From ee4e061d2b55ebdfe9c5e8560ba2e613a7b226b6 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Sat, 18 Jul 2026 09:21:12 +0200 Subject: [PATCH] =?UTF-8?q?docs:=20publish=20train=200.90/0.143=20COMPLETE?= =?UTF-8?q?=20=E2=80=94=20Viktor=20manifest/floor=20+=20DMARC=20quarantine?= =?UTF-8?q?,=20CC-verified?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- documentation/backlog/ROADMAP.md | 2 +- .../RUNBOOK-publish-0.90-0.143-2026-07-18.md | 59 +++++++++---------- 2 files changed, 30 insertions(+), 31 deletions(-) diff --git a/documentation/backlog/ROADMAP.md b/documentation/backlog/ROADMAP.md index b6db608..f48acf5 100644 --- a/documentation/backlog/ROADMAP.md +++ b/documentation/backlog/ROADMAP.md @@ -23,7 +23,7 @@ | R-1 | **Peti convergence:** clean-slate proxmox2 reinstall (spec'd 07-15), first live auto-confirm, supervised escrow ceremony, execute parked publish trains (agent 0.81→0.88, controller → 0.137) | L | spec'd | Flips: publish train PARTIAL→PROVEN-LIVE; appliance/BYO/day-0 "real customer" notes; escrow ceremony. The single biggest unproven surface — an alpha where fixes can't ship remotely is dead. **Reinstall arc SHIPPED hub v0.57.0 (2026-07-16):** the clean-slate reinstall-of-existing-customer path is now first-class — claim re-issue (F2), offsite re-issue (F3), escrow-honesty-on-re-issue (2.3) all auto-fire on re-enrollment. Peti's proxmox2 clean-slate now walks a supported path | | R-2 | ~~Resolve ~215 lines of foreign WIP in felhom.eu clone (`hub/internal/notify/`, `store.go`, `hub/internal/claim/`)~~ | S | **killed** (2026-07-16) | Not a real issue: the "foreign WIP" was in-flight code from a concurrent CC session on the customer-claim arc, snapshotted before it committed. All of it landed cleanly — `notify/`+`claim/engine.go` in `6b40eb8` (v0.50.0), `store.go` in `a1d0450` (v0.54.0), plus follow-up `e205a2d`; v0.55.0 shipped. Working tree is clean, no stashes. Lesson already codified: never run two writing sessions on one felhom.eu clone (CLAUDE.md §git add -A) | | R-3 | Friend-alpha onboarding runbook (generalized from `pilot/RUNBOOK-peti-return-2026-07-13`): hardware prep → golden → install → claim → ceremony → "first restore by the customer" scripted step | M | idea | Flips: "customer performs a restore" MISSING row; produces the tester-agreement sibling of `PETI-tester-agreement.md`. **Next from-scratch rehearsal to include customer DELETE + re-create** — the ESCROW cascade is now DEFINED (hub v0.60.1): host delete DEMOTES escrow to retained custody (never destroys), customer Danger-zone delete PURGES it (the one true purge point). **S6b (manual stale-host delete before re-enroll) is OBSOLETE** — re-enrollment upserts the existing host row cleanly (`store.UpsertHost` ON CONFLICT DO UPDATE; `handleAdminCreateHost` no duplicate refusal) + the v0.57.0 arc auto-fires the re-issues; the rehearsal live-confirms it. **NON-escrow offboarding NOW ANSWERED by the middle-tier Customer RESET (hub v0.61.0, LIVE):** one operator action deprovisions the Hetzner sub-account/box (repo data destroyed), destroys the PBS namespace + backup groups + token, clears the DR recipe / one-time secret / claim state / retained escrow custody (separate ack) — identity + basic config survive. WG peer release rides host delete (peers are host-scoped, gone before RESET runs — RESET refuses while any host row exists). **Remaining consistency gap:** the customer Danger-zone DELETE still leaves host rows and does NOT run the offsite/PBS teardown (RESET is the teardown path; DELETE is escrow-purge + config-drop). Decide whether DELETE should require a prior RESET (or subsume it) — new item R-25b | -| R-4 | Claim-code deliverability: test-send to gmail.com / freemail.hu / citromail.hu / t-online.hu; tighten DMARC `p=none` → `p=quarantine` (pending since email.md 02-04) | S | **DNS half staged (2026-07-18)** | A claim code in spam bricks onboarding at step 1. Cheap, do before first invite. **DMARC change prepared** (`RUNBOOK-publish-0.90-0.143-2026-07-18` Phase 4): target `_dmarc` TXT `v=DMARC1; p=quarantine; rua=mailto:admin@felhom.eu`; alignment confirmed safe (SES/Resend DKIM `d=felhom.eu` + relaxed `send.