admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

R-840/R-859/R-860 records: 11 §5.3.1 + §5.4.2, 03, 04, 00; runbooks config-bundle + os-updates-test-waits; register 333→334 (R-840/859/860 closed, R-861/862 opened); STATUS; report; evidence
gates / gates (push) Successful in 31s
Details

Browse Source 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
This commit is contained in:
authentik Default Admin
2026-10-04 20:40:08 +02:00
parent c01d48f457
commit 79f07a7f10
18 changed files with 478 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
documentation/backlog/CLOSED-ITEMS.md
+8
View File
@@ -26,6 +26,14 @@
---
## 2026-10-04 (night) — the config bundle, test approvals, the Docker-socket self-heal (agent v0.143.0, hub v0.133.0, controller v0.293.0, installer 1.31.0; rulings 96–99)
| Row | What | Closed | Evidence |
|---|---|---|---|
| **R-840** | **A new root wrapper or sudoers line could not reach an installed box — no product route.** Built (decision 96): the config bundle — every root-owned file the installer writes, one reproducible file beside the binary; a signed `agent_config_update` the box's `felhom-os-apply` verifies itself (signature against the root-owned signers file, sha, the 22-path table, every content check before the first write, self-check, undo); the trust root is never a bundle path; the installer installs the same bundle. Live: both demo boxes (bootstrap, then 0 written of 22, probe 71/71), a deliberate change and its undo on demo-hp, a wrong sha and a replay refused, the installer path on demo-felhom. **Reasoning kept: the route cannot reach a root side that predates it — the first bundle on such a box is one by-hand step, and that must be said, not hidden.** Tester 2's step → R-862. | CLOSED 2026-10-04 — BUILT | `audits/r840-config-bundle-2026-10-04/partB/` |
| **R-859** | **An OS approval made under a TEST wait stayed in force after the test, and a real ring-1 box installed it** (Tester 2, 2026-10-04: 49 guest + 106 host packages). Hub v0.133.0: every approval under an override is marked; a start without the override cancels every unsuperseded test approval (no ring-1 plan, ring-1 boxes bumped, one operator event each); amber on the System page; one-time backfill of the automatic early approvals. Live: 4 cancelled at the 18:20 UTC start; the operator's Docker approval stays (CC decision, operator may reverse). | CLOSED 2026-10-04 — FIXED | `audits/r840-config-bundle-2026-10-04/partD/`; `runbooks/os-updates-test-waits.md` |
| **R-860** | **A re-created Docker socket file left the controller and traefik blind until a person acted** (generalises R-858). Measured: only a `docker.socket` restart re-creates the file; a dockerd crash or `systemctl restart docker` does not. Controller v0.293.0 (`internal/sockheal`): 60 s of refusals → the controller exits and Docker restarts it on the current socket; then it restarts any other socket user on an older inode (traefik). Live: 9202 healed in 104 s, demo-hp 9201 in 120 s, every container id unchanged. **Reasoning kept: count only refusals, never timeouts, and only after Docker answered once — or a slow daemon restarts the controller, and a broken socket loops it.** | CLOSED 2026-10-04 — FIXED | `audits/r840-config-bundle-2026-10-04/partE/` |
## 2026-10-04 (~18:30) — R-858 incident (agent v0.142.1, ruling 95)
| Row | What | Closed | Evidence |