From 87ba30ae91acbb8fcb7528c98c9fc493b76a1fcb Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Wed, 8 Jul 2026 16:04:54 +0200 Subject: [PATCH] =?UTF-8?q?docs(pilot):=20GL-6=20COMPLETE=20=E2=80=94=20Ga?= =?UTF-8?q?te=206=20GO,=20summary,=20findings=20ledger,=20deviations?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6 --- documentation/pilot/DRILL-GL6-2026-07-08.md | 50 +++++++++++++++++++++ 1 file changed, 50 insertions(+) diff --git a/documentation/pilot/DRILL-GL6-2026-07-08.md b/documentation/pilot/DRILL-GL6-2026-07-08.md index f38701c..44aea63 100644 --- a/documentation/pilot/DRILL-GL6-2026-07-08.md +++ b/documentation/pilot/DRILL-GL6-2026-07-08.md @@ -334,3 +334,53 @@ Real `--uninstall --vmid 9201` (typed confirm), no busy prop this time. *(Phases 3–6 appended as they run.)* + +## Gate 6 — [Viktor]: **GO — DRILL COMPLETE.** + +Demo healthy on normal life. Two full destroy/rebuild cycles proven (byo #2, appliance #6), both +uninstalls clean, drive data intact ALL THREE checks, armed-key chain proven, C7 live-validated. + +## Summary — what GL-6 validated + +**Key-pin chain (GL-1's whole point) — legs 1–4 all green:** box==repo==password-manager fingerprints +(op `7YqN…`, rec `/ixg…`); signers ARMED from first boot on both byo + appliance installs; the pinned +operational key AUTHORIZED a real signed `agent_update` op end-to-end (round-trip 0.76.0→0.76.1→0.76.0 +with the real key, verify vs pinned signer + nonce, A/B swap, crash-guard silent). + +**Go-live gates now LIVE-VALIDATED on real hardware:** G2 (byo profile — disclosure+ack, no root@pam, +config asserts), G4 (preflight guards + verify pool/ACL asserts incl. **C7 firing on real drift**), +G5 (mandatory byo caps applied to the guest), G6 (uninstall gap-closure — KEPT/WIPED statement, +plain-umount busy-drive handling, self-update-artifact removal, **data intact ×3**), G7 (this drill). +**G1 DONE** (published chain consumed end-to-end via anonymous fetch — the v1.11.2 Gate-0 ruling — ++ armed keys proven). **G12** re-exercised (restore-test `mount_parity: ok` on PBS 5m35s + local tiers). +**G9** rehearsed (dashboard password is operator-set-via-hub; location confirmed) → **deferred to GL-7**; +**G10** (open dashboard until the operator sets a password) → GL-7 prerequisite. + +## Findings ledger (post-drill installer pile unless noted) + +| ID | Sev | What | Status | +|----|-----|------|--------| +| **F4** | HIGH | `--resume` skipped producer steps → config missing hub.host_id/proxmox.token (daemon crash-loop) + provision `-rootfs-grow ""` | **FIXED v1.11.3, live-proven** (dry + the single-shot appliance install) | +| F1 | MED | `/etc/felhom-agent/` + `agent.json.bak-*` (secret-bearing) survive uninstall when prior `.bak` configs exist | open — purge config dir/.bak in uninstall 4b | +| F2 | MED | per-drive `mnt-*.mount` units + `/mnt/` primary mounts survive uninstall ("physically removable" overclaims) | open — uninstall stop+remove the agent's `mnt-*` units | +| F3 | MED | byo FRESH install on a host with the OWNER's guests trips the populated-host leaf guard (`pct list | grep -q .`), needs `--allow-new-leaf` | GL-7 command + candidate guard-narrow to `felhom_guests` | +| F5 | — | initial "public dashboard DNS absent" — **MISDIAGNOSIS**: the `*.demo-felhom.eu` wildcard works (HTTP 200 via DoH); real cause was F6 | superseded by F6 | +| F6 | MED | leftover **broken dnsmasq** (active on `:53`, queries time out) on a byo host (`lan_resolver` off) breaks LAN-client DNS | open — byo install/uninstall stop+mask leftover dnsmasq | +| F7 | MED | R2 pool re-assertion is **bring-up-only** (`bringup.go:498`); no continuous membership reconcile → out-of-band drift doesn't auto-heal (repair via `--adopt-pool`) | open — candidate periodic membership reconcile | +| — | LOW | re-provision changes the guest DHCP IP (.105→.139) → manual LAN DNS entries go stale | GL-7 note (reserve lease / use lan_resolver) | +| — | LOW | legacy `felhom-agent.v*.bak` binaries survive the uninstall `.bak-*` glob | trivial (demo-box history only) | +| — | LOW | snapshot-mode backup briefly flashes "Protected container not running" (monitor false-positive during freeze) | cosmetic | + +**Honest leftovers (unchanged, still open):** S5 customer-data DR drill; G12 parity-on-real-drift + +PBS-tier runtime characterization; CGNAT true-sim retest; Impl-3 shared-box format gate; OOB spike. + +## Drill deviations (recorded) + +1. **v1.11.2 shipped mid-drill (Gate-0 ruling):** empty customer git creds → anonymous artifact fetch + (the artifacts are world-readable by ruling; sha256 stays the integrity root). All 12 fetch targets + 200-anon-validated first. +2. **F4 fixed mid-drill (v1.11.3, Viktor HOLD):** the resume-correctness bug, live-proven fixed. +3. **Phase-3 delivery is operator-driven, not [CC]:** the hub pod has no direct-insert tool and the + admin-enqueue API is global-key-gated, so Viktor signs+enqueues in one `felhom-opsign -upload` command + (`-hub-key` = the hub `report_api_key`, not the web login — a GL-7 clarity note). +4. **G9 password + full app redeploy deferred to GL-7** (operator/customer curation).