admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

hub v0.46.0: observability pass — per-box log pulls, bundle custody, 72h TTL + secret gate

Browse Source 
log_bundle_requests + log_bundles store (gzip, newest-3, 72h TTL purged on the
60s sweep); SaveLogBundle secret gate fail-closed (blocked flag row, no payload;
REDACTED/checksums pass). Report ACK gains controller_log_requested + ingests
controller_log_tail; heartbeat envelope gains log_tail_requested + ingests
log_tail (consume-once on arrival; pre-0.83 agents stay visibly pending). Host
detail Diagnostics section: request buttons (controller/agent), state rows with
honest latency hints, View/Download endpoint. Red-proofs: gate disabled and
clear-on-arrival removed both FAIL their tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
This commit is contained in:
authentik Default Admin
2026-07-11 16:57:47 +02:00
parent 1ee5559772
commit e35b1ae0e6
13 changed files with 898 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hub/CHANGELOG.md
+28
View File
@@ -1,5 +1,33 @@
# Felhom Hub — Changelog
## v0.46.0 — observability pass: per-box log pulls, bundle custody, TTL + secret gate (2026-07-11)
Hub third of the cross-repo observability task (agent v0.83.0 + controller v0.116.0): remote,
pull-only access to both box components' always-DEBUG capture rings — honest to the sovereignty
posture (the hub never connects in; the box pushes on its own cycle and its own log records the
pull, customer-visible).
- **Store** (`internal/store/logbundle.go` + schema): `log_bundle_requests` (one pending intent per
scope+component; scope = customer_id for the controller/report channel, host_id for the agent/
heartbeat channel) + `log_bundles` (gzip payload, newest-3 retention, **72 h TTL** purged on the
existing 60 s sweep). `SaveLogBundle` runs the **token-pattern secret gate BEFORE storing** —
a hit stores a `blocked: possible secret` flag row with NO payload (fail-closed; WARN logged
hub-side); `[REDACTED]` shapes and public checksums deliberately pass (red-proof: gate disabled →
the planted `re_…` token stores → FAIL).
- **Channels** (additive, both directions): the report ACK gains `controller_log_requested` and
ingests `controller_log_tail`; the heartbeat envelope gains `log_tail_requested` and ingests
`log_tail`. Consume-once on arrival (red-proof: clear-on-arrival removed → the ACK re-advertises
forever → round-trip tests FAIL). A pre-0.83 agent simply never fulfills — the request stays
visibly `pending` (S6 tested), harmless.
- **UI** (host detail, English like the rest of the hub operator surface): a Diagnostics section
with **Request controller logs / Request agent logs** buttons (CSRF form posts), state rows
(`pending` with the honest per-channel latency hint — controller ≤ ~15 min report interval,
agent ≈ heartbeat cadence — / `available` with View+Download / `blocked`), and the 72 h custody
note. The hosts read-only invariant is amended: these two request forms are the ONLY actions
(pinned by test).
- Download endpoint `/hosts/{id}/log-bundles/{bid}[?download=1]` — session-authed like the rest of
the operator UI, scoped to the host's own channel scopes.
## v0.45.0 — floor-UI separation + effective-floor source + per-box MinAgent conditional floor (2026-07-11)
Two parts of the NAS/coupling backlog, both addressing the publish-train 0.81/0.113 floor footguns.