admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Day 2026-10-07: Parts A-H done — hub 0.142.0 + agent 0.151.0 delivered, Proxmox lane proven on demo-felhom, kernel spike recorded; 130 -> 126
gates / gates (push) Successful in 3m3s
Details

Browse Source 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
This commit is contained in:
authentik Default Admin
2026-10-07 14:19:58 +02:00
parent 374213f279
commit b0276c7197
23 changed files with 836 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
REPORT.md
+29 -24
View File
@@ -1,33 +1,38 @@
# REPORT — the read-back, the releases and the Tester 1 proof (2026-10-07 morning)
Operator instruction 2026-10-07 08:40: Parts B and D of `TASK-night-readback-offsite-gap-tester1-2026-10-07.md`, then
release hub 0.141.0 → agent 0.150.0 → controller → the held catalog branch, deliver to demo-hp, demo-felhom and the
Tester 1 box, then the Tester 1 update test with the operator present; rule 11 in the shared rule file. Recorded as
`09` §3 decisions 160–161. **The task file is not on DooPlex** (searched the disk and git); Parts B and D were taken from
the evening report and the R-518 row.
# REPORT — the operator's answers built; the kernel lane spiked with real reboots (2026-10-07 day)
| Part | Result |
|---|---|
| **B** — the night read-back (R-518) | demo-hp (9 apps) stop **~91 s** (was 5 min 47 s); demo-felhom (1 app) ~11 s; local tier only, off-site not due; two channels each. `audits/readback-2026-10-07/RESULT-B-D.md` |
| **D** — one press, measured | demo-hp: **80 s** from the press to the last app (per app 39–79 s); the copy finished 4 min later with the apps up; only the local tier ran; the page's „kb. 1–1,5 perc" holds — no text change |
| hub 0.141.0 | built, manifest `011a481a`, Synced/Healthy at HEAD, image 0.141.0, `starting` log, healthz + System 200 at 06:57:42Z (40 s after the sync) |
| agent 0.150.0 | released (sha `a23d1c90…`, bundle `88456b38…`, tag `v0.150.0`), vouched (golden 0.301.0 and MinAgent 0.131.0 unchanged); signed `agent_update` → all three on 0.150.0 by 07:07Z; signed `agent_config_update` → `BUNDLE DONE written=1 same=24 self-check=ok`, probe 68/68 on all three by 07:21Z |
| controller 0.302.0 | MinAgent 0.131.0; floors 0.302.0 with declared MinAgent for demo-hp, demo-felhom, tester-1 → all three `0.302.0 (healthy)` by 07:10Z. Global floor and Tester 2 not touched. Golden waiver issued to 2026-10-13 (the weekly bake's date) |
| catalog | `night-held-2026-10-06` merged (`872039d`); synced on all three boxes (read in their templates) |
| **Tester 1 proof (R-892)** | vaultwarden 1.36.0 → 1.37.4 through the guarded Update: **proven, 14.4 s**, seed read back before and after; removed with its volume; app list equal; pointer restored byte-identical; drill reset. `audits/night-burndown-2026-10-06/s3/box/` |
| rule 11 | „Every helper prompt carries the brief's fences in full" — in all five copies (one md5) |
| **A** — rulings | `09` §3 decisions 162–170 recorded first, plus 171 (reboots without a per-reboot word, never DooPlex). R-822 closed by ruling. R-836 → P2. Shared rule file: no hub build/deploy without the operator (all five copies identical) |
| **B** — Proxmox package lane (R-812 A) | built (agent `pve` layer + `/etc/pve` write gate; hub candidate/approval/System page), delivered, **proven live on demo-felhom**: one signed step, 65 packages in 70 s, `pve-manager` 9.2.2 → 9.2.21, healthy, guest untouched, app 31/31; hub logged it. R-812 closed |
| **C** — agent image check (R-861 (a) A1, (b) B2) | built, delivered to the three boxes; on demo-hp: no `tee` grant, the verb is the route, an `alpine` ref refused (rc 3, file unchanged), felhom-op's pct lines exact. **Not seen: a full managed swap** (no newer controller today) |
