admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: F-CRIT-2 shipped (agent v0.106.0) — OPEN-ITEMS, campaign doc, report

Browse Source 
F-CRIT-2 marked SHIPPED + PROVEN-LIVE: NewestArchiveTime now counts only
plausibly-complete entries (measured 1 MiB floor), verified by replaying
campaign fault 2 on demo-hp in both directions.

Files two follow-ups:
- R-99: prune never REMOVES phantoms. It does NOT count them toward keep-last
  (dry-run kept 2 real + the phantom), so there is no retention/data-loss bug —
  but they accumulate one per aborted upload.
- F-CRIT-1: filed READY-HIGHEST. Campaign 8's other HIGH finding, untouched by
  this fix.
This commit is contained in:
authentik Default Admin
2026-07-28 08:08:56 +02:00
parent 33a7cc51d3
commit d0cec9d3f3
3 changed files with 61 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
documentation/audits/CAMPAIGN-8-backup-restore-2026-07-27.md
+18 -1
View File
@@ -266,7 +266,7 @@ Neither restored guest was booted — deliberately, see F-OPS below.
| # | Finding | Severity | DEFECT / ARTIFACT |
|---|---|---|---|
| **F-CRIT-1** | An app that fails to restart after a quiesce **never alarms** | **HIGH** | **DEFECT** (compression-independent) |
| **F-CRIT-2** | A failed offsite backup leaves a phantom snapshot that **resets tier freshness** | **HIGH** | **DEFECT** (worse on real cadences) |
| ~~**F-CRIT-2**~~ | ~~A failed offsite backup leaves a phantom snapshot that **resets tier freshness**~~ — **FIXED, agent v0.106.0 (2026-07-28), re-tested live by replaying fault 2** | ~~HIGH~~ | DEFECT — closed |
| **F-A1** | A restore-test in progress makes a healthy backup report as FAILED, arms the breaker and pages the operator | MEDIUM | **DEFECT** in behaviour / ARTIFACT in frequency |
| **F-HUB** | The hub **dropped an event** under concurrent load (`SQLITE_BUSY`), no retry, cause unnamed | MEDIUM | DEFECT (frequency compression-influenced) |
| **F-LEAK** | A **failed** restore-test cannot destroy its own scratch guest (403 `VM.Allocate`); leaks are never reclaimed and the 10-slot VMID band shrinks silently | MEDIUM | DEFECT (root-caused by fault 18) |
@@ -336,6 +336,23 @@ Frequency is an ARTIFACT; the behaviour is a DEFECT — at real cadences a ~12-m
against a daily backup collides roughly once per 420 guest-days, i.e. **every ~4 days on a
100-guest fleet**, forever training R-97a's alarm into noise.
### F-CRIT-2 — FIXED (agent v0.106.0, 2026-07-28)
`NewestArchiveTime` now counts only *plausibly complete* entries, via a measured size floor
(`minPlausibleArchiveBytes` = 1 MiB; smallest real backup on the fleet is 612,397,450 B, so 584x
headroom, asserted by a test). Undecidable ⇒ not counted. Size is the only tier-agnostic
discriminator: `verification` and `encrypted` are absent on every local dir archive and on a good
PBS snapshot until verify-new catches up, so gating on either would have rejected 100% of local
backups and caused fleet-wide backup thrash.
Verified by replaying fault 2 against the fixed agent on demo-hp: the phantom was created, rejected,
and announced once; the tier was correctly reported DUE and backed up; and the inverse case showed
no re-backup thrash (with 91 scheduler ticks proving the loop was alive). Detail:
`felhom-agent/REPORT.md`.
**Also settled:** server-side prune does NOT count phantoms toward `keep-last` — a dry-run retained
two real snapshots PLUS the phantom — so the feared retention/data-loss scenario does not occur. It
never removes them either; filed as R-99.
*(Full write-ups for every finding, with complete evidence, are in `~/campaign8/evidence/phaseB/`.)*
---