` SPF). No felhom.eu-zone CF edit token on 180 → **Path B: Viktor applies via CF dashboard**, then `dig` gate. **Test-send half (gmail + freemail.hu, `dmarc=pass` check) remains Viktor's** — open | +| R-4 | Claim-code deliverability: test-send to gmail.com / freemail.hu / citromail.hu / t-online.hu; tighten DMARC `p=none` → `p=quarantine` (pending since email.md 02-04) | S | **DNS half DONE (2026-07-18); test-send open** | A claim code in spam bricks onboarding at step 1. **DMARC now `p=quarantine`** (`RUNBOOK-publish-0.90-0.143-2026-07-18` Phase 4): `_dmarc.felhom.eu` TXT `v=DMARC1; p=quarantine; rua=mailto:admin@felhom.eu` set by Viktor (CF, Path B); `dig` gate green (1.1.1.1 + 8.8.8.8). Alignment safe (SES/Resend DKIM `d=felhom.eu` + relaxed `send.` SPF). **Remaining: Viktor's deliverability test-send** (gmail + freemail.hu, `dmarc=pass` check) | ## P2 — during alpha diff --git a/documentation/pilot/RUNBOOK-publish-0.90-0.143-2026-07-18.md b/documentation/pilot/RUNBOOK-publish-0.90-0.143-2026-07-18.md index 79439e5..6595979 100644 --- a/documentation/pilot/RUNBOOK-publish-0.90-0.143-2026-07-18.md +++ b/documentation/pilot/RUNBOOK-publish-0.90-0.143-2026-07-18.md @@ -2,8 +2,8 @@ **Class:** Runbook-style operational run (NO code changed anywhere). **Executor:** CC, with two password-gated **STOP → Viktor** points (hub UI + Cloudflare — CC cannot perform). -**Status:** Phases **0, 1, 2, 5 COMPLETE** (all CC gates green); Phases **3 (manifest+floor)** and -**4 (DMARC apply)** are the operator handoff below. +**Status:** **ALL PHASES COMPLETE.** CC phases 0/1/2/5 green; operator phases 3 (manifest+floor) and +4 (DMARC) done by Viktor 2026-07-18 and **verified by CC** (hub DB read + `dig` gate). --- @@ -14,8 +14,8 @@ password-gated **STOP → Viktor** points (hub UI + Cloudflare — CC cannot per | 0 | pre-flight (baselines, 404 pre-gates, serials) | ✅ all green | | 1 | publish felhom-agent 0.90.0 | ✅ published, sha-chain identical 5 places | | 2 | build + publish golden 0.143.0 | ✅ published, round-trip + teardown grep=0 | -| 3 | **STOP → Viktor:** manifest vouch + floor | 🛑 pending (values below) | -| 4 | DMARC `p=none` → `p=quarantine` | 🛑 pending (Path B — Viktor, CF dashboard) | +| 3 | **STOP → Viktor:** manifest vouch + floor | ✅ done + CC-verified in hub DB | +| 4 | DMARC `p=none` → `p=quarantine` | ✅ done (Viktor, CF) + `dig` gate green | | 5 | build v1.20.0 universal pairing ISOs | ✅ safety + real built, verified | **The four operator values for the hub Day-0 manifest (Phase 3):** @@ -75,32 +75,35 @@ transient unit baking `felhom-controller:0.143.0`: qemu exited; qcow2 reverted to `virgin` (snapshot intact, exactly-as-found); staged token on 180 shredded. **Token-leak grep of the saved log (literal value) = 0.** Evidence: `180:~/drill/bake-0.143.0.log`. -## Phase 3 — STOP → Viktor: manifest vouch + floor 🛑 PENDING +## Phase 3 — manifest vouch + floor ✅ DONE (Viktor 2026-07-18), CC-verified -hub.felhom.eu → Configuration, **in this order** (vouch first, floor LAST): -1. **Day-0 artifacts:** Agent → `0.90.0` (sha auto-read must equal `18c48272…`), Golden → `0.143.0` - (sha must equal `ded3cfc2…`), **Min agent → `0.90.0`** → **Save artifact manifest**. -2. **Managed updates:** global floor → **`v0.143.0`** → save **LAST**. +Viktor saved both (Day-0 artifacts, then floor LAST). **CC verified against the live hub SQLite +`hub_settings`** (streamed read-only copy, then shredded): `artifact_agent_version=0.90.0` / +`artifact_agent_sha256=18c48272…`, `artifact_golden_version=0.143.0` / +`artifact_golden_sha256=ded3cfc2…`, `artifact_min_agent=0.90.0`, `min_controller_version=0.143.0` — +all exactly the