admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

R-459 CLOSED (MariaDB converts itself, proven by harness + live), golden 0.236.0 (R-467), the golden waiver (R-468)

Browse Source 
Operator rulings 2026-09-13, both shipped the same day:
- MariaDB finishes its own conversion (catalog eec1228/bd32830/3525e35). Harness E3/E3b `proven`
  with engine_state_after "already upgraded to 12.3.3-MariaDB [exit=1]", the skip line gone, C3
  still `failed`; landed on demo-hp through the real 15-min cycle, nothing recreated, one deliberate
  restart logged "MariaDB upgrade not required" with the app serving. Evidence:
  documentation/audits/r459-close-2026-09-13/. The engine-major rule + gate keep every engine
  inside its major until Slice 4 (R-448) — removal tracked as R-469.
- Goldens on a cadence, not per release. golden_currency_gate.py reads a dated waiver
  (documentation/tests/golden-waiver.yml, <= 14 days, row-bound): valid + BEHIND -> loud advisory,
  exit 0; expired -> red again naming the date; UNRECORDED (R-385) never covered; malformed -> 2,
  never 0. Tests cases 5-15 incl. the R-421 decoy; red-proof old-vs-new on the real behind tree.
  R-242's vouch half stays open. Cadence in RUNBOOK-manual-build.md §4.2 + the checklist.
- Golden 0.236.0 baked, round-tripped, vouched, floor raised 0.232.0 -> 0.236.0
  (documentation/tests/golden-0.236.0-2026-09-13/) — the last per-release bake; the waiver was
  issued AFTER it landed. No --no-verify anywhere in this session.

Rows: R-459 CLOSED, R-467 CLOSED, R-242 narrowed; R-468/R-469/R-470/R-471 opened. 09 §3 gains
decisions 5 and 6; STATUS items 11 and 12 closed; CONTEXT records the cadence ruling.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
This commit is contained in:
authentik Default Admin
2026-09-13 10:14:37 +02:00
parent 4b2e5608c2
commit ae59c31a84
62 changed files with 2607 additions and 220 deletions
Download Patch File Download Diff File Expand all files Collapse all files
documentation/tests/golden-0.236.0-2026-09-13/00-vm-boot.txt
+1
View File
@@ -0,0 +1 @@
pve-manager/9.2.2/b9984c6d90a4bd80 (running kernel: 7.0.2-6-pve)
documentation/tests/golden-0.236.0-2026-09-13/01-preconditions.txt
+20
View File
@@ -0,0 +1,20 @@
=== preconditions 2026-09-13T07:46:03Z ===
/dev/sda1 9.1T 3.1T 5.5T 37% /mnt/5_hdd
/dev/sdb1 445G 214G 209G 51% /
felhom-controller clean=[] HEAD=1552716 origin=1552716
felhom.eu clean=[] HEAD=4b2e560 origin=4b2e560
felhom-agent clean=[?? scripts/__pycache__/;] HEAD=4586f0f origin=4586f0f
controller CHANGELOG top: ## v0.236.0 — "delete my data too" deletes the data, or says that it could not (2026-09-
MinAgent lines in the top FOUR entries (v0.233.0..v0.236.0): 0 <- none; newest MinAgent statement is v0.232.0's: **MinAgent: 0.129.0** (unchanged)
controller image 0.236.0 in registry: HTTP 200
404 pre-gate on the golden package: HTTP 404
control — the 0.232.0 package that DOES exist: HTTP 200
=== drill VM ===
Snapshot list:
ID TAG VM_SIZE DATE VM_CLOCK ICOUNT
1 virgin 0 B 2026-07-03 14:12:15 0000:00:00.000 0
no qemu running
=== bake script fingerprint on DooPlex (compared across the hop later) ===
7b0fb5cf082fa3301a45578d1624e375d205b4e538d602e7d198a015e573b6a1 felhom-agent/configs/build-golden.sh
documentation/tests/golden-0.236.0-2026-09-13/02-template.txt
+28
View File
@@ -0,0 +1,28 @@
=== pveam update (the virgin snapshot's INDEX is stale too) ===
update successful
perl: warning: Setting locale failed.
