From e1b679782a7d9928a70cae5c6d34aa9c9fc8253d Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Wed, 12 Aug 2026 14:05:15 +0200 Subject: [PATCH] REPORT: record corrected, second promise closed, removal chain code-only --- REPORT.md | 109 ++++++++++++++++++++++++++++++++++++------------------ 1 file changed, 73 insertions(+), 36 deletions(-) diff --git a/REPORT.md b/REPORT.md index ea61ebc..3df55ae 100644 --- a/REPORT.md +++ b/REPORT.md @@ -1,49 +1,86 @@ -# REPORT — installer golden gate + golden 0.211.0 bake (2026-08-10) +# REPORT — the record, the second promise, the removal chain (2026-08-12) -Commits `eb60087` (R-297 installer) and `999b0a3` (bake evidence). CI run **299** → `success`. -All eight `repo_gates.py` gates OK, including `golden-currency`, which this run took from RED to GREEN. -**`--no-verify` was not used at any point** — the currency gate refused an earlier push and that -refusal was respected until the bake made it true. +Commits `f76cbf0` (Part 0), `2389544` (spec + bake evidence), `125aec1` (R-300), `890a474` (STATUS). +Controller: `68f3e12` (R-299). All gates green in both repos; **`--no-verify` used nowhere** — the +currency gate refused a push mid-session and stayed refused until the bake made it true. -## R-297 — an install takes the golden you approved +## Part 0 — the record now says what is true -`felhom-host-install.sh` v1.26.0. Step 7 short-circuited on ANY local archive: no version compare, -no digest, no warning, so the manifest's sha256 — which vouches from a different trust root than the -code host — was consulted only on the fetch path. Discovery is `sort | tail -1`: correct by recency, -never by verification. +Re-read from the hub's own store, with a control (escrow query returns 1+1 for each demo box, 0+0 for +`drill-r50`). Confirmed: **3 hosts total, no peti row under any name**; 4 escrow rows hub-wide, all +demo; `host_deletions` id=1 `peti-felhom-86d37d` **2026-07-15 08:56:22**, `escrow_acked = 0`; last +report **2026-07-15 08:39:00 UTC**, controller 0.115.0, `offsite: {escrow_state: "pending", +snapshot_count: 0}`; local app-data repo empty; dashboard never claimed. The `PETI` row and `STATUS.md` +now state that the mitigation they named **does not exist** — and leave the parked/not-parked ruling +open, because that is the operator's and the fact does not need his opinion to be true. -`golden_local_matches_manifest()` compares digest first (a match means it IS the vouched artifact), -then the controller tag baked at `/etc/felhom-controller-image`. Auto-discovered mismatch → ignore -and fetch the vouched one; operator-named (`--golden`) mismatch → REFUSE, never silently substitute; -unreadable manifest → refuse rather than pass. +**Contact since the deletion — answered without touching the machine.** No inbound row of any kind +after 2026-07-15 08:39; the only later rows are the hub's OWN alarms (`source = hub`: `node_stale` +09:09:32, `node_down` 09:39:32). No contact attempt, accepted or rejected, in the current hub pod's +logs (since 2026-08-09 17:26Z) — grep proven by **851 `demo-hp` hits against 0 for peti, 0 +unauthorized**. **The window 2026-07-15 → 2026-08-09 cannot be answered from records**: a report from a +deleted host 401s and is not persisted, and those logs are gone. -**Measured on real hardware:** three goldens sit on `demo-hp` carrying controller **0.153.0** and -**0.210.0**, and nothing compared either to the vouched version before use. +## Part 1/2 — the second promise (controller v0.212.0) -**NOT PUBLISHED.** The task asked that a fresh install be watched taking a stale local golden on -`drill-r50` BEFORE the fix. That was not done, so `installer-v1.26.0` is deliberately not cut and -`webpage.yaml` is untouched — pushing to `main` publishes nothing (R-110). Publishing an unobserved -change to the one artifact that runs as root on a virgin box is the failure this project keeps -writing rules about. +`backups_remote.html` line 98 — the **always-visible** half — still ended *„…visszaállíthatók +lehetnek"*. Replaced; the two accurate halves kept. -## Golden 0.211.0 — baked, published, round-trip verified +**Why it survived, which is the useful part:** the spec called that line *"Accurate; keep"*, **and the +guard matched one INFLECTION** (`visszaállítható lehet`) that the plural does not contain. Guard +broadened to the stem `visszaállíthat`. Spec corrected in both places. -Full evidence: `documentation/tests/golden-0.211.0-2026-08-10/` (`bake.log` + `RESULT.md`). +**Plant → convict → remove → pass:** planted the exact shipped plural → the stem guard **FAILED** and +quoted it back; the old singular guard **does not match that sentence at all** (`False`, shown as a +pure string fact, not a contaminated source grep); removed → 5/5 orphan-card tests pass. -- `GOLDEN_SHA256=8593516889eb93fe1691410d7306be8cb87ee835b8d2378740eb34022272f849` -- Served bytes re-downloaded and hashed → identical. 