From b2a1db1363bc054156a3325f01ec7c8a256e1827 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Sat, 18 Jul 2026 09:05:45 +0200 Subject: [PATCH] docs: publish train 0.90/0.143 + golden + N100 v1.20.0 ISOs run (2026-07-18); R-4 DMARC staged --- documentation/backlog/ROADMAP.md | 2 +- .../RUNBOOK-publish-0.90-0.143-2026-07-18.md | 161 ++++++++++++++++++ 2 files changed, 162 insertions(+), 1 deletion(-) create mode 100644 documentation/pilot/RUNBOOK-publish-0.90-0.143-2026-07-18.md diff --git a/documentation/backlog/ROADMAP.md b/documentation/backlog/ROADMAP.md index d07b17f..b6db608 100644 --- a/documentation/backlog/ROADMAP.md +++ b/documentation/backlog/ROADMAP.md @@ -23,7 +23,7 @@ | R-1 | **Peti convergence:** clean-slate proxmox2 reinstall (spec'd 07-15), first live auto-confirm, supervised escrow ceremony, execute parked publish trains (agent 0.81→0.88, controller → 0.137) | L | spec'd | Flips: publish train PARTIAL→PROVEN-LIVE; appliance/BYO/day-0 "real customer" notes; escrow ceremony. The single biggest unproven surface — an alpha where fixes can't ship remotely is dead. **Reinstall arc SHIPPED hub v0.57.0 (2026-07-16):** the clean-slate reinstall-of-existing-customer path is now first-class — claim re-issue (F2), offsite re-issue (F3), escrow-honesty-on-re-issue (2.3) all auto-fire on re-enrollment. Peti's proxmox2 clean-slate now walks a supported path | | R-2 | ~~Resolve ~215 lines of foreign WIP in felhom.eu clone (`hub/internal/notify/`, `store.go`, `hub/internal/claim/`)~~ | S | **killed** (2026-07-16) | Not a real issue: the "foreign WIP" was in-flight code from a concurrent CC session on the customer-claim arc, snapshotted before it committed. All of it landed cleanly — `notify/`+`claim/engine.go` in `6b40eb8` (v0.50.0), `store.go` in `a1d0450` (v0.54.0), plus follow-up `e205a2d`; v0.55.0 shipped. Working tree is clean, no stashes. Lesson already codified: never run two writing sessions on one felhom.eu clone (CLAUDE.md §git add -A) | | R-3 | Friend-alpha onboarding runbook (generalized from `pilot/RUNBOOK-peti-return-2026-07-13`): hardware prep → golden → install → claim → ceremony → "first restore by the customer" scripted step | M | idea | Flips: "customer performs a restore" MISSING row; produces the tester-agreement sibling of `PETI-tester-agreement.md`. **Next from-scratch rehearsal to include customer DELETE + re-create** — the ESCROW cascade is now DEFINED (hub v0.60.1): host delete DEMOTES escrow to retained custody (never destroys), customer Danger-zone delete PURGES it (the one true purge point). **S6b (manual stale-host delete before re-enroll) is OBSOLETE** — re-enrollment upserts the existing host row cleanly (`store.UpsertHost` ON CONFLICT DO UPDATE; `handleAdminCreateHost` no duplicate refusal) + the v0.57.0 arc auto-fires the re-issues; the rehearsal live-confirms it. **NON-escrow offboarding NOW ANSWERED by the middle-tier Customer RESET (hub v0.61.0, LIVE):** one operator action deprovisions the Hetzner sub-account/box (repo data destroyed), destroys the PBS namespace + backup groups + token, clears the DR recipe / one-time secret / claim state / retained escrow custody (separate ack) — identity + basic config survive. WG peer release rides host delete (peers are host-scoped, gone before RESET runs — RESET refuses while any host row exists). **Remaining consistency gap:** the customer Danger-zone DELETE still leaves host rows and does NOT run the offsite/PBS teardown (RESET is the teardown path; DELETE is escrow-purge + config-drop). Decide whether DELETE should require a prior RESET (or subsume it) — new item R-25b | -| R-4 | Claim-code deliverability: test-send