admin f38b03cdb8 Host power-off: refuse while another guest or VM runs; hold the heavy gate; fail closed (R-998) ...

Security review of 3403c87: (1) any guest's controller could switch off a shared host — demo-hp
runs a scratch guest and the Tester 1 VM. Now refused (other_guests_running) when /proc shows any
other lxc-start -n N or kvm -id N; an unreadable /proc refuses. (2) the checks ran once, so a
backup could start before the power-off: the heavy-operation gate is now taken on acceptance and
kept (released only if the power-off command fails). (3) an unwired gate or task reader refused
nothing; now refuses. Each red-proofed.

2026-10-13 19:33:09 +02:00

..

afterbackup_test.go

R-899: no OS leg after a household press (trigger=manual); after-boot kernel reports carry the saved ring

2026-10-08 07:34:19 +02:00

agestate_test.go

agent v0.105.0 — R-88 Part 2: /backup/due gains age_state

2026-07-27 18:00:56 +02:00

backup_target_guard_test.go

v0.112.0 — E-2: GET /disks flags the backup-target drive

2026-07-29 08:20:27 +02:00

backup_target_move_test.go

v0.113.0 — E-2a: guarded backup-target wrapper + POST /backup/target

2026-07-29 09:05:59 +02:00

backup_target.go

v0.113.0 — E-2a: guarded backup-target wrapper + POST /backup/target

2026-07-29 09:05:59 +02:00

backup_tier_states_test.go

v0.131.0: controller supervisor (R-523); per-tier backup status + tier storage presence (R-517/R-518)

2026-09-15 09:49:44 +02:00

backup_tiers_test.go

gofmt: normalize internal/localapi (whitespace only)

2026-07-28 11:15:45 +02:00

backup_tiers.go

v0.98.0 — R-82 Slice A fix: per-tier vzdump wait bound (the 30-minute false failure)

2026-07-26 14:53:24 +02:00

blankformat_test.go

v0.61.0: audit fixes B1 (random temp staging) + D1 (mkfs wrapper member/RO re-checks) + D2 (empty-lsblk fail-safe) + D3 (blank-format anti-retarget)

2026-07-03 07:25:50 +02:00

capacity_linux.go

v0.59.0: report backing device + capacity for a registry-sourced /disks row

2026-07-01 21:34:11 +02:00

capacity_other.go

v0.59.0: report backing device + capacity for a registry-sourced /disks row

2026-07-01 21:34:11 +02:00

cert_test.go

agent: EnsureLeaf signals + loud-WARNs a regenerated leaf (prevention B.1) v0.46.0

2026-06-29 21:45:25 +02:00

cert.go

agent: EnsureLeaf signals + loud-WARNs a regenerated leaf (prevention B.1) v0.46.0

2026-06-29 21:45:25 +02:00

controllersupervisor_test.go

R-861 (a) A1 + (b) B2: the image ref goes to a root verb that checks it; the agent's in-guest tee grant is gone; felhom-op's pct lines are exact (09 §3 decision 165)

2026-10-07 10:19:28 +02:00

controllersupervisor.go

v0.132.0: the slow crash-loop counter (R-539, operator ruling 3 of 2026-09-16)

2026-09-17 10:26:42 +02:00

controllerswap_test.go

R-861 (a) A1 + (b) B2: the image ref goes to a root verb that checks it; the agent's in-guest tee grant is gone; felhom-op's pct lines are exact (09 §3 decision 165)

2026-10-07 10:19:28 +02:00

controllerswap.go

R-861 (a) A1 + (b) B2: the image ref goes to a root verb that checks it; the agent's in-guest tee grant is gone; felhom-op's pct lines are exact (09 §3 decision 165)

2026-10-07 10:19:28 +02:00

crashguard_test.go

R-856: GET /host/crash-guard — the host crash guard's last-boot record for the controller (09 decision 143)

2026-10-06 11:48:01 +02:00

crashguard.go

R-856: GET /host/crash-guard — the host crash guard's last-boot record for the controller (09 decision 143)

2026-10-06 11:48:01 +02:00

debuglogs_test.go

v0.83.0: observability pass — always-DEBUG capture ring + GET /debug/logs + heartbeat log-pull + gap-fill sweep

2026-07-11 16:24:07 +02:00

debuglogs.go

v0.83.0: observability pass — always-DEBUG capture ring + GET /debug/logs + heartbeat log-pull + gap-fill sweep

2026-07-11 16:24:07 +02:00

decommission_test.go

agent v0.36.1: decommission keeps raw mounted (re-enrollable)

