admin/felhom-controller
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v0.352.0 released: global floor 0.352.0 / MinAgent 0.158.1 after rc.1 on 9202 and walk green on three boxes
gates / gates (push) Successful in 35s
Details

Browse Source 
Notes only: CHANGELOG heading and box proof, REPORT, CONTEXT. No code change.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
This commit is contained in:
admin committed 2026-11-10 16:37:30 +01:00
1 parent 3dbb68c163
commit a9189c9dc4
3 files changed
+35 -22
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

CHANGELOG.md
+11 -3
View File
@@ -1,4 +1,4 @@
## v0.352.0 (unreleased, 2026-11-10) — R-1371: one fill warning per filesystem
## v0.352.0 (2026-11-10) — R-1371: one fill warning per filesystem — RELEASED (image `sha256:3c785dd3…`, from `3dbb68c1`, CI 2615; rc.1 on scratch guest 9202); per-box floors 15:16 UTC, global floor 2026-11-10 15:31 UTC (MinAgent 0.158.1)
### 2026-11-10
@@ -28,8 +28,16 @@ file Docker keeps on its data-root and bind-mounts into the container (`/etc/hos
**Red seen three times:** no filesystem check (2 warnings); the production list not wired to the real identity; an
overlay keeping its own device number.
**Not proven.** A running controller with this code on a box (commit only). **Not fixed here:** the guest's own root
disk (`/opt/docker/stacks` lies on it) has no fill watcher — a design point in felhom.eu `16-storage-physical-identity.md`.
**Proven on boxes, 2026-11-10** (felhom.eu `documentation/audits/release-space-fixes-2026-11-10/controller/`).
Scratch guest 9202, filled past the warning line with one test file: the version before this one sent TWO warnings for
the one fill (two names); `0.352.0-rc.1` sent ONE, and cleared it silently when the file was gone. Tester 1, demo-hp and
demo-felhom took the release through per-box floors: each now checks 2 filesystems where it checked 3, all containers
healthy, the box walk and the https-only check green. Then the global floor, in its own save. **Correction to the
sentence above („Not seen on a box"):** it is now seen on a box, as two warnings on 9202.
**Not proven.** A real fill on a household's box. The critical step (95 %) on a box; a test covers it.
**Not fixed here:** the guest's own root disk (`/opt/docker/stacks` lies on it) has no fill watcher — a design point in
felhom.eu `16-storage-physical-identity.md`.
## v0.351.0 (2026-11-09) — old test builds and old infrastructure images are deleted (decision 56 amended, decision 285) — RELEASED (image `sha256:1d90563c…`, from `27360d6a`, CI 2603; rc.1 on Tester 1 by hand); per-box floors 12:14 UTC, global floor 2026-11-09 12:18 UTC on the operator's yes (MinAgent 0.158.1)
CONTEXT.md
+6 -4
View File
@@ -1,9 +1,11 @@
# CONTEXT.md — Project Memory
> **2026-11-10 (day, operator brief) — COMMITTED, NOT RELEASED: one fill warning per filesystem (felhom.eu R-1371).**
> `fillTargets` keeps one target per filesystem (`system.FilesystemKey`; an overlay "/" is identified by a Docker-kept
> file's device, not by its own). No version, no image, no floor: it rides the next controller release. Still open, by
> design question: the guest's own root disk has no fill watcher (felhom.eu `16-storage-physical-identity.md`).
> **2026-11-10 (afternoon, attended) — v0.352.0 RELEASED: one fill warning per filesystem (felhom.eu R-1371).**
> Global floor 15:31 UTC, MinAgent 0.158.1; rc.1 on scratch guest 9202, then the three test boxes through per-box
> floors, walk green (felhom.eu `audits/release-space-fixes-2026-11-10/controller/`). `fillTargets` keeps one target per
> filesystem (`system.FilesystemKey`; an overlay "/" is identified by a Docker-kept file's device, not by its own).
> Seen on 9202: two warnings for one fill before, one after. Still open, by design question: the guest's own root disk
> has no fill watcher (felhom.eu `16-storage-physical-identity.md`).
