49 lines
3.3 KiB
Markdown
49 lines
3.3 KiB
Markdown
# REPORT — agent v0.86.0: DR-tier-by-default (capability `inactive` + F-3 parent ownership)
|
|
|
|
**Date:** 2026-07-12 · **Baselines:** agent v0.85.0 (`bcb8dad`) → **v0.86.0**.
|
|
**Source of truth:** the DR-tier-by-default batch spec + `felhom.eu/documentation/audits/DRILL-day0-vm-2026-07-12.md`.
|
|
**Scope:** agent half of the batch — the capability `inactive` state (disabled ≠ degraded) and the
|
|
F-3 provision parent-dir ownership fix. No escrow/ceremony changes (decision 4: identity-only
|
|
escrow is PARKED by policy). Green gate: `go build ./... && go vet ./... && go test ./...` — all
|
|
26 packages ok.
|
|
|
|
## What shipped
|
|
|
|
1. **Capability `inactive` state** (`internal/capability/probe.go`, `manifest.go`):
|
|
- `StatusInactive = "inactive"`, `ReasonInactive = "disabled by configuration"`.
|
|
- `Capability.GatedBy` + `Prober.GateActive(gate)` — a HEALTHY probe of a gated capability
|
|
whose gate is off is downgraded ok→inactive. Degraded (binary missing / sudo denied) is
|
|
NEVER downgraded: an un-migrated pre-v1.15.0 box must not masquerade as deliberately off.
|
|
- The 3 `pbsdr-*` entries are gated via the stable name prefix in `Manifest()` (a future
|
|
pbsdr-* op is gated automatically; nothing else ever is — pinned by test).
|
|
- `Summarize` counts only real degraded; `logCapabilities` logs an inactive count at INFO and
|
|
now runs AFTER the pbsdr wiring so the startup snapshot equals the first report's.
|
|
2. **`pbsdr.Manager.DRConfigured()`** (`internal/pbsdr/manager.go`): the gate's answer — live
|
|
descriptor state (anything but `disabled`), falling back to the persisted converged marker
|
|
before the first desired-state fetch (an applied box never flaps inactive across a restart).
|
|
3. **F-3** (`internal/provision/backhalf.go`): a root-run provision chowns `guests/` +
|
|
`guests/<vmid>/` to the state-dir's owner (`chown --reference`, non-recursive; bootstrap leaf
|
|
stays guest-root). Non-root (daemon) runs skip it via the `geteuid` seam.
|
|
|
|
## Tests + red-proofs (all three mutations proven red, then restored)
|
|
|
|
| Test | Red-proof mutation | Result |
|
|
|---|---|---|
|
|
| `TestProbe_GateOffHealthyIsInactive` (+ BinaryMissingStaysDegraded, GateOnOrNilIsOK, ExactlyPBSDRGated) | gate branch in `Probe` disabled (`if false`) | inactive case FAILED; degraded case stayed green ✓ |
|
|
| `TestDRConfigured_Lifecycle` (unconfigured→applied→restart-marker→disabled) | `DRConfigured` ignores the `disabled` state | disabled case FAILED ✓ |
|
|
| `TestProvision_RootRunOwnsGuestsParents` (root issues, non-root doesn't, never `-R`) | F-3 chown block removed | root case FAILED ✓ |
|
|
|
|
## Live state touched
|
|
|
|
- **felhom-pve latent F-3 state FIXED live** (pre-existing `guests{,/9201}` root:root 0700 →
|
|
chowned to felhom-agent, bootstrap subtree untouched — the drill's proven fix).
|
|
- **Peti's host: unreachable** — his F-3 check + agent update stay deferred (publish-train D/E/G).
|
|
|
|
## Shipping notes
|
|
|
|
- `configs/felhom-pbs-apply` was already in this repo; host-install **v1.15.0** (felhom.eu,
|
|
same-day) now ships it (drill F-7) + `age` (F-10) + `wg_tunnel.enabled: true` (F-9/decision 5).
|
|
- Hub-side rendering of the `inactive` chip + the per-customer DR flag = hub v0.51.0 (felhom.eu).
|
|
- Deploy: build+push 0.86.0 on 180, deploy to felhom-pve, publish via `scripts/publish-agent.sh`,
|
|
hub Day-0 manifest vouch as operator/browser follow-up.
|