felhom-agent/REPORT.md

REPORT — v0.155.0 released and delivered: the household can turn the machine off (2026-10-13)

Baseline 86adbca (v0.154.0). Code 3403c87, f38b03c, c6d9435, bdf25f0; release entry 68a2130; tag v0.155.0. Task: „The turn the machine off button" (R-998). Design: felhom.eu documentation/architecture/14-host-power-off.md.

What it does

POST /host/poweroff (local API, token-scoped): record → hub told (a report carrying deliberate_off, accepted) → pct shutdown <vmid> --timeout 120 → systemctl poweroff. Refused in the first 10 min after boot, a second time in a boot, while any other guest or VM runs, and while any backup/restore/OS/controller-update/drive/escrow job or a vzdump runs. After acceptance the heavy gate is held; before each step the jobs and the guests are read again (wait ≤ 15 min, or cancel). Every check fails closed. Sudoers: two exact vectors (FELHOM_POWEROFF).

Proof

• Tests: internal/localapi/hostpoweroff_test.go (11), internal/poweroff/state_test.go, internal/hub/deliberate_off_test.go, internal/capability (9 injection cases, new TestEveryAliasIsGranted). Each guard red-proofed by removing it.
• Three security-review passes the same evening; every finding fixed and red-proofed (other guests, gate not held, fail-open, jobs and guests starting after acceptance).
• Fixed without a row: an escrow-ceremony reply data race (go test -race red before, green 3/3 after).
• Live, real sudo on the N100 after the bundle: the two new vectors ALLOWED; poweroff --force, -ff, reboot, halt, pct shutdown with --forceStop or without --timeout refused.
• Live press on the N100 through the dashboard endpoint: 202 at 18:52:34Z, no ping 18:53:02Z, 0 W from 18:53:07Z.
• Back on: power button 21:48:43Z, clean boot (crash guard last_boot_unclean: false); the first report carried no deliberate_off, and the hub ended the hold at 21:49:22Z (host_deliberate_off_ended). No crash or recovered mail.

Delivered

Signed agent_update 0.155.0 + agent_config_update (bundle 795f2ab4…) to demo-felhom, demo-hp, Tester 1. N100: committed 18:37:45Z, bundle installed 18:51:54Z (capability probe 70/70). Not vouched — the operator's act. demo-hp and Tester 1: agent 0.155.0, bundle installed — real sudo -l checks there allow the two lines and refuse --force, --forceStop 1, reboot (felhom.eu/documentation/audits/poweroff-2026-10-13/B-sudo-live-*.txt).