> **2026-11-09 (attended) — v0.351.0 RELEASED** (global floor 12:18 UTC, MinAgent 0.158.1; rc.1 on Tester 1, then the
> three test boxes through per-box floors, walk green; felhom.eu `audits/release-2026-11-09/`). Operator's word 2026-11-09 („go with A"): decision 56 amended
REPORT.md
+18 -15
View File
@@ -1,24 +1,27 @@
# REPORT — one fill warning per filesystem (R-1371) — committed, NOT released (2026-11-10, operator brief)
# REPORT — v0.352.0 released: one fill warning per filesystem (R-1371) (2026-11-10, attended release run)
**Plain words first.** The controller watches how full the disks are. On a box with one data volume it watched that
volume twice, under two names. One full disk would have sent two warnings. The controller now watches each filesystem
once. This is a commit only. No version, no image, no floor change. No box has it. It waits for the next release.
volume twice, under two names. One full disk sent two warnings. Version 0.352.0 watches each filesystem once. It is
released: the global floor is 0.352.0 since 2026-11-10 15:31 UTC. Every box takes it by itself.
The full report of the run is in `felhom.eu`: `REPORT-endings-kernels-fixes-2026-11-10.md`.
The full report of the run is in `felhom.eu`: `REPORT-release-space-fixes-2026-11-10.md`.
| | |
|---|---|
| Change | `fillTargets` / `fillTargetsBy` in `controller/cmd/controller/main.go`; `system.FilesystemKey` (new, `controller/internal/system/fskey*.go`) |
| Rule | One watch target per filesystem. The first stays: app area, then system area, then drives. A path that cannot be identified is kept |
| The trap | Inside the container "/" is an overlay. It has its own device number (139 against 64519 on demo-hp). A plain device compare changes nothing on a box. The key of an overlay path is the device of a file Docker keeps on its data volume (`/etc/hostname`, `/etc/hosts`, `/etc/resolv.conf`) |
| Measured | Read-only, 2026-11-10, demo-hp guests 9201 and 9202 and the N100: felhom.eu `documentation/audits/space-list-2026-11-10/evidence/extra/fs-identity.txt` |
| Tests | `TestR1371_OneFillSendsOneWarning`, `TestR1371_TargetsByFilesystem`, `TestR1371_ProductionListUsesTheRealIdentity`, `TestFilesystemKey_AnOverlayRootIsTheDockerDataRoot`, `TestFilesystemKey_RealSyscalls` |
| Red seen | 3 times: no filesystem check (2 warnings); the production list not wired to the real identity; an overlay keeping its own device number |
| Gates | `python3 scripts/controller_gates.py --fast` |
| Not proven | On a box. No disk was filled, so two real warnings were never seen; the double count is read from the target list and the measured filesystems |
| Version | 0.352.0, MinAgent 0.158.1 (unchanged) |
| Image | `gitea.dooplex.hu/admin/felhom-controller:0.352.0`, `sha256:3c785dd396b091f19d4c777db9d7a206e75ab018b6238b5d887e1a4c6cfd3b29`, built from `3dbb68c1` |
| CI | run 2615, `gates #558`, success, read by commit before the build |
| Change | `fillTargets` / `fillTargetsBy` in `controller/cmd/controller/main.go`; `system.FilesystemKey` (`controller/internal/system/fskey*.go`). No code change since `844f19f1` |
| Red on a box | Scratch guest 9202 on the version before, filled past the warning line with one test file: TWO warnings, two names |
| Green on a box | 9202 on `0.352.0-rc.1`, the same fill: ONE warning. The file removed: cleared silently, armed again |
| Test boxes | Tester 1, demo-hp, demo-felhom through per-box floors (15:16 UTC). Each moved in under 15 seconds. Each checks 2 filesystems where it checked 3. Containers 10 / 26 / 9, none unhealthy. The box walk and the https-only check: green |
| Global floor | 15:31:34 UTC, in its own save, MinAgent declared. The hub read back `Effective floor: v0.352.0` |
| After the floor | The 30-minute watch and the clearing of the per-box floors are in the felhom.eu report, with the evidence |
| Evidence | felhom.eu `documentation/audits/release-space-fixes-2026-11-10/controller/` |
| Not proven | A real fill on a household's box. The critical step (95 %) on a box; a test covers it |
| Not fixed here | The guest's own root disk (`/opt/docker/stacks` lies on it) has no fill watcher. It is a design point in felhom.eu `16-storage-physical-identity.md` |
| Side effect | A registered drive that lies on the same filesystem as a built-in area is now watched under the area's name |
| Machines | None changed by this commit. The measurement was read-only |
| Machines | 9202: one test file written and removed; it now runs the release. The three test boxes: updated by the normal path. No household box touched by hand |
**Next.** A release session builds it. Then read the watch list in the controller's log on a one-volume box: it must
name the data volume once.
**Correction.** The earlier report of this change said two real warnings were never seen. They are now seen, on 9202,
on the version before this one.