audits: disposition — backups-IA finding 2 (legacy-boot SystemDisks dead wizard) RESOLVED by felhom-agent v0.87.0 (slaves-walk, operator ruling 2026-07-13); live evidence drill replay + felhom-pve byte-identical regression; remaining: supervised wizard leg + Day-0 manifest vouch

2026-07-13 13:21:14 +02:00
parent a92e18b21f
commit 74fa61c7bc
1 changed files with 23 additions and 0 deletions
@@ -0,0 +1,23 @@
+# Disposition — backups-IA finding 2 (MEDIUM): legacy-boot SystemDisks → dead drive wizard
+
+**Origin:** the v0.124.0 backups-IA validation (2026-07-13; recorded in felhom-controller
+CHANGELOG v0.124.0 + the drill live run): on a legacy-boot PVE (LVM root, no mounted ESP) the
+agent's `SystemDisks` resolved no raw system disk → `sysKnown=false` → every disk classified
+system → the drive wizard could never offer a candidate; the hot-added 5 GB scsi disk stayed
+invisible on the drill box.
+
+**Disposition: RESOLVED 2026-07-13 — felhom-agent v0.87.0** (repo felhom-agent, commit
+`3c174bc`; operator ruling approved 2026-07-13). The root filesystem's backing device is walked
+recursively through `/sys/block/<dev>/slaves` down to physical disks (dm AND md; topology,
+never VG names); those + any mounted-ESP holder are system. Per-branch conservatism: any
+unresolvable slave fails the WHOLE walk → the unchanged all-system fail-safe — which is back to
+being the walk-FAILURE error case, not the legacy-boot common case. The catastrophic direction
+(a root-backing disk offered as a candidate) is pinned by the signature test
+`TestSystemDisks_WalkTopologies` (never weaken) + red-proofs A/B/D.
+
+**Live evidence (2026-07-13):** drill host (legacy shape) on 0.87.0 — the exact IA replay:
+hot-added 5 GB scsi disk → `GET /disks/candidates` now returns it as an initialize candidate
+(`/dev/sdb`, QEMU HARDDISK, not data-bearing); the root disk sda is NOT offered. felhom-pve
+(EFI+LVM shape) regression: `/disks` roles + candidates byte-identical pre/post upgrade.
+Remaining supervised leg: wizard enroll+format through the customer UI (operator session,
+GO before format) + Day-0 manifest vouch of agent 0.87.0.