perl: warning: Please check that your locale settings:
LANGUAGE = (unset),
LC_ALL = (unset),
LC_CTYPE = "UTF-8",
LC_NUMERIC = (unset),
LC_COLLATE = (unset),
LC_TIME = (unset),
LC_MESSAGES = (unset),
LC_MONETARY = (unset),
LC_ADDRESS = (unset),
LC_IDENTIFICATION = (unset),
LC_MEASUREMENT = (unset),
LC_PAPER = (unset),
LC_TELEPHONE = (unset),
LC_NAME = (unset),
LANG = "en_US.UTF-8"
are supported and installed on your system.
perl: warning: Falling back to a fallback locale ("en_US.UTF-8").
debian-13-standard_13.6-1_amd64.tar.zst
calculating checksum...OK, checksum verified
download of 'http://download.proxmox.com/images/system/debian-13-standard_13.6-1_amd64.tar.zst' to '/var/lib/vz/template/cache/debian-13-standard_13.6-1_amd64.tar.zst' finished
=== bake script + token, file -> file ===
in the VM: 7b0fb5cf082fa3301a45578d1624e375d205b4e538d602e7d198a015e573b6a1
DooPlex : 7b0fb5cf082fa3301a45578d1624e375d205b4e538d602e7d198a015e573b6a1
documentation/tests/golden-0.236.0-2026-09-13/03-bake-launch.txt
+6
View File
@@ -0,0 +1,6 @@
Running as unit: golden-bake.service; invocation ID: c011a9b879364141982db8d7654bf3fe
=== token-leak check on the unit properties (must be 0) ===
0
=== and the grep is PROVEN to work (must be 1) ===
1
active
documentation/tests/golden-0.236.0-2026-09-13/04-markers.txt
+18
View File
@@ -0,0 +1,18 @@
=== acceptance markers, counted on the COMMITTED log ===
docker OK (overlay2 : 1
including mount point :
316:INFO: including mount point rootfs ('/') in backup
317:INFO: including mount point mp0 ('/var/lib/felhom') in backup
upload OK (HTTP 201) : 1
MUST BE ZERO - excluding : 0
MUST BE ZERO - FATAL : 0
=== the result ===
GOLDEN_VERSION=0.236.0
GOLDEN_SHA256=58a3cc24c61dc2271f2cb508ef5a269af97005f386b671f18011258df5f958bf
archive volid: local:backup/vzdump-lxc-9100-2026_09_13-09_51_44.tar.zst
script: build-golden.sh v3.0.0
=== token-leak grep on the COMMITTED log (must be 0), and the grep PROVEN to work ===
bake.log: 0
seeded throwaway copy (must be 1): 1
documentation/tests/golden-0.236.0-2026-09-13/05-teardown.txt
+5
View File
@@ -0,0 +1,5 @@
Logical volume "vm-9100-disk-1" successfully removed.
purging CT 9100 from related configurations..
leftovers in the VM: 0
qemu exited
1 virgin 0 B 2026-07-03 14:12:15 0000:00:00.000 0
documentation/tests/golden-0.236.0-2026-09-13/07-roundtrip.txt
+8
View File
@@ -0,0 +1,8 @@
=== READER 2: the ROUND TRIP — hash the DOWNLOADED bytes, not the bake's printout ===
http=200 bytes=654115664
downloaded sha256: 58a3cc24c61dc2271f2cb508ef5a269af97005f386b671f18011258df5f958bf
bake printed : 58a3cc24c61dc2271f2cb508ef5a269af97005f386b671f18011258df5f958bf
=== THE DELIVERED ARTIFACT MUST NAME ITS OWN CONTROLLER ===
gitea.dooplex.hu/admin/felhom-controller:0.236.0
docker store entries in the archive: 19382
documentation/tests/golden-0.236.0-2026-09-13/08-hub-before-vouch.txt
+11
View File
@@ -0,0 +1,11 @@
=== READER 3: the hub's Day-0 dropdown, reading Gitea on a different code path ===
agent_version — none — sha=
agent_version 0.130.0 sha=a56a92a7bd68f5b46736eaec <-- currently SELECTED
agent_version 0.129.0 sha=53a54f0620afbd6d4a1b8660
agent_version 0.128.0 sha=c6eba73bf9b9ad6980cfef57
