From 1f4702fe50edbdc7aea76f1bf2b58e467127af4c Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Sat, 18 Jul 2026 21:20:50 +0200 Subject: [PATCH] docs: golden 0.146.0 baked + published (Phase 5); STOP for the operator saves MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Golden 0.146.0 baked on the drill VM and published to gitea: felhom-golden/0.146.0/golden.tar.zst sha256 4834c703162c5437467a329144b1a523019bf5693ab9d439558be7323587e955 612696588 B (584 MB archive), controller 0.146.0 confirmed baked in All pass markers green: Result=success/ExecMainStatus=0, 0 FATAL/exclusions, docker OK (overlay2), ALL THREE mounts included (rootfs + mp0 /var/lib/docker + mp1 /mnt/sys_drive), pre-delete HTTP 404 (the pre-gate — version did not exist), upload HTTP 201. Integrity verified independently of the build host: anonymous GET | sha256sum matches byte-for-byte, ranged GET 206, content-length matches the bake's bytes. The version now appears in the hub dropdown (0.136.0, 0.143.0, 0.146.0). Teardown per GL-1: log copied out as evidence first (180:/mnt/5_hdd/felhom.eu/drill/bake-0.146.0.log), guest 9100 purged, token + script + log shredded in-VM, VM off, qemu confirmed gone via `ps -eo comm` (not the self-matching pgrep -f), drill disk reverted to the virgin snapshot exactly as found. Token-leak grep = 0 against the LITERAL token value, on the bake log and both ISO build logs from this session. REMAINING is operator-only and password-gated: Day-0 manifest Golden -> 0.146.0 (Agent stays 0.90.0, MinAgent stays 0.90.0 — v0.146.0 declares no new agent coupling), then the floor -> v0.146.0 saved LAST. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01Nn3VgQk9iwEGgyx6QJ2NvE --- REPORT.md | 47 ++++++++++++++++++++++++-------- documentation/backlog/ROADMAP.md | 2 +- 2 files changed, 37 insertions(+), 12 deletions(-) diff --git a/REPORT.md b/REPORT.md index d33fd4c..8292e48 100644 --- a/REPORT.md +++ b/REPORT.md @@ -164,16 +164,41 @@ half-done. Note that its (a) auto-mint self-bind link, (b) post-RESET health car unprovisioned-offsite flash correspond to **R-36 / R-37 / R-36** and remain open as written. The conditional Phase-1 hub fix is **not** part of any v0.67.0 train, because its condition was refuted. -## Phase 5 — NOT started (the honest hand-off) +## Phase 5 — golden 0.146.0 baked + published (STOP → Viktor) -The golden bake is a nested-VM procedure (snapshot-revert → cold boot → transient `golden-bake` unit -→ 404 pre-gate → upload → sha verify → teardown → token-leak grep). It is well recorded -(`pilot/RUNBOOK-publish-0.85-0.120-2026-07-12` Phase C) and entirely repeatable, but it is a long -multi-step operation with a revert dance at the end, and this session had already run long. Starting -it and running out mid-way would leave a booted drill VM and a half-published artifact — strictly -worse than a clean stop. It also ends in a **STOP → Viktor** regardless, since the manifest and floor -saves are password-gated clicks. +Run on the nested drill VM on 180, following the recorded Phase-C procedure +(`pilot/RUNBOOK-publish-0.85-0.120-2026-07-12`). -**So: controller v0.146.0 is live on the demo box, but the golden still bakes 0.143.0.** The -pre-invite checklist item "rebuild golden → 0.145.x" is therefore now "rebuild golden → **0.146.0**", -and it is the first thing to pick up next session. +**Artifact:** `felhom-golden/0.146.0/golden.tar.zst` + +| | | +|---|---| +| **GOLDEN_SHA256** | **`4834c703162c5437467a329144b1a523019bf5693ab9d439558be7323587e955`** | +| Size | 612 696 588 B (archive 584 MB) | +| Controller baked in | **0.146.0** (confirmed in the log, not assumed) | + +**Every pass marker green:** unit `Result=success` / `ExecMainStatus=0` · **0** FATAL or exclusions · +`docker OK (overlay2; data-root /var/lib/docker)` · **all three mounts included** — rootfs `/`, +mp0 `/var/lib/docker`, mp1 `/mnt/sys_drive` · pre-delete **HTTP 404** (the pre-gate — the version did +not previously exist) · upload **HTTP 201**. + +**Integrity verified independently of the build host** — anonymous `GET | sha256sum` matches +`4834c703…e955` **byte-for-byte**, ranged GET returns **206**, and `content-length` matches the bytes +the bake reported. The golden now appears in the hub's dropdown alongside 0.136.0 and 0.143.0. + +**Teardown per GL-1 discipline:** bake log copied out first as evidence +(`180:/mnt/5_hdd/felhom.eu/drill/bake-0.146.0.log`), then build guest 9100 `pct destroy --purge` +(0 guests remain), token + script + log `shred -u` in-VM, VM powered off, qemu confirmed gone (via +`ps -eo comm`, not the self-matching `pgrep -f`), drill disk reverted to the `virgin` snapshot +**exactly as found**. **Token-leak grep = 0** against the literal token value, on the bake log and on +both ISO build logs from this session. + +> ### STOP — the two remaining saves are yours (password-gated) +> +> 1. **Day-0 manifest** → Golden **0.146.0** (sha auto-reads as `4834c703…e955`). +> **Agent stays 0.90.0, MinAgent stays 0.90.0** — the v0.146.0 CHANGELOG declares no new agent +> coupling, so nothing justifies moving either. Save. +> 2. **Then** the floor → **v0.146.0**, saved **LAST**. +> +> The traveling box converges over the tunnel — that would be the **second** live floor lift, this +> time from the road. Worth noting in CONTEXT when it lands. diff --git a/documentation/backlog/ROADMAP.md b/documentation/backlog/ROADMAP.md index ab1cc8d..47c5032 100644 --- a/documentation/backlog/ROADMAP.md +++ b/documentation/backlog/ROADMAP.md @@ -87,7 +87,7 @@ Everything here is **remote-doable** — the N100 is packed, and none of it need | Action | Owner | Note | |---|---|---| -| **Rebuild the golden → 0.146.0** (was 0.145.x) | Viktor + CC train | The rehearsal banked the floor-lift evidence (0.143.0→0.145.0 unattended in 5 s), so the mechanism is proven — but a fresh box should not *start* stale and then self-update in front of the customer. **Now more stale, not less:** controller **v0.146.0** shipped and is live on the demo box (2026-07-18), while the golden still bakes **0.143.0**. Procedure is recorded in `pilot/RUNBOOK-publish-0.85-0.120-2026-07-12` Phase C (snapshot-revert → cold boot → transient `golden-bake` unit → 404 pre-gate → upload → sha verify → teardown → token-leak grep), then STOP for the operator's manifest + floor saves (floor LAST). Deferred from the 2026-07-18 pre-travel train rather than half-run | +| ~~Rebuild the golden → 0.146.0~~ **BAKED + PUBLISHED 2026-07-18; awaiting the operator's two saves** | Viktor (saves) | Golden **0.146.0** baked on the drill VM and published to gitea — `felhom-golden/0.146.0/golden.tar.zst`, **sha256 `4834c703162c5437467a329144b1a523019bf5693ab9d439558be7323587e955`**, 612 696 588 B (584 MB archive). All pass markers green: `Result=success`/`ExecMainStatus=0`, **0** FATAL/exclusions, `docker OK (overlay2)`, **all three mounts included** (rootfs + mp0 `/var/lib/docker` + mp1 `/mnt/sys_drive`), pre-delete **404**, upload **HTTP 201**; controller **0.146.0** confirmed baked in. Integrity round-trip independent of the build host: anonymous `GET | sha256sum` **matches byte-for-byte**, ranged GET **206**, `content-length` matches. Teardown per GL-1: guest 9100 purged, token/script/log shredded in-VM, VM powered off, drill disk reverted to `virgin` exactly-as-found, **token-leak grep = 0**. Log retained `180:/mnt/5_hdd/felhom.eu/drill/bake-0.146.0.log`. Now selectable in the hub dropdown (versions: 0.136.0, 0.143.0, **0.146.0**). **REMAINING = operator, password-gated:** Day-0 manifest Golden → 0.146.0 (Agent stays 0.90.0, MinAgent stays 0.90.0 — the v0.146.0 CHANGELOG declares no new agent coupling) → save; **then** floor → v0.146.0 saved **LAST** | | **freemail.hu test-send** | Viktor | The open half of R-4; the gmail half closed on 2026-07-18 under `p=quarantine` | | **C6 — customer performs a restore, unassisted** | Viktor as customer zero | The one open script step in R-3 and still MISSING as capability evidence. Remote-doable on the reborn box — the dashboard is remote | | **R-11 rulings** | Viktor | Contact channel, tester agreement, alert thresholds (the R-5 gauge thresholds are still pending a ruling) |