felhom-agent/REPORT.md

REPORT — v0.73.0: F2 mount-role fallback (enrolled user-data drives ejectable/decommissionable)

Date: 2026-07-06 · Class: risky/supervised (loosens a role gate; bounded by containment red-proofs). Baseline: main @ 26664d6 (v0.72.0) → 7545af8. Part A of the pilot-blockers bundle (B = controller v0.102.0, C = catalog healthcheck sweep). Provenance: campaign F2 + RERUN addendum.

The bug

roleForMountPath (internal/localapi/disks.go) resolved a mount's protection role ONLY from the PVE storage view (Observe). A bind-mounted RAW enrolled user-data drive is not a PVE storage → no MountPath match → fail-safe RoleSystem → the eject (disks.go:353) and decommission (disks.go:404) role gates 403'd every user-data drive in the standard topology (campaign journal: where=/mnt/teszt_enroll role=system).

The fix (only roleForMountPath)

After the MountPath loop misses on a SUCCESSFUL Observe, resolve the mount's device from the host mount table (mirroring durableIDForMount's Impl-2b) and classify device-keyed:

• non-/dev source (NAS) → system;
• device on the same whole disk as a KNOWN target → THAT target's role (containment, new storage.SameWholeDisk, whole-disk granularity so a protected disk can't be ejected here);
• else RoleForRawDevice (system-disk membership). Fail-safe preserved: an Observe error returns system BEFORE the fallback (a blind containment pass could label a backup drive user-data — permissive); a mount-read failure or absent/NAS mount → system. Handlers, deviceRole, DecommissionExecutor, classify.go, ReassertGuestBinds untouched; the deviceRole/roleForMountPath unification is deferred.

Tests + red-proofs (f2_role_fallback_test.go)

A1 bind-mounted user-data ejectable + decommission effects; B1 containment (mount on a protected target's disk → 403); B2 system-disk mount → 403; C1/C2 fail-safe (absent, NAS → 403); C3 Observe-error skips the fallback (403 + Mounts() called once). Three red-proofs demonstrated: pre-fix body → A1 FAIL (exact role: system 403); containment-skip mutation → B1 FAIL (protected disk becomes ejectable); Observe-error fallback → C3 FAIL (permissive). Existing TestEject_RoleGated/TestDecommission_* green UNMODIFIED. Full gate go build/vet/test ./... = PASS.

Deploy + live acceptance (on /mnt/teszt_enroll ONLY)

Built -X main.version=0.73.0 on 180, deployed to felhom-pve (.bak-0.72.0 kept). --version = 0.73.0, systemctl is-active = active, capabilities 56/56 degraded=0. Full F2 lifecycle through the real controller endpoints: eject → HTTP 200 (was 403), decommission-anyway → HTTP 200 (decommissioned:true, was 403), post-decommission bind detached, agent restart → drive stayed detached (no rebind), re-commission (reconnect) → 200, end state == pre-state (bound on /dev/sdb, attached, durable uuid:f2236136-ced7…).

Not changed / observations

Only roleForMountPath + the new storage.SameWholeDisk helper. The pre-existing VM.Audit permission ERROR in the agent log is unrelated (known A1 privilege gap). The deviceRole/roleForMountPath unification refactor is deferred.