golden_version — none — sha=
golden_version 0.236.0 sha=58a3cc24c61dc2271f2cb508
golden_version 0.232.0 sha=5f8a53ed5b19a6cb2006298c <-- currently SELECTED
golden_version 0.230.0 sha=9287f7cef5f13166276e8406
min_controller_version = 0.232.0
min_agent = 0.129.0
documentation/tests/golden-0.236.0-2026-09-13/09-vouch.txt
+10
View File
@@ -0,0 +1,10 @@
=== VOUCH: the THREE fields, moved together ===
golden_version 0.232.0 -> 0.236.0 (this bake carries FOUR releases: 0.233.0..0.236.0 were never baked)
agent_version 0.130.0 -> 0.130.0 UNCHANGED, already >= MinAgent
min_agent 0.129.0 -> 0.129.0 UNCHANGED — no header since v0.232.0 declares a change (R-470 filed for the missing line)
min_agent (0.129.0) <= agent_version (0.130.0): NOT the R-216 shape
golden_sha256 sent = 58a3cc24c61dc227… (must equal the bake's 58a3cc24c61dc227…)
POST http=303
Location: /configuration?flash=artifacts_set
(read from -D, never %{redirect_url} — R-132)
documentation/tests/golden-0.236.0-2026-09-13/11-vouch-verified.txt
+10
View File
@@ -0,0 +1,10 @@
=== RE-READ FROM THE PAGE — a 303 and a success flash are not proof ===
agent_version SELECTED = 0.130.0 sha=a56a92a7bd68f5b46736eaec...
golden_version SELECTED = 0.236.0 sha=58a3cc24c61dc2271f2cb508...
min_agent = 0.129.0
golden_sha256 = 58a3cc24c61dc2271f2cb508ef5a269af97005f386b671f18011258df5f958bf
R-120 refusal banner present: False
=== raise the fleet floor 0.232.0 -> 0.236.0 (both demo guests already run 0.236.0 by hand — the floor moves nothing today; it makes a fresh install land current) ===
POST http=303
Location: /configuration?flash=floor_set
after: name="min_controller_version" value="0.236.0"
documentation/tests/golden-0.236.0-2026-09-13/README.md
+74
View File
@@ -0,0 +1,74 @@
# Golden bake 0.236.0 — 2026-09-13
Baked, published, round-trip verified, **vouched**, and the fleet floor raised 0.232.0 → 0.236.0.
**This bake carries FOUR releases: 0.233.0, 0.234.0, 0.235.0 and 0.236.0 were never baked** (R-467).
It is the last per-release bake: from today goldens are on a **weekly cadence, and before any drill or
fresh install** (operator ruling 2026-09-13, R-468 — `RUNBOOK-manual-build.md` §4.2).
| | |
|---|---|
| `GOLDEN_SHA256` | `58a3cc24c61dc2271f2cb508ef5a269af97005f386b671f18011258df5f958bf` |
| size | **654 115 664 B** |
| baked controller | `gitea.dooplex.hu/admin/felhom-controller:0.236.0` |
| `MinAgent` | **0.129.0** — the newest header that STATES one is v0.232.0's; v0.233.0…v0.236.0 carry no line (**R-470**) |
| script | `build-golden.sh v3.0.0`, sha `7b0fb5cf…73b6a1`, **compared across the hop** (`02-template.txt`) |
| template | `debian-13-standard_13.6-1_amd64.tar.zst`, after `pveam update` |
| archive volid | `local:backup/vzdump-lxc-9100-2026_09_13-09_51_44.tar.zst` |
## Acceptance markers — counted on the COMMITTED log (`04-markers.txt`)
```
docker OK (overlay2 : 1
including mount point rootfs : 1 (line 316)
including mount point mp0 : 1 (line 317) <- no mp1 since v3.0.0 (R-165/R-233)
upload OK (HTTP 201) : 1
--- must be ZERO ---
excluding : 0
FATAL : 0
```
## Three independent readers agreed before anything was vouched
1. **The bake** printed `GOLDEN_SHA256=58a3cc24…958bf`.
