admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: REPORT + spike-doc status for host-install v1.6.0 (pool-scoped ACL, live-migrated)

Browse Source 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
authentik Default Admin
2026-07-01 13:02:16 +02:00
parent 741f322d6a
commit 1be1e0d6a3
2 changed files with 62 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files
documentation/audits/SPIKE-pool-scoped-acl-2026-07-01.md
+7
View File
@@ -1,5 +1,12 @@
# SPIKE — pool-scoped ACL for the FelhomAgent token (2026-07-01)
> **STATUS: IMPLEMENTED** in agent **v0.53.0** (`RestoreLXCOptions.Pool` / `reconcile.DefaultPool`, both
> restore sites) + host-install script **v1.6.0** (3-role scoped ACL, `--rescope-acl`, uninstall
> cleanup). The demo host felhom-pve was live-migrated (agent stopped → `--rescope-acl` → agent v0.53.0
> → start) and ALL residual gates passed under the scoped token: **PBS backup+restore (residual #1)**
> and **restore-test into pool (residual #2)** both succeed; blast-radius 403 confirmed on out-of-pool
> guests + ungranted storage. See the felhom.eu + felhom-agent REPORTs.
**Class:** SPIKE (empirical validation; no product code). **Repos read:** felhom-agent `33e3443` (v0.52.0,
read-only). **Host:** felhom-pve (192.168.0.162, node `demo-felhom`, PVE 9.2.2, **single-node**).
**Verdict: PASS** — the agent's 16 privileges CAN be scoped from `/` to `/pool/felhom` +