33 lines
2.4 KiB
Markdown
33 lines
2.4 KiB
Markdown
# REPORT — v0.155.0 released and delivered: the household can turn the machine off (2026-10-13)
|
|
|
|
Baseline `86adbca` (v0.154.0). Code `3403c87`, `f38b03c`, `c6d9435`, `bdf25f0`; release entry `68a2130`; tag `v0.155.0`.
|
|
Task: „The turn the machine off button" (R-998). Design: felhom.eu `documentation/architecture/14-host-power-off.md`.
|
|
|
|
## What it does
|
|
|
|
`POST /host/poweroff` (local API, token-scoped): record → hub told (a report carrying `deliberate_off`, accepted) →
|
|
`pct shutdown <vmid> --timeout 120` → `systemctl poweroff`. Refused in the first 10 min after boot, a second time in a
|
|
boot, while any other guest or VM runs, and while any backup/restore/OS/controller-update/drive/escrow job or a vzdump
|
|
runs. After acceptance the heavy gate is held; before each step the jobs and the guests are read again (wait ≤ 15 min,
|
|
or cancel). Every check fails closed. Sudoers: two exact vectors (`FELHOM_POWEROFF`).
|
|
|
|
## Proof
|
|
|
|
- Tests: `internal/localapi/hostpoweroff_test.go` (11), `internal/poweroff/state_test.go`, `internal/hub/deliberate_off_test.go`,
|
|
`internal/capability` (9 injection cases, new `TestEveryAliasIsGranted`). Each guard red-proofed by removing it.
|
|
- Three security-review passes the same evening; every finding fixed and red-proofed (other guests, gate not held,
|
|
fail-open, jobs and guests starting after acceptance).
|
|
- Fixed without a row: an escrow-ceremony reply data race (`go test -race` red before, green 3/3 after).
|
|
- Live, real sudo on the N100 after the bundle: the two new vectors ALLOWED; `poweroff --force`, `-ff`, `reboot`, `halt`,
|
|
`pct shutdown` with `--forceStop` or without `--timeout` refused.
|
|
- Live press on the N100 through the dashboard endpoint: 202 at 18:52:34Z, no ping 18:53:02Z, 0 W from 18:53:07Z.
|
|
- Back on: power button 21:48:43Z, clean boot (crash guard `last_boot_unclean: false`); the first report carried no
|
|
`deliberate_off`, and the hub ended the hold at 21:49:22Z (`host_deliberate_off_ended`). No crash or recovered mail.
|
|
|
|
## Delivered
|
|
|
|
Signed `agent_update` 0.155.0 + `agent_config_update` (bundle `795f2ab4…`) to demo-felhom, demo-hp, Tester 1. N100:
|
|
committed 18:37:45Z, bundle installed 18:51:54Z (capability probe 70/70). **Not vouched** — the operator's act.
|
|
demo-hp and Tester 1: agent 0.155.0, bundle installed — real `sudo -l` checks there allow the two lines and refuse
|
|
`--force`, `--forceStop 1`, `reboot` (`felhom.eu/documentation/audits/poweroff-2026-10-13/B-sudo-live-*.txt`).
|