to gmail.com / freemail.hu / citromail.hu / t-online.hu; tighten DMARC `p=none` → `p=quarantine` (pending since email.md 02-04) | S | idea | A claim code in spam bricks onboarding at step 1. Cheap, do before first invite | +| R-4 | Claim-code deliverability: test-send to gmail.com / freemail.hu / citromail.hu / t-online.hu; tighten DMARC `p=none` → `p=quarantine` (pending since email.md 02-04) | S | **DNS half staged (2026-07-18)** | A claim code in spam bricks onboarding at step 1. Cheap, do before first invite. **DMARC change prepared** (`RUNBOOK-publish-0.90-0.143-2026-07-18` Phase 4): target `_dmarc` TXT `v=DMARC1; p=quarantine; rua=mailto:admin@felhom.eu`; alignment confirmed safe (SES/Resend DKIM `d=felhom.eu` + relaxed `send.` SPF). No felhom.eu-zone CF edit token on 180 → **Path B: Viktor applies via CF dashboard**, then `dig` gate. **Test-send half (gmail + freemail.hu, `dmarc=pass` check) remains Viktor's** — open | ## P2 — during alpha diff --git a/documentation/pilot/RUNBOOK-publish-0.90-0.143-2026-07-18.md b/documentation/pilot/RUNBOOK-publish-0.90-0.143-2026-07-18.md new file mode 100644 index 0000000..79439e5 --- /dev/null +++ b/documentation/pilot/RUNBOOK-publish-0.90-0.143-2026-07-18.md @@ -0,0 +1,161 @@ +# RUNBOOK — publish train 0.90/0.143 + golden + universal N100 ISO + DMARC quarantine (2026-07-18) + +**Class:** Runbook-style operational run (NO code changed anywhere). **Executor:** CC, with two +password-gated **STOP → Viktor** points (hub UI + Cloudflare — CC cannot perform). +**Status:** Phases **0, 1, 2, 5 COMPLETE** (all CC gates green); Phases **3 (manifest+floor)** and +**4 (DMARC apply)** are the operator handoff below. + +--- + +## Results at a glance + +| Phase | What | Outcome | +|---|---|---| +| 0 | pre-flight (baselines, 404 pre-gates, serials) | ✅ all green | +| 1 | publish felhom-agent 0.90.0 | ✅ published, sha-chain identical 5 places | +| 2 | build + publish golden 0.143.0 | ✅ published, round-trip + teardown grep=0 | +| 3 | **STOP → Viktor:** manifest vouch + floor | 🛑 pending (values below) | +| 4 | DMARC `p=none` → `p=quarantine` | 🛑 pending (Path B — Viktor, CF dashboard) | +| 5 | build v1.20.0 universal pairing ISOs | ✅ safety + real built, verified | + +**The four operator values for the hub Day-0 manifest (Phase 3):** +``` +AGENT_VERSION=0.90.0 +AGENT_SHA256=18c48272228940373ba567b79e63832c292fb802abb83bf4f7b277ebed15a93c +GOLDEN_VERSION=0.143.0 +GOLDEN_SHA256=ded3cfc210f6ee76e6dd125879eb508467af91d83d32a0e79d53473d5e102a2e +MIN_AGENT=0.90.0 (declared by controller v0.143.0) +FLOOR=v0.143.0 (save LAST) +``` + +--- + +## 1. Baselines used (verified 2026-07-18 against live Gitea — unchanged vs the spec) + +| Repo | `main` @ | Version | +|---|---|---| +| felhom-controller | `a4a7de3d` | v0.143.0 (MinAgent 0.90.0) — image already in registry (built+deployed 07-17) | +| felhom-agent | `8208a80c` | v0.90.0 — deployed both demo agents | +| felhom.eu | `cfdcb50b` | hub v0.66.0, scripts v1.20.0 | + +## Phase 0 — pre-flight ✅ + +- **Package pre-gates:** `felhom-agent/0.90.0` = **404**, `felhom-golden/0.143.0` = **404** (nothing to + overwrite; immutability respected). +- **Controller image:** `gitea.dooplex.hu/admin/felhom-controller:0.143.0` running on guest 9201, + `Up (healthy)` — pullable from registry (not rebuilt). +- **N100 disk serials (harvested pre-wipe):** + - Internal SSD `/dev/sda` — **AirDisk 512GB SSD**, `ID_SERIAL_SHORT=QDF922W009654S30EX` — backs the + `pve` VG (`/dev/sda3` → `pve-root`, mounted `/`) = **install target**. + - External HDD `/dev/sdb` — **TOSHIBA MQ04ABF100**, `ID_SERIAL_SHORT=65NOP3HDT` — the secondary-backup + drive; the