55 lines
3.9 KiB
Markdown
55 lines
3.9 KiB
Markdown
# REPORT — any backup tier lets an app update, and the release header must state its MinAgent (2026-09-13)
|
||
|
||
*Overwritten each run. This records the most recent implementation only.*
|
||
|
||
> **Shipped as controller v0.239.0 and delivered to both demo guests by the managed floor alone** (hub
|
||
> v0.112.0, declared MinAgent). No hand install. Scenarios G–M are tested; K, H, the failed update and
|
||
> the restore were walked live on demo-hp. Evidence: `felhom.eu/documentation/audits/rulings-r472-r475-2026-09-13/`.
|
||
|
||
## 1. What changed
|
||
|
||
| Commit | What |
|
||
|---|---|
|
||
| `f946b0d` | `controller/scripts/minagent_header_gate.py` (fast, blocking): the newest `## vX.Y.Z` block must hold a line starting `**MinAgent: X.Y.Z**`. Decoy test; registered in GATES, FINGERPRINTS and COVERS. Backfill: v0.233.0–v0.236.0 now read `**MinAgent: 0.129.0** (unchanged)` — v0.232.0's value; zero commits under `internal/agentapi` since 2026-09-01, highest `featureMinAgent` 0.129.0 (R-470). |
|
||
| `b93c154` | v0.239.0 (R-475): `backup.Manager.UpdateRestorePoints` walks Tier 2 → 1 → 3 and returns the first copy the caller accepts; stacks' `freshRestorePoint` is the one age rule; nothing anywhere → back up first; refused only when no copy AND `CanBackUpApp` is false. `RunAppBackupNow` treats a Tier-2 failure as a WARN and marks the captured unit proven current. The hold stores `copy_tier` and names the tier; old holds keep their sentence. A successful off-site restore now clears an update hold. The backups page still calls `Tier2UnitRestorePoint`. |
|
||
|
||
## 2. Tests and red-proofs
|
||
|
||
- Go gate green per commit: `go build ./... && go vet ./... && go test ./...` (28 packages ok).
|
||
- `controller_gates.py --fast` green; `test_controller_gates.py` and `test_gate_decoys.py` green.
|
||
- New tests: `internal/stacks/update_tiers_test.go`, `internal/backup/update_tiers_test.go`,
|
||
`cmd/controller/r475_wiring_test.go`, `scripts/test_minagent_header_gate.py`.
|
||
|
||
| Red-proof | Mutation | Result |
|
||
|---|---|---|
|
||
| F | gate accepts a body mention | the decoy test fails; 4 tests ran |
|
||
| M | age checked only for Tier 2 | 3 M sub-cases fail; 5 RUN lines |
|
||
| L | refuse even with a copy | the L test fails |
|
||
| tail | the proven-current mark misses | fails on the mtime |
|
||
| off-site clear | call removed | the hold stays; test fails |
|
||
|
||
The first run of all four Go red-proofs was inert: the harness ran outside the module (`RUN lines=0`).
|
||
They were rerun from the module folder and each failed as intended.
|
||
|
||
## 3. Live — demo-hp, endpoint-level
|
||
|
||
| Step | Result |
|
||
|---|---|
|
||
| Delivery | floor 0.239.0 + MinAgent 0.129.0 saved 15:19:12Z; demo-hp on 0.239.0 at +14 s, demo-felhom at +15 s |
|
||
| K | throwaway actualbudget, Tier 2 off, unit removed: `found: none — backing up first`, Tier 2 skipped, Tier 1 chosen, done |
|
||
| H | gokapi: `precondition met — Tier 1 (own recovery unit)`, no backup, done |
|
||
| F-shape | never-healthy image: held; text ends „saját meghajtó, 2026-09-13 17:34."; start 409; record `copy_tier: 1` |
|
||
| Restore | `POST /backup/restore` from „helyi": hold CLEARED, gokapi v1.9.6 healthy |
|
||
|
||
A first K attempt did not test K: the deploy had already written a Tier-1 unit, so Tier 1 was
|
||
chosen. It is kept as `04a-…`. The restore script's first read polled a 404 path and stopped early; the
|
||
second read is appended to `08-…`.
|
||
|
||
## 4. Observations
|
||
|
||
1. **The Tier-3 lookup pays its full 15 s bound on demo-hp and logs a misleading WARN about another app's snapshot size.** FILED: R-477
|
||
2. **A leftover recovery unit from a REMOVED install counted as the fresh Tier-1 restore point of a reinstall.** FILED: R-478
|
||
3. **For a bind-data app the Tier-1 unit holds settings only, so the route the hold names does not restore data.** FILED: R-479
|
||
4. **After a successful restore the card keeps the failed update's sentence, which says the running app is stopped.** FILED: R-480
|
||
5. **Removal with `remove_backups` again left both throwaways' recovery units and their backup prefs.** FILED: R-474
|