felhom-agent/REPORT.md

REPORT — slice 8C Phase A (agent half): disk endpoints + data-bearing classifier gate (v0.12.0) (2026-06-10)

Overwrite-latest report. Cumulative history: CHANGELOG.md. Implements the host-agent half of TASK — Slice 8C. The controller de-privileging + disk-subsystem retirement is the felhom-controller half (v0.37.0). No hub change.

Outcome

The agent now owns disk execution. It serves the §6 disk-management endpoints the controller's UI drives, with the 8C security invariant: the agent decides data-bearing-ness by inspecting the actual device (agent-internal evidence), NEVER from the caller's claim. A compromised controller asserting "this drive is blank" cannot wipe a data-bearing drive — proven live (a data-bearing device → refused pending_signature, mkfs never called, the device untouched).

What landed

• internal/storage — SudoHostOps.Format(device, fstype) (device-pinned mkfs.ext4 -F / mkfs.xfs -f, ValidateBlockDevice+ValidateFSType, narrow FELHOM_FORMAT sudoers). SudoHostOps.InspectDevice(device) → DeviceProbe (blkid -p signatures + lsblk -J partitions/mount). DeviceProbe.DataBearing() is conservative: any filesystem / partition table / partition / mount — OR a probe that did not read cleanly — is data-bearing (fail-safe).
• internal/localapi — the §6 disk endpoints, self-scoped (token→guest; cross-guest 403): GET /disks (drives + data-bearing flag), POST /disks/assign (benign EnsureMount), POST /disks/eject (benign Unmount + dependent guests), POST /disks/format. /disks/format is the centerpiece: the agent inspects the device; blank → benign → mkfs; data-bearing → ClassStorageWipe → the slice-4 gate → pending_signature (refused). The signed completion is slice 10. storageGateAdapter bridges to the gate (no new gate/crypto).

Tests

go test ./... green; -race green (build server). localapi security matrix: blank → mkfs called, gate not consulted; data-bearing → 403, mkfs NEVER called, gate consulted; ambiguous/unprobed → fail-safe destructive; gate-allows still refuses in 8C; assign/eject; cross-guest 403; bad device/fstype 400; unconfigured 503. storage: validators (whitelist + injection rejection), InspectDevice (blank/fs/parttable/mounted/failed-probe-fail-safe), Format invokes the right mkfs.

Live validation (demo-felhom)

A provisioned de-privileged controller (v0.37.0) drove the agent: GET /disks flagged the mounted felhom-usb (/dev/sdb1) data_bearing: true and the LVM/PBS/dir storages false. POST /disks/format on the mounted-vfat /dev/sda2 → 403 "device is data-bearing — format requires operator authorization (pending_signature)"; agent log refusing format of a data-bearing device … gate=pending_signature; /dev/sda2 untouched. Deployed to the standing demo service as v0.12.0.

Deferred (stated, not built)

The operator-signed completion of a data-bearing wipe/format → slice 10. No spare blank /dev/sd* on the demo to live-exercise an actual mkfs (won't format real disks — covered by unit tests). No secrets committed.