install filter must **not** match it. + - (SD card `/dev/sdd` present, irrelevant.) Serials match the prior v1.16.0 run exactly (box unchanged). + +## Phase 1 — publish felhom-agent 0.90.0 ✅ + +Published the **live-deployed** binary (not a rebuild). **SHA_A = `18c48272228940373ba567b79e63832c292fb802abb83bf4f7b277ebed15a93c`**, byte-identical across **five** points: +felhom-pve `/usr/local/bin/felhom-agent` → local `/tmp` → build-server `/tmp` → published package → +independent **anonymous** GET. `publish-agent.sh 0.90.0`: pre-delete **404**, PUT **201**, round-trip GET +sha match. Package: `https://gitea.dooplex.hu/api/packages/admin/generic/felhom-agent/0.90.0/felhom-agent` +(anon GET **200**, 13 801 829 bytes). Registry token sourced on the build server, never echoed. + +## Phase 2 — build + publish golden 0.143.0 ✅ + +Drill VM on 180 reverted to `virgin`, booted with the recorded qemu line (drill-vm-golden-bake memory — +`-cpu host -smp 4 -m 8192`, `if=virtio,cache=writeback`, slirp `hostfwd :2222`). Template resolved live +(rots): **`debian-13-standard_13.6-1_amd64.tar.zst`** (checksum OK). `build-golden.sh` v2.0.0 as a +transient unit baking `felhom-controller:0.143.0`: + +- overlay2; **all 3 mounts included** (rootfs + mp0 `/var/lib/docker` + mp1 `/mnt/sys_drive`), no FATAL/exclusion. +- archive **612 397 450 bytes**; pre-delete **404**, PUT **201**. +- **GOLDEN_SHA256 = `ded3cfc210f6ee76e6dd125879eb508467af91d83d32a0e79d53473d5e102a2e`**. +- **Gate:** independent anon GET of `felhom-golden/0.143.0/golden.tar.zst` → **200**, 612 397 450 bytes, + sha **matches**. +- **Teardown (GL-1):** build guest 9100 `--purge`d; in-VM token/script/log `shred`ded; VM powered off; + qemu exited; qcow2 reverted to `virgin` (snapshot intact, exactly-as-found); staged token on 180 + shredded. **Token-leak grep of the saved log (literal value) = 0.** Evidence: `180:~/drill/bake-0.143.0.log`. + +## Phase 3 — STOP → Viktor: manifest vouch + floor 🛑 PENDING + +hub.felhom.eu → Configuration, **in this order** (vouch first, floor LAST): +1. **Day-0 artifacts:** Agent → `0.90.0` (sha auto-read must equal `18c48272…`), Golden → `0.143.0` + (sha must equal `ded3cfc2…`), **Min agent → `0.90.0`** → **Save artifact manifest**. +2. **Managed updates:** global floor → **`v0.143.0`** → save **LAST**. + +Expected fleet effect (verify, don't assume): **demo (9201)** already on 0.143.0 → no-op. **Peti's box** +agent 0.81 < MinAgent 0.90.0 → the hub **HOLDS** the floor for it and flags it (designed, not an error) — +confirm the hold/flag renders on his customer page and note it. + +## Phase 4 — DMARC `p=none` → `p=quarantine` 🛑 PENDING (Path B — Viktor) + +- **Current** (`dig +short TXT _dmarc.felhom.eu @1.1.1.1`): `"v=DMARC1; p=none;"`. +- **No felhom.eu-zone Cloudflare DNS-edit token on 180** (standing posture = per-customer zone-scoped + tokens only) → **Path B**: Viktor sets the record in the Cloudflare dashboard. +- **Target** `_dmarc` TXT (overwrite content only — touch nothing else): + ``` + v=DMARC1; p=quarantine; rua=mailto:admin@felhom.eu + ``` +- **Alignment confirmed safe:** felhom.eu SPF `v=spf1 include:_spf.mx.cloudflare.net ~all`; + `send.felhom.eu` SPF `v=spf1 include:amazonses.com ~all` (Resend/SES, DKIM-signs `d=felhom.eu`) — so + `quarantine` does not endanger legitimate mail. +- **Gate after Viktor applies:** `dig +short TXT _dmarc.felhom.eu @1.1.1.1` must show `p=quarantine`. +- Viktor's manual deliverability test-send (gmail + freemail.hu, check `dmarc=pass` in + Authentication-Results) remains **his** follow-up half of R-4. + +## Phase 5 — v1.20.0 universal pairing ISOs ✅ + +Built on 180 from `~/git/felhom.eu` @ `cfdcb50` (scripts v1.20.0), assistant `felhom-iso-assistant:trixie`. +**Input PVE ISO:** `proxmox-ve_9.2-1.iso`, sha256 `4e88fe416df9b527624a175f24c9aa07c714d3332afb1ee3dbf3879573ef2c6c` +(the exact recorded July input, at `180:~/drill/`). Both builds: pairing mode, **build manifest +`secret-bearing: no`**, loader `mkimage`, script v1.20.0. + +**Build 1 — safety pre-flight ISO** (`profiles/n100.profile` AS-IS, `--pairing`): +- `180:~/felhom-iso/out/felhom-pve-9.2-1-v1.20.0-n100-generic-mkimage.iso` +- sha256 **`2e1107a15ea2abd892426661a853610dfb2ff49ec1d3e7561a876a393d4ea5c7`**, 1 704 417 280 bytes +- embedded answer.toml: `filter.ID_SERIAL_SHORT = "REPLACE-WITH-TARGET-SSD-SERIAL"` (**match-nothing** → + installer aborts fail-safe, touches no disk — S5c). Purpose: prove the mkimage loader boots the real + board before anything destructive. + +**Build 2 — real install ISO** (uncommitted working profile `180:~/felhom-iso/n100-demo.profile`, +`--pairing`; profile mirrors the prior v1.16.0 run + the two allowed v1.20.0 deltas): +- `180:~/felhom-iso/out/felhom-pve-9.2-1-v1.20.0-n100-demo-generic-mkimage.iso` +- sha256 **`69cd7ba5872bb02c4977959bfe97312690f3a164937e71609bb987ac93e435dc`**, 1 704 417 280 bytes +- embedded answer.toml verified: `fqdn = "demo-felhom.local"`, `filter.ID_SERIAL_SHORT = + "QDF922W009654S30EX"` (internal SSD; **≠** external HDD `65NOP3HDT` → backup drive protected), + `root-ssh-keys = ["ssh-ed25519 …Dcz HFRDa7C kisfenyo@windows"]` (durable break-glass, baked). +- **Operator decisions (confirmed with Viktor this run):** FQDN `demo-felhom.local` (mirror prior run, + satisfies "only deltas = version + serial"); bake the `kisfenyo@windows` ed25519 key (durable + post-wipe access, as the prior physical run). The working profile is **not committed** (serial + key). + +## Observations (recorded, NOT acted on) + +- The committed `profiles/n100.profile` ships FQDN `felhom-host.local` and no baked key; the real-ISO + profile intentionally diverges (Viktor's confirmed decisions above). No repo change made. +- PVE input kept at the recorded `9.2-1` (no newer release substituted for the rehearsal). +- `build-felhom-iso.sh` / `publish-agent.sh` exec bits are stripped by a plain `git` checkout on 180 — + invoked via `bash`. Cosmetic, not a defect. + +--- + +## Viktor handoff checklist + +**A. Hub (Phase 3), in order:** Day-0 artifacts → Agent `0.90.0` / Golden `0.143.0` / Min agent `0.90.0` +→ Save artifact manifest → **then** Managed updates floor → `v0.143.0` → save (LAST). Confirm Peti's +box shows the MinAgent hold/flag. + +**B. DNS (Phase 4):** Cloudflare → felhom.eu zone → `_dmarc` TXT → `v=DMARC1; p=quarantine; rua=mailto:admin@felhom.eu`. +Then `dig +short TXT _dmarc.felhom.eu @1.1.1.1` should show `p=quarantine`. Test-sends (gmail + freemail.hu) += your R-4 half. + +**C. N100 bare-metal rehearsal (unblocked by this run):** +1. **Flash the safety ISO first** → boot the N100 with **Secure Boot OFF** (mkimage is unsigned; + SB-enforcing fails `Access Denied`, proven) → expect: loader boots + installer aborts fail-safe, + **touches no disk**. +2. Then flash the **real ISO** for the rehearsal. +3. Hub pre-steps, in order: **host delete** for the demo host (escrow ack → custody demoted, not + destroyed) → **customer RESET** (refuses while a host row exists → delete first) → boot the ISO → + console shows the Hungarian pairing-code banner → **bind** (prefer the self-bind flow to live-validate + R-27 slice 1) → day-0. + +Both ISOs + sha256 + manifest are on `180:~/felhom-iso/out/`. This run unblocks the R-1 supervised +rehearsal and closes the DNS half of R-4 once B is applied.