2. **The round trip** (`07-roundtrip.txt`) — the published bytes downloaded back: `HTTP 200`,
**654 115 664 B**, sha `58a3cc24…958bf`, hashed from the **downloaded** bytes.
3. **The hub's Day-0 dropdown** (`08-hub-before-vouch.txt`), a different code path reading Gitea:
`0.236.0 sha=58a3cc24c61dc2271f2cb508`.
The delivered artifact names the controller it will start, read out of the downloaded archive:
`./etc/felhom-controller-image` → `gitea.dooplex.hu/admin/felhom-controller:0.236.0`, with **19 382**
entries under `var/lib/felhom/docker/`.
## Pre-gates, each proven able to see something first (`01-preconditions.txt`, `03-bake-launch.txt`)
| gate | result | the control that makes it believable |
|---|---|---|
| 404 pre-gate | `HTTP 404` for 0.236.0 before the bake | the 0.232.0 package returns `HTTP 200` on the same URL shape |
| token-leak grep on the committed log | **0** | the token appended to a throwaway copy greps **1**; the copy was `shred -u`'d |
| token off every command line | unit properties grep **0** | same seeded control returns **1** |
## The vouch — three fields, and only one moved (`09-vouch.txt`, `11-vouch-verified.txt`)
| field | before | after | why |
|---|---|---|---|
| `golden_version` | 0.232.0 | **0.236.0** | the new bake |
| `agent_version` | 0.130.0 | 0.130.0 | unchanged — already ≥ MinAgent |
| `min_agent` | 0.129.0 | 0.129.0 | unchanged — no header since v0.232.0 declares a change (R-470) |
`POST /configuration/artifacts` → `303 flash=artifacts_set`; the page was **re-read** (golden
`0.236.0` selected, sha `58a3cc24…`), the R-120 refusal banner **absent**. Floor
`POST /configuration/global-floor` → `303 flash=floor_set`, re-read `0.236.0`.
## The floor, and why no box moved
**Both demo guests were already on 0.236.0 by hand** (proven during R-442's live validation the same
morning), so the floor raise changes nothing on the fleet today. It clears `golden_currency_gate.py`
and makes a fresh install land on the current release — which the nightly drills need. The chain
itself was exercised on 2026-09-01 (`golden-0.232.0-2026-09-01/12-selfupdate.txt`) and is not
re-proven here; nothing about it changed.
## Teardown (`05-teardown.txt`)
`pct destroy 9100 --purge`, `shred -u` of the token, runner, script and log **after** the log was
copied out (leftovers in `/root`: 0), `poweroff`, qemu confirmed exited with `ps -eo comm`, and
`qemu-img snapshot -a virgin`. The disk carries the single `virgin` snapshot.
documentation/tests/golden-0.236.0-2026-09-13/bake.log
+327
View File
@@ -0,0 +1,327 @@
[golden] build-golden.sh v3.0.0 — baking controller gitea.dooplex.hu/admin/felhom-controller:0.236.0
[golden] creating build LXC 9100 (nesting=1,keyctl=1, unprivileged; rootfs 32G + ONE data volume 24G @ /var/lib/felhom, backup=1) …
Logical volume "vm-9100-disk-0" created.
Logical volume pve/vm-9100-disk-0 changed.
Creating filesystem with 8388608 4k blocks and 2097152 inodes
Filesystem UUID: 2f235e82-2a88-4be0-b7b7-75778991837c
Superblock backups stored on blocks:
32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208,
4096000, 7962624
Logical volume "vm-9100-disk-1" created.
Logical volume pve/vm-9100-disk-1 changed.
