From 6cc875cc3647d537dd4f5caeceff2bdbefc09517 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Thu, 23 Jul 2026 20:46:27 +0200 Subject: [PATCH] =?UTF-8?q?drill:=20R-63=20=C5=91/=C5=B1=20captured=20live?= =?UTF-8?q?=20on=20the=20KVM=20HP=20(+=20pairing=20+=20rootpw);=20HP=20SVM?= =?UTF-8?q?-enable=20fix;=20evidence=20PNG?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01NKSN3gSg4TKVBBqkwW2djR --- REPORT.md | 36 ++++++++++++++++-- .../R-63-console-font-drill-2026-07-23.png | Bin 0 -> 4853 bytes 2 files changed, 32 insertions(+), 4 deletions(-) create mode 100644 documentation/audits/R-63-console-font-drill-2026-07-23.png diff --git a/REPORT.md b/REPORT.md index ce70267..32c6451 100644 --- a/REPORT.md +++ b/REPORT.md @@ -12,11 +12,11 @@ hub **v0.72.0→v0.73.0**. Commits: `b620435` (scripts code), hub `0.73.0` train | **7 — hub `offsite_stale` newborn anchor** | ✅ SHIPPED + deployed (hub v0.73.0, Synced/Healthy); red-proofed; live: demo-hp/demo-felhom silent | | **1 — OOB belt (F9)** | ✅ code (default appliance leg) + **LIVE on BOTH boxes** + **login PROVEN on felhom-pve** | | **2 — apt no-subscription** | ✅ code + **LIVE aligned on both boxes** (`apt-get update` clean) | -| **3 — R-63 console font** | ✅ code (Lat2 font, verified font names) — nested-render proof pending the drill | +| **3 — R-63 console font** | ✅ code + **live ő/ű capture on the HP drill** (képernyő/teendő correct) | | **4 — R-71 build-gate + rule** | ✅ code + red-proofed + **LIVE-demonstrated blocking the real gap**; standing rule 5 added | | **4 — golden republish** | ✅ **built + published + vouched** — golden **0.161.0** (sha `77624408…`), floor stays 0.156.0; the LIVE gap is CLOSED | | **5 — ISO v1.25.0 build** | ✅ **built** (`…v1.25.0-nested-vm-generic-mkimage.iso`, sha `99b38420…`); gate passed live; rootpw+R-63 present | -| **5 — nested drill** | ⚠️ ABORTED on N100 (install pathologically slow, contended by live guest 9201); R-63 code-verified, live visual → HP drill | +| **5 — nested drill** | ✅ **RUN on the HP** (KVM after SVM-enable): R-63 ő/ű **captured**, pairing registered, rootpw opens console; belt/apt fresh-install needs a bind | | **6 — felhom-pve root vault** | ✅ rotated + vaulted + **verified authenticating over :22** | ## CRITICAL FINDING — the R-71 gap was LIVE, now CLOSED @@ -63,7 +63,7 @@ enterprise+ceph disabled, no-subscription added, `apt-get update` exit 0 on both **Part 3 (R-63).