admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: golden 0.146.0 baked + published (Phase 5); STOP for the operator saves

Browse Source 
Golden 0.146.0 baked on the drill VM and published to gitea:
  felhom-golden/0.146.0/golden.tar.zst
  sha256 4834c703162c5437467a329144b1a523019bf5693ab9d439558be7323587e955
  612696588 B (584 MB archive), controller 0.146.0 confirmed baked in

All pass markers green: Result=success/ExecMainStatus=0, 0 FATAL/exclusions,
docker OK (overlay2), ALL THREE mounts included (rootfs + mp0 /var/lib/docker +
mp1 /mnt/sys_drive), pre-delete HTTP 404 (the pre-gate — version did not exist),
upload HTTP 201.

Integrity verified independently of the build host: anonymous GET | sha256sum
matches byte-for-byte, ranged GET 206, content-length matches the bake's bytes.
The version now appears in the hub dropdown (0.136.0, 0.143.0, 0.146.0).

Teardown per GL-1: log copied out as evidence first
(180:/mnt/5_hdd/felhom.eu/drill/bake-0.146.0.log), guest 9100 purged, token +
script + log shredded in-VM, VM off, qemu confirmed gone via `ps -eo comm` (not
the self-matching pgrep -f), drill disk reverted to the virgin snapshot exactly
as found. Token-leak grep = 0 against the LITERAL token value, on the bake log
and both ISO build logs from this session.