published values. No ordering issue (both persisted). -Expected fleet effect (verify, don't assume): **demo (9201)** already on 0.143.0 → no-op. **Peti's box** -agent 0.81 < MinAgent 0.90.0 → the hub **HOLDS** the floor for it and flags it (designed, not an error) — -confirm the hold/flag renders on his customer page and note it. +**Fleet effect (verified from `hosts`/`reports`, not assumed):** +- `demo-felhom` — agent **0.90.0**, controller **0.143.0**, reporting 07-18 → floor **no-op**, MinAgent satisfied. +- `demo-vm-felhom` (nested) — agent **0.90.0**, controller **0.143.0** → no-op. +- **`peti-felhom` — CORRECTION to the spec's assumption:** no `hosts` row; last controller report + **2026-07-15** (v0.115.0). He is **not currently enrolled/reporting**, so there is **no live MinAgent + hold to observe**. The gate is correctly armed (his 0.115 < floor 0.143; a future 0.81 agent < + MinAgent 0.90.0 would trigger the hold) but stays **latent** until his box re-enrolls in the R-1 + rehearsal. Not an error — the spec anticipated a hold with no box to act on yet. -## Phase 4 — DMARC `p=none` → `p=quarantine` 🛑 PENDING (Path B — Viktor) +## Phase 4 — DMARC `p=none` → `p=quarantine` ✅ DONE (Viktor 2026-07-18, Path B), gate green -- **Current** (`dig +short TXT _dmarc.felhom.eu @1.1.1.1`): `"v=DMARC1; p=none;"`. - **No felhom.eu-zone Cloudflare DNS-edit token on 180** (standing posture = per-customer zone-scoped - tokens only) → **Path B**: Viktor sets the record in the Cloudflare dashboard. -- **Target** `_dmarc` TXT (overwrite content only — touch nothing else): - ``` - v=DMARC1; p=quarantine; rua=mailto:admin@felhom.eu - ``` + tokens only) → **Path B**: Viktor set the record in the Cloudflare dashboard (DNS-only). +- **Applied** `_dmarc.felhom.eu` TXT: `v=DMARC1; p=quarantine; rua=mailto:admin@felhom.eu`. +- **Gate PASSED:** `dig +short TXT _dmarc.felhom.eu @1.1.1.1` **and** `@8.8.8.8` both return + `"v=DMARC1; p=quarantine; rua=mailto:admin@felhom.eu"`. - **Alignment confirmed safe:** felhom.eu SPF `v=spf1 include:_spf.mx.cloudflare.net ~all`; `send.felhom.eu` SPF `v=spf1 include:amazonses.com ~all` (Resend/SES, DKIM-signs `d=felhom.eu`) — so `quarantine` does not endanger legitimate mail. -- **Gate after Viktor applies:** `dig +short TXT _dmarc.felhom.eu @1.1.1.1` must show `p=quarantine`. -- Viktor's manual deliverability test-send (gmail + freemail.hu, check `dmarc=pass` in - Authentication-Results) remains **his** follow-up half of R-4. +- **Still Viktor's:** the manual deliverability test-send (gmail + freemail.hu, check `dmarc=pass` in + Authentication-Results) — the open half of R-4. ## Phase 5 — v1.20.0 universal pairing ISOs ✅ @@ -139,15 +142,11 @@ Built on 180 from `~/git/felhom.eu` @ `cfdcb50` (scripts v1.20.0), assistant `fe ## Viktor handoff checklist -**A. Hub (Phase 3), in order:** Day-0 artifacts → Agent `0.90.0` / Golden `0.143.0` / Min agent `0.90.0` -→ Save artifact manifest → **then** Managed updates floor → `v0.143.0` → save (LAST). Confirm Peti's -box shows the MinAgent hold/flag. +**A. Hub (Phase 3)** — ✅ DONE + CC-verified (manifest 0.90.0/0.143.0/MinAgent 0.90.0, floor v0.143.0). +**B. DNS (Phase 4)** — ✅ DONE, `dig` gate green. **Remaining: your deliverability test-send** (gmail + +freemail.hu, confirm `dmarc=pass`) — the open half of R-4. -**B. DNS (Phase 4):** Cloudflare → felhom.eu zone → `_dmarc` TXT → `v=DMARC1; p=quarantine; rua=mailto:admin@felhom.eu`. -Then `dig +short TXT _dmarc.felhom.eu @1.1.1.1` should show `p=quarantine`. Test-sends (gmail + freemail.hu) -= your R-4 half. - -**C. N100 bare-metal rehearsal (unblocked by this run):** +**C. N100 bare-metal rehearsal (unblocked by this run — remaining):** 1. **Flash the safety ISO first** → boot the N100 with **Secure Boot OFF** (mkimage is unsigned; SB-enforcing fails `Access Denied`, proven) → expect: loader boots + installer aborts fail-safe, **touches no disk**.