Creating filesystem with 6291456 4k blocks and 1572864 inodes
Filesystem UUID: 39948d21-08ac-4cde-b5d3-997c54b68f36
Superblock backups stored on blocks:
32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208,
extracting archive '/var/lib/vz/template/cache/debian-13-standard_13.6-1_amd64.tar.zst'
Total bytes read: 553512960 (528MiB, 94MiB/s)
Detected container architecture: amd64
Creating SSH host key 'ssh_host_ed25519_key' - this may take some time ...
done: SHA256:e56AH6TbE0URIv25xegROJSnKt2yI9lK+kjeinRAeIE root@felhom-golden
Creating SSH host key 'ssh_host_ecdsa_key' - this may take some time ...
done: SHA256:VUZj3qbCDwZzz7pZsp5QlPisPDJ5KwjVShkoQEQuAZ4 root@felhom-golden
Creating SSH host key 'ssh_host_rsa_key' - this may take some time ...
done: SHA256:7n/yEy8Nfqo8I4pX5L2b3Kg3d2K2sfgYYAZeH9XqWaI root@felhom-golden
[golden] starting + installing Docker (official repo, trixie channel) …
apt-listchanges: Can't set locale; make sure $LC_* and $LANG are correct!
perl: warning: Setting locale failed.
perl: warning: Please check that your locale settings:
LANGUAGE = (unset),
LC_ALL = (unset),
LC_CTYPE = (unset),
LC_NUMERIC = (unset),
LC_COLLATE = (unset),
LC_TIME = (unset),
LC_MESSAGES = (unset),
LC_MONETARY = (unset),
LC_ADDRESS = (unset),
LC_IDENTIFICATION = (unset),
LC_MEASUREMENT = (unset),
LC_PAPER = (unset),
LC_TELEPHONE = (unset),
LC_NAME = (unset),
LANG = "en_US.UTF-8"
are supported and installed on your system.
perl: warning: Falling back to the standard locale ("C").
locale: Cannot set LC_CTYPE to default locale: No such file or directory
locale: Cannot set LC_MESSAGES to default locale: No such file or directory
locale: Cannot set LC_ALL to default locale: No such file or directory
apt-listchanges: Can't set locale; make sure $LC_* and $LANG are correct!
perl: warning: Setting locale failed.
perl: warning: Please check that your locale settings:
LANGUAGE = (unset),
LC_ALL = (unset),
LC_CTYPE = (unset),
LC_NUMERIC = (unset),
LC_COLLATE = (unset),
LC_TIME = (unset),
LC_MESSAGES = (unset),
LC_MONETARY = (unset),
LC_ADDRESS = (unset),
LC_IDENTIFICATION = (unset),
LC_MEASUREMENT = (unset),
LC_PAPER = (unset),
LC_TELEPHONE = (unset),
LC_NAME = (unset),
LANG = "en_US.UTF-8"
are supported and installed on your system.
perl: warning: Falling back to the standard locale ("C").
locale: Cannot set LC_CTYPE to default locale: No such file or directory
locale: Cannot set LC_MESSAGES to default locale: No such file or directory
locale: Cannot set LC_ALL to default locale: No such file or directory
[golden] baking daemon.json: classic overlay2 driver (containerd-snapshotter OFF) + log rotation …
[golden] wiring the single data volume (R-165 variant V-c): /var/lib/felhom/{docker,sys_drive} -> binds …
[golden] verifying Docker works in the build guest (storage driver should be overlay2 on the ext4 data volume) …
Unable to find image 'hello-world:latest' locally
latest: Pulling from library/hello-world
4f55086f7dd0: Pulling fs layer
4f55086f7dd0: Verifying Checksum
4f55086f7dd0: Download complete
4f55086f7dd0: Pull complete
Digest: sha256:5e23090353324d887c48ad5e5c56d294eab81588df9605b07d1afe895f9cc8f8
Status: Downloaded newer image for hello-world:latest
docker OK (overlay2; data-root /var/lib/docker)
/var/lib/docker is a real mount: /dev/mapper/pve-vm--9100--disk--1[/docker] ext4
/mnt/sys_drive is a real mount: /dev/mapper/pve-vm--9100--disk--1[/sys_drive] ext4
both paths are ONE filesystem: /dev/mapper/pve-vm--9100--disk--1 23317576
[golden] baking the in-guest controller image gitea.dooplex.hu/admin/felhom-controller:0.236.0 (no registry cred at deploy) …
WARNING! Your credentials are stored unencrypted in '/root/.docker/config.json'.