2026-06-15 20:06:23 +02:00

disks_backup_target_row_test.go

R-116 (v0.116.0): give the backup-target flag and the gate's key the same row

2026-07-30 08:48:31 +02:00

disks_bind_liveness_test.go

v0.117.0 — R-117: the liveness signal now tests liveness

2026-07-30 12:26:42 +02:00

disks_bug2_f9_test.go

F20-BUG2 + F9-reporting: /disks surfaces wipe_durable_id (gate scheme) + guest_attached

2026-06-14 15:00:56 +02:00

disks_candidates_test.go

gofmt: normalize internal/localapi (whitespace only)

2026-07-28 11:15:45 +02:00

disks_device_presence_test.go

R-124 recipe root namespace as PBS spells it; R-118 no root size for an absent drive; R-269 rotated-out token rejected at once; R-317 dnsmasq install probed by its unit (burn-down round 2)

2026-10-05 18:56:13 +02:00

disks_smart_test.go

v0.95.0: SMART coverage — union-path drives + LVM/dm root + device model

2026-07-25 08:21:45 +02:00

disks_test.go

R-25 (agent half): the format answer carries the NEW filesystem's UUID, bound to the durable id

2026-10-05 21:16:11 +02:00

disks.go

R-25 (agent half): the format answer carries the NEW filesystem's UUID, bound to the durable id

2026-10-05 21:16:11 +02:00

durableid_rawmount_test.go

agent v0.87.0: SystemDisks device-mapper walk — legacy-boot hosts get a working drive wizard (IA finding 2, MEDIUM)

2026-07-13 13:15:03 +02:00

escrow_ceremony_test.go

v0.89.0: pbsdr self-grant (R-22) + escrow config live-reload + agent-plane poke listener (Direction-2a)

2026-07-16 22:47:22 +02:00

escrow_ceremony.go

v0.89.0: pbsdr self-grant (R-22) + escrow config live-reload + agent-plane poke listener (Direction-2a)

2026-07-16 22:47:22 +02:00

escrow_recover_class_test.go

R-304: no 'wrong code' when earlier sealed packages were not all checked (424 older_unchecked)

2026-10-08 07:53:01 +02:00

escrow_recover.go

R-304: no 'wrong code' when earlier sealed packages were not all checked (424 older_unchecked)

2026-10-08 07:53:01 +02:00

escrow_stage_test.go

v0.78.0: DELETE /escrow/stage-secret — idempotent staged-secret wipe

2026-07-09 22:19:10 +02:00

escrow_stage.go

v0.78.0: DELETE /escrow/stage-secret — idempotent staged-secret wipe

2026-07-09 22:19:10 +02:00

f2_role_fallback_test.go

agent v0.87.0: SystemDisks device-mapper walk — legacy-boot hosts get a working drive wizard (IA finding 2, MEDIUM)

2026-07-13 13:15:03 +02:00

format_fsuuid_test.go

R-25 (agent half): the format answer carries the NEW filesystem's UUID, bound to the durable id

2026-10-05 21:16:11 +02:00

formatjob_test.go

F20-BUG3: run mkfs detached (survives request deadline + agent restart); v0.31.0

2026-06-14 15:16:01 +02:00

formatjob.go

R-25 (agent half): the format answer carries the NEW filesystem's UUID, bound to the durable id

2026-10-05 21:16:11 +02:00

guestbind.go

Host power-off for the household (R-998): POST /host/poweroff

2026-10-13 19:29:52 +02:00

guestbinds_reassert_test.go

agent v0.34.0: intermediary mount model — shared parent + host-side attach/detach + reconcile

2026-06-15 16:29:32 +02:00

guestbindstore.go

v0.32.0: self-serve decommission endpoint + intent-aware re-assert (B2a)

2026-06-14 19:55:17 +02:00

guestmemory_test.go

v0.90.0 — guest RAM resize (R-24) + fast-tick-until-convergence (R-28)

2026-07-17 19:09:40 +02:00

guestmemory.go

gofmt: normalize internal/localapi (whitespace only)

2026-07-28 11:15:45 +02:00

guestpower_observable_test.go

guest-power: add the liveness observable it shipped without (v0.109.0)

2026-07-28 11:14:56 +02:00

guestpower_test.go

F-REBOOT + F-LEAK: the agent's authority over guest lifecycle (v0.107.0)

2026-07-28 10:27:07 +02:00

guestpower.go

guest-power: add the liveness observable it shipped without (v0.109.0)

2026-07-28 11:14:56 +02:00

host_metrics_test.go

slice 9: GET /host/metrics + CPU/chassis-temp collector (v0.14.0)

2026-06-10 16:16:03 +02:00

host_metrics.go

slice 9: GET /host/metrics + CPU/chassis-temp collector (v0.14.0)