| **D** — RESET purge + clean-up (R-32) | purge through the sub-account's own login built and delivered (hub 0.142.0). **The one-time clean-up STOPPED:** ~2.7 GB belongs to no live customer, reachable only by the pool box's main account — no such login on DooPlex |
| **E** — other-key archives line (R-366 slice 2) | built and delivered; R-366 closed |
| **F** — retire the empty fields (R-105) | built and delivered (columns kept, unread); `05`/`06` corrected; R-105 closed |
| **G** — kernel spike (R-836) | 24 reboots + 2 power cycles on Tester 1 (VM), demo-felhom, demo-hp (Secure Boot on). **ESP one-shot flag: works on all three. UEFI BootNext: works on all three. A watchdog armed by systemd: fails on all three** (a reset clears the timer; a frozen kernel needs a person). Design with two operator questions: `audits/kernel-spike-2026-10-07/DESIGN-kernel-lane.md`. Boxes left clean on a healthily booted default |
| **H** — Tester 2 (read only) | the household got 0 mails while the box was off (operator 10); no row |
| Rows before | Rows after | Opened | Closed |
|---|---|---|---|
| **137** | **130** | **0** | **7** (R-892, R-894, R-542, R-777, R-612, R-805, R-806) |
| **130** | **126** | **0** | **4** (R-822, R-812, R-366, R-105) |
**Fixed without a row:** none. **One slip:** the catalog merge was pushed in the same command as its unit-test run,
before reading the result (standing rule 1). Read right after: 156 tests, the single known error (`test_pg_conversion`
is a script, not a test module — the same on `main` before the merge); `catalog_gates.py --fast` was green before the push.
**Releases (one per repo changed):** hub **0.142.0** (live, healthz 200 within 50 s); agent **0.151.0** + bundle on demo-hp,
demo-felhom, Tester 1 (probe 68/68 each). **The agent vouch was refused by the hub** (`golden_behind_fleet`: golden 0.301.0
is behind the fleet's controller 0.302.0), so new installs keep agent 0.150.0 until the weekly bake. No controller release
(no controller code changed). CI: one lost job (felhom.eu run 1497, every step failed with no log) re-run once → success
(R-887 count +1).
**Instruction-file edits:** `.claude/rules/unprompted-work.md` §3 item 11 added in all five copies (operator ruling,
decision 160).
**Helpers:** each prompt carried the brief's fences in full (rule 11). **Security note** on `hub/internal/api/handler.go`
(raised by a background review, no detail): the last three changes log box/customer ids and counts only — nothing fixed.
**Teardown:** Tester 1 — vaultwarden removed through the product (no container, no volume), the saved
`controller.yaml.pre-r892` shredded, pointer restored identical; demo-hp — the one press made a normal local copy (kept
by retention), nothing else; hub — nothing provisioned. The night report stays in `REPORT-night-burndown-2026-10-06.md`.
**Teardown:** Tester 1 — spike entries, ESP flag, BootNext loader/entry and watchdog config removed; VM 341's test
watchdog device removed; default 7.0.2-6 (running). demo-felhom — the same; default 7.0.2-6; Proxmox userspace now 9.2.21.
demo-hp — the same; default 7.0.14-20. 7.0.14-20 is installed on Tester 1 and demo-felhom (booted healthily in the
spike) but not their default. Hub — nothing provisioned.
## Two decisions for you
1. **The kernel lane's promise:** may a box restart at night for a kernel update, and do we tell the household? My pick:
yes, with one line in the household's mail the day before. If you do nothing: kernels stay manual.
2. **The pool box clean-up (~2.7 GB):** give me the pool box's main-account login for one session, or delete the
folders yourself in the Hetzner console. My pick: you delete them in the console (no new credential on DooPlex). If
you do nothing: the leftovers stay; nothing reads them.