Configure a credential helper to remove this warning. See
https://docs.docker.com/go/credential-store/
0.236.0: Pulling from admin/felhom-controller
a8ac7f6c67ab: Pulling fs layer
bf30769d36e7: Pulling fs layer
044b66fbe46c: Pulling fs layer
b5c41a28e83f: Pulling fs layer
4051fe1934c3: Pulling fs layer
7879c9030fd8: Pulling fs layer
b5c41a28e83f: Waiting
4051fe1934c3: Waiting
7879c9030fd8: Waiting
a8ac7f6c67ab: Verifying Checksum
a8ac7f6c67ab: Download complete
044b66fbe46c: Verifying Checksum
044b66fbe46c: Download complete
b5c41a28e83f: Verifying Checksum
b5c41a28e83f: Download complete
4051fe1934c3: Verifying Checksum
4051fe1934c3: Download complete
7879c9030fd8: Verifying Checksum
7879c9030fd8: Download complete
bf30769d36e7: Verifying Checksum
bf30769d36e7: Download complete
a8ac7f6c67ab: Pull complete
bf30769d36e7: Pull complete
044b66fbe46c: Pull complete
b5c41a28e83f: Pull complete
4051fe1934c3: Pull complete
7879c9030fd8: Pull complete
Digest: sha256:ec94c3298040ae9061555c1dbdd0fc6221d64ba42f7154ce71739ec1d8f09176
Status: Downloaded newer image for gitea.dooplex.hu/admin/felhom-controller:0.236.0
gitea.dooplex.hu/admin/felhom-controller:0.236.0
[golden] asking the controller which infra images it manages …
[golden] baking infra images (4): traefik:v3.6.7 cloudflare/cloudflared:2026.6.0 gtstef/filebrowser:1.3.3-stable gitea.dooplex.hu/admin/felhom-samba:1.1.0 …
v3.6.7: Pulling from library/traefik
589002ba0eae: Pulling fs layer
ef63511ea6cc: Pulling fs layer
0738e5cb835e: Pulling fs layer
3e6813f70c64: Pulling fs layer
3e6813f70c64: Waiting
ef63511ea6cc: Verifying Checksum
ef63511ea6cc: Download complete
589002ba0eae: Verifying Checksum
589002ba0eae: Download complete
3e6813f70c64: Verifying Checksum
3e6813f70c64: Download complete
0738e5cb835e: Verifying Checksum
0738e5cb835e: Download complete
589002ba0eae: Pull complete
ef63511ea6cc: Pull complete
0738e5cb835e: Pull complete
3e6813f70c64: Pull complete
Digest: sha256:a9890c898f379c1905ee5b28342f6b408dc863f08db2dab20e46c267d1ff463a
Status: Downloaded newer image for traefik:v3.6.7
docker.io/library/traefik:v3.6.7
2026.6.0: Pulling from cloudflare/cloudflared
47de5dd0b812: Pulling fs layer
c172f21841df: Pulling fs layer
99515e7b4d35: Pulling fs layer
99ba982a9142: Pulling fs layer
d6b1b89eccac: Pulling fs layer
2780920e5dbf: Pulling fs layer
7c12895b777b: Pulling fs layer
3214acf345c0: Pulling fs layer
52630fc75a18: Pulling fs layer
dd64bf2dd177: Pulling fs layer
b839dfae01f6: Pulling fs layer
ebddc55facdc: Pulling fs layer
bdfd7f7e5bf6: Pulling fs layer
2d4d7adf6272: Pulling fs layer
40008157d8d2: Pulling fs layer
bd8962e29291: Pulling fs layer
cac2ae0193cb: Pulling fs layer
74d1dac84ecc: Pulling fs layer
b839dfae01f6: Waiting
ebddc55facdc: Waiting
bdfd7f7e5bf6: Waiting
2d4d7adf6272: Waiting
40008157d8d2: Waiting
bd8962e29291: Waiting
cac2ae0193cb: Waiting
74d1dac84ecc: Waiting
99ba982a9142: Waiting
d6b1b89eccac: Waiting
2780920e5dbf: Waiting
7c12895b777b: Waiting
3214acf345c0: Waiting
52630fc75a18: Waiting
dd64bf2dd177: Waiting
47de5dd0b812: Download complete
c172f21841df: Verifying Checksum
c172f21841df: Download complete
47de5dd0b812: Pull complete
99515e7b4d35: Verifying Checksum
99515e7b4d35: Download complete
99ba982a9142: Verifying Checksum