2026-06-10 16:16:03 +02:00

hostpoweroff_test.go

Host power-off: refuse while another guest or VM runs; hold the heavy gate; fail closed (R-998)

2026-10-13 19:33:09 +02:00

hostpoweroff.go

Host power-off: refuse while another guest or VM runs; hold the heavy gate; fail closed (R-998)

2026-10-13 19:33:09 +02:00

intermediary_attach_liveness_test.go

v0.117.0 — R-117: the liveness signal now tests liveness

2026-07-30 12:26:42 +02:00

intermediary_gate_test.go

agent v0.49.0: reboot-during-backup stale-lock recovery (F2-b) + shared-parent script redeploy fix (F2-a)

2026-06-30 09:00:32 +02:00

intermediary_install_test.go

R-861: narrow the agent's root grants — exact sudo patterns, felhom-priv-apply content checker, fixed hook/parent files in the bundle, signed self-update verified as root, escrow root reads pinned

2026-10-05 12:00:43 +02:00

intermediary_test.go

v0.114.0 — R-113: drive presence means the DEVICE, not the bind

2026-07-29 17:20:16 +02:00

intermediary.go

R-861: narrow the agent's root grants — exact sudo patterns, felhom-priv-apply content checker, fixed hook/parent files in the bundle, signed self-update verified as root, escrow root reads pinned

2026-10-05 12:00:43 +02:00

netreassert_test.go

test: localapi invisible-share test asserts re-arm + re-verify

2026-07-12 07:59:20 +02:00

netreassert.go

F11 matrix-correction: re-arm on guest-blind (active mounts not inherited by rebooted guest — live finding)

2026-07-12 07:58:39 +02:00

netstorage_test.go

v0.81.0: NAS verify-before-commit — retry=0, journal classifier, detached verify job + auto-rollback

2026-07-11 09:44:06 +02:00

netstorage.go

gofmt: normalize internal/localapi (whitespace only)

2026-07-28 11:15:45 +02:00

netverify_logseq_test.go

v0.83.0: observability pass — always-DEBUG capture ring + GET /debug/logs + heartbeat log-pull + gap-fill sweep

2026-07-11 16:24:07 +02:00

netverifyjob_test.go

gofmt: normalize internal/localapi (whitespace only)

2026-07-28 11:15:45 +02:00

netverifyjob.go

v0.83.0: observability pass — always-DEBUG capture ring + GET /debug/logs + heartbeat log-pull + gap-fill sweep

2026-07-11 16:24:07 +02:00

r861_controller_image_test.go

R-861 (a) A1 + (b) B2: the image ref goes to a root verb that checks it; the agent's in-guest tee grant is gone; felhom-op's pct lines are exact (09 §3 decision 165)

2026-10-07 10:19:28 +02:00

r894_saved_backup_test.go

R-894: after a restart the agent remembers the last backup per tier

2026-10-06 20:33:27 +02:00

server_test.go

controllerswap: F1 verify hardening — reject crash-looping no-healthcheck image v0.47.0

2026-06-29 22:45:41 +02:00

server.go

Host power-off for the household (R-998): POST /host/poweroff

2026-10-13 19:29:52 +02:00

stalelock_pool_test.go

v0.62.0 — A1: pool-membership ownership check for the stale-lock reaper

2026-07-03 13:25:05 +02:00

stalelock_test.go

agent v0.49.0: reboot-during-backup stale-lock recovery (F2-b) + shared-parent script redeploy fix (F2-a)

2026-06-30 09:00:32 +02:00

stalelock.go

v0.62.0 — A1: pool-membership ownership check for the stale-lock reaper

2026-07-03 13:25:05 +02:00

tokenstore_test.go

R-124 recipe root namespace as PBS spells it; R-118 no root size for an absent drive; R-269 rotated-out token rejected at once; R-317 dnsmasq install probed by its unit (burn-down round 2)

2026-10-05 18:56:13 +02:00

tokenstore.go

R-124 recipe root namespace as PBS spells it; R-118 no root size for an absent drive; R-269 rotated-out token rejected at once; R-317 dnsmasq install probed by its unit (burn-down round 2)

2026-10-05 18:56:13 +02:00

version_header_test.go

v0.82.0: X-Felhom-Agent-Version response header — the controller capability channel

2026-07-11 14:51:48 +02:00

wipe_reresolve_test.go

controllerswap: F1 verify hardening — reject crash-looping no-healthcheck image v0.47.0

2026-06-29 22:45:41 +02:00

wipe_reresolve.go

v0.61.0: audit fixes B1 (random temp staging) + D1 (mkfs wrapper member/RO re-checks) + D2 (empty-lsblk fail-safe) + D3 (blank-format anti-retarget)

2026-07-03 07:25:50 +02:00