656 141 689 B. -- All six acceptance markers counted (two initially returned a false `0` through broken shell - quoting and were re-run with `grep -F` — a 0 from a broken instrument is not a measurement). -- Token never on a command line; leak grep on the committed log = 0, and that 0 was made believable - by first proving the grep finds a planted token. -- Drill VM reverted to `virgin` before and after; build guest destroyed `--purge`; `/root` residue empty. +Two instrument defects fixed on the way: the guard's failure message sliced rendered HTML at a **byte** +offset and cut Hungarian mid-character (now rune-safe); and a first pass at the bake's acceptance +markers returned a false `0` through shell quoting — re-run with `grep -F`, because a zero from a +broken instrument is not a measurement. -## Registers +## Part 3 — the removal chain (R-300), CODE ONLY -R-295 (PARTIAL — hub half open), R-296, R-297, R-298 filed. Ceiling moved R-294 → **R-298**. +Confirmed at source: uninstall removes the snippet and **restarts** (`:1075-1082`), leaving the unit +enabled; the byo preflight then refuses on `:53`. -## NOT DONE +**The prompt's framing needed one correction:** the installer does **not** install dnsmasq — the +**agent** does (`lanresolver.go:107`), conditionally, and `felhom-agent` is fenced this session. So +ownership is recorded at **preflight**, before anything is installed, which is the only moment it is a +fact — not a package mtime. At removal: Felhom's → stop+disable; the owner's → restart only; **no +record (every box in the field) → restart only, fail-safe, with the reason and the command logged.** +The refusal keeps its two routes and its promise, and gains the missing line naming our own leftover. -- **The Day-0 vouch** — the operator's, deliberately not made here. -- **Part 2** (uninstall leaves `dnsmasq` bound to :53) — dropped first, per the task's drop order. -- **Part 4a** (hub half of the code naming, and its emails) — dropped second, filed as R-295 PARTIAL. +**NOT OBSERVED LIVE.** The `drill-r50` install→uninstall→install cycle was not run, so the wrong +outcome was never quoted and **no `installer-v1.27.0` tag is cut.** + +## Golden 0.212.0 — baked, published, round-trip verified + +`4b0a7dacc503c38732ed0a44949398639248c7fbd90758a1e4a047c21a7a15d8`, 656 611 277 B, served bytes +re-downloaded and hashed identical. All six markers counted with `grep -F`. Token never on a command +line; leak grep 0, believable because a planted-token control grepped 1. Drill VM reverted to `virgin`. +Evidence: `documentation/tests/golden-0.212.0-2026-08-12/`. + +## DROPPED — named plainly + +- **The hub half of the naming (R-295)** — dropped first, exactly as the drop order allows. The four + hub surfaces were NOT enumerated at `file:line`; that enumeration is still owed. +- **The stale-golden observation (R-297)** — dropped second. Nothing published, which is the safe state. +- **And one that was NOT droppable: R-300's live cycle.** The code shipped; the demonstration did not. + Named here rather than shortened silently. + +## Observations, not acted on + +- **R-301** — the abandon countdown banner (`layout.html:143`) states the retired promise a third time + and un-hedged. It is probably TRUE where it renders, and it renders on every page; a rebuilt box can + have an active countdown while its store is orphaned. Not established: whether the two sentences name + the same bytes. Left alone deliberately — this session was fenced to the orphan card. +- The orphan card now says "we cannot determine / it depends on the key / write to us" **twice** once a + customer clicks through — reinforcement at the decision point rather than a contradiction, but worth + an eye if the card is revisited. + +## Deliberately out of scope + +The CI runs that fail with no log; the twenty facts the machines report that nothing reads; the nine +grey claims; the storage page's separate empty-list cause (R-298); and proving a *retained* key can +actually open an old store — the one thing the retention fix has never been shown to do.