99ba982a9142: Download complete
d6b1b89eccac: Verifying Checksum
d6b1b89eccac: Download complete
2780920e5dbf: Verifying Checksum
2780920e5dbf: Download complete
7c12895b777b: Verifying Checksum
7c12895b777b: Download complete
c172f21841df: Pull complete
3214acf345c0: Verifying Checksum
3214acf345c0: Download complete
52630fc75a18: Verifying Checksum
52630fc75a18: Download complete
dd64bf2dd177: Verifying Checksum
dd64bf2dd177: Download complete
b839dfae01f6: Verifying Checksum
b839dfae01f6: Download complete
ebddc55facdc: Verifying Checksum
ebddc55facdc: Download complete
bdfd7f7e5bf6: Verifying Checksum
bdfd7f7e5bf6: Download complete
40008157d8d2: Verifying Checksum
40008157d8d2: Download complete
bd8962e29291: Verifying Checksum
bd8962e29291: Download complete
2d4d7adf6272: Verifying Checksum
2d4d7adf6272: Download complete
cac2ae0193cb: Verifying Checksum
cac2ae0193cb: Download complete
99515e7b4d35: Pull complete
74d1dac84ecc: Verifying Checksum
74d1dac84ecc: Download complete
99ba982a9142: Pull complete
d6b1b89eccac: Pull complete
2780920e5dbf: Pull complete
7c12895b777b: Pull complete
3214acf345c0: Pull complete
52630fc75a18: Pull complete
dd64bf2dd177: Pull complete
b839dfae01f6: Pull complete
ebddc55facdc: Pull complete
bdfd7f7e5bf6: Pull complete
2d4d7adf6272: Pull complete
40008157d8d2: Pull complete
bd8962e29291: Pull complete
cac2ae0193cb: Pull complete
74d1dac84ecc: Pull complete
Digest: sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f
Status: Downloaded newer image for cloudflare/cloudflared:2026.6.0
docker.io/cloudflare/cloudflared:2026.6.0
1.3.3-stable: Pulling from gtstef/filebrowser
6a0ac1617861: Pulling fs layer
ef8806083e82: Pulling fs layer
b74107c861c7: Pulling fs layer
adc935def003: Pulling fs layer
4f4fb700ef54: Pulling fs layer
18695ccc900a: Pulling fs layer
45d119d5c397: Pulling fs layer
dac52db4fc51: Pulling fs layer
6d598f86b2f2: Pulling fs layer
8aa349c8396c: Pulling fs layer
dac52db4fc51: Waiting
6d598f86b2f2: Waiting
8aa349c8396c: Waiting
4f4fb700ef54: Waiting
18695ccc900a: Waiting
45d119d5c397: Waiting
adc935def003: Waiting
6a0ac1617861: Verifying Checksum
6a0ac1617861: Download complete
adc935def003: Verifying Checksum
adc935def003: Download complete
6a0ac1617861: Pull complete
4f4fb700ef54: Verifying Checksum
4f4fb700ef54: Download complete
b74107c861c7: Verifying Checksum
b74107c861c7: Download complete
ef8806083e82: Verifying Checksum
ef8806083e82: Download complete
45d119d5c397: Verifying Checksum
45d119d5c397: Download complete
18695ccc900a: Verifying Checksum
18695ccc900a: Download complete
dac52db4fc51: Verifying Checksum
dac52db4fc51: Download complete
6d598f86b2f2: Verifying Checksum
6d598f86b2f2: Download complete
8aa349c8396c: Verifying Checksum
8aa349c8396c: Download complete
ef8806083e82: Pull complete
b74107c861c7: Pull complete
adc935def003: Pull complete
4f4fb700ef54: Pull complete
18695ccc900a: Pull complete
45d119d5c397: Pull complete
dac52db4fc51: Pull complete
6d598f86b2f2: Pull complete
8aa349c8396c: Pull complete
Digest: sha256:eb3733681db8757412632c61a99ad656f0d94ed6781bb2ea114b4d70babab78c
Status: Downloaded newer image for gtstef/filebrowser:1.3.3-stable
docker.io/gtstef/filebrowser:1.3.3-stable
