pve latent F-3 state FIXED live (pre-existing guests{,/9201} root:root 0700 → chowned to felhom-agent, bootstrap subtree untouched — the drill's proven fix).
• Peti's host: unreachable — his F-3 check + agent update stay deferred (publish-train D/E/G).

Shipping notes

• configs/felhom-pbs-apply was already in this repo; host-install v1.15.0 (felhom.eu, same-day) now ships it (drill F-7) + age (F-10) + wg_tunnel.enabled: true (F-9/decision 5).
• Hub-side rendering of the inactive chip + the per-customer DR flag = hub v0.51.0 (felhom.eu).
• Deploy: build+push 0.86.0 on 180, deploy to felhom-pve, publish via scripts/publish-agent.sh, hub Day-0 manifest vouch as operator/browser follow-up.