admin 6ab1e7c56c R-861: narrow the agent's root grants — exact sudo patterns, felhom-priv-apply content checker, fixed hook/parent files in the bundle, signed self-update verified as root, escrow root reads pinned ...

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

2026-10-05 12:00:43 +02:00

..

candidates.go

v0.55.0: raw-device discovery + registry-sourced drive tracking (Impl-2a)

2026-07-01 17:33:49 +02:00

claim_r220_test.go

v0.127.0: a mount Felhom itself made is not 'something else' (R-220)

2026-08-06 12:55:28 +02:00

claim_test.go

v0.61.0: audit fixes B1 (random temp staging) + D1 (mkfs wrapper member/RO re-checks) + D2 (empty-lsblk fail-safe) + D3 (blank-format anti-retarget)

2026-07-03 07:25:50 +02:00

claim.go

v0.127.0: a mount Felhom itself made is not 'something else' (R-220)

2026-08-06 12:55:28 +02:00

doc.go

…

durable_device_test.go

agent v0.37.0: host-reboot remount re-resolves enrolled drives by fs-UUID

2026-06-16 17:49:00 +02:00

durable_device.go

agent v0.37.0: host-reboot remount re-resolves enrolled drives by fs-UUID

2026-06-16 17:49:00 +02:00

durableid_test.go

…

durableid.go

…

hostops_disk_test.go

v0.54.0: format-safety foundation — unclaimed-disk guard + guarded-mkfs wrapper

2026-07-01 16:52:31 +02:00

hostops_test.go

R-861: narrow the agent's root grants — exact sudo patterns, felhom-priv-apply content checker, fixed hook/parent files in the bundle, signed self-update verified as root, escrow root reads pinned

2026-10-05 12:00:43 +02:00

hostops.go

R-861: narrow the agent's root grants — exact sudo patterns, felhom-priv-apply content checker, fixed hook/parent files in the bundle, signed self-update verified as root, escrow root reads pinned

2026-10-05 12:00:43 +02:00

hostread.go

agent v0.87.0: SystemDisks device-mapper walk — legacy-boot hosts get a working drive wizard (IA finding 2, MEDIUM)

2026-07-13 13:15:03 +02:00

intent_test.go

agent v0.27.0: slice 10 P3 — self-heal watchdog reconcile + 4-state intent model

2026-06-12 17:49:25 +02:00

intent.go

agent v0.27.0: slice 10 P3 — self-heal watchdog reconcile + 4-state intent model

2026-06-12 17:49:25 +02:00

mountunit.go

agent v0.50.0: NAS network storage Part A1 (NFS/SMB automount foundation)

2026-06-30 11:12:27 +02:00

netmigrate_test.go

R-861: narrow the agent's root grants — exact sudo patterns, felhom-priv-apply content checker, fixed hook/parent files in the bundle, signed self-update verified as root, escrow root reads pinned

2026-10-05 12:00:43 +02:00

netmount_test.go

R-861: narrow the agent's root grants — exact sudo patterns, felhom-priv-apply content checker, fixed hook/parent files in the bundle, signed self-update verified as root, escrow root reads pinned

2026-10-05 12:00:43 +02:00

netmount.go

R-861: narrow the agent's root grants — exact sudo patterns, felhom-priv-apply content checker, fixed hook/parent files in the bundle, signed self-update verified as root, escrow root reads pinned

2026-10-05 12:00:43 +02:00

netreassert_test.go

test: fix unused var in reassert test

2026-07-12 07:49:58 +02:00

netreassert.go

F11 matrix-correction: re-arm on guest-blind (active mounts not inherited by rebooted guest — live finding)

2026-07-12 07:58:39 +02:00

netresidue_test.go

agent v0.85.0 WIP: F12/F11/F10/F9/F2/F1 boot-recovery plane + appliance self-heal (pre-build)

2026-07-12 07:48:49 +02:00

netverify_test.go

v0.81.0: NAS verify-before-commit — retry=0, journal classifier, detached verify job + auto-rollback

2026-07-11 09:44:06 +02:00

netverify.go

v0.81.0: NAS verify-before-commit — retry=0, journal classifier, detached verify job + auto-rollback

2026-07-11 09:44:06 +02:00

observe_smart_test.go

v0.95.0: SMART coverage — union-path drives + LVM/dm root + device model

2026-07-25 08:21:45 +02:00

observe_test.go

R-106 follow-up: mergeConfig dropped the pbs namespace, so v0.118.0's fix was inert (v0.118.1)

2026-07-30 13:23:21 +02:00

observe_thinhigh_test.go

v0.133.0: a restore-test can never fill a box's disk; leftovers retried on a timer (R-672, R-673)

2026-09-24 16:23:15 +02:00

observe.go

v0.133.0: a restore-test can never fill a box's disk; leftovers retried on a timer (R-672, R-673)

2026-09-24 16:23:15 +02:00

r861_privapply_contract_test.go

R-861: narrow the agent's root grants — exact sudo patterns, felhom-priv-apply content checker, fixed hook/parent files in the bundle, signed self-update verified as root, escrow root reads pinned

2026-10-05 12:00:43 +02:00

registry_known_test.go

v0.55.0: raw-device discovery + registry-sourced drive tracking (Impl-2a)

2026-07-01 17:33:49 +02:00

registry_known.go

v0.55.0: raw-device discovery + registry-sourced drive tracking (Impl-2a)

2026-07-01 17:33:49 +02:00

role_test.go

controllerswap: stdin tee write + narrow FELHOM_CONTROLLERSWAP grants (non-root, v0.45.0)

2026-06-29 19:42:30 +02:00

role_walk_test.go

agent v0.87.0: SystemDisks device-mapper walk — legacy-boot hosts get a working drive wizard (IA finding 2, MEDIUM)

2026-07-13 13:15:03 +02:00

role.go

agent v0.87.0: SystemDisks device-mapper walk — legacy-boot hosts get a working drive wizard (IA finding 2, MEDIUM)

2026-07-13 13:15:03 +02:00

smart.go

v0.95.0: SMART coverage — union-path drives + LVM/dm root + device model

2026-07-25 08:21:45 +02:00

smartdev_test.go

v0.95.0: SMART coverage — union-path drives + LVM/dm root + device model

2026-07-25 08:21:45 +02:00

smartdev.go

v0.95.0: SMART coverage — union-path drives + LVM/dm root + device model

2026-07-25 08:21:45 +02:00

validate_test.go

controllerswap: stdin tee write + narrow FELHOM_CONTROLLERSWAP grants (non-root, v0.45.0)

2026-06-29 19:42:30 +02:00

validate.go

…

watchdog_test.go

agent v0.27.0: slice 10 P3 — self-heal watchdog reconcile + 4-state intent model

2026-06-12 17:49:25 +02:00

watchdog.go

agent v0.27.0: slice 10 P3 — self-heal watchdog reconcile + 4-state intent model

2026-06-12 17:49:25 +02:00