** felhom-bootstrap loads a Latin-2 console font (`Lat2-Terminus16` → `Lat2-Fixed16` → `Lat2-Terminus14`) once before the first paint (idempotent, best-effort, never blocks boot). Font names verified present in the trixie console-setup package. Renders ő/ű in the R-59 network screen -(élő/telepítő/ellenőrizze) + pairing banner (képernyő/teendő). Nested-console capture pending drill. +(élő/telepítő/ellenőrizze) + pairing banner (képernyő/teendő). LIVE-captured on the HP drill (see the drill section + R-63 evidence PNG). **Part 4 (build-gate + rule).** `assert_golden_ge_floor` + `ver_ge` in build-felhom-iso; runs before workspace/mint; `die`s with both versions on `golden < floor`; `FELHOM_ASSERT_GOLDEN/FLOOR` inputs; @@ -79,7 +79,35 @@ shredded. felhom-pve now has G1 vault parity with demo-hp. (Note: the vault's `s original day-0 stamp — not bumped on rotation; cosmetic, the SECRET is the rotated one, proven by the auth test.) -## Nested drill — attempted, ABORTED, deferred to an HP-based run +## Nested drill — RUN on the HP (2026-07-23) + +The N100 attempt was aborted (install crawled, contended by live guest 9201). Per the operator's +steer the drill moved to the HP (demo-hp). Blocker found + fixed: the HP had **AMD SVM disabled in +BIOS** (`SVM disabled (by BIOS) in MSR_VM_CR`) so KVM was unavailable — the operator enabled +**Security → System Security → Virtualization Technology = Enable**; on reboot `/dev/kvm` appeared +(`kvm_amd` auto-loads via the persisted `/etc/modules-load.d/felhom-kvm.conf`) and the live guest +9201 auto-recovered. + +The KVM-accelerated install reached first-boot in **~12 min** (vs the N100's 40+ that never +finished) and PROVED, live: +- **R-63 — ő/ű console capture**: the first-boot pairing banner renders „képernyő"/„teendő" with + correct double-acute ő under the Lat2 font (evidence: `documentation/audits/R-63-console-font-drill-2026-07-23.png`). + This is the spec's R-63 closure evidence. +- **v1.25.0 pairing chain**: the box self-registered as an unclaimed appliance (hub log + `appliance registered: new unclaimed box uuid=206c8838…`). +- **R-61 rootpw regression**: the build's `.rootpw.txt` opens the installed console (`ROOTPW-OK: + felhom-host`). +- Bonus: `apt-get install sshpass` succeeded on demo-hp — confirms the Part-2 no-subscription + alignment works for real installs, not just `update`. + +Still requiring an operator **bind** (password-gated) to exercise on the ISO-driven fresh