From 77bccf12121f0b8f582e834362fd2037dce5c4c5 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Mon, 29 Jun 2026 15:08:59 +0200 Subject: [PATCH] =?UTF-8?q?context:=20OPS=20R1=20=E2=80=94=20agent=20local?= =?UTF-8?q?-API=20leaf=20restored,=20controller=E2=86=94agent=20service=20?= =?UTF-8?q?restored=20(no=20code=20change)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01EPZ4GJ8L5Jqf8UiPwbn1kt --- CONTEXT.md | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/CONTEXT.md b/CONTEXT.md index 8a0f3b7..852c4e6 100644 --- a/CONTEXT.md +++ b/CONTEXT.md @@ -7,7 +7,22 @@ > > Ask Claude Code: "Please update CONTEXT.md with what we did today" -Last updated: 2026-06-27 (v0.86.0 — Phase 2 managed updates: floor-driven auto-update) +Last updated: 2026-06-29 (OPS: R1 restore of agent local-API leaf — controller↔agent service restored) + +> **2026-06-29 — OPS (no code change): controller↔agent TLS leaf-pin mismatch RESOLVED via R1.** +> The 2026-06-28 root→non-root agent migration regenerated the agent's local-API leaf +> (`60b5974d…`→`ced34036…`) and truncated its token store, so the in-guest controller's pinned +> `agentapi` client failed every call (`TLS pin mismatch`) — disk UI dead AND the quiesce +> app-consistent-backup loop dead. Fix: restored the pre-migration `local-api.{crt,key}` **+** +> `local-tokens.log` from `/root/agent-backup-bundle-test/aside-var-lib/` on felhom-pve (R1 RUNBOOK, +> supervised). Agent now serves `60b5974d…` again (== controller pin + bootstrap.json seed) and the +> restored token store's 9201 entry matches the controller's current `local_api.token` — **zero +> in-guest change.** Gates passed: leaf loaded (not regenerated), wire fp `60b5974d…`, authenticated +> `GET /disks` 200/5-disks (bogus token 401), and the next quiesce cycle ran a real backup job. +> Rollback point kept at `/root/agent-rollback-20260629-150137/`. **OPEN (carried forward):** the +> migration/Day-0 path must carry these three files into the new `felhom-agent`-owned data dir (or +> treat their loss as a re-bootstrap trigger), else any re-migration reintroduces this. Full record: +> `felhom.eu/documentation/audits/SPIKE-agent-pin-mismatch-2026-06-29.md` (§9 Outcome). > **2026-06-27 — v0.86.0 (deployed on 9201): Phase 2 managed updates — controller-version FLOOR.** > On top of the Phase 1 opt-in "update to latest" button, the controller now honors an operator-enforced