felhom-agent/REPORT.md

REPORT — agent v0.84.0: ReassertNetworkMounts — NAS automount survives guest reboots (RCA fix 1)

Date: 2026-07-11 · Commit: 474b858 · Deployed: felhom-pve (backup .bak-0.83.0) · PUBLISHED to Gitea (same evening, operator-requested): publish-agent.sh 0.84.0 with the LIVE felhom-pve bytes (sha identical felhom-pve↔180) — pre-GET 404 → PUT 201 → round-trip match → anonymous GET 200, 13 582 910 bytes, sha == AGENT_SHA256 2e31b9a8f9355d674c8f81523015421bf1ecb590023d7fdf959a2bfbaf4c42d3; hop copies removed (180 + local + felhom-pve /tmp), token-leak in transcript: none (creds decoded remotely only). OPERATOR follow-up: hub Day-0 manifest vouch (Configs → Day-0 artifacts: agent 0.84.0 / sha above) — password-gated UI. Peti still on 0.81.0 until the next train. Source: felhom.eu/documentation/audits/AUDIT-nas-cwa-rca-2026-07-11.md (fix 1); pairs with controller v0.117.0 (fixes 2+4).

Baseline (fresh-verified at session start)

Agent 0.83.0 live on felhom-pve; controller 0.116.1 on 9201; nas-media active-mounted; CWA healthy.

What shipped

• internal/storage/netreassert.go ReassertNetworkAutomounts — the §8 decision table: real nfs/nfs4/cifs mounted → skip (fresh namespaces inherit real mounts); autofs trigger → systemctl stop -- <unit>.automount + enable --now -- <unit>.automount (existing FELHOM_NETMOUNT verbs — the §3 sudoers fallback was NOT needed, see equivalence below); neither → skip (orphan states owned by add/remove). Idempotent; per-share errors never stop the pass. networkUnitEntries() factored out of ListNetworkMounts (behavior unchanged).
• internal/localapi/netreassert.go Server.ReassertNetworkMounts — daemon leg: host-global pass once, then per-RUNNING-guest GuestSeesMount verify (WARN-only). Type-asserted capability (lean NetworkStorageOps + fakes untouched). Wired at startup after ReassertGuestBinds; deliberately NOT in the 20 s ticker (idle trigger = healthy, never churned).
• internal/guesthook/netreassert.go + PhasePostStart — hook leg: PVE runs the hookscript as root → direct systemctl; GuestSeesPath verify (hook-process mirror of GuestSeesMount); non-fatal by contract (stderr → PVE task log, exit 0 always, 30 s bound). The installed wrapper already forwards all phases — no snippet re-install was needed.

Tests + red-proofs

Test	Result	Red-proof
§8 decision table (TestNetReassertAction_Table)	PASS	always-rearm shape → FAIL netReassertAction("nfs") = "rearmed", want "skip-active" (the live-mount churn)
rearm emits EXACTLY stop+enable-now on the right unit	PASS (linux)	covered by the table red-proof (same predicate)
active mount → ZERO systemctl calls	PASS (linux)	the always-rearm shape fails it with 2 recorded calls
idempotent double-pass; zero-units no-op	PASS (linux)	—
hook wiring (TestRunGuestHook_PostStartInvokesNetworkReassert)	PASS	PhasePostStart case removed → FAIL got []
hook core verifies rearmed+active rows only; verify-failure non-fatal	PASS	—
daemon leg verifies RUNNING guests only; invisible share = WARN-only	PASS	—

Full linux suite on 180: clean. Windows suite: clean (unit-name tests skip by design).

Deploy + live validation

• Installed on felhom-pve 21:16; felhom-agent 0.84.0; journal clean.
• Equivalence (spike gate §3, live): the startup sweep found nas-media idle → re-armed via stop+enable-now → guest visibility retained (no WARN) → stop+enable-now ≡ restart proven; no sudoers widening.
• Hook leg, real entry: felhom-agent guest-hook 9201 post-start as root → exit 0, network share nas-media visible in guest (skip-active).
• 🛑 Q1c reboot (operator GO, 21:20 pct reboot 9201): the start-task transcript itself carried netreassert: automount trigger re-armed + guest-hook: vmid 9201 post-start — network share nas-media visible in guest (rearmed). Post-boot, NO manual action: guest had trigger + nfs4; calibre-web auto-started healthy on the NAS library (the RCA's 4-hour silent death is gone); uid-1000 write-through WRITE-OK; controller health status=ok first cycle; no storage badge. Q1c GREEN.

Observations / follow-ups

• Sudoers fallback not needed (record per §3: stop+enable-now re-propagates identically).
• RCA fixes 3 (boot-failure alerting), 5 (label mojibake), 6 (ring spam) remain queued as separate tasks.
• Peti publish-train queue: agent 0.84.0 + controller 0.117.0 + journal-group one-liner + temp Git Sync creds deletion.