golden 0.211.0 baked and published; bake evidence

GOLDEN_SHA256=8593516889eb93fe1691410d7306be8cb87ee835b8d2378740eb34022272f849 Round-trip verified on the served bytes. Not vouched - that is the operator's.
2026-08-10 14:18:57 +02:00
parent eb600872f2
commit 999b0a35f8
2 changed files with 380 additions and 0 deletions
@@ -0,0 +1,56 @@
+# Golden bake 0.211.0 — 2026-08-10
+
+Baked in the drill VM on DooPlex per `RUNBOOK-manual-build.md` §4.0/§4.1. Reverted to `virgin`
+before and after; build guest 9100 destroyed `--purge`.
+
+| | |
+|---|---|
+| `GOLDEN_VERSION` | **0.211.0** |
+| `GOLDEN_SHA256` | **8593516889eb93fe1691410d7306be8cb87ee835b8d2378740eb34022272f849** |
+| controller baked | `gitea.dooplex.hu/admin/felhom-controller:0.211.0` |
+| `MinAgent` (from the controller CHANGELOG header) | **0.127.0** |
+| archive | `local:backup/vzdump-lxc-9100-2026_08_10-14_13_46.tar.zst`, 625 MB |
+| published | `…/generic/felhom-golden/0.211.0/golden.tar.zst`, 656 141 689 B, `upload OK (HTTP 201)` |
+| template | `debian-13-standard_13.6-1_amd64.tar.zst` (checksum verified on download) |
+| drill VM | `pve-manager/9.2.2`, kernel 7.0.2-6-pve |
+
+## Acceptance markers — counted, not eyeballed
+
+| marker | count |
+|---|---|
+| `docker OK (overlay2` | 1 |
+| `including mount point rootfs` | 1 |
+| `including mount point mp0` | 1 (there is no mp1 — R-165 collapsed the two data volumes) |
+| `upload OK (HTTP 201)` | 1 |
+| `FATAL` | 0 |
+| `excluding` | 0 |
+
+A first attempt at two of these greps broke on shell quoting and returned `0` for markers that were
+in fact present. They were re-run with `grep -F` and correct quoting — **a 0 from a broken instrument
+is not a measurement**, which is the same class this runbook's own R-233 note is about.
+
+## Fetchability — verified on the SERVED bytes, not the local file
+
+```
+curl -fsSL …/generic/felhom-golden/0.211.0/golden.tar.zst
+downloaded: 656141689 bytes
+sha256:     8593516889eb93fe1691410d7306be8cb87ee835b8d2378740eb34022272f849
+```
+
+Matches `GOLDEN_SHA256` exactly. The controller image was independently confirmed retrievable from
+the registry (`docker manifest inspect …:0.211.0` → schemaVersion 2); note that an anonymous
+`/v2/.../tags/list` returns **401**, which is an auth response and NOT evidence of absence.
+
+## Secret handling
+
+Token copied file→file (`scp`), read inside the VM by a runner script, never on a command line.
+`systemctl show golden-bake -p Environment -p ExecStart | grep -c -F "<token>"` = **0**.
+Token-leak grep on the **committed** log = **0**, and that 0 is believable because the grep was first
+shown to work: a throwaway copy with the token appended grepped **1**, then was shredded.
+Token, bake script, runner and log all `shred -u`'d inside the VM; `/root` residue check empty.
+
+## NOT DONE
+
+**The Day-0 vouch has not been made** — that is the operator's, and this session deliberately did not
+make it. Vouching is a THREE-field change: `golden_version` 0.211.0, `agent_version` 0.128.0,
+`min_agent` 0.127.0.