install: +the belt-default + apt legs *inside host-install* and the golden-0.161.0 pull (host-install only +runs after a box is bound). Those legs are already proven live on both real boxes this session, and +the no-floor-update outcome is structurally guaranteed post-vouch (golden 0.161 ≥ floor 0.156). The +unclaimed drill box (uuid 206c8838) can be bound to a throwaway customer to close that last leg, or +discarded. + +## Nested drill — (earlier N100 attempt, superseded) Golden republish + vouch + the v1.25.0 ISO build are DONE. The nested drill was attempted on the N100 (felhom-pve): 1.7 GB ISO transferred + sha-verified, VM 9313 created (OVMF SB-off for the diff --git a/documentation/audits/R-63-console-font-drill-2026-07-23.png b/documentation/audits/R-63-console-font-drill-2026-07-23.png new file mode 100644 index 0000000000000000000000000000000000000000..50e2a4988c40de41465a8108e3af3a9bbbd683a0 GIT binary patch literal 4853 zcmbtXcU)83vfd#;M1+VOK%|L+s8j_4Qgc9*awrEydO{KD1nEM6fJzYoQJPY{h^X`$ zh(Lm<9O)nsY6wUVkx&w9;N`yGz25uY``y3Z{$tOq+54NdX3y+z)=IQ6yUBC>%y9q! zc#I6MTLJ(FO9h{0W8DFM{e(D{IO}R?X$k=07XSeB2mtn2Cd?851Sp zyC5A3;-$~8aV*(KnSSB|uVR}bcYUdeY@(I=rz?NZ19#oy^O+2jMAT+j#yg6NR-$WI zPRTruWP)sUgyM$prWS6?fmVuAYIV(8npa%+jx@)P-fWvTAhPz4_T%5YQ?$yQUi;Gr zC5P9pGI3nQ#`~}P`apA@Uq_BKctsTYNw=+8D;DXzJ;GC?4Ou9tS_D&Z`zI)l31l(7 zn*0`xwQa7|MR+vPPnf0`nBK+GC%6`)iKab*6?~#UUmoxzM%+Xhpw%zZc z{SP<7>@nXRwh3;sE%l=BY9(+{V{Ak9@^Hr^8SueQ6?_9xH4fJ2@<%}@p%!`)g>w(p zgR-W?PwxR#r=uhgLQ(qJKB!@vAUVak)U^l1D|5VaZ@;pqDuqiveB%UpuSjX=TuWiRt1YmaC|3Ah_}2RxHzkr;R@t?Al&X0+LZWl?kptDW zKnKQ~ID;GFUILz`_9bfUZ0ODgqub)G#AUE(pa`iEZA=@%Po8OX%{zTFp4Zt9_VeF|iqwA*cYswaXib4bH(|6+vxL)mgcg-&=c%SF`w7KqLxBV+L#AW zm7>ULm~Z=yG9{TCu517eoi{3mhX`3fwZh0y+I+ zmGdG_;MMYqE{siiIhD7^?oK*TkIMP$3ohCrQ-aN*G}6__eCTA>=v~{ijVcOs%221S zBNP2s$94CVdO@e3@_Ap!7}e;D_%YJXy?ENhM&QQJ>sVt94m(zzgVqY?qPc(&X!P!e zYYCrWAhnuw356G5=x?4_CA*JnaCn6ew|`cmhQgOGrss=c&z)*M^I6 zm+^x}mk>GM^}%wr5l@LD_9w+2(D`>LbHnE3$`{tUpnt~Cl2HYohb_95y`2AMBM;ZH zds>H>FP9m(w!|sU&xY@226gG3B|y+(XItm#G4$=lVN`PMh)SL9lZ7iv!&7SGxi)KV z0o8Uvb=^6S6}LcUn+Qy0R2+UXV5gU&-Jg_viu{l>C$<5qbe-)$5iN0cEe2Ur>pKW0 zf<-G|4D*P;$a~BW(s|gvZN$DKdYKmtV31GwvIqrVB~P$cMpk`mCDHbwG**@p@W!*7 z2_c$v%~# z<6Zc%2)U=5cTMyvf|e$d0~I7&eRg44I*-G5?