OS updates guest fast lane: records — 11 §8.1 BUILT, 03 cloudflared corrected, 07 §6.1 OS leg, 00 PARTIAL, monthly runbook infra pins, golden 0.291.0 record + vouch, register 331 -> 333 (R-837/838/726/843 closed; R-840/841/842/844/845 opened), STATUS, report

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-10-04 11:41:50 +02:00
parent e55b2ceb63
commit e78726314e
25 changed files with 1573 additions and 18 deletions
@@ -0,0 +1,58 @@
+# Golden 0.291.0 — bake + publish, 2026-10-04
+
+Procedure: `documentation/runbooks/RUNBOOK-manual-build.md` §4.0 and §4.1 steps 1–4, in the drill VM
+on DooPlex. Step 5 (vouching in the hub) was **not** done; it is the operator's act.
+
+- Controller image: `gitea.dooplex.hu/admin/felhom-controller:0.291.0` (manifest present in the
+  registry before the bake).
+- Build script: `felhom-agent/configs/build-golden.sh` v3.0.0, agent repo `main` = `a55eedcf2cc1`
+  (tree clean, HEAD == origin/main after `git fetch`); sha256 of the copy in the VM matched the repo
+  file (`e4c9ede772e7…`, the same script bytes as the 0.290.0 bake).
+- Drill VM: reverted to `virgin`, cold-booted per §4.0; `pveversion` = `pve-manager/9.2.2`.
+- Step 2: `pveam update` → `update successful`; template `debian-13-standard_13.6-1_amd64.tar.zst`
+  (the only `_amd64` debian-13 entry), downloaded with checksum verified.
+- Pre-gate: `GET …/generic/felhom-golden/0.291.0/golden.tar.zst` → **404** before the bake.
+- Token: copied file → file (`scp`); launched via the in-VM runner script as transient unit
+  `golden-bake`. `systemctl show golden-bake -p Environment -p ExecStart | grep -c -F <token>` = **0**
+  (control: same output with the token appended = **1**).
+
+## Result
+
+```
+GOLDEN_VERSION=0.291.0
+GOLDEN_SHA256=64c2fe5d58d65706185023b359c42843ecd2d215298dd29febfc983ad43e11fb
+```
+
+## Pass markers (quoted verbatim from `bake.log`)
+
+```
+83:  docker OK (overlay2; data-root /var/lib/docker)
+319:INFO: including mount point rootfs ('/') in backup
+320:INFO: including mount point mp0 ('/var/lib/felhom') in backup
+325:[golden]   pre-delete existing: HTTP 404 (404/204 expected)
+326:[golden]   upload OK (HTTP 201)
+```
+
+`grep -E 'excluding|FATAL' bake.log` → no matches.
+
+## Token-leak grep
+
+On the copy in this directory (the one that would be committed):
+`grep -c -F "$(cat ~/.gitea-token)" bake.log` = **0**.
+Positive control: a throwaway copy with the token appended → **1**; the copy was `shred -u`'d.
+Same 0 / 1 result on the scratch copy pulled straight from the VM.
+
+## Round trip
+
+See `02-round-trip.txt`: the published package downloaded anonymously (HTTP 200, 648807981 bytes)
+hashes to `64c2fe5d58d65706185023b359c42843ecd2d215298dd29febfc983ad43e11fb` — **matches**
+GOLDEN_SHA256.
+
+## Teardown state
+
+- `pct destroy 9100 --purge` → rc 0 (both LVs removed); `pct list` empty.
+- `/root/.gitea-token`, `/root/bake-run.sh`, `/root/bake.log` in the VM: `shred -u`, confirmed absent.
+- VM powered off; no `qemu-system-x86` process remained.
+- `qemu-img snapshot -a virgin drill.qcow2` → OK; snapshot list shows only `virgin`.
+- Hub, k3s, demo boxes, ep0, PBS, Storage Box: not touched.
+- `df -h`: `/mnt/5_hdd` 37 %, `/` 53 % (before and after).