1.1.0: Pulling from admin/felhom-samba
897d797d2723: Pulling fs layer
3051591aa250: Pulling fs layer
ce57a3f93416: Pulling fs layer
fb94eeec2fe1: Pulling fs layer
fb94eeec2fe1: Waiting
ce57a3f93416: Verifying Checksum
ce57a3f93416: Download complete
fb94eeec2fe1: Verifying Checksum
fb94eeec2fe1: Download complete
897d797d2723: Download complete
3051591aa250: Verifying Checksum
3051591aa250: Download complete
897d797d2723: Pull complete
3051591aa250: Pull complete
ce57a3f93416: Pull complete
fb94eeec2fe1: Pull complete
Digest: sha256:1c17c09422bec0366d7cf0e0fcfc1486ba6c90334a0a5d5c851073a9342f8f10
Status: Downloaded newer image for gitea.dooplex.hu/admin/felhom-samba:1.1.0
gitea.dooplex.hu/admin/felhom-samba:1.1.0
[golden] baking the controller-bootstrap unit (deploys the BAKED controller from the config mount) …
Created symlink '/etc/systemd/system/multi-user.target.wants/felhom-controller-bootstrap.service' → '/etc/systemd/system/felhom-controller-bootstrap.service'.
[golden] baking the controller-bootstrap PATH unit (starts the service on bootstrap-mount hot-plug — B1) …
Created symlink '/etc/systemd/system/multi-user.target.wants/felhom-controller-bootstrap.path' → '/etc/systemd/system/felhom-controller-bootstrap.path'.
[golden] baking the first-boot SSH host-key regeneration unit (F3) …
Created symlink '/etc/systemd/system/multi-user.target.wants/felhom-regen-hostkeys.service' → '/etc/systemd/system/felhom-regen-hostkeys.service'.
[golden] identity-clean + minimize …
[golden] stop + archive …
INFO: including mount point rootfs ('/') in backup
INFO: including mount point mp0 ('/var/lib/felhom') in backup
INFO: archive file size: 623MB
INFO: Finished Backup of VM 9100 (00:00:43)
[golden] DONE. golden archive volid: local:backup/vzdump-lxc-9100-2026_09_13-09_51_44.tar.zst (rootfs 32G + ONE data volume 24G @ /var/lib/felhom, all in the archive)
[golden] publishing golden (654115664 bytes, sha256 58a3cc24c61dc227…) → https://gitea.dooplex.hu/api/packages/admin/generic/felhom-golden/0.236.0/golden.tar.zst
[golden] pre-delete existing: HTTP 404 (404/204 expected)
[golden] upload OK (HTTP 201)
GOLDEN_VERSION=0.236.0
GOLDEN_SHA256=58a3cc24c61dc2271f2cb508ef5a269af97005f386b671f18011258df5f958bf
[golden] Record in the hub operator UI (Configs → Day-0 artifacts): golden 0.236.0 / 58a3cc24c61dc2271f2cb508ef5a269af97005f386b671f18011258df5f958bf
[golden] (the build guest 9100 is stopped; destroy it with: pct destroy 9100 --purge)
documentation/tests/golden-waiver.yml
+11
View File
@@ -0,0 +1,11 @@
# documentation/tests/golden-waiver.yml — read by scripts/golden_currency_gate.py
#
# Goldens are on a CADENCE, not per release (operator ruling 2026-09-13, R-468): weekly, and always
# before any drill or fresh install. While this waiver is valid a golden BEHIND the record makes the
# gate ADVISORY instead of red. It never covers a golden that is UNRECORDED (R-385). At most 14 days
# after `issued`, or the gate refuses it. Renew with a new dated commit; delete it at the first
# external install. Issued AFTER the 0.236.0 bake landed — not over a bake that could have been done.
issued: 2026-09-13
expires: 2026-09-27
reason: pre-customer development; goldens on a weekly cadence (operator ruling 2026-09-13)
register_row: R-468