docs: publish train 0.90/0.143 COMPLETE — Viktor manifest/floor + DMARC quarantine, CC-verified
This commit is contained in:
@@ -2,8 +2,8 @@
|
||||
|
||||
**Class:** Runbook-style operational run (NO code changed anywhere). **Executor:** CC, with two
|
||||
password-gated **STOP → Viktor** points (hub UI + Cloudflare — CC cannot perform).
|
||||
**Status:** Phases **0, 1, 2, 5 COMPLETE** (all CC gates green); Phases **3 (manifest+floor)** and
|
||||
**4 (DMARC apply)** are the operator handoff below.
|
||||
**Status:** **ALL PHASES COMPLETE.** CC phases 0/1/2/5 green; operator phases 3 (manifest+floor) and
|
||||
4 (DMARC) done by Viktor 2026-07-18 and **verified by CC** (hub DB read + `dig` gate).
|
||||
|
||||
---
|
||||
|
||||
@@ -14,8 +14,8 @@ password-gated **STOP → Viktor** points (hub UI + Cloudflare — CC cannot per
|
||||
| 0 | pre-flight (baselines, 404 pre-gates, serials) | ✅ all green |
|
||||
| 1 | publish felhom-agent 0.90.0 | ✅ published, sha-chain identical 5 places |
|
||||
| 2 | build + publish golden 0.143.0 | ✅ published, round-trip + teardown grep=0 |
|
||||
| 3 | **STOP → Viktor:** manifest vouch + floor | 🛑 pending (values below) |
|
||||
| 4 | DMARC `p=none` → `p=quarantine` | 🛑 pending (Path B — Viktor, CF dashboard) |
|
||||
| 3 | **STOP → Viktor:** manifest vouch + floor | ✅ done + CC-verified in hub DB |
|
||||
| 4 | DMARC `p=none` → `p=quarantine` | ✅ done (Viktor, CF) + `dig` gate green |
|
||||
| 5 | build v1.20.0 universal pairing ISOs | ✅ safety + real built, verified |
|
||||
|
||||
**The four operator values for the hub Day-0 manifest (Phase 3):**
|
||||
@@ -75,32 +75,35 @@ transient unit baking `felhom-controller:0.143.0`:
|
||||
qemu exited; qcow2 reverted to `virgin` (snapshot intact, exactly-as-found); staged token on 180
|
||||
shredded. **Token-leak grep of the saved log (literal value) = 0.** Evidence: `180:~/drill/bake-0.143.0.log`.
|
||||
|
||||
## Phase 3 — STOP → Viktor: manifest vouch + floor 🛑 PENDING
|
||||
## Phase 3 — manifest vouch + floor ✅ DONE (Viktor 2026-07-18), CC-verified
|
||||
|
||||
hub.felhom.eu → Configuration, **in this order** (vouch first, floor LAST):
|
||||
1. **Day-0 artifacts:** Agent → `0.90.0` (sha auto-read must equal `18c48272…`), Golden → `0.143.0`
|
||||
(sha must equal `ded3cfc2…`), **Min agent → `0.90.0`** → **Save artifact manifest**.
|
||||
2. **Managed updates:** global floor → **`v0.143.0`** → save **LAST**.
|
||||
Viktor saved both (Day-0 artifacts, then floor LAST). **CC verified against the live hub SQLite
|
||||
`hub_settings`** (streamed read-only copy, then shredded): `artifact_agent_version=0.90.0` /
|
||||
`artifact_agent_sha256=18c48272…`, `artifact_golden_version=0.143.0` /
|
||||
`artifact_golden_sha256=ded3cfc2…`, `artifact_min_agent=0.90.0`, `min_controller_version=0.143.0` —
|
||||
all exactly the published values. No ordering issue (both persisted).
|
||||
|
||||
Expected fleet effect (verify, don't assume): **demo (9201)** already on 0.143.0 → no-op. **Peti's box**
|
||||
agent 0.81 < MinAgent 0.90.0 → the hub **HOLDS** the floor for it and flags it (designed, not an error) —
|
||||
confirm the hold/flag renders on his customer page and note it.
|
||||
**Fleet effect (verified from `hosts`/`reports`, not assumed):**
|
||||
- `demo-felhom` — agent **0.90.0**, controller **0.143.0**, reporting 07-18 → floor **no-op**, MinAgent satisfied.
|
||||
- `demo-vm-felhom` (nested) — agent **0.90.0**, controller **0.143.0** → no-op.