-_id=c8_-EVC`AZ}ta0HVoe8uMU4T z`^8va4zzGN2SHFlcqPwPIUsQJ5Sdc5%mSQwk0ZvjDZg2%5%MmhY9ENC+|N8y=(v_C zkz2NREL=$*p6qoze8&r^hrGp>yWwoN*ATv@S8266|D`CmP_V2F*XRo#GUyUNUAN$W z$qu|GrZb!0`oQF3K*NXmru9yn9nhJ7bF zcv^?De6AQdqCvRSve$HIOsaGfaQeyh4t=l9Gs+#>+|lkGxnHMC)_}K|VL~$iZ(?1K z_|E!kV%9W!BT9yFs7?D3KH%1cVw;q49>%WWbhs%JgHfl1`J)Yw*k6$URhj0syN+9( zQ)|<4IcGk*abl~xC2qZi89fNr8o)kCWmli%@*iclaZk8rkJ&Yt4%Q{q_$W8^zGQ3m zFtW@`_28Y^v|C`$-RQx!hG2c4U(CE1J%^cqkvQkf4%D%}?&pbZp#G z;5lmj5pMH3%B?q~=4_`rC7UOokK|ZvokQ76P)Fx}zzA-5qciag?yX%mZ;Xb>2#iq2 z+mBT@#|TC4>QrZEc`AtY(Uqe5oQ)9598F_jnVcA!ZkmP8gPlkY#OhTO4J{;bo{8)*J}f%2-?rP^1m^(X&2zK;&omY z27gTxhK-G*Qg{N9@=^(RM5~{itG#oqdPIlBA<?{;O_jWw55|tw^@^ zeq6kL9v?+gJuAxgPrKB%8HSx`Z-3LIQE2&5h1!UKe!0rv9?y-j#B%PcseRhr#qkl1 z<^~^>W?(+k+*P*dd8Z8-JJtbY@!?yCG(BAwDWJP} z#;K8qCi-Iz*J`WrllYZm`-glWvP_3Cz$xy>fNMI%7k;r{A+Of1##|X9#XLanX%L(s z3>bVZoHV_!0y2Kr0*)4U((=W;Nae|&u(d&-SXWIIY#?FA_4~m!`LW^orqXaR<=lO0 zUsTv)E$tc!Onl?u8PRu*Q50>^DZq9h{4I-`N`7&0?F6~ZC3MBGDMQg0+a&**B31Wo zQ>x59=&L`kBgSo~+w|6ODw|f9;qxeH^Y-6dr#*}@vc)Z^S0<%MVcD|s*u(dq++}Oh zOxoOew*=vdtcrwMhjjD} zowkA*Rl?9$&>Dw&F9qnB^qDVztO_qcvYNX&?STzWFl+GZU>|t2k_v8iEb&cz@cBMX zP+v@Re}%Xm&8-vyGFD5Tismm&ze6SSAWDu~=!rlMu461o!qn&LQWSL182kGX=cB5Zf3o<`WXIqb?HV##yP{`1 zqHBKGTm%3_3mC>b$iwD6ItbG7-!0}>vHe3Ke7iDwa_77HqrY=fbDV&|$GmNoip#J! zex_&I&4$wgro8yp{?6)s;_X_(hF3H}cGQ`= zM}_nopETf?;yro#p(xq7-!a9V2`s-&-R4|Xl^OxM1j$|JNRMzq#_=|3xF*)G_tSSP zs7*9f^cFH$%KFsHFMi%FeB~Es*JA9<=V+kAZX9o1^WO47@WzS^jrgs!;Mcb$sJ*2$ zpbD1OHUt(`4XDx2T%6_xbk%HR4xHFne?jKcj5{6t(7eOzNf%x*UaE zhT4QX@sZU=BKONmlG3AWDL~2A%Hp2v1AL|xrb(u7P~oPAKRr*ICJwEnQ@F0nr@}+$(2PL?i=0x<3N(hzrGv) zYq3CY??UK+Y$!fj1h>mktWcY1-g$7v&Fe+Fbq9ZB&bA?@Jr9UC#RSJ?*K%Ydw;Z>@ za$T?&l-x@MlXUeJ^!31F1;nc|!`9t$ortmmAYI<8Vb58Zvvm9;z8sTI5tX`K1Fm)hV zA8RrqFPOW#Z*s=zz?b)UNvknA!W?dN4+vJGaFW~N?wYp0auN9(+mJ9wMibfEffmo} zvfa^U%@)2u_XrLlxb=tzC8>;yzsK$ib1>x`#Hl;8LfDYMz|f7IBC$4IF52r3oeSEx z*QUnL>qhwiJITiOPv+7-g=h{BpEBm)6Ee4{o$;0@y#D&#Kq`lD%)fL3y!Kfi6Y4op zK;*jQnr=Mx%u-&;A^7aytbbd^Vg_DG78~Is2dSlx+1EKMo&Mf%w5tYRNiwd5{G71c z^O97Bdvk9^v)h<95jt`8m6d|0u44z?b$;E5@r{hMnCs&@@K--$Ox}FS%pWww3XZ_=P=gn~5%+QwViql@jX(K45PBR}z z43!iwqe*NSnW=Y+n0UFl8hyrIIOFzLHhhl`XXDcydhy7Np=|1?;hPc7d$#UHiS^Kj zjw>T0SC*ypMc>~2h#)F23?_%jwt%#&BprOVa6ykBl~L@sdi~vOe8hs$oGv9Pt)YcM zpiB}*8g9$6bBzeJ`(hSP%Mj^3gZJ?;g+>X~%Y7F*Cu;{O|?}un ze(dq(a+G;(nlIx#^*80Xz$G@hc6Yy5AEJIE+unG-6+vzh65GFVi_PH@HS)WI9kbKM z*;io8TtLS@E!p9?PGBJxFy5LkSFJ+78i?R&vloC?z;um7Ai0aZPpBo`6;{xh)1Ayt zcjsxHKE;c>${SpVCn`a2VZ33Ag!>4H`ocX~lzbUz?;!Rydsu8=`(S-zIxI6voDk(J zL8fZ>nslE}d5Ar|LLRlow;tJJs<|z2o~wsBKyjTH1Vz)Z!kijcC(E#ClOkPP%{;KlrE9x35S2eDx z$|@;oC@Fn-bvfXF0DMt*J?}mE&wz=J=e;bz#a}Z7dHT8q208os|7Xn8!CJn*$7f_< LcD+K+DfYhry)piA literal 0 HcmV?d00001