docs: controller-swap narrow-grant Option A IMPLEMENTED (agent v0.45.0) — spike + multidrive pointers resolved

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EPZ4GJ8L5Jqf8UiPwbn1kt

documentation/audits/SPIKE-controllerswap-narrow-grants-2026-06-29.md

@@ -118,3 +118,14 @@ spike):
 /etc/sudoers` parses OK; remaining drop-ins `felhom-agent`, `README`, `zfs`; the real
 `felhom-agent` grant is untouched (lxc-info grant still present). No secrets recorded (the image ref
 is not a secret; no tokens were handled).
+
+---
+
+## IMPLEMENTED 2026-06-29 — felhom-agent v0.45.0
+
+Option A shipped per this spike's GO. `writeImage` now pipes the image on stdin into an in-guest
+`tee` (no `bash -c`); the 5 narrow grants live in the `FELHOM_CONTROLLERSWAP` sudoers alias + the
+capability manifest (Critical). Live: agent reports `capabilities self-check ok=45/45`; all 5 grants
+match (`sudo -n -l` exit 0) and the negative controls (`bash -c`, `tee /etc/passwd`, `docker rm -f`,
+`rm -rf`) are denied on the live host. **Live swap (Scenario D) awaiting supervised run** (restarts the
+controller). See `felhom-agent/REPORT.md` + CHANGELOG v0.45.0.

documentation/audits/SPIKE-multidrive-mutual-exclusion-2026-06-29.md

@@ -201,9 +201,13 @@ reports `bound_under_parent=true` for **both** felhom-usb + felhom-flash; the co
 zero `drive ABSENT` after); the real UI (`/settings`) shows **both drives Aktív concurrently**. Symptom
 gone.
 
-**Surfaced, NOT fixed (operator decision):** `GuestExec`'s general `pct exec <vmid> -- …`
-(controller-swap / managed auto-update) needs arbitrary root-in-guest — **not granted; controller-swap
-is broken under the non-root agent** until a narrow trust path is decided. **Deferred:** `sensors -j`
+**Surfaced, then RESOLVED (2026-06-29, agent v0.45.0):** `GuestExec`'s general `pct exec <vmid> -- …`
+(controller-swap / managed auto-update) needed arbitrary root-in-guest. Rather than grant it,
+controller-swap's only shell vector (`writeImage`'s `bash -c "printf … >"`) was replaced by a
+stdin-fed `tee`, making all 5 swap vectors fixed/read-only and allowlistable as `FELHOM_CONTROLLERSWAP`
+(no `bash -c`, no general `pct exec`). Spike-proven (`SPIKE-controllerswap-narrow-grants-2026-06-29.md`)
++ shipped; controller-swap works under the non-root agent again (live: 45/45 capability ok, negative
+controls denied). **Deferred:** `sensors -j`
 (no caller + lm-sensors not installed). **Left as-is:** the §4 host-side doubling (re-isolating the
 live parent would orphan the working guest slave — fixed grant takes effect on the next clean host
 boot). The §7 "guest_attached / pct config" note is **resolved**: `GuestConfig` is a Proxmox **API**