|
||||
- **`peti-felhom` — CORRECTION to the spec's assumption:** no `hosts` row; last controller report
|
||||
**2026-07-15** (v0.115.0). He is **not currently enrolled/reporting**, so there is **no live MinAgent
|
||||
hold to observe**. The gate is correctly armed (his 0.115 < floor 0.143; a future 0.81 agent <
|
||||
MinAgent 0.90.0 would trigger the hold) but stays **latent** until his box re-enrolls in the R-1
|
||||
rehearsal. Not an error — the spec anticipated a hold with no box to act on yet.
|
||||
|
||||
## Phase 4 — DMARC `p=none` → `p=quarantine` 🛑 PENDING (Path B — Viktor)
|
||||
## Phase 4 — DMARC `p=none` → `p=quarantine` ✅ DONE (Viktor 2026-07-18, Path B), gate green
|
||||
|
||||
- **Current** (`dig +short TXT _dmarc.felhom.eu @1.1.1.1`): `"v=DMARC1; p=none;"`.
|
||||
- **No felhom.eu-zone Cloudflare DNS-edit token on 180** (standing posture = per-customer zone-scoped
|
||||
tokens only) → **Path B**: Viktor sets the record in the Cloudflare dashboard.
|
||||
- **Target** `_dmarc` TXT (overwrite content only — touch nothing else):
|
||||
```
|
||||
v=DMARC1; p=quarantine; rua=mailto:admin@felhom.eu
|
||||
```
|
||||
tokens only) → **Path B**: Viktor set the record in the Cloudflare dashboard (DNS-only).
|
||||
- **Applied** `_dmarc.felhom.eu` TXT: `v=DMARC1; p=quarantine; rua=mailto:admin@felhom.eu`.
|
||||
- **Gate PASSED:** `dig +short TXT _dmarc.felhom.eu @1.1.1.1` **and** `@8.8.8.8` both return
|
||||
`"v=DMARC1; p=quarantine; rua=mailto:admin@felhom.eu"`.
|
||||
- **Alignment confirmed safe:** felhom.eu SPF `v=spf1 include:_spf.mx.cloudflare.net ~all`;
|
||||
`send.felhom.eu` SPF `v=spf1 include:amazonses.com ~all` (Resend/SES, DKIM-signs `d=felhom.eu`) — so
|
||||
`quarantine` does not endanger legitimate mail.
|
||||
- **Gate after Viktor applies:** `dig +short TXT _dmarc.felhom.eu @1.1.1.1` must show `p=quarantine`.
|
||||
- Viktor's manual deliverability test-send (gmail + freemail.hu, check `dmarc=pass` in
|
||||
Authentication-Results) remains **his** follow-up half of R-4.
|
||||
- **Still Viktor's:** the manual deliverability test-send (gmail + freemail.hu, check `dmarc=pass` in
|
||||
Authentication-Results) — the open half of R-4.
|
||||
|
||||
## Phase 5 — v1.20.0 universal pairing ISOs ✅
|
||||
|
||||
@@ -139,15 +142,11 @@ Built on 180 from `~/git/felhom.eu` @ `cfdcb50` (scripts v1.20.0), assistant `fe
|
||||
|
||||
## Viktor handoff checklist
|
||||
|
||||
**A. Hub (Phase 3), in order:** Day-0 artifacts → Agent `0.90.0` / Golden `0.143.0` / Min agent `0.90.0`
|
||||
→ Save artifact manifest → **then** Managed updates floor → `v0.143.0` → save (LAST). Confirm Peti's
|
||||
box shows the MinAgent hold/flag.
|
||||
**A. Hub (Phase 3)** — ✅ DONE + CC-verified (manifest 0.90.0/0.143.0/MinAgent 0.90.0, floor v0.143.0).
|
||||
**B. DNS (Phase 4)** — ✅ DONE, `dig` gate green. **Remaining: your deliverability test-send** (gmail +
|
||||
freemail.hu, confirm `dmarc=pass`) — the open half of R-4.
|
||||
|
||||
**B. DNS (Phase 4):** Cloudflare → felhom.eu zone → `_dmarc` TXT → `v=DMARC1; p=quarantine; rua=mailto:admin@felhom.eu`.
|
||||
Then `dig +short TXT _dmarc.felhom.eu @1.1.1.1` should show `p=quarantine`. Test-sends (gmail + freemail.hu)
|
||||
= your R-4 half.
|
||||
|
||||
**C. N100 bare-metal rehearsal (unblocked by this run):**
|
||||
**C. N100 bare-metal rehearsal (unblocked by this run — remaining):**
|
||||
1. **Flash the safety ISO first** → boot the N100 with **Secure Boot OFF** (mkimage is unsigned;
|
||||
SB-enforcing fails `Access Denied`, proven) → expect: loader boots + installer aborts fail-safe,
|
||||
**touches no disk**.
|
||||
|
||||
Reference in New Issue
Block a user