REMAINING is operator-only and password-gated: Day-0 manifest Golden -> 0.146.0
(Agent stays 0.90.0, MinAgent stays 0.90.0 — v0.146.0 declares no new agent
coupling), then the floor -> v0.146.0 saved LAST.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nn3VgQk9iwEGgyx6QJ2NvE
This commit is contained in:
authentik Default Admin
2026-07-18 21:20:50 +02:00
parent b14b5a65d9
commit 1f4702fe50
2 changed files with 37 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
REPORT.md
+36 -11
View File
@@ -164,16 +164,41 @@ half-done. Note that its (a) auto-mint self-bind link, (b) post-RESET health car
unprovisioned-offsite flash correspond to **R-36 / R-37 / R-36** and remain open as written. The
conditional Phase-1 hub fix is **not** part of any v0.67.0 train, because its condition was refuted.
## Phase 5 — NOT started (the honest hand-off)
## Phase 5 — golden 0.146.0 baked + published (STOP → Viktor)
The golden bake is a nested-VM procedure (snapshot-revert → cold boot → transient `golden-bake` unit
→ 404 pre-gate → upload → sha verify → teardown → token-leak grep). It is well recorded
(`pilot/RUNBOOK-publish-0.85-0.120-2026-07-12` Phase C) and entirely repeatable, but it is a long
multi-step operation with a revert dance at the end, and this session had already run long. Starting
it and running out mid-way would leave a booted drill VM and a half-published artifact — strictly
worse than a clean stop. It also ends in a **STOP → Viktor** regardless, since the manifest and floor
saves are password-gated clicks.
Run on the nested drill VM on 180, following the recorded Phase-C procedure
(`pilot/RUNBOOK-publish-0.85-0.120-2026-07-12`).
**So: controller v0.146.0 is live on the demo box, but the golden still bakes 0.143.0.** The
pre-invite checklist item "rebuild golden → 0.145.x" is therefore now "rebuild golden → **0.146.0**",
and it is the first thing to pick up next session.
**Artifact:** `felhom-golden/0.146.0/golden.tar.zst`
| | |
|---|---|
| **GOLDEN_SHA256** | **`4834c703162c5437467a329144b1a523019bf5693ab9d439558be7323587e955`** |
| Size | 612 696 588 B (archive 584 MB) |
| Controller baked in | **0.146.0** (confirmed in the log, not assumed) |
**Every pass marker green:** unit `Result=success` / `ExecMainStatus=0` · **0** FATAL or exclusions ·
`docker OK (overlay2; data-root /var/lib/docker)` · **all three mounts included** — rootfs `/`,
mp0 `/var/lib/docker`, mp1 `/mnt/sys_drive` · pre-delete **HTTP 404** (the pre-gate — the version did
not previously exist) · upload **HTTP 201**.
**Integrity verified independently of the build host** — anonymous `GET | sha256sum` matches
`4834c703…e955` **byte-for-byte**, ranged GET returns **206**, and `content-length` matches the bytes
the bake reported. The golden now appears in the hub's dropdown alongside 0.136.0 and 0.143.0.
**Teardown per GL-1 discipline:** bake log copied out first as evidence
(`180:/mnt/5_hdd/felhom.eu/drill/bake-0.146.0.log`), then build guest 9100 `pct destroy --purge`
(0 guests remain), token + script + log `shred -u` in-VM, VM powered off, qemu confirmed gone (via
`ps -eo comm`, not the self-matching `pgrep -f`), drill disk reverted to the `virgin` snapshot
**exactly as found**. **Token-leak grep = 0** against the literal token value, on the bake log and on
both ISO build logs from this session.
> ### STOP — the two remaining saves are yours (password-gated)
>
> 1. **Day-0 manifest** → Golden **0.146.0** (sha auto-reads as `4834c703…e955`).
> **Agent stays 0.90.0, MinAgent stays 0.90.0** — the v0.146.0 CHANGELOG declares no new agent
> coupling, so nothing justifies moving either. Save.
> 2. **Then** the floor → **v0.146.0**, saved **LAST**.
>
> The traveling box converges over the tunnel — that would be the **second** live floor lift, this
> time from the road. Worth noting in CONTEXT when it lands.
documentation/backlog/ROADMAP.md
+1 -1
View File
@@ -87,7 +87,7 @@ Everything here is **remote-doable** — the N100 is packed, and none of it need
| Action | Owner | Note |
|---|---|---|
| **Rebuild the golden → 0.146.0** (was 0.145.x) | Viktor + CC train | The rehearsal banked the floor-lift evidence (0.143.0→0.145.0 unattended in 5 s), so the mechanism is proven — but a fresh box should not *start* stale and then self-update in front of the customer. **Now more stale, not less:** controller **v0.146.0** shipped and is live on the demo box (2026-07-18), while the golden still bakes **0.143.0**. Procedure is recorded in `pilot/RUNBOOK-publish-0.85-0.120-2026-07-12` Phase C (snapshot-revert → cold boot → transient `golden-bake` unit → 404 pre-gate → upload → sha verify → teardown → token-leak grep), then STOP for the operator's manifest + floor saves (floor LAST). Deferred from the 2026-07-18 pre-travel train rather than half-run |
| ~~Rebuild the golden → 0.146.0~~ **BAKED + PUBLISHED 2026-07-18; awaiting the operator's two saves** | Viktor (saves) | Golden **0.146.0** baked on the drill VM and published to gitea — `felhom-golden/0.146.0/golden.tar.zst`, **sha256 `4834c703162c5437467a329144b1a523019bf5693ab9d439558be7323587e955`**, 612 696 588 B (584 MB archive). All pass markers green: `Result=success`/`ExecMainStatus=0`, **0** FATAL/exclusions, `docker OK (overlay2)`, **all three mounts included** (rootfs + mp0 `/var/lib/docker` + mp1 `/mnt/sys_drive`), pre-delete **404**, upload **HTTP 201**; controller **0.146.0** confirmed baked in. Integrity round-trip independent of the build host: anonymous `GET | sha256sum` **matches byte-for-byte**, ranged GET **206**, `content-length` matches. Teardown per GL-1: guest 9100 purged, token/script/log shredded in-VM, VM powered off, drill disk reverted to `virgin` exactly-as-found, **token-leak grep = 0**. Log retained `180:/mnt/5_hdd/felhom.eu/drill/bake-0.146.0.log`. Now selectable in the hub dropdown (versions: 0.136.0, 0.143.0, **0.146.0**). **REMAINING = operator, password-gated:** Day-0 manifest Golden → 0.146.0 (Agent stays 0.90.0, MinAgent stays 0.90.0 — the v0.146.0 CHANGELOG declares no new agent coupling) → save; **then** floor → v0.146.0 saved **LAST** |
| **freemail.hu test-send** | Viktor | The open half of R-4; the gmail half closed on 2026-07-18 under `p=quarantine` |
| **C6 — customer performs a restore, unassisted** | Viktor as customer zero | The one open script step in R-3 and still MISSING as capability evidence. Remote-doable on the reborn box — the dashboard is remote |
| **R-11 rulings** | Viktor | Contact channel, tester agreement, alert thresholds (the R-5 gauge thresholds are still pending a ruling) |